Edit tour

Windows Analysis Report
5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.zip

Overview

General Information

Sample name:	5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.zip
Analysis ID:	1436588
MD5:	712479d0327772ab6f33210166864396
SHA1:	3f1eb29d0df58e6894885deb81c9e768852c5b81
SHA256:	e6de7ada1b561986658c12fb727f83287c6835142754b30b149a53c410d52c59
Infos:

Detection

Xmrig

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for dropped file

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for dropped file

Snort IDS alert for network traffic

Yara detected Xmrig cryptocurrency miner

Changes security center settings (notifications, updates, antivirus, firewall)

Contains functionality to infect the boot sector

Creates files with lurking names (e.g. Crack.exe)

Drops PE files to the user root directory

Found API chain indicative of debugger detection

Found pyInstaller with non standard icon

Found strings related to Crypto-Mining

Machine Learning detection for dropped file

Modifies the windows firewall

Sigma detected: Potentially Suspicious Malware Callback Communication

Uses known network protocols on non-standard ports

Uses netsh to modify the Windows network and firewall settings

Writes many files with high entropy

AV process strings found (often used to terminate AV products)

Abnormal high CPU Usage

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Connects to several IPs in different countries

Contains capabilities to detect virtual machines

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to communicate with device drivers

Contains functionality to delete services

Contains functionality to dynamically determine API calls

Contains functionality to enumerate running services

Contains functionality to query CPU information (cpuid)

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Creates or modifies windows services

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the user directory

Drops PE files to the windows directory (C:\Windows)

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

May sleep (evasive loops) to hinder dynamic analysis

OS version to string mapping found (often used in BOTs)

PE file contains sections with non-standard names

Queries disk information (often used to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Communication To Uncommon Destination Ports

Sigma detected: Suspicious Copy From or To System Directory

Sigma detected: Suspicious Outbound SMTP Connections

Sigma detected: Use Short Name Path in Command Line

Uses FTP

Uses code obfuscation techniques (call, push, ret)

Uses taskkill to terminate processes

Yara signature match

Classification

Process Tree

System is w10x64_ra

rundll32.exe (PID: 6256 cmdline: C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding MD5: EF3179D498793BF4234F708D3BE28633)

svchost.exe (PID: 6308 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

7zG.exe (PID: 6568 cmdline: "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\" -ad -an -ai#7zMap16652:184:7zEvent5233 MD5: 50F289DF0C19484E970849AAC4E6F977)

svchost.exe (PID: 6724 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -p MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

SgrmBroker.exe (PID: 6760 cmdline: C:\Windows\system32\SgrmBroker.exe MD5: 3BA1A18A0DC30A0545E7765CB97D8E63)

svchost.exe (PID: 6708 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 6848 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 6916 cmdline: C:\Windows\system32\svchost.exe -k UnistackSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 3868 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

MpCmdRun.exe (PID: 1036 cmdline: "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable MD5: B3676839B2EE96983F9ED735CD044159)

conhost.exe (PID: 4940 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe (PID: 2868 cmdline: "C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe" MD5: A9D4007C9419A6E8D55805B8F8F52DE0)

5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe (PID: 5920 cmdline: "C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe" MD5: A9D4007C9419A6E8D55805B8F8F52DE0)

5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe (PID: 5764 cmdline: "C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe" MD5: A9D4007C9419A6E8D55805B8F8F52DE0)

5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe (PID: 5404 cmdline: "C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe" MD5: A9D4007C9419A6E8D55805B8F8F52DE0)

cmd.exe (PID: 4896 cmdline: C:\Windows\system32\cmd.exe /c copy /y C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe C:\Users\user\HelpPane.exe MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 2712 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 6244 cmdline: C:\Windows\system32\cmd.exe /c C:\Users\user\HelpPane.exe --startup auto install MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6108 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

HelpPane.exe (PID: 3348 cmdline: C:\Users\user\HelpPane.exe --startup auto install MD5: A9D4007C9419A6E8D55805B8F8F52DE0)

HelpPane.exe (PID: 1876 cmdline: C:\Users\user\HelpPane.exe --startup auto install MD5: A9D4007C9419A6E8D55805B8F8F52DE0)

cmd.exe (PID: 6320 cmdline: C:\Windows\system32\cmd.exe /c C:\Users\user\HelpPane.exe start MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 400 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

HelpPane.exe (PID: 1448 cmdline: C:\Users\user\HelpPane.exe start MD5: A9D4007C9419A6E8D55805B8F8F52DE0)

HelpPane.exe (PID: 1284 cmdline: C:\Users\user\HelpPane.exe start MD5: A9D4007C9419A6E8D55805B8F8F52DE0)

HelpPane.exe (PID: 7048 cmdline: "C:\Users\user\HelpPane.exe" MD5: A9D4007C9419A6E8D55805B8F8F52DE0)

HelpPane.exe (PID: 1764 cmdline: "C:\Users\user\HelpPane.exe" MD5: A9D4007C9419A6E8D55805B8F8F52DE0)

cmd.exe (PID: 5744 cmdline: C:\Windows\system32\cmd.exe /c taskkill /pid 2284 /f MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 3364 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

taskkill.exe (PID: 6572 cmdline: taskkill /pid 2284 /f MD5: CA313FD7E6C2A778FFD21CFB5C1C56CD)

cmd.exe (PID: 6272 cmdline: C:\Windows\system32\cmd.exe /c copy /y C:\Windows\TEMP\_MEI70~1\xmrig.exe C:\Windows\TEMP\xmrig.exe MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 6288 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cmd.exe (PID: 4780 cmdline: C:\Windows\system32\cmd.exe /c copy /y C:\Windows\TEMP\_MEI70~1\config.json C:\Windows\TEMP\config.json MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 2012 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

xmrig.exe (PID: 6092 cmdline: C:\Windows\TEMP\xmrig.exe MD5: 13BDD9CD9F7E51746172996262B5A873)

conhost.exe (PID: 6416 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

netsh.exe (PID: 6200 cmdline: netsh firewall add allowedprogram C:\Users\user\HelpPane.exe "MyApp" ENABLE MD5: 4E89A1A088BE715D6C946E55AB07C7DF)

conhost.exe (PID: 6240 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

spoolsv.exe (PID: 3184 cmdline: C:\Windows\System32\spoolsv.exe MD5: 0D4B1E3E4488E9BDC035F23E1F4FE22F)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
xmrig	According to PCrisk, XMRIG is a completely legitimate open-source application that utilizes system CPUs to mine Monero cryptocurrency. Unfortunately, criminals generate revenue by infiltrating this app into systems without users' consent. This deceptive marketing method is called "bundling".In most cases, "bundling" is used to infiltrate several potentially unwanted programs (PUAs) at once. So, there is a high probability that XMRIG Virus came with a number of adware-type applications that deliver intrusive ads and gather sensitive information.	No Attribution	https://gridinsoft.com/xmrig https://www.crowdstrike.com/blog/new-kiss-a-dog-cryptojacking-campaign-targets-docker-and-kubernetes/	https://malpedia.caad.fkie.fraunhofer.de/details/win.xmrig

Yara Signatures

Dropped Files

Source	Rule	Description	Author
C:\Windows\Temp\_MEI70482\config.json	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
C:\Users\user\AppData\Local\Temp\_MEI57642\config.json	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
C:\Users\user\AppData\Local\Temp\_MEI14482\config.json	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
C:\Users\user\AppData\Local\Temp\_MEI33482\config.json	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
C:\Windows\Temp\config.json	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
C:\Users\user\AppData\Local\Temp\_MEI28682\config.json	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
C:\Windows\Temp\xmrig.exe	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
C:\Users\user\AppData\Local\Temp\_MEI33482\xmrig.exe	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
C:\Users\user\AppData\Local\Temp\_MEI57642\xmrig.exe	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
C:\Windows\Temp\_MEI70482\xmrig.exe	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
C:\Users\user\AppData\Local\Temp\_MEI14482\xmrig.exe	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
C:\Users\user\AppData\Local\Temp\_MEI28682\xmrig.exe	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Click to see the 7 entries

Memory Dumps

Source	Rule	Description	Author
00000028.00000002.2395762565.0000000001500000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000028.00000002.2393808878.0000000000CCE000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000028.00000002.2393514571.00000000009B5000.00000004.00000001.01000000.0000004C.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000025.00000002.1507947087.0000000000EF0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000012.00000003.1422207868.000000000151D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000028.00000002.2396216239.00000000018A2000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000028.00000002.2393808878.0000000000CE3000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000023.00000003.1504992076.0000000000C15000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000025.00000002.1508063957.000000000311C000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000028.00000000.1545522218.00000000009B0000.00000008.00000001.01000000.0000004C.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000012.00000003.1422400569.000000000151E000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
0000000E.00000003.1405690614.00000000024AF000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
00000028.00000002.2357701679.0000000000401000.00000040.00000001.01000000.0000004C.sdmp	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe PID: 5764	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: cmd.exe PID: 6272	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: cmd.exe PID: 4780	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Process Memory Space: xmrig.exe PID: 6092	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
Click to see the 12 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
40.0.xmrig.exe.400000.0.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
40.2.xmrig.exe.400000.0.unpack	JoeSecurity_Xmrig	Yara detected Xmrig cryptocurrency miner	Joe Security
40.2.xmrig.exe.400000.0.unpack	MAL_XMR_Miner_May19_1	Detects Monero Crypto Coin Miner	Florian Roth	0x45ab34:$x1: donate.ssl.xmrig.com 0x45ae41:$x2: * COMMANDS 'h' hashrate, 'p' pause, 'r' resume 0x45a203:$s1: [%s] login error code: %d 0x4c5e72:$s2: \\?\pipe\uv\%p-%lu

Sigma Signatures

System Summary

Sigma detected: Potentially Suspicious Malware Callback Communication

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 85.65.152.136, DestinationIsIpv6: false, DestinationPort: 13504, EventID: 3, Image: C:\Users\user\HelpPane.exe, Initiated: true, ProcessId: 1764, Protocol: tcp, SourceIp: 192.168.2.16, SourceIsIpv6: false, SourcePort: 8000

Sigma detected: Communication To Uncommon Destination Ports

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 175.178.238.26, DestinationIsIpv6: false, DestinationPort: 8080, EventID: 3, Image: C:\Users\user\HelpPane.exe, Initiated: true, ProcessId: 1764, Protocol: tcp, SourceIp: 192.168.2.16, SourceIsIpv6: false, SourcePort: 8000

Sigma detected: Suspicious Copy From or To System Directory

Source: Process started

Author: Florian Roth (Nextron Systems), Markus Neis, Tim Shelton (HAWK.IO), Nasreddine Bencherchali (Nextron Systems): Data: Command: C:\Windows\system32\cmd.exe /c copy /y C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe C:\Users\user\HelpPane.exe, CommandLine: C:\Windows\system32\cmd.exe /c copy /y C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe C:\Users\user\HelpPane.exe, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe" , ParentImage: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, ParentProcessId: 5404, ParentProcessName: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c copy /y C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe C:\Users\user\HelpPane.exe, ProcessId: 4896, ProcessName: cmd.exe

Sigma detected: Suspicious Outbound SMTP Connections

Source: Network Connection

Author: frack113: Data: DestinationIp: 178.35.129.239, DestinationIsIpv6: false, DestinationPort: 587, EventID: 3, Image: C:\Users\user\HelpPane.exe, Initiated: true, ProcessId: 1764, Protocol: tcp, SourceIp: 192.168.2.16, SourceIsIpv6: false, SourcePort: 8000

Sigma detected: Use Short Name Path in Command Line

Source: Process started

Author: frack113, Nasreddine Bencherchali: Data: Command: C:\Windows\system32\cmd.exe /c copy /y C:\Windows\TEMP\_MEI70~1\xmrig.exe C:\Windows\TEMP\xmrig.exe, CommandLine: C:\Windows\system32\cmd.exe /c copy /y C:\Windows\TEMP\_MEI70~1\xmrig.exe C:\Windows\TEMP\xmrig.exe, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\HelpPane.exe", ParentImage: C:\Users\user\HelpPane.exe, ParentProcessId: 1764, ParentProcessName: HelpPane.exe, ProcessCommandLine: C:\Windows\system32\cmd.exe /c copy /y C:\Windows\TEMP\_MEI70~1\xmrig.exe C:\Windows\TEMP\xmrig.exe, ProcessId: 6272, ProcessName: cmd.exe

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 656, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 6308, ProcessName: svchost.exe

Snort Signatures

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 115.55.114.39 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:20.701168
SID:	2030919
Source Port:	6881
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 61.3.83.110 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:24.728974
SID:	2030919
Source Port:	53753
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 42.235.37.39 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:00.858786
SID:	2030919
Source Port:	45784
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.10.212.35 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:53.493742
SID:	2030919
Source Port:	39360
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.89.6.36 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:42.308680
SID:	2030919
Source Port:	8081
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.141.150.131 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:41.688292
SID:	2030919
Source Port:	46687
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 123.8.13.239 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:25.790079
SID:	2030919
Source Port:	7460
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.200.185 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:05.828537
SID:	2030919
Source Port:	20866
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 179.164.223.187 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:52.907136
SID:	2030919
Source Port:	8000
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.204.30 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:04.714545
SID:	2030919
Source Port:	30301
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.248.32.234 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:46.955606
SID:	2030919
Source Port:	6881
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 112.94.99.16 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:40.065806
SID:	2030919
Source Port:	26667
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.203.44 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:05.829772
SID:	2030919
Source Port:	11211
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 120.85.113.225 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:47.308933
SID:	2030919
Source Port:	16065
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.200.182.4 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:16.726170
SID:	2030919
Source Port:	8872
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 42.7.135.20 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:32.214318
SID:	2030919
Source Port:	8081
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 115.63.48.177 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:13.898632
SID:	2030919
Source Port:	28409
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 123.11.74.193 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:00.646534
SID:	2030919
Source Port:	6881
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 182.126.124.234 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:33.547854
SID:	2030919
Source Port:	7937
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 148.66.134.158 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:53.390516
SID:	2030919
Source Port:	5060
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 198.16.58.241 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:03.357855
SID:	2030919
Source Port:	30301
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 182.116.55.56 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:03.525540
SID:	2030919
Source Port:	40118
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.89.201.99 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:48.901071
SID:	2030919
Source Port:	1434
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.93.23.182 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:17.513096
SID:	2030919
Source Port:	47288
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 121.231.203.147 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:47.299605
SID:	2030919
Source Port:	11211
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 47.76.76.152 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:10.393028
SID:	2030919
Source Port:	8081
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 119.178.200.213 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:36.315557
SID:	2030919
Source Port:	5060
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.235.118.223 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:49.134973
SID:	2030919
Source Port:	23835
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 123.13.117.143 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:52.998144
SID:	2030919
Source Port:	7440
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.206.182.201 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:35.816217
SID:	2030919
Source Port:	1027
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.141.229.85 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:50.019257
SID:	2030919
Source Port:	5353
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 220.198.241.1 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:48.915506
SID:	2030919
Source Port:	14585
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.198.205 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:23.359068
SID:	2030919
Source Port:	4000
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 182.123.194.51 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:39.791300
SID:	2030919
Source Port:	44426
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 120.85.183.143 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:47.999833
SID:	2030919
Source Port:	32766
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 180.180.203.148 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:57.952837
SID:	2030919
Source Port:	54346
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 27.207.186.223 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:45.793328
SID:	2030919
Source Port:	8083
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 39.86.4.202 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:05.156228
SID:	2030919
Source Port:	50264
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.199.5.238 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:13.145343
SID:	2030919
Source Port:	4000
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.251.167.95 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:40.347518
SID:	2030919
Source Port:	63208
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.206.183.119 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:51.168479
SID:	2030919
Source Port:	25095
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.192.42 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:30.366553
SID:	2030919
Source Port:	59537
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.207.186 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:26.509858
SID:	2030919
Source Port:	11211
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 120.57.217.11 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:47.283912
SID:	2030919
Source Port:	20654
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 89.208.66.152 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:33.032442
SID:	2030919
Source Port:	8082
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 112.239.22.116 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:44.932507
SID:	2030919
Source Port:	45920
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.93.185.153 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:45.293713
SID:	2030919
Source Port:	4000
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 182.126.125.219 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:32.908912
SID:	2030919
Source Port:	8082
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.201.168 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:45.716974
SID:	2030919
Source Port:	8083
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.93.183.141 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:09.155049
SID:	2030919
Source Port:	55440
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.194.172.112 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:25.210146
SID:	2030919
Source Port:	8083
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 121.237.46.126 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:43.855073
SID:	2030919
Source Port:	48740
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 175.174.27.230 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:47.797234
SID:	2030919
Source Port:	62064
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.141.230.54 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:53.560680
SID:	2030919
Source Port:	8081
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 27.215.86.87 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:24.800609
SID:	2030919
Source Port:	4000
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 120.86.255.37 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:46.654114
SID:	2030919
Source Port:	21207
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.201.127 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:43.930713
SID:	2030919
Source Port:	41335
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 212.15.143.127 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:51.959190
SID:	2030919
Source Port:	8080
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.195.30 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:06.461794
SID:	2030919
Source Port:	43100
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.220.97.164 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:40.446509
SID:	2030919
Source Port:	8083
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 61.53.153.24 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:14.080621
SID:	2030919
Source Port:	40306
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.200.12 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:29.890971
SID:	2030919
Source Port:	27548
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 119.117.247.228 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:47.710034
SID:	2030919
Source Port:	42309
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 113.238.126.129 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:32.194725
SID:	2030919
Source Port:	1900
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 121.239.56.243 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:54.506187
SID:	2030919
Source Port:	12290
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.10.212.38 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:19.609423
SID:	2030919
Source Port:	65292
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.201.4.37 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:24.198039
SID:	2030919
Source Port:	49423
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.197.170.93 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:15.635078
SID:	2030919
Source Port:	53905
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.76.235 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:00.106843
SID:	2030919
Source Port:	9634
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.217.85.206 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:52.477609
SID:	2030919
Source Port:	4000
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.199.77.246 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:38.705805
SID:	2030919
Source Port:	33513
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.200.183.158 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:22.772546
SID:	2030919
Source Port:	20348
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 39.88.118.172 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:24.601577
SID:	2030919
Source Port:	60648
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.213.86.207 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:38.298685
SID:	2030919
Source Port:	30301
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 120.85.117.132 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:30.081694
SID:	2030919
Source Port:	20172
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 220.71.236.115 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:47.081662
SID:	2030919
Source Port:	9238
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.184.50.75 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:53.042703
SID:	2030919
Source Port:	30301
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.192.206 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:18.150664
SID:	2030919
Source Port:	8081
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 95.32.200.22 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:45.110302
SID:	2030919
Source Port:	1288
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.93.28.230 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:04.668219
SID:	2030919
Source Port:	6881
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.200.181.142 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:56.857057
SID:	2030919
Source Port:	20906
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 61.52.32.10 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:50.767225
SID:	2030919
Source Port:	8275
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 106.56.48.164 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:27.915046
SID:	2030919
Source Port:	5060
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.141.33.56 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:10.129801
SID:	2030919
Source Port:	5634
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 27.213.104.161 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:49.608745
SID:	2030919
Source Port:	24449
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.203.84 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:01.374339
SID:	2030919
Source Port:	5353
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 42.228.84.63 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:38.265697
SID:	2030919
Source Port:	6881
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.80.172.62 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:14.253732
SID:	2030919
Source Port:	8000
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.194.165.129 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:34.169248
SID:	2030919
Source Port:	8080
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.217.36.189 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:26.963391
SID:	2030919
Source Port:	8082
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.99.136.155 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:04.656669
SID:	2030919
Source Port:	8000
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.95.131.182 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:51.476783
SID:	2030919
Source Port:	8000
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.194.217.78 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:48.942129
SID:	2030919
Source Port:	5353
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.220.148.243 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:36.099305
SID:	2030919
Source Port:	4000
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 125.45.11.195 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:42.300689
SID:	2030919
Source Port:	8082
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.194.43 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:19.939246
SID:	2030919
Source Port:	40605
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 89.130.132.127 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:49.886907
SID:	2030919
Source Port:	8800
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 182.123.231.0 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:09.153740
SID:	2030919
Source Port:	19461
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.222.233.3 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:14.079490
SID:	2030919
Source Port:	30301
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 222.140.159.103 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:59.224750
SID:	2030919
Source Port:	28705
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 220.143.16.169 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:21.344757
SID:	2030919
Source Port:	10594
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 42.233.105.228 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:57.211614
SID:	2030919
Source Port:	8081
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.201.13.236 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:53.052115
SID:	2030919
Source Port:	8083
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 219.155.192.224 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:40.771931
SID:	2030919
Source Port:	27465
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.194.119 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:37.082852
SID:	2030919
Source Port:	30301
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 175.178.238.26 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:24.569110
SID:	2030919
Source Port:	8080
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.213.89.25 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:27.772585
SID:	2030919
Source Port:	8082
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 115.55.245.41 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:49.330080
SID:	2030919
Source Port:	7039
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.89.207.165 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:49.162402
SID:	2030919
Source Port:	20331
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.220.75.159 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:48.323294
SID:	2030919
Source Port:	57279
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 42.235.172.106 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:31.717141
SID:	2030919
Source Port:	1848
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 222.138.101.166 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:08.500727
SID:	2030919
Source Port:	56641
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 182.116.92.17 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:33.226043
SID:	2030919
Source Port:	4947
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 125.45.65.178 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:48.255296
SID:	2030919
Source Port:	8000
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 191.53.124.59 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:49.896207
SID:	2030919
Source Port:	8083
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 187.120.94.122 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:46.440135
SID:	2030919
Source Port:	1976
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 61.2.108.221 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:28.405175
SID:	2030919
Source Port:	11211
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 42.228.221.204 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:52.815368
SID:	2030919
Source Port:	34054
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.98.124.62 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:45.642336
SID:	2030919
Source Port:	8082
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.254.180.225 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:26.464047
SID:	2030919
Source Port:	21310
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 182.123.211.52 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:35.503724
SID:	2030919
Source Port:	30301
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.10.212.37 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:48.856331
SID:	2030919
Source Port:	14275
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 112.109.205.237 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:28.026746
SID:	2030919
Source Port:	5060
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 222.137.107.8 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:28.046885
SID:	2030919
Source Port:	63487
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 61.3.178.148 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:43.298303
SID:	2030919
Source Port:	11211
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 123.129.105.142 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:57.542054
SID:	2030919
Source Port:	8081
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 171.117.189.215 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:19.069700
SID:	2030919
Source Port:	11774
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.69.50 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:33.219750
SID:	2030919
Source Port:	17414
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 123.11.242.2 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:53.291152
SID:	2030919
Source Port:	6881
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.207.163 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:04.716837
SID:	2030919
Source Port:	46833
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 182.119.230.142 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:23.163067
SID:	2030919
Source Port:	8000
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 171.119.199.150 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:27.435765
SID:	2030919
Source Port:	49936
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 123.10.155.147 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:39.177721
SID:	2030919
Source Port:	30301
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 222.134.174.205 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:52.657822
SID:	2030919
Source Port:	8082
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.70.100.11 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:11.205241
SID:	2030919
Source Port:	8082
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 175.8.122.45 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:48.850816
SID:	2030919
Source Port:	19695
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.211.209.44 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:17.559507
SID:	2030919
Source Port:	59364
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 58.55.135.118 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:48.749288
SID:	2030919
Source Port:	16470
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.10.212.35 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:53.429577
SID:	2030919
Source Port:	49165
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 115.52.5.90 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:52.516696
SID:	2030919
Source Port:	50827
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.194.220 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:22.076916
SID:	2030919
Source Port:	17716
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.10.212.35 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:53.565579
SID:	2030919
Source Port:	62245
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.195.7 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:46.701858
SID:	2030919
Source Port:	50989
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.75.89 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:14.668698
SID:	2030919
Source Port:	13453
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 125.40.26.161 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:17.066178
SID:	2030919
Source Port:	58903
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 60.18.227.43 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:43.332050
SID:	2030919
Source Port:	6881
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 112.242.239.197 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:12.908916
SID:	2030919
Source Port:	4000
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.217.39.174 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:15.013099
SID:	2030919
Source Port:	8080
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 182.116.13.143 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:29.099337
SID:	2030919
Source Port:	28409
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.251.174.176 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:32.583908
SID:	2030919
Source Port:	37424
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.89.198.54 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:51.343479
SID:	2030919
Source Port:	8083
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 221.15.194.248 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:55.380743
SID:	2030919
Source Port:	62063
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.206.234 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:19.147182
SID:	2030919
Source Port:	31718
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 112.242.107.168 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:11.888714
SID:	2030919
Source Port:	6881
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.199.0.12 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:46.645942
SID:	2030919
Source Port:	8083
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.217.38.180 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:01.323756
SID:	2030919
Source Port:	51688
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 103.83.184.86 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:42.382140
SID:	2030919
Source Port:	54956
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.201.115 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:48.945353
SID:	2030919
Source Port:	2067
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.217.86.30 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:47.772137
SID:	2030919
Source Port:	5353
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.141.110.131 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:04.665335
SID:	2030919
Source Port:	36088
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 221.0.160.131 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:31.265010
SID:	2030919
Source Port:	8080
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.97.208.113 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:35.788497
SID:	2030919
Source Port:	41763
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 221.1.224.184 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:49.041781
SID:	2030919
Source Port:	6881
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 27.215.48.40 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:31.279443
SID:	2030919
Source Port:	8080
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.196.38 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:58.131947
SID:	2030919
Source Port:	8082
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.235.63.112 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:34.177291
SID:	2030919
Source Port:	11211
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.88.14 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:40.444773
SID:	2030919
Source Port:	15400
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.192.165 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:57.409025
SID:	2030919
Source Port:	59628
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.222.249.71 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:53.495530
SID:	2030919
Source Port:	27157
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.199.190.33 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:09.111728
SID:	2030919
Source Port:	42664
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.92.219.115 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:53.240362
SID:	2030919
Source Port:	4000
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.99.143.20 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:17.507933
SID:	2030919
Source Port:	7586
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.178.244.79 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:48.883504
SID:	2030919
Source Port:	1027
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 60.16.234.149 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:48.914721
SID:	2030919
Source Port:	8082
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 175.174.51.163 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:08.010987
SID:	2030919
Source Port:	62553
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.182.240.16 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:04.047187
SID:	2030919
Source Port:	49097
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.92.47.125 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:19.140722
SID:	2030919
Source Port:	4000
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.203.208 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:15.068909
SID:	2030919
Source Port:	56462
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.201.230 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:22.148176
SID:	2030919
Source Port:	8081
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.199.104 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:31.306072
SID:	2030919
Source Port:	19210
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.195.189 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:54.582376
SID:	2030919
Source Port:	60738
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 81.235.157.102 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:35.633887
SID:	2030919
Source Port:	8080
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 61.168.142.14 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:00.659253
SID:	2030919
Source Port:	33665
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.215.220.220 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:27.473229
SID:	2030919
Source Port:	55523
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 115.54.95.66 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:43.302372
SID:	2030919
Source Port:	27777
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.141.11.8 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:40.568067
SID:	2030919
Source Port:	49350
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.194.171.192 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:13.131309
SID:	2030919
Source Port:	8080
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 112.248.190.167 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:17.469241
SID:	2030919
Source Port:	16433
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.253.217.105 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:53.592938
SID:	2030919
Source Port:	22302
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.141.27.188 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:56.668991
SID:	2030919
Source Port:	21532
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 42.6.50.171 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:44.426127
SID:	2030919
Source Port:	44033
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.248.57.119 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:31.273517
SID:	2030919
Source Port:	19570
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.194.217.109 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:49.372464
SID:	2030919
Source Port:	8081
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 42.231.88.178 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:42.507304
SID:	2030919
Source Port:	30301
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 113.236.254.106 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:53.378431
SID:	2030919
Source Port:	27244
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 221.214.149.101 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:18.055697
SID:	2030919
Source Port:	6881
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.220.61.10 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:28.134466
SID:	2030919
Source Port:	8082
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 40.133.224.20 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:46.457933
SID:	2030919
Source Port:	41073
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.92.40.26 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:44.404699
SID:	2030919
Source Port:	8000
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 113.239.64.251 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:52.263582
SID:	2030919
Source Port:	6881
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 123.11.76.9 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:51.350512
SID:	2030919
Source Port:	44426
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 42.235.83.133 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:00.764937
SID:	2030919
Source Port:	8081
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.207.112 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:57.905358
SID:	2030919
Source Port:	11211
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.211.213.60 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:56.788020
SID:	2030919
Source Port:	8083
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 221.14.122.195 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:09.710134
SID:	2030919
Source Port:	6881
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 31.162.62.77 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:34.324556
SID:	2030919
Source Port:	8083
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 39.74.124.34 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:28.270760
SID:	2030919
Source Port:	5353
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.248.29.38 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:15.296552
SID:	2030919
Source Port:	27854
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.200.189.131 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:32.588605
SID:	2030919
Source Port:	61362
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 123.11.78.171 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:47.368388
SID:	2030919
Source Port:	45784
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.253.211.156 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:47.420225
SID:	2030919
Source Port:	63457
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.252.205.5 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:30.804631
SID:	2030919
Source Port:	6482
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 115.55.248.7 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:34.061426
SID:	2030919
Source Port:	5060
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.193.241 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:46.703419
SID:	2030919
Source Port:	19287
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.89.198.137 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:18.056778
SID:	2030919
Source Port:	1434
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 27.210.217.205 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:40.466980
SID:	2030919
Source Port:	6881
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 222.137.213.159 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:12.236122
SID:	2030919
Source Port:	6881
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.217.33.2 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:27.431831
SID:	2030919
Source Port:	30301
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.252.161.210 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:58.988556
SID:	2030919
Source Port:	1027
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.199.14.27 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:04.299807
SID:	2030919
Source Port:	21770
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 58.178.116.82 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:04.984598
SID:	2030919
Source Port:	15073
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 182.127.113.64 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:34.463417
SID:	2030919
Source Port:	40124
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 123.156.51.58 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:27.012825
SID:	2030919
Source Port:	1900
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 116.111.31.44 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:29.409645
SID:	2030919
Source Port:	30301
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 115.55.253.126 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:30.838104
SID:	2030919
Source Port:	44426
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.204.38 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:24.624286
SID:	2030919
Source Port:	33548
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.213.87.169 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:38.313771
SID:	2030919
Source Port:	65494
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 182.60.13.105 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:31.384673
SID:	2030919
Source Port:	60916
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.93.191.192 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:48.942040
SID:	2030919
Source Port:	6881
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 219.155.2.231 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:16.412002
SID:	2030919
Source Port:	1027
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 222.135.207.188 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:44.778301
SID:	2030919
Source Port:	6881
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 221.15.62.202 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:15.019549
SID:	2030919
Source Port:	56641
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.195.28 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:23.395395
SID:	2030919
Source Port:	1027
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 120.85.119.53 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:02.911661
SID:	2030919
Source Port:	17510
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 115.55.245.71 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:47.830072
SID:	2030919
Source Port:	8000
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 123.10.141.176 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:44.354482
SID:	2030919
Source Port:	8082
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.75.29 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:15.899656
SID:	2030919
Source Port:	8198
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 182.119.221.73 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:25.378919
SID:	2030919
Source Port:	61642
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.217.35.101 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:51.149121
SID:	2030919
Source Port:	55731
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.200.187 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:59.194846
SID:	2030919
Source Port:	6881
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 112.248.110.81 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:26.179429
SID:	2030919
Source Port:	11256
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.184.56.155 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:33.312386
SID:	2030919
Source Port:	11290
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.206.129 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:12.034640
SID:	2030919
Source Port:	5060
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.193.91.27 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:53.203452
SID:	2030919
Source Port:	29605
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.254.177.36 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:56.730016
SID:	2030919
Source Port:	5353
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.207.102 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:13.170555
SID:	2030919
Source Port:	8082
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 182.113.25.95 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:14.360671
SID:	2030919
Source Port:	5060
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 222.140.90.32 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:46.406749
SID:	2030919
Source Port:	49987
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 125.44.35.142 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:15.033840
SID:	2030919
Source Port:	4000
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.235.112.77 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:46.657877
SID:	2030919
Source Port:	8081
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 115.55.240.86 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:50.256768
SID:	2030919
Source Port:	19048
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 137.175.46.64 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:44.247808
SID:	2030919
Source Port:	6736
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 42.228.222.130 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:58.742678
SID:	2030919
Source Port:	6881
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 42.227.3.250 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:22.260359
SID:	2030919
Source Port:	36160
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.141.162.151 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:31.517210
SID:	2030919
Source Port:	5060
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.204.118 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:47.938276
SID:	2030919
Source Port:	8000
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.220.150.181 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:18.332664
SID:	2030919
Source Port:	11211
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.253.219.183 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:48.168725
SID:	2030919
Source Port:	18577
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 222.141.82.27 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:20.089407
SID:	2030919
Source Port:	47307
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 42.231.96.176 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:53.337233
SID:	2030919
Source Port:	3078
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 61.53.133.187 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:21.417623
SID:	2030919
Source Port:	25134
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.213.94.237 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:37.026668
SID:	2030919
Source Port:	28634
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 221.14.37.81 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:35.632421
SID:	2030919
Source Port:	64503
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 182.117.90.225 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:19.081206
SID:	2030919
Source Port:	9926
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.207.67.98 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:39.670144
SID:	2030919
Source Port:	8081
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 42.224.178.47 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:22.661312
SID:	2030919
Source Port:	28409
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.196.39.46 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:18.771480
SID:	2030919
Source Port:	20766
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 42.86.123.101 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:19.805702
SID:	2030919
Source Port:	38223
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.62.131.76 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:19.240508
SID:	2030919
Source Port:	30301
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.141.129.252 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:46.632858
SID:	2030919
Source Port:	49521
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 42.227.129.175 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:53.200461
SID:	2030919
Source Port:	5353
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 42.232.59.36 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:50.972855
SID:	2030919
Source Port:	5353
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 160.238.93.44 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:35.191079
SID:	2030919
Source Port:	48026
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.50.73.154 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:00.194015
SID:	2030919
Source Port:	23377
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 78.168.196.128 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:10.569760
SID:	2030919
Source Port:	41757
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 109.108.218.34 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:04.098843
SID:	2030919
Source Port:	1434
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 61.3.3.158 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:49.322436
SID:	2030919
Source Port:	30922
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.221.97.24 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:50.411844
SID:	2030919
Source Port:	17885
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.89.0.106 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:53.571256
SID:	2030919
Source Port:	4000
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.220.108.113 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:12.140730
SID:	2030919
Source Port:	11211
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.195.238 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:28.810706
SID:	2030919
Source Port:	6881
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 42.227.205.32 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:22.078109
SID:	2030919
Source Port:	19478
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 188.149.142.208 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:52.205956
SID:	2030919
Source Port:	17607
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.10.212.33 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:52.978731
SID:	2030919
Source Port:	34827
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 119.183.40.71 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:56.807665
SID:	2030919
Source Port:	30301
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.235.120.55 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:03.553442
SID:	2030919
Source Port:	20102
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.99.130.52 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:53.594774
SID:	2030919
Source Port:	4000
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.201.3.204 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:39.159715
SID:	2030919
Source Port:	7791
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.235.101.142 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:30.321534
SID:	2030919
Source Port:	59170
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 42.59.84.143 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:17.924904
SID:	2030919
Source Port:	1334
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.199.2.18 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:12.159616
SID:	2030919
Source Port:	22523
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.192.36 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:50.089066
SID:	2030919
Source Port:	8083
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 112.248.110.58 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:23.067246
SID:	2030919
Source Port:	32312
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 115.49.65.154 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:55.271874
SID:	2030919
Source Port:	6990
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 222.142.241.123 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:00.863687
SID:	2030919
Source Port:	44365
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.206.165.113 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:28.059552
SID:	2030919
Source Port:	13000
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.206.85 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:27.990405
SID:	2030919
Source Port:	8081
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.77.54 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:52.255576
SID:	2030919
Source Port:	30301
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 49.84.159.171 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:46.730572
SID:	2030919
Source Port:	8080
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.204.26 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:57.906490
SID:	2030919
Source Port:	47135
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 49.234.57.41 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:53.416666
SID:	2030919
Source Port:	21168
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.205.188 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:52.378318
SID:	2030919
Source Port:	4000
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.192.149 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:28.203549
SID:	2030919
Source Port:	8082
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 186.148.245.119 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:45.536987
SID:	2030919
Source Port:	36130
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 186.148.245.183 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:52.405364
SID:	2030919
Source Port:	25070
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 222.140.140.198 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:49.330656
SID:	2030919
Source Port:	31750
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.203.91 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:02.488872
SID:	2030919
Source Port:	5060
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 80.53.153.185 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:26.244428
SID:	2030919
Source Port:	6340
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.248.129.208 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:48.742604
SID:	2030919
Source Port:	8080
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.10.212.34 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:52.084932
SID:	2030919
Source Port:	46311
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.89.6.216 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:57.853283
SID:	2030919
Source Port:	61591
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 61.3.179.228 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:39.494776
SID:	2030919
Source Port:	60982
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 37.79.0.6 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:53.440513
SID:	2030919
Source Port:	1281
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 42.231.92.106 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:46.376221
SID:	2030919
Source Port:	8000
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.141.158.194 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:44.174450
SID:	2030919
Source Port:	1434
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.243.173.110 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:53.349488
SID:	2030919
Source Port:	2801
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 105.96.25.193 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:09.517924
SID:	2030919
Source Port:	11211
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.248.44.170 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:50.741682
SID:	2030919
Source Port:	30301
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 42.239.246.52 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:51.752936
SID:	2030919
Source Port:	8083
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 219.155.172.111 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:26.777156
SID:	2030919
Source Port:	17077
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.205.77 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:12.058075
SID:	2030919
Source Port:	27297
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 58.17.125.118 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:24.559751
SID:	2030919
Source Port:	5060
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.199.0.37 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:08.010191
SID:	2030919
Source Port:	1558
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 120.85.113.16 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:37.370219
SID:	2030919
Source Port:	15525
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.10.212.35 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:53.244495
SID:	2030919
Source Port:	7715
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.199.14.73 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:50.572361
SID:	2030919
Source Port:	8080
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 61.53.95.218 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:46.692899
SID:	2030919
Source Port:	8000
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.99.131.251 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:53.567470
SID:	2030919
Source Port:	30301
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.213.93.120 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:56.725451
SID:	2030919
Source Port:	59136
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 123.130.35.72 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:32.890286
SID:	2030919
Source Port:	8081
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.200.176.205 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:34.168490
SID:	2030919
Source Port:	11614
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 115.61.18.2 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:45.529825
SID:	2030919
Source Port:	5060
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.206.187.184 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:04.270520
SID:	2030919
Source Port:	63836
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.255.84.52 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:32.645681
SID:	2030919
Source Port:	50847
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.202.50 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:47.526965
SID:	2030919
Source Port:	5857
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 182.113.18.92 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:08.823125
SID:	2030919
Source Port:	8082
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 14.223.26.33 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:06.173820
SID:	2030919
Source Port:	8083
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 78.188.112.42 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:24.058345
SID:	2030919
Source Port:	7724
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 101.22.184.177 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:12.141090
SID:	2030919
Source Port:	17833
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 123.175.92.230 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:12.157882
SID:	2030919
Source Port:	41705
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 171.36.88.43 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:51.483031
SID:	2030919
Source Port:	31524
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.10.212.35 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:50.937983
SID:	2030919
Source Port:	59351
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 27.6.206.186 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:47.004203
SID:	2030919
Source Port:	65391
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 220.198.240.185 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:04.655403
SID:	2030919
Source Port:	27474
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 119.179.238.174 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:49.803518
SID:	2030919
Source Port:	60648
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 42.235.64.33 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:48.368015
SID:	2030919
Source Port:	44377
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 182.122.234.142 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:09.903155
SID:	2030919
Source Port:	5353
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 123.14.35.188 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:47.809457
SID:	2030919
Source Port:	30301
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 221.202.181.253 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:52.207327
SID:	2030919
Source Port:	26929
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 124.131.156.1 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:49.923676
SID:	2030919
Source Port:	8082
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 113.228.150.105 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:53.371882
SID:	2030919
Source Port:	63764
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 120.85.112.221 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:44.365305
SID:	2030919
Source Port:	17872
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 123.129.129.98 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:36.957420
SID:	2030919
Source Port:	1027
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 115.57.109.53 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:01.950208
SID:	2030919
Source Port:	30872
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 61.53.105.50 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:17.946810
SID:	2030919
Source Port:	8080
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 175.175.188.249 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:18.086005
SID:	2030919
Source Port:	4375
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 120.56.5.224 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:53.425624
SID:	2030919
Source Port:	8083
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 177.245.155.184 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:46.669517
SID:	2030919
Source Port:	56840
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 47.107.92.35 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:46.525437
SID:	2030919
Source Port:	8083
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.89.71.117 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:14.079247
SID:	2030919
Source Port:	25800
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 123.190.31.146 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:59.001235
SID:	2030919
Source Port:	24247
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 42.239.255.233 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:05.639744
SID:	2030919
Source Port:	8082
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.93.183.173 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:48.716133
SID:	2030919
Source Port:	13621
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 113.225.115.233 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:48.106276
SID:	2030919
Source Port:	8080
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.96.135.13 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:33.473080
SID:	2030919
Source Port:	3277
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 123.14.99.249 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:37.664423
SID:	2030919
Source Port:	8080
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 182.114.228.16 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:40.456327
SID:	2030919
Source Port:	3600
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.194.29 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:55.670915
SID:	2030919
Source Port:	56461
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 182.117.33.62 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:40.657388
SID:	2030919
Source Port:	8080
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 120.63.221.76 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:16.702254
SID:	2030919
Source Port:	6881
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 125.42.230.168 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:51.726108
SID:	2030919
Source Port:	13010
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.235.45.72 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:49.477492
SID:	2030919
Source Port:	15006
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 177.245.153.99 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:30.065356
SID:	2030919
Source Port:	49027
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.213.88.166 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:34.494148
SID:	2030919
Source Port:	30301
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.197.119 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:48.462093
SID:	2030919
Source Port:	5060
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 182.117.78.148 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:28.402905
SID:	2030919
Source Port:	8083
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.217.37.194 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:35.525508
SID:	2030919
Source Port:	50561
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.99.190.136 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:35.585084
SID:	2030919
Source Port:	8652
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.203.18 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:02.384168
SID:	2030919
Source Port:	10044
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 49.75.64.215 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:48.871438
SID:	2030919
Source Port:	57985
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.93.188.112 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:19.347046
SID:	2030919
Source Port:	30301
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 61.137.199.152 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:27.561147
SID:	2030919
Source Port:	18530
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 5.188.64.229 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:52.236087
SID:	2030919
Source Port:	5353
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 27.202.116.74 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:55.049763
SID:	2030919
Source Port:	56641
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.200.181.176 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:58.988530
SID:	2030919
Source Port:	63249
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.141.142.251 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:19.147168
SID:	2030919
Source Port:	1900
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.205.131.100 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:08.001312
SID:	2030919
Source Port:	8080
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 114.226.245.81 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:20.546834
SID:	2030919
Source Port:	8081
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 182.127.143.19 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:32.917019
SID:	2030919
Source Port:	7235
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 42.5.65.154 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:45.554583
SID:	2030919
Source Port:	12787
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.10.212.37 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:11.887905
SID:	2030919
Source Port:	15323
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.203.90 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:18.591356
SID:	2030919
Source Port:	8000
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 115.48.31.1 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:53.364218
SID:	2030919
Source Port:	15777
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.213.92.159 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:27.941743
SID:	2030919
Source Port:	44328
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.213.85.239 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:28.416947
SID:	2030919
Source Port:	33080
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 219.155.168.215 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:36.682482
SID:	2030919
Source Port:	30301
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.78.135 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:42.299424
SID:	2030919
Source Port:	62780
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.89.71.168 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:54.532242
SID:	2030919
Source Port:	30617
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 182.116.55.134 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:52.288687
SID:	2030919
Source Port:	6881
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.253.215.73 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:48.888646
SID:	2030919
Source Port:	25226
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 85.215.242.168 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:52.145408
SID:	2030919
Source Port:	6881
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.201.7 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:45.050984
SID:	2030919
Source Port:	1027
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.253.221.191 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:00.219443
SID:	2030919
Source Port:	8082
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.208.96.81 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:47.407574
SID:	2030919
Source Port:	33088
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 182.113.235.204 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:48.270945
SID:	2030919
Source Port:	11396
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 61.53.97.55 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:01.767115
SID:	2030919
Source Port:	8000
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 125.44.21.50 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:46.632358
SID:	2030919
Source Port:	8081
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 221.13.243.13 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:10.462420
SID:	2030919
Source Port:	5060
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.215.214.178 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:19.211545
SID:	2030919
Source Port:	6610
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 27.210.218.119 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:46.651475
SID:	2030919
Source Port:	8000
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.78.170 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:42.352219
SID:	2030919
Source Port:	3285
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 39.171.253.87 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:45.598500
SID:	2030919
Source Port:	30301
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 222.241.210.81 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:02.448395
SID:	2030919
Source Port:	8080
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 182.127.154.100 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:58.378654
SID:	2030919
Source Port:	8081
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.202.152 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:35.646961
SID:	2030919
Source Port:	61480
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 120.86.252.160 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:51.606483
SID:	2030919
Source Port:	8974
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 182.124.122.251 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:54.822906
SID:	2030919
Source Port:	4000
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.204.80 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:09.157673
SID:	2030919
Source Port:	29739
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 120.85.118.198 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:48.607766
SID:	2030919
Source Port:	5045
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 27.215.180.200 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:49.773788
SID:	2030919
Source Port:	25535
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.207.136 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:50.043740
SID:	2030919
Source Port:	5353
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 95.32.69.32 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:48.618333
SID:	2030919
Source Port:	2087
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 115.55.199.44 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:46.249926
SID:	2030919
Source Port:	30301
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.206.187.150 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:49.255592
SID:	2030919
Source Port:	8081
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.248.53.145 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:52.179710
SID:	2030919
Source Port:	43183
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.141.226.116 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:57.776741
SID:	2030919
Source Port:	45756
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.89.193.177 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:47.772234
SID:	2030919
Source Port:	49006
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 115.61.148.148 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:55.962662
SID:	2030919
Source Port:	1185
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.197.242 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:51.443072
SID:	2030919
Source Port:	64609
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 39.90.160.121 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:57.545474
SID:	2030919
Source Port:	20781
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.222.192.193 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:17.511381
SID:	2030919
Source Port:	2574
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 106.112.179.121 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:18.143156
SID:	2030919
Source Port:	41346
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.193.227 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:52.293838
SID:	2030919
Source Port:	1027
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.10.212.34 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:53.459676
SID:	2030919
Source Port:	46401
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.213.82.138 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:46.813869
SID:	2030919
Source Port:	30040
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.242.239.85 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:11.000020
SID:	2030919
Source Port:	1027
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 221.215.247.125 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:53.507736
SID:	2030919
Source Port:	8081
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.198.43 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:52.991021
SID:	2030919
Source Port:	29918
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.202.54 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:45.052040
SID:	2030919
Source Port:	1434
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 119.187.201.64 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:51.025851
SID:	2030919
Source Port:	5060
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.203.117 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:04.711744
SID:	2030919
Source Port:	5060
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.207.60 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:48.968046
SID:	2030919
Source Port:	45724
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 113.230.80.68 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:50.621864
SID:	2030919
Source Port:	8080
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 112.248.112.76 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:25.580221
SID:	2030919
Source Port:	24240
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.194.129 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:08.035706
SID:	2030919
Source Port:	19378
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 115.56.155.143 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:53.247679
SID:	2030919
Source Port:	8083
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.199.3 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:40.038146
SID:	2030919
Source Port:	10984
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.195.124 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:53.448881
SID:	2030919
Source Port:	30301
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 182.117.30.233 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:24.586566
SID:	2030919
Source Port:	19307
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.252.160.59 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:37.940926
SID:	2030919
Source Port:	45689
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.194.171.174 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:13.114775
SID:	2030919
Source Port:	48283
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.10.212.37 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:53.104039
SID:	2030919
Source Port:	41238
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 61.3.95.14 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:29.003557
SID:	2030919
Source Port:	30301
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 182.121.173.58 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:12.157403
SID:	2030919
Source Port:	65413
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 115.55.245.232 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:13.103216
SID:	2030919
Source Port:	5353
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.222.252.98 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:15.015281
SID:	2030919
Source Port:	8000
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.200.147 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:46.124262
SID:	2030919
Source Port:	18538
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.141.161.72 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:30.044469
SID:	2030919
Source Port:	63831
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.203.214 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:37.410570
SID:	2030919
Source Port:	5353
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.207.77 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:38.685266
SID:	2030919
Source Port:	63317
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.194.210.76 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:47.508922
SID:	2030919
Source Port:	8000
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.182.240.126 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:27.447674
SID:	2030919
Source Port:	61656
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.99.133.192 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:40.945740
SID:	2030919
Source Port:	16589
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 115.49.203.227 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:45.361204
SID:	2030919
Source Port:	8083
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 42.228.35.248 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:08.965624
SID:	2030919
Source Port:	21125
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.206.187.0 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:48.224706
SID:	2030919
Source Port:	8081
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 123.14.214.241 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:21.386153
SID:	2030919
Source Port:	8000
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 125.47.235.12 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:31.444146
SID:	2030919
Source Port:	41451
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.193.170 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:43.361076
SID:	2030919
Source Port:	64230
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 42.5.245.210 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:00.193434
SID:	2030919
Source Port:	30301
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 120.211.137.176 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:18.892700
SID:	2030919
Source Port:	5060
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.195.255 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:42.542205
SID:	2030919
Source Port:	8083
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 222.137.57.27 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:03.593163
SID:	2030919
Source Port:	8081
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.89.202.101 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:26.053410
SID:	2030919
Source Port:	1027
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 112.248.63.217 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:04.326737
SID:	2030919
Source Port:	5060
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 27.215.82.209 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:08.326139
SID:	2030919
Source Port:	9134
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 61.3.188.193 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:21.480120
SID:	2030919
Source Port:	6881
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 186.148.245.86 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:12.051042
SID:	2030919
Source Port:	25286
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 221.235.45.4 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:09.208033
SID:	2030919
Source Port:	8000
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.207.253 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:52.219980
SID:	2030919
Source Port:	8080
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 219.155.195.79 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:30.602158
SID:	2030919
Source Port:	8080
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 171.36.157.2 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:48.071160
SID:	2030919
Source Port:	25973
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.10.212.37 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:00.676563
SID:	2030919
Source Port:	18900
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.76.88 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:02.395769
SID:	2030919
Source Port:	15403
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.10.212.38 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:52.931571
SID:	2030919
Source Port:	53465
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 182.120.51.224 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:32.972617
SID:	2030919
Source Port:	1372
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.220.108.129 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:12.145495
SID:	2030919
Source Port:	30301
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.10.212.35 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:39.674790
SID:	2030919
Source Port:	61659
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.199.77.27 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:03.596988
SID:	2030919
Source Port:	18790
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 61.52.27.104 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:06.231909
SID:	2030919
Source Port:	5060
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 42.234.244.67 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:08.737606
SID:	2030919
Source Port:	54564
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 39.89.165.53 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:34.654922
SID:	2030919
Source Port:	28409
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 119.109.147.116 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:22.578426
SID:	2030919
Source Port:	60706
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 42.58.121.236 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:53.414689
SID:	2030919
Source Port:	5137
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.196.5 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:24.623483
SID:	2030919
Source Port:	29646
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 45.229.174.144 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:55.448769
SID:	2030919
Source Port:	11211
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.10.212.37 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:27.962807
SID:	2030919
Source Port:	16630
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.194.166.98 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:48.993048
SID:	2030919
Source Port:	53575
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.203.119 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:52.289416
SID:	2030919
Source Port:	30301
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 116.68.162.186 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:00.011258
SID:	2030919
Source Port:	46037
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 45.189.207.241 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:22.233497
SID:	2030919
Source Port:	8083
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 106.3.130.252 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:25.880633
SID:	2030919
Source Port:	30301
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.50.73.202 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:48.885489
SID:	2030919
Source Port:	32763
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.202.151 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:22.114426
SID:	2030919
Source Port:	45675
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 61.53.140.32 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:27.664156
SID:	2030919
Source Port:	8083
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.141.227.103 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:46.093432
SID:	2030919
Source Port:	5060
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 125.25.93.161 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:42.282608
SID:	2030919
Source Port:	18096
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 46.153.236.32 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:58.911172
SID:	2030919
Source Port:	13297
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.204.226 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:06.437774
SID:	2030919
Source Port:	17017
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 120.85.114.169 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:21.658530
SID:	2030919
Source Port:	24216
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 39.87.73.210 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:16.115356
SID:	2030919
Source Port:	55291
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 61.52.109.1 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:35.670339
SID:	2030919
Source Port:	32860
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 182.125.120.85 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:14.421187
SID:	2030919
Source Port:	45193
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.213.95.10 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:56.962998
SID:	2030919
Source Port:	40563
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 87.255.200.247 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:38.404958
SID:	2030919
Source Port:	24980
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.248.44.129 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:37.346396
SID:	2030919
Source Port:	18652
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 112.31.180.128 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:17.525446
SID:	2030919
Source Port:	1900
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.213.95.216 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:18.331861
SID:	2030919
Source Port:	5274
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 120.86.252.180 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:44.030773
SID:	2030919
Source Port:	14781
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 175.30.112.140 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:47.777287
SID:	2030919
Source Port:	11211
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 189.165.201.254 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:48.866115
SID:	2030919
Source Port:	32623
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 61.3.179.115 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:40.646721
SID:	2030919
Source Port:	8081
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.215.138.43 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:45.450518
SID:	2030919
Source Port:	17433
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 112.239.102.121 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:51.146356
SID:	2030919
Source Port:	5964
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.221.61.2 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:48.498687
SID:	2030919
Source Port:	39378
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 115.58.42.240 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:00.285847
SID:	2030919
Source Port:	37497
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.194.168.91 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:53.212682
SID:	2030919
Source Port:	59147
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 81.68.153.169 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:35.832276
SID:	2030919
Source Port:	16054
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.207.130 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:15.957051
SID:	2030919
Source Port:	3540
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 121.61.149.209 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:25.219388
SID:	2030919
Source Port:	8083
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.195.155 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:28.455613
SID:	2030919
Source Port:	29478
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 219.157.151.133 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:20.959434
SID:	2030919
Source Port:	4000
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.248.22.205 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:35.459976
SID:	2030919
Source Port:	8080
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 31.162.4.120 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:51.758260
SID:	2030919
Source Port:	1796
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 123.185.49.90 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:22.662318
SID:	2030919
Source Port:	4000
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.205.157 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:09.148592
SID:	2030919
Source Port:	8080
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 121.231.121.39 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:52.236258
SID:	2030919
Source Port:	61479
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 14.155.205.75 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:40.334518
SID:	2030919
Source Port:	5060
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.200.69 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:00.246540
SID:	2030919
Source Port:	6881
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 209.59.113.249 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:51.126533
SID:	2030919
Source Port:	57674
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 112.237.23.220 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:16.706801
SID:	2030919
Source Port:	2003
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.205.14 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:51.745847
SID:	2030919
Source Port:	6881
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.213.86.46 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:32.231995
SID:	2030919
Source Port:	8082
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 116.74.19.124 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:56.782035
SID:	2030919
Source Port:	33749
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 182.124.40.132 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:55.608726
SID:	2030919
Source Port:	60648
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.194.135 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:40.004597
SID:	2030919
Source Port:	8082
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 222.139.39.163 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:11.500044
SID:	2030919
Source Port:	6881
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.197.189.217 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:57.856263
SID:	2030919
Source Port:	4945
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.93.21.122 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:28.323848
SID:	2030919
Source Port:	8081
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 60.246.138.175 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:12.129345
SID:	2030919
Source Port:	62851
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.184.58.208 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:34.479076
SID:	2030919
Source Port:	8082
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.211.215.190 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:38.971076
SID:	2030919
Source Port:	5353
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 42.5.53.19 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:56.754279
SID:	2030919
Source Port:	4000
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 222.140.87.236 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:05.782465
SID:	2030919
Source Port:	26401
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 220.124.130.79 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:53.351707
SID:	2030919
Source Port:	23975
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 27.216.35.127 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:00.264663
SID:	2030919
Source Port:	8000
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.178.249.186 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:53.115395
SID:	2030919
Source Port:	4770
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 27.6.3.211 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:46.669808
SID:	2030919
Source Port:	18557
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 182.56.69.246 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:35.364468
SID:	2030919
Source Port:	22520
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 112.248.100.146 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:59.541989
SID:	2030919
Source Port:	3755
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.242.233.228 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:20.682803
SID:	2030919
Source Port:	4000
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 202.110.15.176 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:27.344993
SID:	2030919
Source Port:	6881
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 151.177.251.42 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:31.817942
SID:	2030919
Source Port:	1027
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 112.248.107.205 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:04.649420
SID:	2030919
Source Port:	24420
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.214.8.218 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:21.471602
SID:	2030919
Source Port:	58924
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 120.85.119.218 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:55.550248
SID:	2030919
Source Port:	3870
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 42.239.240.169 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:47.849657
SID:	2030919
Source Port:	5353
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.192.127.79 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:53.204186
SID:	2030919
Source Port:	22281
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.205.251 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:20.649855
SID:	2030919
Source Port:	1027
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.193.70 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:29.890337
SID:	2030919
Source Port:	34928
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.10.212.36 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:50.432420
SID:	2030919
Source Port:	62650
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.215.222.16 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:46.617809
SID:	2030919
Source Port:	15949
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.10.212.38 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:43.675612
SID:	2030919
Source Port:	6649
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 115.55.252.99 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:58.041787
SID:	2030919
Source Port:	37662
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 124.7.139.186 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:43.504565
SID:	2030919
Source Port:	11211
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.78.59 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:31.266848
SID:	2030919
Source Port:	12447
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.248.24.210 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:47.788313
SID:	2030919
Source Port:	33917
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 120.56.5.31 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:42.271584
SID:	2030919
Source Port:	21908
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.89.185.186 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:31.262046
SID:	2030919
Source Port:	47762
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.206.189.163 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:51.361471
SID:	2030919
Source Port:	11211
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.89.183.154 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:25.232465
SID:	2030919
Source Port:	60936
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.89.5.128 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:38.300426
SID:	2030919
Source Port:	4000
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 112.242.100.32 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:19.115527
SID:	2030919
Source Port:	57617
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 122.159.62.209 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:27.789156
SID:	2030919
Source Port:	4000
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 153.34.81.58 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:22.016732
SID:	2030919
Source Port:	45886
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.202.167 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:52.223621
SID:	2030919
Source Port:	4234
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.248.25.83 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:44.426840
SID:	2030919
Source Port:	12460
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 222.246.41.12 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:31.277822
SID:	2030919
Source Port:	3026
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.213.86.33 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:19.572311
SID:	2030919
Source Port:	41547
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.248.18.124 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:27.944887
SID:	2030919
Source Port:	30526
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.199.81 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:20.743465
SID:	2030919
Source Port:	54607
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.81.202 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:46.399511
SID:	2030919
Source Port:	6463
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.206.186.128 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:52.238748
SID:	2030919
Source Port:	8000
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.198.88 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:38.046829
SID:	2030919
Source Port:	8083
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.220.106.143 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:24.420393
SID:	2030919
Source Port:	4000
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 123.4.46.248 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:52.117834
SID:	2030919
Source Port:	24465
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.10.212.37 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:52.739611
SID:	2030919
Source Port:	1319
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.198.155 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:05.831915
SID:	2030919
Source Port:	22738
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 115.55.247.210 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:02.827074
SID:	2030919
Source Port:	8080
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.209.1.159 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:54.536432
SID:	2030919
Source Port:	21688
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 120.86.253.225 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:40.464232
SID:	2030919
Source Port:	18778
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 27.47.2.116 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:53.445339
SID:	2030919
Source Port:	14400
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 61.0.9.201 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:53.224659
SID:	2030919
Source Port:	8651
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 190.109.229.181 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:23.191044
SID:	2030919
Source Port:	40772
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.194.169 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:53.095777
SID:	2030919
Source Port:	8000
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 221.14.188.19 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:53.333057
SID:	2030919
Source Port:	47233
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.196.193 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:48.398705
SID:	2030919
Source Port:	4000
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.222.251.146 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:53.391529
SID:	2030919
Source Port:	6621
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.88.93 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:57.951587
SID:	2030919
Source Port:	8505
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 182.119.188.84 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:09.936571
SID:	2030919
Source Port:	5060
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.192.6 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:29.406786
SID:	2030919
Source Port:	8080
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.215.255.17 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:44.856859
SID:	2030919
Source Port:	61653
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.248.41.238 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:18.315700
SID:	2030919
Source Port:	30301
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.201.3.242 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:21.423104
SID:	2030919
Source Port:	25759
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.194.166.233 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:16.720952
SID:	2030919
Source Port:	50279
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 42.225.218.4 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:48.092528
SID:	2030919
Source Port:	8083
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.248.17.169 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:29.154895
SID:	2030919
Source Port:	4000
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 218.61.110.165 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:42.463594
SID:	2030919
Source Port:	6881
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 124.235.243.25 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:41.597542
SID:	2030919
Source Port:	30301
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 157.211.1.243 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:07.987059
SID:	2030919
Source Port:	8080
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.196.25 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:40.493012
SID:	2030919
Source Port:	53286
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 188.150.231.39 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:31.154904
SID:	2030919
Source Port:	9007
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.10.212.37 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:52.715539
SID:	2030919
Source Port:	58141
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.205.89 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:16.828449
SID:	2030919
Source Port:	32424
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 27.207.162.152 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:11.197720
SID:	2030919
Source Port:	8083
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 120.211.183.3 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:43.406321
SID:	2030919
Source Port:	22715
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 211.150.84.20 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:53.531962
SID:	2030919
Source Port:	30034
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.89.207.109 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:16.709333
SID:	2030919
Source Port:	21078
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 120.86.255.150 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:09.714252
SID:	2030919
Source Port:	9825
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.222.253.43 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:13.839679
SID:	2030919
Source Port:	11211
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 112.242.43.175 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:34.174908
SID:	2030919
Source Port:	5060
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 115.49.26.188 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:06.940326
SID:	2030919
Source Port:	11396
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 123.129.133.153 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:26.689048
SID:	2030919
Source Port:	5353
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 112.248.69.209 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:52.504459
SID:	2030919
Source Port:	40234
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 182.119.183.8 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:38.000244
SID:	2030919
Source Port:	12938
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 123.12.25.187 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:38.701463
SID:	2030919
Source Port:	5060
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.93.25.165 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:43.223381
SID:	2030919
Source Port:	56700
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 115.56.57.254 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:52.410342
SID:	2030919
Source Port:	30301
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 219.155.42.190 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:42.411952
SID:	2030919
Source Port:	16873
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.192.112 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:20.747091
SID:	2030919
Source Port:	8081
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 123.10.3.172 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:05.345331
SID:	2030919
Source Port:	6881
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 42.224.1.160 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:35.182278
SID:	2030919
Source Port:	64523
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 115.52.151.248 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:24.420200
SID:	2030919
Source Port:	30872
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.194.200.94 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:53.243224
SID:	2030919
Source Port:	41606
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.71.230 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:31.156331
SID:	2030919
Source Port:	2356
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.221.74.43 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:10.314543
SID:	2030919
Source Port:	31891
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.222.226.188 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:32.281724
SID:	2030919
Source Port:	30301
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 42.224.5.140 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:53.591487
SID:	2030919
Source Port:	4000
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.10.212.37 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:36.233147
SID:	2030919
Source Port:	57154
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 27.215.82.59 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:30.304760
SID:	2030919
Source Port:	52259
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.215.246.197 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:36.799502
SID:	2030919
Source Port:	49781
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.194.55 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:52.050913
SID:	2030919
Source Port:	20131
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 39.81.137.240 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:28.910580
SID:	2030919
Source Port:	8080
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.252.163.184 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:50.044942
SID:	2030919
Source Port:	30301
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 42.237.116.219 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:04.664389
SID:	2030919
Source Port:	5060
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.201.108.93 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:14.123801
SID:	2030919
Source Port:	44608
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.248.19.118 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:33.873437
SID:	2030919
Source Port:	5191
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 222.137.113.60 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:33.900655
SID:	2030919
Source Port:	10933
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.99.131.143 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:14.078792
SID:	2030919
Source Port:	8083
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 112.239.96.126 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:19.527248
SID:	2030919
Source Port:	48974
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 222.138.163.153 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:52.496725
SID:	2030919
Source Port:	27409
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.93.23.92 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:18.336350
SID:	2030919
Source Port:	15421
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 113.238.67.29 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:07.442712
SID:	2030919
Source Port:	64355
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 116.68.162.158 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:51.291817
SID:	2030919
Source Port:	8080
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 115.52.250.211 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:48.072487
SID:	2030919
Source Port:	15591
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 223.13.61.70 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:28.034019
SID:	2030919
Source Port:	28879
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 120.85.113.189 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:50.819917
SID:	2030919
Source Port:	1076
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.204.248 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:44.286362
SID:	2030919
Source Port:	47806
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 115.54.79.176 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:36.461724
SID:	2030919
Source Port:	8083
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 113.228.133.250 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:47.144684
SID:	2030919
Source Port:	57674
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.207.188 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:52.589340
SID:	2030919
Source Port:	53815
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.141.211.40 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:36.294461
SID:	2030919
Source Port:	8082
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 123.11.105.66 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:52.881953
SID:	2030919
Source Port:	25629
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 115.60.202.57 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:41.656853
SID:	2030919
Source Port:	32280
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.206.176.227 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:03.704144
SID:	2030919
Source Port:	6881
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.204.6 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:12.535574
SID:	2030919
Source Port:	45745
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.203.72 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:40.827544
SID:	2030919
Source Port:	31753
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 190.109.227.211 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:55.702709
SID:	2030919
Source Port:	31173
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 81.232.48.63 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:50.068240
SID:	2030919
Source Port:	64979
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 115.55.194.3 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:19.287670
SID:	2030919
Source Port:	24616
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 120.86.255.57 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:51.089623
SID:	2030919
Source Port:	19240
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 120.56.3.131 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:48.520629
SID:	2030919
Source Port:	4000
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 120.85.114.157 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:37.064496
SID:	2030919
Source Port:	22795
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 42.177.198.181 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:12.167291
SID:	2030919
Source Port:	8081
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 39.74.4.17 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:46.835320
SID:	2030919
Source Port:	55940
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.10.212.33 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:53.670267
SID:	2030919
Source Port:	19242
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 120.56.0.237 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:48.891932
SID:	2030919
Source Port:	8082
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 115.56.179.134 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:45.676579
SID:	2030919
Source Port:	30301
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.202.8 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:43.354577
SID:	2030919
Source Port:	39703
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 120.85.118.247 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:41.462032
SID:	2030919
Source Port:	16714
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 175.148.210.248 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:19.040009
SID:	2030919
Source Port:	40330
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 175.166.5.244 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:00.934127
SID:	2030919
Source Port:	32865
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.200.184.210 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:16.724456
SID:	2030919
Source Port:	55318
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 120.85.116.216 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:34.493537
SID:	2030919
Source Port:	1961
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.141.153.125 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:24.754457
SID:	2030919
Source Port:	8000
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.215.217.182 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:39.341317
SID:	2030919
Source Port:	5353
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 123.5.150.117 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:41.183928
SID:	2030919
Source Port:	46064
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.182.250.191 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:31.252793
SID:	2030919
Source Port:	8082
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 2.55.98.253 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:33.122750
SID:	2030919
Source Port:	10721
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 24.155.118.58 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:52.490983
SID:	2030919
Source Port:	30301
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.199.157 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:52.221055
SID:	2030919
Source Port:	6881
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 27.157.170.56 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:14.432418
SID:	2030919
Source Port:	33932
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 222.137.158.244 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:35.281395
SID:	2030919
Source Port:	63336
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 120.85.114.63 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:52.590947
SID:	2030919
Source Port:	14931
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 222.134.173.76 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:24.416132
SID:	2030919
Source Port:	5060
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.201.7.216 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:13.134535
SID:	2030919
Source Port:	28164
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.243.247.195 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:19.905556
SID:	2030919
Source Port:	5353
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.215.212.4 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:56.752817
SID:	2030919
Source Port:	5353
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.255.83.178 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:06.833431
SID:	2030919
Source Port:	53618
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 110.42.235.42 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:45.273309
SID:	2030919
Source Port:	18739
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 222.132.104.176 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:21.415694
SID:	2030919
Source Port:	7850
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.10.212.35 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:14.030875
SID:	2030919
Source Port:	44913
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.182.247.182 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:43.225490
SID:	2030919
Source Port:	8081
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.10.212.36 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:52.829660
SID:	2030919
Source Port:	5576
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.203.236 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:01.372918
SID:	2030919
Source Port:	54241
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 123.8.81.152 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:11.143549
SID:	2030919
Source Port:	30301
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.201.88 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:35.660370
SID:	2030919
Source Port:	56923
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.205.58.18 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:17.256904
SID:	2030919
Source Port:	8081
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 113.231.249.196 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:17.288235
SID:	2030919
Source Port:	34907
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.10.212.36 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:19.130065
SID:	2030919
Source Port:	20046
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.81.231 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:27.880928
SID:	2030919
Source Port:	7459
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 182.112.156.39 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:10.454704
SID:	2030919
Source Port:	8082
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.92.189.86 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:19.723595
SID:	2030919
Source Port:	8080
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.89.70.39 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:47.778868
SID:	2030919
Source Port:	62741
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 112.242.87.123 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:53.027094
SID:	2030919
Source Port:	30003
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.194.125 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:52.220783
SID:	2030919
Source Port:	44715
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.76.39 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:35.639782
SID:	2030919
Source Port:	13472
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.248.17.148 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:15.099018
SID:	2030919
Source Port:	2192
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.215.222.219 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:12.151850
SID:	2030919
Source Port:	11211
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 182.117.117.236 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:00.146481
SID:	2030919
Source Port:	8083
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 24.242.46.78 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:50.500561
SID:	2030919
Source Port:	8080
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 182.113.213.176 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:27.057300
SID:	2030919
Source Port:	6881
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.251.165.169 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:15.554492
SID:	2030919
Source Port:	30244
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 81.182.189.101 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:21.294849
SID:	2030919
Source Port:	18235
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.89.198.233 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:19.462190
SID:	2030919
Source Port:	8081
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.201.11.4 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:55.623620
SID:	2030919
Source Port:	21205
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.208.232.40 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:15.048732
SID:	2030919
Source Port:	6587
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.91.190.128 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:28.423527
SID:	2030919
Source Port:	12086
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 222.140.171.151 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:06.905771
SID:	2030919
Source Port:	3109
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.196.39.51 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:52.135324
SID:	2030919
Source Port:	8082
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 42.59.206.141 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:42.213210
SID:	2030919
Source Port:	30301
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 120.211.137.182 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:46.748871
SID:	2030919
Source Port:	8083
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 95.169.197.246 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:07.166762
SID:	2030919
Source Port:	11211
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 115.50.216.157 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:03.932326
SID:	2030919
Source Port:	8081
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.88.179.47 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:18.326845
SID:	2030919
Source Port:	30301
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 222.247.8.15 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:18.330388
SID:	2030919
Source Port:	46363
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 114.218.141.66 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:58.035737
SID:	2030919
Source Port:	47086
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.141.154.132 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:25.919710
SID:	2030919
Source Port:	22710
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 60.216.254.16 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:36.486602
SID:	2030919
Source Port:	6881
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.206.185.199 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:14.375941
SID:	2030919
Source Port:	47083
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 111.70.31.106 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:53.332060
SID:	2030919
Source Port:	4000
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.248.31.179 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:20.948219
SID:	2030919
Source Port:	8081
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 182.124.35.104 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:28.283770
SID:	2030919
Source Port:	1027
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.71.66 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:10.155596
SID:	2030919
Source Port:	15388
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.198.180 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:22.579028
SID:	2030919
Source Port:	5353
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.207.77.22 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:23.302456
SID:	2030919
Source Port:	8082
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 222.142.222.207 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:51.673404
SID:	2030919
Source Port:	5060
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.197.76 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:46.533664
SID:	2030919
Source Port:	8082
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 27.37.87.197 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:17.510567
SID:	2030919
Source Port:	60210
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 219.156.175.192 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:46.162395
SID:	2030919
Source Port:	8000
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 42.239.240.239 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:28.229328
SID:	2030919
Source Port:	41512
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.248.51.122 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:01.320985
SID:	2030919
Source Port:	30301
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.241.42.226 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:28.414101
SID:	2030919
Source Port:	5060
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 182.124.119.225 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:50.844837
SID:	2030919
Source Port:	5353
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 14.155.221.46 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:47.785611
SID:	2030919
Source Port:	5060
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 115.51.120.251 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:48.951870
SID:	2030919
Source Port:	8081
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 113.231.217.163 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:39.179336
SID:	2030919
Source Port:	7045
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.93.19.249 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:22.034135
SID:	2030919
Source Port:	8083
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.215.208.106 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:13.116932
SID:	2030919
Source Port:	8083
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 42.239.188.170 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:03.557523
SID:	2030919
Source Port:	5060
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 112.248.190.83 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:16.846268
SID:	2030919
Source Port:	5353
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.201.1.45 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:39.817709
SID:	2030919
Source Port:	56396
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 120.86.252.142 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:53.401114
SID:	2030919
Source Port:	4390
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.200.191 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:28.925134
SID:	2030919
Source Port:	4000
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 115.50.44.165 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:40.309117
SID:	2030919
Source Port:	5786
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.247.104.212 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:35.897526
SID:	2030919
Source Port:	8080
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 123.8.161.46 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:15.852998
SID:	2030919
Source Port:	8082
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.141.160.235 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:24.854948
SID:	2030919
Source Port:	47145
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 221.15.7.234 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:14.154671
SID:	2030919
Source Port:	54480
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.193.137 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:03.598551
SID:	2030919
Source Port:	9482
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 27.215.209.34 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:10.794984
SID:	2030919
Source Port:	29452
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.213.119.47 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:56.281918
SID:	2030919
Source Port:	23027
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 103.40.255.245 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:49.924231
SID:	2030919
Source Port:	8080
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.222.254.246 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:34.476851
SID:	2030919
Source Port:	6881
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 182.127.10.178 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:08.595387
SID:	2030919
Source Port:	1057
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 123.9.195.230 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:41.200429
SID:	2030919
Source Port:	54831
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 221.15.189.62 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:52.099482
SID:	2030919
Source Port:	8000
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 39.91.82.241 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:03.910081
SID:	2030919
Source Port:	60508
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 182.120.249.219 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:33.229733
SID:	2030919
Source Port:	9050
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.75.250 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:20.668354
SID:	2030919
Source Port:	2530
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.204.150 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:44.227514
SID:	2030919
Source Port:	6881
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.202.72.16 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:42.860979
SID:	2030919
Source Port:	4148
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 113.236.105.239 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:43.652477
SID:	2030919
Source Port:	6881
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.206.14 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:30.368164
SID:	2030919
Source Port:	5060
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 119.189.215.205 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:16.222604
SID:	2030919
Source Port:	15465
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 182.124.168.209 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:58.842302
SID:	2030919
Source Port:	8080
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.202.76.122 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:42.304811
SID:	2030919
Source Port:	5353
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 221.230.38.202 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:24.547285
SID:	2030919
Source Port:	5353
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.254.58.40 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:43.850237
SID:	2030919
Source Port:	25918
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 196.191.231.12 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:33.610290
SID:	2030919
Source Port:	3588
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 95.32.198.228 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:35.693977
SID:	2030919
Source Port:	1536
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.200.240 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:27.046702
SID:	2030919
Source Port:	6881
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.194.151 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:33.022280
SID:	2030919
Source Port:	8083
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 112.242.167.52 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:11.020991
SID:	2030919
Source Port:	65175
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.192.203 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:02.698814
SID:	2030919
Source Port:	8000
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.215.210.66 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:18.093840
SID:	2030919
Source Port:	8080
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 222.138.119.36 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:51.134136
SID:	2030919
Source Port:	11054
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.70.87.160 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:48.169281
SID:	2030919
Source Port:	6881
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 115.49.25.205 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:36.484332
SID:	2030919
Source Port:	5972
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 83.97.73.228 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:42.426824
SID:	2030919
Source Port:	30734
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.10.212.33 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:49.401877
SID:	2030919
Source Port:	55764
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.252.192.87 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:57.761908
SID:	2030919
Source Port:	46287
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 27.210.156.182 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:01.053242
SID:	2030919
Source Port:	8000
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 182.243.157.74 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:01.401671
SID:	2030919
Source Port:	6881
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 123.194.35.224 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:14.046070
SID:	2030919
Source Port:	1900
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.248.47.91 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:43.562281
SID:	2030919
Source Port:	1027
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.208.233.222 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:41.729393
SID:	2030919
Source Port:	31068
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.202.65.104 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:16.731804
SID:	2030919
Source Port:	55499
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 123.130.4.251 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:53.286342
SID:	2030919
Source Port:	8000
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.76.102 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:25.251064
SID:	2030919
Source Port:	2476
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 114.104.155.242 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:52.418543
SID:	2030919
Source Port:	8000
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 160.153.235.195 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:34.933716
SID:	2030919
Source Port:	23451
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 123.132.181.53 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:53.609605
SID:	2030919
Source Port:	26176
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.10.212.37 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:53.306650
SID:	2030919
Source Port:	44230
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.63.114.20 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:51.980458
SID:	2030919
Source Port:	34281
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 182.120.61.120 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:46.842087
SID:	2030919
Source Port:	30301
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 182.127.177.158 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:25.659128
SID:	2030919
Source Port:	4000
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 45.229.174.165 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:50.917685
SID:	2030919
Source Port:	30301
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 156.155.112.139 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:44.439267
SID:	2030919
Source Port:	4000
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.192.120.105 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:36.414770
SID:	2030919
Source Port:	8000
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.93.190.104 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:52.441360
SID:	2030919
Source Port:	43302
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 125.41.208.128 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:38.410483
SID:	2030919
Source Port:	40901
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 111.61.93.5 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:52.727851
SID:	2030919
Source Port:	41856
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 112.83.1.68 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:13.669881
SID:	2030919
Source Port:	3442
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.235.103.30 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:15.026653
SID:	2030919
Source Port:	8081
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.222.255.43 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:45.157118
SID:	2030919
Source Port:	57668
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 120.85.112.192 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:47.367519
SID:	2030919
Source Port:	24582
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 115.55.181.56 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:13.137950
SID:	2030919
Source Port:	22671
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 45.119.84.144 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:50.631896
SID:	2030919
Source Port:	5060
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 120.35.47.102 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:13.123734
SID:	2030919
Source Port:	10816
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.220.56.180 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:50.388436
SID:	2030919
Source Port:	51109
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 42.227.2.139 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:18.519064
SID:	2030919
Source Port:	5353
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 91.219.171.20 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:15.818948
SID:	2030919
Source Port:	25110
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.203.185 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:26.134786
SID:	2030919
Source Port:	47390
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 42.230.41.246 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:15.024824
SID:	2030919
Source Port:	6881
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 115.49.75.234 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:36.717810
SID:	2030919
Source Port:	54428
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 120.85.183.45 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:06.870276
SID:	2030919
Source Port:	14627
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 219.157.198.116 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:27.178838
SID:	2030919
Source Port:	30301
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 80.202.217.118 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:50.605561
SID:	2030919
Source Port:	61120
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.77.222 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:50.881816
SID:	2030919
Source Port:	17738
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.88.114 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:53.335341
SID:	2030919
Source Port:	6301
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 182.126.78.17 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:07.152177
SID:	2030919
Source Port:	46072
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.212.62.54 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:05.786975
SID:	2030919
Source Port:	11211
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 193.234.64.121 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:23.829308
SID:	2030919
Source Port:	11673
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 175.173.94.100 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:42.214211
SID:	2030919
Source Port:	22502
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 189.174.100.153 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:47.059654
SID:	2030919
Source Port:	51090
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.201.245 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:52.290171
SID:	2030919
Source Port:	53127
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 115.61.177.9 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:15.867486
SID:	2030919
Source Port:	17543
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 27.202.31.103 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:22.709623
SID:	2030919
Source Port:	18836
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 47.222.117.185 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:33.761569
SID:	2030919
Source Port:	20520
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.89.67.254 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:53.295886
SID:	2030919
Source Port:	21223
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 91.239.77.159 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:25.752903
SID:	2030919
Source Port:	28820
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.220.150.108 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:12.162678
SID:	2030919
Source Port:	20514
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.10.212.38 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:28.892409
SID:	2030919
Source Port:	46181
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.201.129 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:08.057624
SID:	2030919
Source Port:	4000
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 182.60.1.148 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:16.231941
SID:	2030919
Source Port:	27017
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.201.252 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:32.638334
SID:	2030919
Source Port:	37725
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.93.185.25 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:44.725182
SID:	2030919
Source Port:	6881
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.199.14.219 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:37.992491
SID:	2030919
Source Port:	1027
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 222.138.100.11 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:53.945291
SID:	2030919
Source Port:	36160
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 112.248.80.118 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:39.919155
SID:	2030919
Source Port:	8083
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 124.234.158.191 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:47.778656
SID:	2030919
Source Port:	11211
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.203.123 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:23.980473
SID:	2030919
Source Port:	23167
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 27.202.212.226 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:27.025152
SID:	2030919
Source Port:	36160
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.201.232 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:47.346029
SID:	2030919
Source Port:	43453
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 42.4.96.111 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:07.549919
SID:	2030919
Source Port:	26860
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 61.53.88.225 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:17.179853
SID:	2030919
Source Port:	5060
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 61.3.95.214 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:03.667363
SID:	2030919
Source Port:	4845
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.248.30.127 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:16.723719
SID:	2030919
Source Port:	8082
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 123.4.58.219 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:36.103684
SID:	2030919
Source Port:	19456
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.215.216.182 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:22.663108
SID:	2030919
Source Port:	1027
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 120.85.182.220 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:36.210606
SID:	2030919
Source Port:	17931
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.81.119 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:47.704815
SID:	2030919
Source Port:	3341
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.220.148.104 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:48.579714
SID:	2030919
Source Port:	8082
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.241.172.105 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:37.354088
SID:	2030919
Source Port:	16508
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 222.139.74.112 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:16.902383
SID:	2030919
Source Port:	26449
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.193.71 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:52.378619
SID:	2030919
Source Port:	34483
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 95.32.95.235 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:52.490726
SID:	2030919
Source Port:	2049
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 182.121.241.3 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:52.852751
SID:	2030919
Source Port:	8080
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 88.234.130.44 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:01.767892
SID:	2030919
Source Port:	34685
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 27.207.227.15 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:46.528229
SID:	2030919
Source Port:	4000
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 61.53.111.77 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:19.462844
SID:	2030919
Source Port:	10615
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 222.134.174.86 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:50.234661
SID:	2030919
Source Port:	6881
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 42.239.238.40 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:15.622868
SID:	2030919
Source Port:	8080
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.195.186 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:13.561523
SID:	2030919
Source Port:	11211
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.193.171 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:13.196924
SID:	2030919
Source Port:	46103
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.204.13 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:05.828743
SID:	2030919
Source Port:	8081
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 182.120.51.148 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:03.405735
SID:	2030919
Source Port:	6881
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.96.134.239 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:33.172697
SID:	2030919
Source Port:	4000
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 123.13.56.150 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:52.493459
SID:	2030919
Source Port:	17932
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.202.67.157 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:33.407216
SID:	2030919
Source Port:	19603
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 182.127.183.40 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:11.559695
SID:	2030919
Source Port:	5698
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 90.159.4.179 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:42.467995
SID:	2030919
Source Port:	18145
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 123.5.186.112 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:56.726731
SID:	2030919
Source Port:	8083
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 219.157.219.131 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:27.309148
SID:	2030919
Source Port:	6881
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.235.34.245 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:21.467567
SID:	2030919
Source Port:	23221
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.215.215.202 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:44.646858
SID:	2030919
Source Port:	20455
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 125.24.157.223 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:52.174189
SID:	2030919
Source Port:	11792
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.89.68.132 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:53.396000
SID:	2030919
Source Port:	53151
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 123.5.126.66 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:39.418648
SID:	2030919
Source Port:	58178
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.194.167.124 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:48.728430
SID:	2030919
Source Port:	4486
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 210.22.177.142 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:27.447775
SID:	2030919
Source Port:	56572
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 103.239.175.169 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:31.267451
SID:	2030919
Source Port:	38528
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.201.15.246 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:27.640592
SID:	2030919
Source Port:	11395
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 120.86.255.218 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:16.309742
SID:	2030919
Source Port:	8758
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.10.212.33 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:27.655684
SID:	2030919
Source Port:	61830
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.89.5.154 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:32.216748
SID:	2030919
Source Port:	3468
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 120.37.237.66 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:57.854486
SID:	2030919
Source Port:	35335
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 178.72.77.243 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:48.833860
SID:	2030919
Source Port:	1574
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 27.7.206.74 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:46.286459
SID:	2030919
Source Port:	8081
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 125.47.241.124 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:19.230061
SID:	2030919
Source Port:	39153
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 27.6.206.197 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:57.889045
SID:	2030919
Source Port:	8080
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.248.22.38 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:53.563526
SID:	2030919
Source Port:	25305
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 111.70.25.62 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:42.182873
SID:	2030919
Source Port:	42389
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.93.28.47 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:46.747277
SID:	2030919
Source Port:	6774
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 24.50.234.61 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:35.430722
SID:	2030919
Source Port:	9253
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.200.177.161 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:17.522912
SID:	2030919
Source Port:	28942
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 120.85.113.20 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:49.521388
SID:	2030919
Source Port:	12704
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.194.90 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:38.045768
SID:	2030919
Source Port:	1027
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 95.134.34.192 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:24.579349
SID:	2030919
Source Port:	47317
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.92.189.210 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:23.311215
SID:	2030919
Source Port:	50104
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 115.55.231.16 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:11.621638
SID:	2030919
Source Port:	6881
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 83.219.1.198 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:51.809645
SID:	2030919
Source Port:	8080
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 117.204.197.52 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:42.777756
SID:	2030919
Source Port:	8080
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 1.10.212.33 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:52.750781
SID:	2030919
Source Port:	52051
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 182.121.23.170 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:56:55.788847
SID:	2030919
Source Port:	16787
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

ET TROJAN Mozi Botnet DHT Config Sent - Source IP: 59.93.182.219 - Destination IP: 192.168.2.16

Timestamp:	05/06/24-04:57:47.827968
SID:	2030919
Source Port:	8080
Destination Port:	8000
Protocol:	UDP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\_MEI14482\xmrig.exe

Avira: detection malicious, Label: PUA/GM.Miner.OW

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\_MEI14482\back.jpg	ReversingLabs: Detection: 70%
Source: C:\Users\user\AppData\Local\Temp\_MEI14482\back.jpg	Virustotal: Detection: 69%			Perma Link

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\_MEI14482\xmrig.exe

Joe Sandbox ML: detected

Bitcoin Miner

Yara detected Xmrig cryptocurrency miner

Source: Yara match	File source: 40.0.xmrig.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 40.2.xmrig.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000028.00000002.2395762565.0000000001500000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000002.2393808878.0000000000CCE000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000002.2393514571.00000000009B5000.00000004.00000001.01000000.0000004C.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.1507947087.0000000000EF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.1422207868.000000000151D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000002.2396216239.00000000018A2000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000002.2393808878.0000000000CE3000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000023.00000003.1504992076.0000000000C15000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000025.00000002.1508063957.000000000311C000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000000.1545522218.00000000009B0000.00000008.00000001.01000000.0000004C.sdmp, type: MEMORY
Source: Yara match	File source: 00000012.00000003.1422400569.000000000151E000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000003.1405690614.00000000024AF000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000028.00000002.2357701679.0000000000401000.00000040.00000001.01000000.0000004C.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe PID: 5764, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: cmd.exe PID: 6272, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: cmd.exe PID: 4780, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: xmrig.exe PID: 6092, type: MEMORYSTR
Source: Yara match	File source: C:\Windows\Temp\_MEI70482\config.json, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\_MEI57642\config.json, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\_MEI14482\config.json, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\_MEI33482\config.json, type: DROPPED
Source: Yara match	File source: C:\Windows\Temp\config.json, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\_MEI28682\config.json, type: DROPPED
Source: Yara match	File source: C:\Windows\Temp\xmrig.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\_MEI33482\xmrig.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\_MEI57642\xmrig.exe, type: DROPPED
Source: Yara match	File source: C:\Windows\Temp\_MEI70482\xmrig.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\_MEI14482\xmrig.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\_MEI28682\xmrig.exe, type: DROPPED

Found strings related to Crypto-Mining

Source: xmrig.exe, 00000028.00000002.2357701679.0000000000401000.00000040.00000001.01000000.0000004C.sdmp	String found in binary or memory: stratum+tcp://
Source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000012.00000003.1422207868.000000000151D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: "algo": "cryptonight",
Source: xmrig.exe, 00000028.00000002.2357701679.0000000000401000.00000040.00000001.01000000.0000004C.sdmp	String found in binary or memory: -o, --url=URL URL of mining server
Source: xmrig.exe, 00000028.00000002.2357701679.0000000000401000.00000040.00000001.01000000.0000004C.sdmp	String found in binary or memory: stratum+tcp://
Source: xmrig.exe, 00000028.00000002.2357701679.0000000000401000.00000040.00000001.01000000.0000004C.sdmp	String found in binary or memory: Usage: xmrig [OPTIONS]
Source: cmd.exe, 00000023.00000003.1504992076.0000000000C15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: FileDescriptionXMRig CPU miner.

Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe

File opened: C:\Users\user\AppData\Local\Temp\_MEI28682\msvcr90.dll

Jump to behavior

Source:	Binary string: O:\src\pywin32\build\temp.win32-2.7\Release\_win32sysloader.pdb source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000E.00000003.1399061320.00000000021D1000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000012.00000003.1416602430.0000000001516000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001C.00000003.1476308666.0000000002FB1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\build27\cpython\PCBuild\python27.pdb1v source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000002.1437875354.000000006CE41000.00000040.00000001.01000000.00000009.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000002.1569290197.000000006CB22000.00000040.00000001.01000000.00000016.sdmp, HelpPane.exe, 0000001F.00000002.2451622387.000000006C5F2000.00000040.00000001.01000000.0000003E.sdmp
Source:	Binary string: C:\build27\cpython\PCBuild\_hashlib.pdb% source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000002.1435325332.000000006CBC1000.00000040.00000001.01000000.0000000E.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000002.1562891852.000000006C779000.00000040.00000001.01000000.0000001B.sdmp, HelpPane.exe, 0000001F.00000002.2443718893.000000006C209000.00000040.00000001.01000000.00000043.sdmp
Source:	Binary string: C:\build27\cpython\PCBuild\_ctypes.pdb source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000002.1575915828.0000000073A82000.00000040.00000001.01000000.00000018.sdmp, HelpPane.exe, 0000001F.00000002.2451179086.000000006C3D2000.00000040.00000001.01000000.00000040.sdmp
Source:	Binary string: C:\build27\cpython\PCBuild\_hashlib.pdb source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000002.1562891852.000000006C779000.00000040.00000001.01000000.0000001B.sdmp, HelpPane.exe, 0000001F.00000002.2443718893.000000006C209000.00000040.00000001.01000000.00000043.sdmp
Source:	Binary string: C:\build27\cpython\PCBuild\_socket.pdb source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000002.1575655979.0000000073A51000.00000040.00000001.01000000.00000019.sdmp, HelpPane.exe, 0000001F.00000002.2450848717.000000006C3A1000.00000040.00000001.01000000.00000041.sdmp
Source:	Binary string: O:\src\pywin32\build\temp.win32-2.7\Release\pywintypes.pdb source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000002.1433643030.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp
Source:	Binary string: O:\src\pywin32\build\temp.win32-2.7\Release\servicemanager.pdb source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000002.1434219289.000000001E7D1000.00000040.00000001.01000000.00000015.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000002.1561871341.000000001E7D4000.00000040.00000001.01000000.00000022.sdmp, HelpPane.exe, 0000001F.00000002.2443190696.000000001E7D4000.00000040.00000001.01000000.0000004A.sdmp
Source:	Binary string: O:\src\pywin32\build\temp.win32-2.7\Release\pywintypes.pdb$ source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000002.1433643030.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp
Source:	Binary string: O:\src\pywin32\build\temp.win32-2.7\Release\win32service.pdbl source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000002.1435001879.000000001ECB1000.00000040.00000001.01000000.00000011.sdmp
Source:	Binary string: msvcm90.i386.pdb source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000E.00000003.1399292112.00000000021D1000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000018.00000003.1442751141.00000000025A0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: O:\src\pywin32\build\temp.win32-2.7\Release\win32api.pdb source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp
Source:	Binary string: O:\src\pywin32\build\temp.win32-2.7\Release\win32service.pdb source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000002.1435001879.000000001ECB1000.00000040.00000001.01000000.00000011.sdmp
Source:	Binary string: C:\build27\cpython\PCBuild\python27.pdb source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000002.1437875354.000000006CE41000.00000040.00000001.01000000.00000009.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000002.1569290197.000000006CB22000.00000040.00000001.01000000.00000016.sdmp, HelpPane.exe, 0000001F.00000002.2451622387.000000006C5F2000.00000040.00000001.01000000.0000003E.sdmp
Source:	Binary string: O:\src\pywin32\build\temp.win32-2.7\Release\servicemanager.pdb19 source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000002.1434219289.000000001E7D1000.00000040.00000001.01000000.00000015.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000002.1561871341.000000001E7D4000.00000040.00000001.01000000.00000022.sdmp, HelpPane.exe, 0000001F.00000002.2443190696.000000001E7D4000.00000040.00000001.01000000.0000004A.sdmp
Source:	Binary string: C:\build27\cpython\PCBuild\_ssl.pdb source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000002.1436346191.000000006CCD1000.00000040.00000001.01000000.0000000D.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000002.1565656857.000000006C8DF000.00000040.00000001.01000000.0000001A.sdmp, HelpPane.exe, 0000001F.00000002.2446687040.000000006C36F000.00000040.00000001.01000000.00000042.sdmp
Source:	Binary string: O:\src\pywin32\build\temp.win32-2.7\Release\win32event.pdb source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000002.1434686478.000000001E9B1000.00000040.00000001.01000000.00000014.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000002.1562434901.000000001E9B4000.00000040.00000001.01000000.00000021.sdmp, HelpPane.exe, 0000001F.00000002.2443445446.000000001E9B4000.00000040.00000001.01000000.00000049.sdmp
Source:	Binary string: C:\build27\cpython\PCBuild\_ctypes.pdba source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000002.1442157158.0000000074DE1000.00000040.00000001.01000000.0000000B.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000002.1575915828.0000000073A82000.00000040.00000001.01000000.00000018.sdmp, HelpPane.exe, 0000001F.00000002.2451179086.000000006C3D2000.00000040.00000001.01000000.00000040.sdmp

Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 15_2_1E8C1F60 PyArg_ParseTuple,?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z,PyList_New,FindFirstFileA,GetLastError,?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z,PyList_Append,?PyObject_FromWIN32_FIND_DATAA@@YAPAU_object@@PAU_WIN32_FIND_DATAA@@@Z,PyList_Append,FindNextFileA,GetLastError,?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z,?PyWinObject_FreeString@@YAXPAD@Z,FindClose,		15_2_1E8C1F60
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 19_2_6C876D30 FindFirstFileA,FindNextFileA,		19_2_6C876D30

Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe

Code function: 15_2_032541B0 PyList_New,SetErrorMode,PyArg_ParseTuple,PyObject_IsTrue,PyEval_SaveThread,GetLogicalDriveStringsA,PyEval_RestoreThread,PyErr_SetFromWindowsErr,PyEval_SaveThread,GetDriveTypeA,PyEval_RestoreThread,GetVolumeInformationA,SetLastError,FindFirstVolumeMountPointA,Py_BuildValue,PyList_Append,FindNextVolumeMountPointA,FindVolumeMountPointClose,Py_BuildValue,PyList_Append,SetErrorMode,FindVolumeMountPointClose,SetErrorMode,

15_2_032541B0

Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe

Code function: 4x nop then movd mm0, dword ptr [edx]

19_2_6C72DDB0

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 14.155.205.75:5060 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.235.101.142:59170 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 156.155.112.139:4000 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.202.8:39703 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 47.76.76.152:8081 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 87.255.200.247:24980 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 91.239.77.159:28820 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 125.41.208.128:40901 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.248.25.83:12460 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 59.178.244.79:1027 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 186.148.245.183:25070 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 80.202.217.118:61120 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 186.148.245.119:36130 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 123.10.155.147:30301 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.194.135:8082 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 42.6.50.171:44033 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.193.241:19287 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.201.230:8081 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.217.86.30:5353 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 59.89.71.117:25800 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 123.13.56.150:17932 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 123.9.195.230:54831 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.141.153.125:8000 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.199.77.246:33513 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 1.10.212.35:61659 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.247.104.212:8080 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 49.234.57.41:21168 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 42.59.206.141:30301 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 175.173.94.100:22502 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 175.30.112.140:11211 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 120.211.183.3:22715 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 109.108.218.34:1434 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 124.7.139.186:11211 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.202.72.16:4148 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 27.210.218.119:8000 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 124.234.158.191:11211 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 61.3.178.148:11211 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 120.86.255.37:21207 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.200.183.158:20348 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 42.5.65.154:12787 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.205.58.18:8081 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 60.18.227.43:6881 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.193.170:64230 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.203.185:47390 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.200.181.142:20906 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 220.124.130.79:23975 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 47.107.92.35:8083 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.194.90:1027 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.194.217.78:5353 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.192.6:8080 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 120.211.137.182:8083 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.215.215.202:20455 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 49.75.64.215:57985 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 175.174.27.230:62064 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.215.222.16:15949 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 59.89.193.177:49006 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 115.49.25.205:5972 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 115.61.18.2:5060 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.50.73.202:32763 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.235.112.77:8081 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 59.93.23.92:15421 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 39.171.253.87:30301 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.63.114.20:34281 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 221.15.189.62:8000 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 83.97.73.228:30734 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.253.215.73:25226 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 125.44.21.50:8081 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.141.129.252:49521 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 27.37.87.197:60210 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 27.6.3.211:18557 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 59.89.201.99:1434 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 60.16.234.149:8082 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 49.84.159.171:8080 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.207.60:45724 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 39.74.4.17:55940 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 188.150.231.39:9007 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 121.231.203.147:11211 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.141.226.116:45756 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 81.182.189.101:18235 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.197.170.93:53905 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.208.96.81:33088 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.141.162.151:5060 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 209.59.113.249:57674 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 42.239.240.169:5353 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 59.89.70.39:62741 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.235.45.72:15006 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 14.155.221.46:5060 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.248.24.210:33917 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 120.86.252.160:8974 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 171.36.157.2:25973 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.220.148.243:4000 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 113.225.115.233:8080 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.201.115:2067 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 119.179.238.174:60648 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 198.16.58.241:30301 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 189.174.100.153:51090 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 1.10.212.33:55764 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.194.167.124:4486 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.195.189:60738 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 111.70.31.106:4000 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.77.243:1574 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 47.222.117.185:20520 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 120.56.0.237:8082 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 59.93.191.192:6881 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 182.124.122.251:4000 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.141.227.103:5060 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.141.230.54:8081 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 112.239.102.121:5964 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 59.99.130.52:4000 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.141.229.85:5353 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.243.247.195:5353 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 1.70.87.160:6881 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.201.245:53127 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.206.183.119:25095 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 222.138.119.36:11054 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.141.142.251:1900 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 115.55.240.86:19048 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 119.183.40.71:30301 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 42.224.5.140:4000 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 211.150.84.20:30034 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 39.91.82.241:60508 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 1.10.212.33:19242 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 1.10.212.35:44913 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.197.52:8080 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.209.1.159:21688 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 113.228.150.105:63764 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 113.239.64.251:6881 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.203.119:30301 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.215.222.219:11211 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 123.11.76.9:44426 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 59.95.131.182:8000 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.194.171.174:48283 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 222.139.74.112:26449 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 42.239.246.52:8083 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.248.129.208:8080 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 85.215.242.168:6881 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 188.149.142.208:17607 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 1.10.212.37:18900 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 121.231.121.39:61479 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.222.249.71:27157 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.206.186.128:8000 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.77.54:30301 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.193.227:1027 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 112.242.167.52:65175 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 114.104.155.242:8000 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 112.242.87.123:30003 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 111.61.93.5:41856 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 1.10.212.36:5576 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 115.56.155.143:8083 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 110.42.235.42:18739 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 222.140.159.103:28705 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.243.173.110:2801 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 113.236.254.106:27244 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.235.103.30:8081 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 221.15.7.234:54480 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 123.13.117.143:7440 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 222.138.100.11:36160 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 123.10.3.172:6881 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 89.130.132.127:8800 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 190.109.227.211:31173 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 60.216.254.16:6881 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 180.180.203.148:54346 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.254.177.36:5353 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 121.239.56.243:12290 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.213.93.120:59136 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 59.89.71.168:30617 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 221.15.194.248:62063 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.192.203:8000 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 222.137.113.60:10933 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 42.235.83.133:8081 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 160.153.235.195:23451 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 27.202.116.74:56641 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 1.10.212.34:46401 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.197.189.217:4945 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 115.49.65.154:6990 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 45.229.174.144:11211 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 120.85.119.218:3870 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 123.12.25.187:5060 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.194.171.192:8080 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 182.124.40.132:60648 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 120.37.237.66:35335 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.201.11.4:21205 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 5.188.64.229:5353 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.194.29:56461 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.141.110.131:36088 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.255.84.52:50847 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 182.121.23.170:16787 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.192.165:59628 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 59.93.28.47:6774 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 115.61.148.148:1185 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 116.68.162.186:46037 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.213.119.47:23027 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.204.26:47135 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.200.69:6881 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 40.133.224.20:41073 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.141.27.188:21532 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 123.5.186.112:8083 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 59.99.136.155:8000 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 1.241.172.105:16508 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.252.161.210:1027 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.200.181.176:63249 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.215.212.4:5353 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 42.5.53.19:4000 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 123.190.31.146:24247 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 116.74.19.124:33749 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.203.90:8000 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.207.188:53815 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.211.213.60:8083 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.196.38:8082 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 61.52.32.10:8275 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 42.233.105.228:8081 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 221.13.243.13:5060 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.213.95.10:40563 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 182.126.78.17:46072 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 88.234.130.44:34685 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 42.237.116.219:5060 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 123.129.105.142:8081 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 39.90.160.121:20781 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.200.187:6881 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 59.182.247.182:8081 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.252.192.87:46287 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.141.150.131:46687 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 59.89.6.216:61591 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 27.6.206.197:8080 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.207.112:11211 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.88.93:8505 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.248.51.122:30301 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 114.218.141.66:47086 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 115.55.252.99:37662 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.199.157:6881 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.141.154.132:22710 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 182.127.154.100:8081 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 222.142.241.123:44365 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.50.73.154:23377 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 42.228.222.130:6881 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 182.124.168.209:8080 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 46.153.236.32:13297 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.220.108.113:11211 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.76.39:13472 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 182.60.1.148:27017 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 115.49.26.188:11396 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.195.124:30301 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 59.93.183.141:55440 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 115.55.181.56:22671 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 112.248.100.146:3755 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 89.208.66.152:8082 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 220.198.240.185:27474 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.76.235:9634 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 182.122.234.142:5353 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.203.91:5060 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 182.117.117.236:8083 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 222.141.82.27:47307 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 42.5.245.210:30301 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.215.255.17:61653 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.253.221.191:8082 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.198.155:22738 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 27.216.35.127:8000 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 115.58.42.240:37497 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.76.88:15403 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 123.11.74.193:6881 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 61.168.142.14:33665 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 106.3.130.252:30301 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 191.53.124.59:8083 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 42.235.37.39:45784 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.235.120.55:20102 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 81.68.153.169:16054 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 113.230.80.68:8080 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 160.238.93.44:48026 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 175.166.5.244:32865 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 42.239.188.170:5060 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 182.116.55.56:40118 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 61.52.27.104:5060 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 78.168.196.128:41757 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.248.29.38:27854 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 27.210.156.182:8000 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 59.93.188.112:30301 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.217.38.180:51688 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 59.93.19.249:8083 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.242.239.85:1027 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.206.176.227:6881 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 221.202.181.253:26929 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 42.239.240.239:41512 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.203.236:54241 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.203.84:5353 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 1.10.212.33:52051 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 182.243.157.74:6881 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 182.113.18.92:8082 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.141.161.72:63831 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 115.56.57.254:30301 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 119.189.215.205:15465 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 61.53.97.55:8000 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 189.165.201.254:32623 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 115.57.109.53:30872 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.203.18:10044 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 120.57.217.11:20654 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 222.241.210.81:8080 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.205.131.100:8080 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.193.137:9482 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 182.113.25.95:5060 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 186.148.245.86:25286 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 115.55.247.210:8080 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 120.85.119.53:17510 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 1.10.212.37:15323 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 42.228.35.248:21125 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 114.226.245.81:8081 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 182.120.51.148:6881 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.204.30:30301 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.76.102:2476 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 221.235.45.4:8000 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.75.29:8198 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 59.93.28.230:6881 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 222.137.57.27:8081 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.199.77.27:18790 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.205.251:1027 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 61.3.95.214:4845 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 182.127.10.178:1057 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 115.50.216.157:8081 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 27.215.209.34:29452 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 59.182.240.16:49097 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 120.85.112.192:24582 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.71.230:2356 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.199.190.33:42664 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.206.187.184:63836 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.199.14.27:21770 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 112.248.63.217:5060 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 112.248.107.205:24420 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.203.117:5060 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.207.163:46833 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 222.139.39.163:6881 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 222.140.171.151:3109 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.204.226:17017 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 58.178.116.82:15073 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 39.86.4.202:50264 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 42.239.255.233:8082 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 45.189.207.241:8083 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 59.96.135.13:3277 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 222.140.87.236:26401 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.212.62.54:11211 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.200.185:20866 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.204.13:8081 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.203.44:11211 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 125.47.241.124:39153 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 14.223.26.33:8083 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 182.124.119.225:5353 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.195.155:29478 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.207.77.22:8082 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.195.30:43100 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 61.53.153.24:40306 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.255.83.178:53618 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 120.85.183.45:14627 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 182.112.156.39:8082 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.199.0.37:1558 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 175.174.51.163:62553 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.201.129:4000 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 1.10.212.35:59351 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 95.169.197.246:11211 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 113.238.67.29:64355 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 27.207.162.152:8083 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 42.4.96.111:26860 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 1.70.100.11:8082 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 190.109.229.181:40772 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 157.211.1.243:8080 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.215.208.106:8083 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 116.111.31.44:30301 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.242.233.228:4000 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.194.129:19378 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 27.215.82.209:9134 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 222.138.101.166:56641 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 42.234.244.67:54564 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 120.63.221.76:6881 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.251.174.176:37424 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 182.60.13.105:60916 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.220.150.108:20514 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 105.96.25.193:11211 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.205.157:8080 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 182.123.231.0:19461 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.204.80:29739 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 1.10.212.35:49165 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 125.42.230.168:13010 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 219.155.2.231:1027 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 221.14.122.195:6881 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 120.86.255.150:9825 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 42.224.178.47:28409 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 182.119.188.84:5060 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 42.231.96.176:3078 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.141.33.56:5634 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.71.66:15388 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.203.208:56462 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.199.2.18:22523 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.221.74.43:31891 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 222.140.90.32:49987 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 120.35.47.102:10816 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.201.7.216:28164 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 115.61.177.9:17543 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 39.87.73.210:55291 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 123.8.81.152:30301 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 115.55.245.232:5353 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 101.22.184.177:17833 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.192.127.79:22281 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 42.177.198.181:8081 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.204.6:45745 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 182.127.183.40:5698 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 115.55.231.16:6881 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 27.157.170.56:33932 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 112.242.107.168:6881 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 120.86.255.57:19240 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.206.129:5060 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.205.89:32424 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.205.77:27297 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 60.246.138.175:62851 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.220.108.129:30301 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 182.121.173.58:65413 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 123.175.92.230:41705 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.222.233.3:30301 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 125.25.93.161:18096 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.199.5.238:4000 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.204.118:8000 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.198.88:8083 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.207.102:8082 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 222.137.213.159:6881 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 124.235.243.25:30301 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 218.61.110.165:6881 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.206.187.0:8081 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 120.85.114.157:22795 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 171.36.88.43:31524 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 31.162.4.120:1796 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 112.242.239.197:4000 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.203.123:23167 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 222.247.8.15:46363 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 123.194.35.224:1900 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 123.8.161.46:8082 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.248.57.119:19570 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.217.39.174:8080 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.193.171:46103 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 222.140.140.198:31750 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 80.53.153.185:6340 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 42.227.2.139:5353 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.195.186:11211 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 112.83.1.68:3442 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 219.156.175.192:8000 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.222.253.43:11211 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.222.252.98:8000 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 115.63.48.177:28409 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 91.219.171.20:25110 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 59.99.131.143:8083 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 59.89.207.109:21078 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.201.108.93:44608 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 119.187.201.64:5060 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.80.172.62:8000 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 59.98.124.62:8082 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 1.10.212.38:65292 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.206.185.199:47083 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 42.225.218.4:8083 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 182.125.120.85:45193 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 178.72.75.89:13453 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 59.99.143.20:7586 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.192.112:8081 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 1.10.212.37:44230 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 182.117.30.233:19307 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 2.55.98.253:10721 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 221.15.62.202:56641 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 42.230.41.246:6881 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 125.44.35.142:4000 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.208.232.40:6587 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.248.17.148:2192 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 120.56.5.31:21908 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 212.15.143.127:8080 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.251.165.169:30244 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 42.239.238.40:8080 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.194.166.98:53575 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.200.182.4:8872 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 59.89.185.186:47762 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 112.31.180.128:1900 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.207.130:3540 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.200.177.161:28942 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.200.184.210:55318 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 1.10.212.37:58141 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 1.10.212.35:39360 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 1.10.212.35:62245 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 120.86.255.218:8758 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 1.10.212.36:20046 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 112.248.110.58:32312 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 112.237.23.220:2003 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.194.166.233:50279 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.248.30.127:8082 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.202.65.104:55499 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 221.215.247.125:8081 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 112.248.190.83:5353 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 1.10.212.37:14275 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 120.85.183.143:32766 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 125.40.26.161:58903 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.204.202.151:45675 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 61.53.88.225:5060 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 171.117.189.215:11774 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.220.150.181:11211 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.248.41.238:30301 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 1.10.212.38:46181 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 113.231.249.196:34907 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 117.214.8.218:58924 -> 192.168.2.16:8000
Source: Traffic	Snort IDS: 2030919 ET TROJAN Mozi Botnet DHT Config Sent 112.248.190.167:16433 -> 192.168.2.16:8000

Uses known network protocols on non-standard ports

Source: unknown

Network traffic detected: HTTP traffic on port 50126 -> 2121

Source: unknown

Network traffic detected: IP country count 25

Source: global traffic	TCP traffic: 192.168.2.16:49710 -> 166.148.200.249:2121
Source: global traffic	TCP traffic: 192.168.2.16:49713 -> 35.137.203.142:2121
Source: global traffic	TCP traffic: 192.168.2.16:49714 -> 140.190.24.113:2121
Source: global traffic	TCP traffic: 192.168.2.16:49716 -> 213.249.245.75:2121
Source: global traffic	TCP traffic: 192.168.2.16:49718 -> 164.70.186.78:2121
Source: global traffic	TCP traffic: 192.168.2.16:49720 -> 100.15.75.145:2121
Source: global traffic	TCP traffic: 192.168.2.16:49722 -> 70.124.10.255:2121
Source: global traffic	TCP traffic: 192.168.2.16:49724 -> 104.67.188.105:2121
Source: global traffic	TCP traffic: 192.168.2.16:49726 -> 88.142.184.208:2121
Source: global traffic	TCP traffic: 192.168.2.16:49727 -> 92.15.231.140:2121
Source: global traffic	TCP traffic: 192.168.2.16:49730 -> 75.174.68.132:2121
Source: global traffic	TCP traffic: 192.168.2.16:49732 -> 201.113.164.51:2121
Source: global traffic	TCP traffic: 192.168.2.16:49734 -> 36.84.169.30:2121
Source: global traffic	TCP traffic: 192.168.2.16:49736 -> 73.35.188.189:2121
Source: global traffic	TCP traffic: 192.168.2.16:49738 -> 105.68.254.0:2121
Source: global traffic	TCP traffic: 192.168.2.16:49740 -> 90.215.132.151:2121
Source: global traffic	TCP traffic: 192.168.2.16:49742 -> 100.36.47.116:2121
Source: global traffic	TCP traffic: 192.168.2.16:49744 -> 115.74.91.137:2121
Source: global traffic	TCP traffic: 192.168.2.16:49746 -> 86.124.13.69:2121
Source: global traffic	TCP traffic: 192.168.2.16:49748 -> 20.75.38.29:2121
Source: global traffic	TCP traffic: 192.168.2.16:49750 -> 24.130.57.109:2121
Source: global traffic	TCP traffic: 192.168.2.16:49752 -> 187.200.140.177:2121
Source: global traffic	TCP traffic: 192.168.2.16:49754 -> 90.193.156.199:2121
Source: global traffic	TCP traffic: 192.168.2.16:49756 -> 150.220.125.58:2121
Source: global traffic	TCP traffic: 192.168.2.16:49758 -> 20.222.8.129:2121
Source: global traffic	TCP traffic: 192.168.2.16:49760 -> 103.162.154.23:2121
Source: global traffic	TCP traffic: 192.168.2.16:49762 -> 187.159.2.51:2121
Source: global traffic	TCP traffic: 192.168.2.16:49764 -> 73.63.91.71:2121
Source: global traffic	TCP traffic: 192.168.2.16:49766 -> 213.166.90.11:2121
Source: global traffic	TCP traffic: 192.168.2.16:49767 -> 82.39.124.216:2121
Source: global traffic	TCP traffic: 192.168.2.16:49770 -> 84.217.90.112:2121
Source: global traffic	TCP traffic: 192.168.2.16:49772 -> 178.234.143.20:2121
Source: global traffic	TCP traffic: 192.168.2.16:49774 -> 196.84.198.19:2121
Source: global traffic	TCP traffic: 192.168.2.16:49776 -> 174.118.107.167:2121
Source: global traffic	TCP traffic: 192.168.2.16:49778 -> 111.226.215.4:2121
Source: global traffic	TCP traffic: 192.168.2.16:49781 -> 5.142.219.193:2121
Source: global traffic	TCP traffic: 192.168.2.16:49782 -> 173.178.93.163:2121
Source: global traffic	TCP traffic: 192.168.2.16:49784 -> 73.189.43.14:2121
Source: global traffic	TCP traffic: 192.168.2.16:49786 -> 108.183.105.128:2121
Source: global traffic	TCP traffic: 192.168.2.16:49788 -> 69.141.22.219:2121
Source: global traffic	TCP traffic: 192.168.2.16:49790 -> 142.252.53.106:2121
Source: global traffic	TCP traffic: 192.168.2.16:49793 -> 174.79.2.219:2121
Source: global traffic	TCP traffic: 192.168.2.16:49794 -> 211.219.206.145:2121
Source: global traffic	TCP traffic: 192.168.2.16:49796 -> 79.196.95.8:2121
Source: global traffic	TCP traffic: 192.168.2.16:49798 -> 70.172.40.136:2121
Source: global traffic	TCP traffic: 192.168.2.16:49800 -> 87.166.1.99:2121
Source: global traffic	TCP traffic: 192.168.2.16:49802 -> 78.21.74.104:2121
Source: global traffic	TCP traffic: 192.168.2.16:49804 -> 189.253.72.130:2121
Source: global traffic	TCP traffic: 192.168.2.16:49806 -> 123.130.44.98:2121
Source: global traffic	TCP traffic: 192.168.2.16:49808 -> 182.109.58.235:2121
Source: global traffic	TCP traffic: 192.168.2.16:49810 -> 74.129.206.76:2121
Source: global traffic	TCP traffic: 192.168.2.16:49812 -> 108.2.68.15:2121
Source: global traffic	TCP traffic: 192.168.2.16:49814 -> 72.253.247.220:2121
Source: global traffic	TCP traffic: 192.168.2.16:49816 -> 123.10.24.255:2121
Source: global traffic	TCP traffic: 192.168.2.16:49818 -> 202.190.106.215:2121
Source: global traffic	TCP traffic: 192.168.2.16:49821 -> 2.126.55.74:2121
Source: global traffic	TCP traffic: 192.168.2.16:49822 -> 71.221.146.72:2121
Source: global traffic	TCP traffic: 192.168.2.16:49823 -> 14.153.184.124:2121
Source: global traffic	TCP traffic: 192.168.2.16:49826 -> 175.250.21.18:2121
Source: global traffic	TCP traffic: 192.168.2.16:49828 -> 88.70.37.48:2121
Source: global traffic	TCP traffic: 192.168.2.16:49830 -> 190.31.92.93:2121
Source: global traffic	TCP traffic: 192.168.2.16:49832 -> 187.139.173.210:2121
Source: global traffic	TCP traffic: 192.168.2.16:49834 -> 79.157.98.21:2121
Source: global traffic	TCP traffic: 192.168.2.16:49838 -> 149.11.204.146:2121
Source: global traffic	TCP traffic: 192.168.2.16:49840 -> 85.66.80.209:2121
Source: global traffic	TCP traffic: 192.168.2.16:49841 -> 100.4.98.205:2121
Source: global traffic	TCP traffic: 192.168.2.16:49844 -> 86.8.247.4:2121
Source: global traffic	TCP traffic: 192.168.2.16:49846 -> 49.22.166.94:2121
Source: global traffic	TCP traffic: 192.168.2.16:49848 -> 18.172.155.195:2121
Source: global traffic	TCP traffic: 192.168.2.16:49850 -> 217.103.67.136:2121
Source: global traffic	TCP traffic: 192.168.2.16:49852 -> 184.168.238.60:2121
Source: global traffic	TCP traffic: 192.168.2.16:49854 -> 88.88.34.254:2121
Source: global traffic	TCP traffic: 192.168.2.16:49856 -> 201.25.34.80:2121
Source: global traffic	TCP traffic: 192.168.2.16:49858 -> 98.11.196.125:2121
Source: global traffic	TCP traffic: 192.168.2.16:49860 -> 115.86.174.81:2121
Source: global traffic	TCP traffic: 192.168.2.16:49862 -> 163.47.81.9:2121
Source: global traffic	TCP traffic: 192.168.2.16:49864 -> 45.38.130.234:2121
Source: global traffic	TCP traffic: 192.168.2.16:49866 -> 71.62.131.219:2121
Source: global traffic	TCP traffic: 192.168.2.16:49868 -> 211.80.156.157:2121
Source: global traffic	TCP traffic: 192.168.2.16:49870 -> 69.255.144.143:2121
Source: global traffic	TCP traffic: 192.168.2.16:49872 -> 68.170.77.226:2121
Source: global traffic	TCP traffic: 192.168.2.16:49874 -> 51.137.203.141:2121
Source: global traffic	TCP traffic: 192.168.2.16:49876 -> 14.75.234.10:2121
Source: global traffic	TCP traffic: 192.168.2.16:49878 -> 90.204.82.70:2121
Source: global traffic	TCP traffic: 192.168.2.16:49880 -> 76.23.3.9:2121
Source: global traffic	TCP traffic: 192.168.2.16:49882 -> 80.197.137.196:2121
Source: global traffic	TCP traffic: 192.168.2.16:49884 -> 84.106.198.128:2121
Source: global traffic	TCP traffic: 192.168.2.16:49886 -> 38.44.1.45:2121
Source: global traffic	TCP traffic: 192.168.2.16:49888 -> 119.192.251.99:2121
Source: global traffic	TCP traffic: 192.168.2.16:49890 -> 123.144.34.49:2121
Source: global traffic	TCP traffic: 192.168.2.16:49892 -> 222.237.147.227:2121
Source: global traffic	TCP traffic: 192.168.2.16:49894 -> 112.230.77.155:2121
Source: global traffic	TCP traffic: 192.168.2.16:49896 -> 203.206.143.107:2121
Source: global traffic	TCP traffic: 192.168.2.16:49898 -> 89.46.255.178:2121
Source: global traffic	TCP traffic: 192.168.2.16:49900 -> 216.117.162.236:2121
Source: global traffic	TCP traffic: 192.168.2.16:49902 -> 2.152.179.32:2121
Source: global traffic	TCP traffic: 192.168.2.16:49904 -> 35.204.211.43:2121
Source: global traffic	TCP traffic: 192.168.2.16:49906 -> 49.170.40.102:2121
Source: global traffic	TCP traffic: 192.168.2.16:49908 -> 49.160.49.242:2121
Source: global traffic	TCP traffic: 192.168.2.16:49910 -> 39.27.13.134:2121
Source: global traffic	TCP traffic: 192.168.2.16:49913 -> 217.71.254.134:2121
Source: global traffic	TCP traffic: 192.168.2.16:49914 -> 92.207.138.140:2121
Source: global traffic	TCP traffic: 192.168.2.16:49916 -> 121.239.148.97:2121
Source: global traffic	TCP traffic: 192.168.2.16:49918 -> 75.69.181.185:2121
Source: global traffic	TCP traffic: 192.168.2.16:49920 -> 70.64.135.84:2121
Source: global traffic	TCP traffic: 192.168.2.16:49922 -> 124.104.19.175:2121
Source: global traffic	TCP traffic: 192.168.2.16:49924 -> 50.50.245.60:2121
Source: global traffic	TCP traffic: 192.168.2.16:49926 -> 95.233.231.144:2121
Source: global traffic	TCP traffic: 192.168.2.16:49928 -> 91.23.96.94:2121
Source: global traffic	TCP traffic: 192.168.2.16:49931 -> 180.225.207.195:2121
Source: global traffic	TCP traffic: 192.168.2.16:49932 -> 39.57.192.254:2121
Source: global traffic	TCP traffic: 192.168.2.16:49934 -> 46.89.232.180:2121
Source: global traffic	TCP traffic: 192.168.2.16:49936 -> 73.118.128.95:2121
Source: global traffic	TCP traffic: 192.168.2.16:49937 -> 64.234.71.164:2121
Source: global traffic	TCP traffic: 192.168.2.16:49939 -> 188.214.213.151:2121
Source: global traffic	TCP traffic: 192.168.2.16:49942 -> 101.93.183.130:2121
Source: global traffic	TCP traffic: 192.168.2.16:49944 -> 73.87.131.239:2121
Source: global traffic	TCP traffic: 192.168.2.16:49945 -> 204.141.177.155:2121
Source: global traffic	TCP traffic: 192.168.2.16:49947 -> 177.135.211.33:2121
Source: global traffic	TCP traffic: 192.168.2.16:49951 -> 36.14.21.3:2121
Source: global traffic	TCP traffic: 192.168.2.16:49953 -> 20.116.64.231:2121
Source: global traffic	TCP traffic: 192.168.2.16:49955 -> 73.159.106.21:2121
Source: global traffic	TCP traffic: 192.168.2.16:49956 -> 71.94.100.217:2121
Source: global traffic	TCP traffic: 192.168.2.16:49958 -> 156.239.231.220:2121
Source: global traffic	TCP traffic: 192.168.2.16:49960 -> 49.76.33.233:2121
Source: global traffic	TCP traffic: 192.168.2.16:49963 -> 46.109.137.149:2121
Source: global traffic	TCP traffic: 192.168.2.16:49964 -> 123.28.163.82:2121
Source: global traffic	TCP traffic: 192.168.2.16:49966 -> 83.53.51.42:2121
Source: global traffic	TCP traffic: 192.168.2.16:49968 -> 125.246.254.11:2121
Source: global traffic	TCP traffic: 192.168.2.16:49970 -> 66.108.100.134:2121
Source: global traffic	TCP traffic: 192.168.2.16:49972 -> 43.201.47.213:2121
Source: global traffic	TCP traffic: 192.168.2.16:49974 -> 98.122.116.210:2121
Source: global traffic	TCP traffic: 192.168.2.16:49977 -> 73.183.154.173:2121
Source: global traffic	TCP traffic: 192.168.2.16:49978 -> 173.18.4.227:2121
Source: global traffic	TCP traffic: 192.168.2.16:49980 -> 73.184.119.203:2121
Source: global traffic	TCP traffic: 192.168.2.16:49983 -> 119.223.221.121:2121
Source: global traffic	TCP traffic: 192.168.2.16:49984 -> 1.49.252.112:2121
Source: global traffic	TCP traffic: 192.168.2.16:49985 -> 24.132.104.243:2121
Source: global traffic	TCP traffic: 192.168.2.16:49988 -> 105.72.6.198:2121
Source: global traffic	TCP traffic: 192.168.2.16:49990 -> 60.76.76.108:2121
Source: global traffic	TCP traffic: 192.168.2.16:49992 -> 82.78.235.56:2121
Source: global traffic	TCP traffic: 192.168.2.16:49994 -> 98.184.230.194:2121
Source: global traffic	TCP traffic: 192.168.2.16:49997 -> 86.126.81.230:2121
Source: global traffic	TCP traffic: 192.168.2.16:49998 -> 179.54.202.127:2121
Source: global traffic	TCP traffic: 192.168.2.16:50000 -> 153.205.240.87:2121
Source: global traffic	TCP traffic: 192.168.2.16:50002 -> 221.3.28.190:2121
Source: global traffic	TCP traffic: 192.168.2.16:50004 -> 83.36.215.37:2121
Source: global traffic	TCP traffic: 192.168.2.16:50006 -> 119.165.35.137:2121
Source: global traffic	TCP traffic: 192.168.2.16:50008 -> 62.115.189.118:2121
Source: global traffic	TCP traffic: 192.168.2.16:50011 -> 40.113.144.129:2121
Source: global traffic	TCP traffic: 192.168.2.16:50012 -> 111.59.245.235:2121
Source: global traffic	TCP traffic: 192.168.2.16:50013 -> 116.172.87.75:2121
Source: global traffic	TCP traffic: 192.168.2.16:50016 -> 58.153.229.5:2121
Source: global traffic	TCP traffic: 192.168.2.16:50018 -> 154.125.106.175:2121
Source: global traffic	TCP traffic: 192.168.2.16:50020 -> 82.151.55.252:2121
Source: global traffic	TCP traffic: 192.168.2.16:50022 -> 124.54.188.17:2121
Source: global traffic	TCP traffic: 192.168.2.16:50024 -> 91.196.221.70:2121
Source: global traffic	TCP traffic: 192.168.2.16:50026 -> 1.225.194.212:2121
Source: global traffic	TCP traffic: 192.168.2.16:50028 -> 189.232.134.22:2121
Source: global traffic	TCP traffic: 192.168.2.16:50030 -> 188.127.174.192:2121
Source: global traffic	TCP traffic: 192.168.2.16:50033 -> 5.56.64.87:2121
Source: global traffic	TCP traffic: 192.168.2.16:50034 -> 118.37.227.7:2121
Source: global traffic	TCP traffic: 192.168.2.16:50037 -> 51.116.138.204:2121
Source: global traffic	TCP traffic: 192.168.2.16:50038 -> 187.94.222.6:2121
Source: global traffic	TCP traffic: 192.168.2.16:50040 -> 47.37.113.171:2121
Source: global traffic	TCP traffic: 192.168.2.16:50043 -> 125.165.86.247:2121
Source: global traffic	TCP traffic: 192.168.2.16:50044 -> 183.162.166.97:2121
Source: global traffic	TCP traffic: 192.168.2.16:50046 -> 20.197.33.115:2121
Source: global traffic	TCP traffic: 192.168.2.16:50048 -> 171.225.13.244:2121
Source: global traffic	TCP traffic: 192.168.2.16:50050 -> 71.53.157.218:2121
Source: global traffic	TCP traffic: 192.168.2.16:50052 -> 86.21.54.149:2121
Source: global traffic	TCP traffic: 192.168.2.16:50053 -> 189.146.178.160:2121
Source: global traffic	TCP traffic: 192.168.2.16:50056 -> 47.96.78.154:2121
Source: global traffic	TCP traffic: 192.168.2.16:50057 -> 90.218.5.59:2121
Source: global traffic	TCP traffic: 192.168.2.16:50060 -> 109.205.180.149:2121
Source: global traffic	TCP traffic: 192.168.2.16:50062 -> 116.126.49.212:2121
Source: global traffic	TCP traffic: 192.168.2.16:50065 -> 187.153.144.97:2121
Source: global traffic	TCP traffic: 192.168.2.16:50066 -> 79.154.68.52:2121
Source: global traffic	TCP traffic: 192.168.2.16:50068 -> 184.174.107.146:2121
Source: global traffic	TCP traffic: 192.168.2.16:50070 -> 220.71.129.47:2121
Source: global traffic	TCP traffic: 192.168.2.16:50073 -> 208.87.22.137:2121
Source: global traffic	TCP traffic: 192.168.2.16:50074 -> 182.111.5.233:2121
Source: global traffic	TCP traffic: 192.168.2.16:50075 -> 103.109.6.215:2121
Source: global traffic	TCP traffic: 192.168.2.16:50077 -> 43.156.44.194:2121
Source: global traffic	TCP traffic: 192.168.2.16:50080 -> 66.103.220.9:2121
Source: global traffic	TCP traffic: 192.168.2.16:50082 -> 8.139.2.255:2121
Source: global traffic	TCP traffic: 192.168.2.16:50084 -> 75.182.234.146:2121
Source: global traffic	TCP traffic: 192.168.2.16:50086 -> 49.169.39.43:2121
Source: global traffic	TCP traffic: 192.168.2.16:50088 -> 20.232.59.48:2121
Source: global traffic	TCP traffic: 192.168.2.16:50091 -> 16.162.180.123:2121
Source: global traffic	TCP traffic: 192.168.2.16:50092 -> 207.66.112.94:2121
Source: global traffic	TCP traffic: 192.168.2.16:50094 -> 190.160.27.247:2121
Source: global traffic	TCP traffic: 192.168.2.16:50096 -> 115.141.248.1:2121
Source: global traffic	TCP traffic: 192.168.2.16:50098 -> 68.34.99.131:2121
Source: global traffic	TCP traffic: 192.168.2.16:50100 -> 93.229.32.114:2121
Source: global traffic	TCP traffic: 192.168.2.16:50102 -> 38.18.122.147:2121
Source: global traffic	TCP traffic: 192.168.2.16:50104 -> 118.35.206.150:2121
Source: global traffic	TCP traffic: 192.168.2.16:50106 -> 92.253.68.186:2121
Source: global traffic	TCP traffic: 192.168.2.16:50108 -> 84.133.30.105:2121
Source: global traffic	TCP traffic: 192.168.2.16:50110 -> 61.55.18.14:2121
Source: global traffic	TCP traffic: 192.168.2.16:50112 -> 45.87.1.166:2121
Source: global traffic	TCP traffic: 192.168.2.16:50114 -> 173.240.190.237:2121
Source: global traffic	TCP traffic: 192.168.2.16:50116 -> 179.255.165.104:2121
Source: global traffic	TCP traffic: 192.168.2.16:50118 -> 173.186.63.246:2121
Source: global traffic	TCP traffic: 192.168.2.16:50120 -> 73.112.120.219:2121
Source: global traffic	TCP traffic: 192.168.2.16:50121 -> 27.207.39.138:2121
Source: global traffic	TCP traffic: 192.168.2.16:50124 -> 71.31.151.54:2121
Source: global traffic	TCP traffic: 192.168.2.16:50126 -> 34.128.145.40:2121
Source: global traffic	TCP traffic: 192.168.2.16:50128 -> 221.3.49.159:2121
Source: global traffic	TCP traffic: 192.168.2.16:50130 -> 196.196.68.7:2121
Source: global traffic	TCP traffic: 192.168.2.16:50132 -> 113.226.113.123:2121
Source: global traffic	TCP traffic: 192.168.2.16:50135 -> 186.202.7.41:2121
Source: global traffic	TCP traffic: 192.168.2.16:50136 -> 40.134.86.153:2121
Source: global traffic	TCP traffic: 192.168.2.16:50138 -> 122.194.22.137:2121
Source: global traffic	TCP traffic: 192.168.2.16:50140 -> 74.77.49.187:2121
Source: global traffic	TCP traffic: 192.168.2.16:50142 -> 113.242.203.213:2121
Source: global traffic	TCP traffic: 192.168.2.16:50144 -> 98.109.18.153:2121
Source: global traffic	TCP traffic: 192.168.2.16:50145 -> 125.78.110.175:2121
Source: global traffic	TCP traffic: 192.168.2.16:50148 -> 112.163.192.212:2121
Source: global traffic	TCP traffic: 192.168.2.16:50151 -> 116.40.189.189:2121
Source: global traffic	TCP traffic: 192.168.2.16:50152 -> 59.103.222.239:2121
Source: global traffic	TCP traffic: 192.168.2.16:50154 -> 60.248.246.121:2121
Source: global traffic	TCP traffic: 192.168.2.16:50156 -> 85.193.93.60:2121
Source: global traffic	TCP traffic: 192.168.2.16:50158 -> 187.48.185.76:2121
Source: global traffic	TCP traffic: 192.168.2.16:50160 -> 213.18.112.155:2121
Source: global traffic	TCP traffic: 192.168.2.16:50162 -> 179.66.129.72:2121
Source: global traffic	TCP traffic: 192.168.2.16:50164 -> 163.255.185.34:2121
Source: global traffic	TCP traffic: 192.168.2.16:50166 -> 98.212.21.110:2121
Source: global traffic	TCP traffic: 192.168.2.16:50168 -> 60.21.229.138:2121
Source: global traffic	TCP traffic: 192.168.2.16:50170 -> 154.148.45.69:2121
Source: global traffic	TCP traffic: 192.168.2.16:50172 -> 189.153.186.34:2121
Source: global traffic	TCP traffic: 192.168.2.16:50174 -> 70.80.238.19:2121
Source: global traffic	TCP traffic: 192.168.2.16:50176 -> 104.93.124.254:2121
Source: global traffic	TCP traffic: 192.168.2.16:50178 -> 79.144.99.44:2121
Source: global traffic	TCP traffic: 192.168.2.16:50181 -> 47.122.51.65:2121
Source: global traffic	TCP traffic: 192.168.2.16:50183 -> 104.174.143.71:2121
Source: global traffic	TCP traffic: 192.168.2.16:50185 -> 80.119.223.253:2121
Source: global traffic	TCP traffic: 192.168.2.16:50186 -> 112.103.252.249:2121
Source: global traffic	TCP traffic: 192.168.2.16:50190 -> 112.238.43.125:2121
Source: global traffic	TCP traffic: 192.168.2.16:50193 -> 47.244.119.251:2121
Source: global traffic	TCP traffic: 192.168.2.16:50194 -> 93.144.107.191:2121
Source: global traffic	TCP traffic: 192.168.2.16:50196 -> 78.23.133.140:2121
Source: global traffic	TCP traffic: 192.168.2.16:50195 -> 73.133.2.57:2121
Source: global traffic	TCP traffic: 192.168.2.16:50198 -> 150.255.30.207:2121
Source: global traffic	TCP traffic: 192.168.2.16:50200 -> 71.235.56.180:2121
Source: global traffic	TCP traffic: 192.168.2.16:50201 -> 182.233.214.56:2121
Source: global traffic	TCP traffic: 192.168.2.16:50204 -> 210.5.190.214:2121
Source: global traffic	TCP traffic: 192.168.2.16:50206 -> 49.48.43.254:2121
Source: global traffic	TCP traffic: 192.168.2.16:50207 -> 221.160.246.44:2121
Source: global traffic	TCP traffic: 192.168.2.16:50209 -> 104.222.45.222:2121
Source: global traffic	TCP traffic: 192.168.2.16:50211 -> 201.102.186.151:2121
Source: global traffic	TCP traffic: 192.168.2.16:50213 -> 92.104.140.43:2121
Source: global traffic	TCP traffic: 192.168.2.16:50219 -> 120.196.4.149:2121
Source: global traffic	TCP traffic: 192.168.2.16:50216 -> 217.217.194.14:2121
Source: global traffic	TCP traffic: 192.168.2.16:50220 -> 110.138.153.93:2121
Source: global traffic	TCP traffic: 192.168.2.16:50222 -> 71.58.210.134:2121
Source: global traffic	TCP traffic: 192.168.2.16:50224 -> 111.26.192.63:2121
Source: global traffic	TCP traffic: 192.168.2.16:50227 -> 78.115.218.214:2121
Source: global traffic	TCP traffic: 192.168.2.16:50228 -> 188.72.123.137:2121
Source: global traffic	TCP traffic: 192.168.2.16:50231 -> 72.208.6.163:2121
Source: global traffic	TCP traffic: 192.168.2.16:50234 -> 190.30.122.126:2121
Source: global traffic	TCP traffic: 192.168.2.16:50235 -> 27.58.41.241:2121
Source: global traffic	TCP traffic: 192.168.2.16:50238 -> 14.160.134.158:2121
Source: global traffic	TCP traffic: 192.168.2.16:50240 -> 108.34.21.249:2121
Source: global traffic	TCP traffic: 192.168.2.16:50242 -> 183.233.93.130:2121
Source: global traffic	TCP traffic: 192.168.2.16:50243 -> 61.161.28.125:2121
Source: global traffic	TCP traffic: 192.168.2.16:50244 -> 27.213.157.225:2121
Source: global traffic	TCP traffic: 192.168.2.16:50246 -> 46.0.171.21:2121
Source: global traffic	TCP traffic: 192.168.2.16:50248 -> 187.138.31.196:2121
Source: global traffic	TCP traffic: 192.168.2.16:50250 -> 74.51.225.184:2121
Source: global traffic	TCP traffic: 192.168.2.16:50252 -> 168.220.94.137:2121
Source: global traffic	TCP traffic: 192.168.2.16:50254 -> 222.163.7.242:2121
Source: global traffic	TCP traffic: 192.168.2.16:50257 -> 177.34.196.1:2121
Source: global traffic	TCP traffic: 192.168.2.16:50258 -> 113.78.184.237:2121
Source: global traffic	TCP traffic: 192.168.2.16:50261 -> 105.130.167.223:2121
Source: global traffic	TCP traffic: 192.168.2.16:50265 -> 153.99.157.36:2121
Source: global traffic	TCP traffic: 192.168.2.16:50264 -> 20.45.74.140:2121
Source: global traffic	TCP traffic: 192.168.2.16:50268 -> 18.165.91.73:2121
Source: global traffic	TCP traffic: 192.168.2.16:50270 -> 190.11.40.87:2121
Source: global traffic	TCP traffic: 192.168.2.16:50260 -> 71.186.189.60:2121
Source: global traffic	TCP traffic: 192.168.2.16:50272 -> 36.85.153.27:2121
Source: global traffic	TCP traffic: 192.168.2.16:50273 -> 18.172.251.146:2121
Source: global traffic	TCP traffic: 192.168.2.16:50276 -> 113.232.167.50:2121
Source: global traffic	TCP traffic: 192.168.2.16:50278 -> 94.8.106.34:2121
Source: global traffic	TCP traffic: 192.168.2.16:50280 -> 194.42.89.141:2121
Source: global traffic	TCP traffic: 192.168.2.16:50282 -> 117.89.16.57:2121
Source: global traffic	TCP traffic: 192.168.2.16:50284 -> 126.78.66.219:2121
Source: global traffic	TCP traffic: 192.168.2.16:50286 -> 27.207.21.16:2121
Source: global traffic	TCP traffic: 192.168.2.16:50288 -> 119.155.11.243:2121
Source: global traffic	TCP traffic: 192.168.2.16:50290 -> 104.34.24.209:2121
Source: global traffic	TCP traffic: 192.168.2.16:50293 -> 76.104.43.21:2121
Source: global traffic	TCP traffic: 192.168.2.16:50294 -> 185.107.27.184:2121
Source: global traffic	TCP traffic: 192.168.2.16:50302 -> 195.240.238.212:2121
Source: global traffic	TCP traffic: 192.168.2.16:50304 -> 193.124.183.222:2121
Source: global traffic	TCP traffic: 192.168.2.16:50306 -> 113.26.215.31:2121
Source: global traffic	TCP traffic: 192.168.2.16:50308 -> 124.64.6.45:2121
Source: global traffic	TCP traffic: 192.168.2.16:50310 -> 93.41.237.60:2121
Source: global traffic	TCP traffic: 192.168.2.16:50312 -> 91.203.165.183:2121
Source: global traffic	TCP traffic: 192.168.2.16:50318 -> 223.221.178.206:2121
Source: global traffic	TCP traffic: 192.168.2.16:50320 -> 61.99.64.185:2121
Source: global traffic	TCP traffic: 192.168.2.16:50330 -> 68.189.69.171:2121
Source: global traffic	TCP traffic: 192.168.2.16:50335 -> 110.136.96.12:2121
Source: global traffic	TCP traffic: 192.168.2.16:50339 -> 193.175.238.88:2121
Source: global traffic	TCP traffic: 192.168.2.16:50343 -> 189.172.31.228:2121
Source: global traffic	TCP traffic: 192.168.2.16:50346 -> 183.141.107.50:2121
Source: global traffic	TCP traffic: 192.168.2.16:50349 -> 45.120.174.5:2121
Source: global traffic	TCP traffic: 192.168.2.16:50353 -> 98.122.64.212:2121
Source: global traffic	TCP traffic: 192.168.2.16:50357 -> 220.91.126.18:2121
Source: global traffic	TCP traffic: 192.168.2.16:50359 -> 130.61.85.191:2121
Source: global traffic	TCP traffic: 192.168.2.16:50360 -> 41.97.219.244:2121
Source: global traffic	TCP traffic: 192.168.2.16:50365 -> 188.214.156.147:2121
Source: global traffic	TCP traffic: 192.168.2.16:50370 -> 84.119.151.112:2121
Source: global traffic	TCP traffic: 192.168.2.16:50372 -> 91.207.42.121:2121
Source: global traffic	TCP traffic: 192.168.2.16:50373 -> 124.49.54.1:2121
Source: global traffic	TCP traffic: 192.168.2.16:50376 -> 80.213.20.177:2121
Source: global traffic	TCP traffic: 192.168.2.16:50378 -> 27.200.193.13:2121
Source: global traffic	TCP traffic: 192.168.2.16:50380 -> 78.115.142.120:2121
Source: global traffic	TCP traffic: 192.168.2.16:50382 -> 73.178.202.135:2121
Source: global traffic	TCP traffic: 192.168.2.16:50384 -> 91.41.59.153:2121
Source: global traffic	TCP traffic: 192.168.2.16:50388 -> 117.161.132.183:2121
Source: global traffic	TCP traffic: 192.168.2.16:50390 -> 94.131.47.117:2121
Source: global traffic	TCP traffic: 192.168.2.16:50392 -> 24.181.4.6:2121
Source: global traffic	TCP traffic: 192.168.2.16:50394 -> 67.188.255.137:2121
Source: global traffic	TCP traffic: 192.168.2.16:50396 -> 81.245.127.27:2121
Source: global traffic	TCP traffic: 192.168.2.16:50398 -> 189.179.17.239:2121
Source: global traffic	TCP traffic: 192.168.2.16:50400 -> 173.235.82.189:2121
Source: global traffic	TCP traffic: 192.168.2.16:50404 -> 23.197.37.196:2121
Source: global traffic	TCP traffic: 192.168.2.16:50405 -> 70.92.238.155:2121
Source: global traffic	TCP traffic: 192.168.2.16:50408 -> 116.9.149.105:2121
Source: global traffic	TCP traffic: 192.168.2.16:50410 -> 139.59.34.85:2121
Source: global traffic	TCP traffic: 192.168.2.16:50412 -> 98.254.182.143:2121
Source: global traffic	TCP traffic: 192.168.2.16:50414 -> 45.161.140.137:2121
Source: global traffic	TCP traffic: 192.168.2.16:50417 -> 67.184.169.181:2121
Source: global traffic	TCP traffic: 192.168.2.16:50421 -> 71.193.153.207:2121
Source: global traffic	TCP traffic: 192.168.2.16:50422 -> 195.205.150.94:2121
Source: global traffic	TCP traffic: 192.168.2.16:50424 -> 181.171.153.111:2121
Source: global traffic	TCP traffic: 192.168.2.16:50426 -> 61.76.155.82:2121
Source: global traffic	TCP traffic: 192.168.2.16:50428 -> 188.222.212.57:2121
Source: global traffic	TCP traffic: 192.168.2.16:50430 -> 85.4.52.227:2121
Source: global traffic	TCP traffic: 192.168.2.16:50432 -> 165.1.218.28:2121
Source: global traffic	TCP traffic: 192.168.2.16:50437 -> 83.57.93.232:2121
Source: global traffic	TCP traffic: 192.168.2.16:50441 -> 149.224.112.238:2121
Source: global traffic	TCP traffic: 192.168.2.16:50443 -> 103.165.157.224:2121
Source: global traffic	TCP traffic: 192.168.2.16:50455 -> 96.91.172.122:2121
Source: global traffic	TCP traffic: 192.168.2.16:50453 -> 20.111.46.231:2121
Source: global traffic	TCP traffic: 192.168.2.16:50458 -> 187.126.142.208:2121
Source: global traffic	TCP traffic: 192.168.2.16:50457 -> 117.69.72.226:2121
Source: global traffic	TCP traffic: 192.168.2.16:50461 -> 51.105.105.242:2121
Source: global traffic	TCP traffic: 192.168.2.16:50462 -> 222.190.5.46:2121
Source: global traffic	TCP traffic: 192.168.2.16:50465 -> 216.67.24.140:2121
Source: global traffic	TCP traffic: 192.168.2.16:50468 -> 122.41.139.45:2121
Source: global traffic	TCP traffic: 192.168.2.16:50471 -> 98.96.97.42:2121
Source: global traffic	TCP traffic: 192.168.2.16:50473 -> 206.71.159.50:2121
Source: global traffic	TCP traffic: 192.168.2.16:50474 -> 211.44.88.172:2121
Source: global traffic	TCP traffic: 192.168.2.16:50475 -> 67.180.251.139:2121
Source: global traffic	TCP traffic: 192.168.2.16:50476 -> 158.23.81.6:2121
Source: global traffic	TCP traffic: 192.168.2.16:50479 -> 101.249.29.72:2121
Source: global traffic	TCP traffic: 192.168.2.16:50481 -> 119.185.45.247:2121
Source: global traffic	TCP traffic: 192.168.2.16:50482 -> 73.44.84.145:2121
Source: global traffic	TCP traffic: 192.168.2.16:50485 -> 20.106.148.131:2121
Source: global traffic	TCP traffic: 192.168.2.16:50486 -> 117.5.105.172:2121
Source: global traffic	TCP traffic: 192.168.2.16:50487 -> 85.6.142.168:2121
Source: global traffic	TCP traffic: 192.168.2.16:50489 -> 218.147.235.186:2121
Source: global traffic	TCP traffic: 192.168.2.16:50490 -> 24.17.76.59:2121
Source: global traffic	TCP traffic: 192.168.2.16:50492 -> 106.214.7.190:2121
Source: global traffic	TCP traffic: 192.168.2.16:50494 -> 211.210.139.133:2121
Source: global traffic	TCP traffic: 192.168.2.16:50495 -> 85.244.169.185:2121
Source: global traffic	TCP traffic: 192.168.2.16:50498 -> 149.154.65.23:2121
Source: global traffic	TCP traffic: 192.168.2.16:50500 -> 191.223.41.72:2121
Source: global traffic	TCP traffic: 192.168.2.16:50503 -> 36.39.190.158:2121
Source: global traffic	TCP traffic: 192.168.2.16:50505 -> 83.136.148.89:2121
Source: global traffic	TCP traffic: 192.168.2.16:50507 -> 1.85.248.100:2121
Source: global traffic	TCP traffic: 192.168.2.16:50509 -> 69.11.194.63:2121
Source: global traffic	TCP traffic: 192.168.2.16:50513 -> 154.83.2.90:2121
Source: global traffic	TCP traffic: 192.168.2.16:50515 -> 39.127.143.189:2121
Source: global traffic	TCP traffic: 192.168.2.16:50517 -> 211.218.72.245:2121
Source: global traffic	TCP traffic: 192.168.2.16:50519 -> 173.75.32.106:2121
Source: global traffic	TCP traffic: 192.168.2.16:50522 -> 98.45.130.150:2121
Source: global traffic	TCP traffic: 192.168.2.16:50521 -> 179.223.58.150:2121
Source: global traffic	TCP traffic: 192.168.2.16:50526 -> 67.170.205.145:2121
Source: global traffic	TCP traffic: 192.168.2.16:50528 -> 20.150.153.193:2121
Source: global traffic	TCP traffic: 192.168.2.16:50527 -> 213.112.243.210:2121
Source: global traffic	TCP traffic: 192.168.2.16:50531 -> 64.225.92.66:2121
Source: global traffic	TCP traffic: 192.168.2.16:50533 -> 73.248.162.45:2121
Source: global traffic	TCP traffic: 192.168.2.16:50535 -> 98.16.119.74:2121
Source: global traffic	TCP traffic: 192.168.2.16:50537 -> 189.165.22.222:2121
Source: global traffic	TCP traffic: 192.168.2.16:50539 -> 182.98.150.37:2121
Source: global traffic	TCP traffic: 192.168.2.16:50541 -> 80.31.8.165:2121
Source: global traffic	TCP traffic: 192.168.2.16:50543 -> 221.168.159.170:2121
Source: global traffic	TCP traffic: 192.168.2.16:50545 -> 116.123.90.217:2121
Source: global traffic	TCP traffic: 192.168.2.16:50547 -> 1.80.113.33:2121
Source: global traffic	TCP traffic: 192.168.2.16:50549 -> 175.117.140.51:2121
Source: global traffic	TCP traffic: 192.168.2.16:50551 -> 86.120.6.251:2121
Source: global traffic	TCP traffic: 192.168.2.16:50553 -> 93.219.17.233:2121
Source: global traffic	TCP traffic: 192.168.2.16:50555 -> 115.8.11.239:2121
Source: global traffic	TCP traffic: 192.168.2.16:50557 -> 89.174.3.24:2121
Source: global traffic	TCP traffic: 192.168.2.16:50564 -> 190.92.153.181:2121
Source: global traffic	TCP traffic: 192.168.2.16:50568 -> 187.251.200.253:2121
Source: global traffic	TCP traffic: 192.168.2.16:50575 -> 20.125.78.0:2121
Source: global traffic	TCP traffic: 192.168.2.16:50577 -> 178.186.179.18:2121
Source: global traffic	TCP traffic: 192.168.2.16:50581 -> 89.58.52.251:2121
Source: global traffic	TCP traffic: 192.168.2.16:50582 -> 152.89.185.57:2121
Source: global traffic	TCP traffic: 192.168.2.16:50584 -> 104.17.99.214:2121
Source: global traffic	TCP traffic: 192.168.2.16:50587 -> 67.189.133.104:2121
Source: global traffic	TCP traffic: 192.168.2.16:50595 -> 98.242.36.116:2121
Source: global traffic	TCP traffic: 192.168.2.16:50599 -> 87.2.36.15:2121
Source: global traffic	TCP traffic: 192.168.2.16:50603 -> 108.165.114.34:2121
Source: global traffic	TCP traffic: 192.168.2.16:50605 -> 98.33.116.168:2121
Source: global traffic	TCP traffic: 192.168.2.16:50607 -> 93.176.173.211:2121
Source: global traffic	TCP traffic: 192.168.2.16:50612 -> 110.231.130.41:2121
Source: global traffic	TCP traffic: 192.168.2.16:50616 -> 222.235.83.57:2121
Source: global traffic	TCP traffic: 192.168.2.16:50619 -> 46.90.129.21:2121
Source: global traffic	TCP traffic: 192.168.2.16:50621 -> 124.91.229.153:2121
Source: global traffic	TCP traffic: 192.168.2.16:50625 -> 85.16.183.122:2121
Source: global traffic	TCP traffic: 192.168.2.16:50629 -> 91.229.92.88:2121
Source: global traffic	TCP traffic: 192.168.2.16:50631 -> 24.62.255.253:2121
Source: global traffic	TCP traffic: 192.168.2.16:50632 -> 93.216.201.153:2121
Source: global traffic	TCP traffic: 192.168.2.16:50635 -> 222.223.37.205:2121
Source: global traffic	TCP traffic: 192.168.2.16:50637 -> 41.230.218.202:2121
Source: global traffic	TCP traffic: 192.168.2.16:50640 -> 59.21.168.97:2121
Source: global traffic	TCP traffic: 192.168.2.16:50643 -> 73.45.29.118:2121
Source: global traffic	TCP traffic: 192.168.2.16:50645 -> 80.167.84.104:2121
Source: global traffic	TCP traffic: 192.168.2.16:50647 -> 79.248.82.8:2121
Source: global traffic	TCP traffic: 192.168.2.16:50650 -> 174.20.97.27:2121
Source: global traffic	TCP traffic: 192.168.2.16:50651 -> 91.41.188.118:2121
Source: global traffic	TCP traffic: 192.168.2.16:50655 -> 108.41.141.172:2121
Source: global traffic	TCP traffic: 192.168.2.16:50658 -> 120.8.21.137:2121
Source: global traffic	TCP traffic: 192.168.2.16:50659 -> 100.2.122.180:2121
Source: global traffic	TCP traffic: 192.168.2.16:50661 -> 86.121.139.105:2121
Source: global traffic	TCP traffic: 192.168.2.16:50662 -> 31.202.16.193:2121
Source: global traffic	TCP traffic: 192.168.2.16:50665 -> 175.18.216.34:2121
Source: global traffic	TCP traffic: 192.168.2.16:50666 -> 1.251.243.65:2121
Source: global traffic	TCP traffic: 192.168.2.16:50669 -> 178.187.219.73:2121
Source: global traffic	TCP traffic: 192.168.2.16:50672 -> 179.254.32.45:2121
Source: global traffic	TCP traffic: 192.168.2.16:50673 -> 23.220.172.150:2121
Source: global traffic	TCP traffic: 192.168.2.16:50675 -> 91.15.33.122:2121
Source: global traffic	TCP traffic: 192.168.2.16:50677 -> 184.61.89.211:2121
Source: global traffic	TCP traffic: 192.168.2.16:50680 -> 212.187.25.212:2121
Source: global traffic	TCP traffic: 192.168.2.16:50683 -> 50.3.33.187:2121
Source: global traffic	TCP traffic: 192.168.2.16:50685 -> 175.112.231.128:2121
Source: global traffic	TCP traffic: 192.168.2.16:50687 -> 71.115.207.213:2121
Source: global traffic	TCP traffic: 192.168.2.16:50689 -> 94.21.5.245:2121
Source: global traffic	TCP traffic: 192.168.2.16:50691 -> 182.244.148.18:2121
Source: global traffic	TCP traffic: 192.168.2.16:50694 -> 121.159.44.62:2121
Source: global traffic	TCP traffic: 192.168.2.16:50696 -> 95.100.247.133:2121
Source: global traffic	TCP traffic: 192.168.2.16:50700 -> 34.65.27.140:2121
Source: global traffic	TCP traffic: 192.168.2.16:50702 -> 71.196.187.243:2121
Source: global traffic	TCP traffic: 192.168.2.16:50706 -> 38.171.11.236:2121
Source: global traffic	TCP traffic: 192.168.2.16:50709 -> 39.116.40.5:2121
Source: global traffic	TCP traffic: 192.168.2.16:50720 -> 217.95.121.142:2121
Source: global traffic	TCP traffic: 192.168.2.16:50723 -> 85.137.228.99:2121
Source: global traffic	TCP traffic: 192.168.2.16:50726 -> 93.185.159.51:2121
Source: global traffic	TCP traffic: 192.168.2.16:50728 -> 27.203.118.210:2121
Source: global traffic	TCP traffic: 192.168.2.16:50729 -> 101.65.79.36:2121
Source: global traffic	TCP traffic: 192.168.2.16:50718 -> 123.128.168.1:2121
Source: global traffic	TCP traffic: 192.168.2.16:50733 -> 121.152.228.54:2121
Source: global traffic	TCP traffic: 192.168.2.16:50732 -> 135.181.57.96:2121
Source: global traffic	TCP traffic: 192.168.2.16:50734 -> 116.139.82.91:2121
Source: global traffic	TCP traffic: 192.168.2.16:50736 -> 156.242.212.172:2121
Source: global traffic	TCP traffic: 192.168.2.16:50738 -> 71.34.106.185:2121
Source: global traffic	TCP traffic: 192.168.2.16:50740 -> 119.154.190.4:2121
Source: global traffic	TCP traffic: 192.168.2.16:50741 -> 154.210.32.21:2121
Source: global traffic	TCP traffic: 192.168.2.16:50744 -> 200.216.148.34:2121
Source: global traffic	TCP traffic: 192.168.2.16:50746 -> 118.98.35.10:2121
Source: global traffic	TCP traffic: 192.168.2.16:50749 -> 45.33.5.34:2121
Source: global traffic	TCP traffic: 192.168.2.16:50750 -> 114.42.229.208:2121
Source: global traffic	TCP traffic: 192.168.2.16:50755 -> 208.184.124.137:2121
Source: global traffic	TCP traffic: 192.168.2.16:50757 -> 37.20.148.191:2121
Source: global traffic	TCP traffic: 192.168.2.16:50759 -> 73.234.5.204:2121
Source: global traffic	TCP traffic: 192.168.2.16:50761 -> 96.10.238.106:2121
Source: global traffic	TCP traffic: 192.168.2.16:50762 -> 209.183.149.234:2121
Source: global traffic	TCP traffic: 192.168.2.16:50752 -> 39.68.11.249:2121
Source: global traffic	TCP traffic: 192.168.2.16:50765 -> 171.231.31.165:2121
Source: global traffic	TCP traffic: 192.168.2.16:50766 -> 5.129.51.197:2121
Source: global traffic	TCP traffic: 192.168.2.16:50767 -> 185.48.149.208:2121
Source: global traffic	TCP traffic: 192.168.2.16:50770 -> 73.248.132.178:2121
Source: global traffic	TCP traffic: 192.168.2.16:50772 -> 109.172.100.131:2121
Source: global traffic	TCP traffic: 192.168.2.16:50774 -> 39.27.135.223:2121
Source: global traffic	TCP traffic: 192.168.2.16:50776 -> 111.18.251.50:2121
Source: global traffic	TCP traffic: 192.168.2.16:50777 -> 66.69.12.241:2121
Source: global traffic	TCP traffic: 192.168.2.16:50780 -> 68.234.240.182:2121
Source: global traffic	TCP traffic: 192.168.2.16:50782 -> 27.79.77.134:2121
Source: global traffic	TCP traffic: 192.168.2.16:50784 -> 107.190.0.105:2121
Source: global traffic	TCP traffic: 192.168.2.16:50787 -> 95.37.152.98:2121
Source: global traffic	TCP traffic: 192.168.2.16:50788 -> 76.176.42.197:2121
Source: global traffic	TCP traffic: 192.168.2.16:50789 -> 98.255.42.68:2121
Source: global traffic	TCP traffic: 192.168.2.16:50793 -> 188.191.254.52:2121
Source: global traffic	TCP traffic: 192.168.2.16:50794 -> 20.23.119.186:2121
Source: global traffic	TCP traffic: 192.168.2.16:50796 -> 220.255.44.99:2121
Source: global traffic	TCP traffic: 192.168.2.16:50798 -> 2.108.129.87:2121
Source: global traffic	TCP traffic: 192.168.2.16:50801 -> 14.95.142.67:2121
Source: global traffic	TCP traffic: 192.168.2.16:50803 -> 4.231.28.100:2121
Source: global traffic	TCP traffic: 192.168.2.16:50806 -> 182.216.235.11:2121
Source: global traffic	TCP traffic: 192.168.2.16:50813 -> 125.122.17.98:2121
Source: global traffic	TCP traffic: 192.168.2.16:50815 -> 79.116.255.24:2121
Source: global traffic	TCP traffic: 192.168.2.16:50821 -> 86.82.116.212:2121
Source: global traffic	TCP traffic: 192.168.2.16:50823 -> 187.6.77.125:2121
Source: global traffic	TCP traffic: 192.168.2.16:50825 -> 187.199.50.175:2121
Source: global traffic	TCP traffic: 192.168.2.16:50829 -> 124.226.170.100:2121
Source: global traffic	TCP traffic: 192.168.2.16:50833 -> 198.46.170.76:2121

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1

Source: unknown

FTP traffic detected: 216.117.162.236:21 -> 192.168.2.16:49899 220 (vsFTPd 2.0.5)

Source: unknown	TCP traffic detected without corresponding DNS query: 166.148.200.249
Source: unknown	TCP traffic detected without corresponding DNS query: 166.148.200.249
Source: unknown	TCP traffic detected without corresponding DNS query: 35.137.203.142
Source: unknown	TCP traffic detected without corresponding DNS query: 140.190.24.113
Source: unknown	TCP traffic detected without corresponding DNS query: 35.137.203.142
Source: unknown	TCP traffic detected without corresponding DNS query: 140.190.24.113
Source: unknown	TCP traffic detected without corresponding DNS query: 213.249.245.75
Source: unknown	TCP traffic detected without corresponding DNS query: 213.249.245.75
Source: unknown	TCP traffic detected without corresponding DNS query: 164.70.186.78
Source: unknown	TCP traffic detected without corresponding DNS query: 164.70.186.78
Source: unknown	TCP traffic detected without corresponding DNS query: 100.15.75.145
Source: unknown	TCP traffic detected without corresponding DNS query: 100.15.75.145
Source: unknown	TCP traffic detected without corresponding DNS query: 104.67.188.105
Source: unknown	TCP traffic detected without corresponding DNS query: 104.67.188.105
Source: unknown	TCP traffic detected without corresponding DNS query: 88.142.184.208
Source: unknown	TCP traffic detected without corresponding DNS query: 88.142.184.208
Source: unknown	TCP traffic detected without corresponding DNS query: 92.15.231.140
Source: unknown	TCP traffic detected without corresponding DNS query: 92.15.231.140
Source: unknown	TCP traffic detected without corresponding DNS query: 75.174.68.132
Source: unknown	TCP traffic detected without corresponding DNS query: 75.174.68.132
Source: unknown	TCP traffic detected without corresponding DNS query: 201.113.164.51
Source: unknown	TCP traffic detected without corresponding DNS query: 201.113.164.51
Source: unknown	TCP traffic detected without corresponding DNS query: 36.84.169.30
Source: unknown	TCP traffic detected without corresponding DNS query: 36.84.169.30
Source: unknown	TCP traffic detected without corresponding DNS query: 73.35.188.189
Source: unknown	TCP traffic detected without corresponding DNS query: 73.35.188.189
Source: unknown	TCP traffic detected without corresponding DNS query: 105.68.254.0
Source: unknown	TCP traffic detected without corresponding DNS query: 105.68.254.0
Source: unknown	TCP traffic detected without corresponding DNS query: 90.215.132.151
Source: unknown	TCP traffic detected without corresponding DNS query: 90.215.132.151
Source: unknown	TCP traffic detected without corresponding DNS query: 100.36.47.116
Source: unknown	TCP traffic detected without corresponding DNS query: 100.36.47.116
Source: unknown	TCP traffic detected without corresponding DNS query: 115.74.91.137
Source: unknown	TCP traffic detected without corresponding DNS query: 115.74.91.137
Source: unknown	TCP traffic detected without corresponding DNS query: 86.124.13.69
Source: unknown	TCP traffic detected without corresponding DNS query: 86.124.13.69
Source: unknown	TCP traffic detected without corresponding DNS query: 20.75.38.29
Source: unknown	TCP traffic detected without corresponding DNS query: 20.75.38.29
Source: unknown	TCP traffic detected without corresponding DNS query: 24.130.57.109
Source: unknown	TCP traffic detected without corresponding DNS query: 24.130.57.109
Source: unknown	TCP traffic detected without corresponding DNS query: 187.200.140.177
Source: unknown	TCP traffic detected without corresponding DNS query: 187.200.140.177
Source: unknown	TCP traffic detected without corresponding DNS query: 90.193.156.199
Source: unknown	TCP traffic detected without corresponding DNS query: 90.193.156.199
Source: unknown	TCP traffic detected without corresponding DNS query: 150.220.125.58
Source: unknown	TCP traffic detected without corresponding DNS query: 150.220.125.58
Source: unknown	TCP traffic detected without corresponding DNS query: 20.222.8.129
Source: unknown	TCP traffic detected without corresponding DNS query: 20.222.8.129
Source: unknown	TCP traffic detected without corresponding DNS query: 103.162.154.23
Source: unknown	TCP traffic detected without corresponding DNS query: 103.162.154.23

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1

Source: global traffic	DNS traffic detected: DNS query: dht.transmissionbt.com
Source: global traffic	DNS traffic detected: DNS query: xmr.crypto-pool.fr
Source: global traffic	DNS traffic detected: DNS query: router.bittorrent.com
Source: global traffic	DNS traffic detected: DNS query: router.utorrent.com
Source: global traffic	DNS traffic detected: DNS query: bttracker.debian.org

Source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000003.1416564795.000000000394E000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000003.1418282897.0000000003954000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000003.1531724512.0000000002A23000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000019.00000003.1456617188.00000000035B1000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001D.00000003.1499803297.0000000002CB4000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000002.2386623399.0000000001582000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://breakingcode.wordpress.com/)
Source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000003.1418252565.00000000034B5000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000003.1420484257.00000000031B9000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000002.1429863321.00000000034B3000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000003.1418367126.00000000034B3000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000003.1416665400.000000000345C000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000003.1534549383.0000000002AD0000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000003.1534608692.00000000024D1000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000003.1544307502.00000000024D4000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000003.1539960207.0000000002AD0000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000003.1531724512.0000000002A23000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000019.00000003.1459174688.0000000003213000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000019.00000003.1458534958.00000000031E7000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000019.00000003.1456617188.00000000035B1000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000019.00000003.1461886305.00000000035CA000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000019.00000002.1467750392.00000000035CA000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001D.00000002.1515736032.000000000281E000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001D.00000003.1501662011.00000000027C0000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001D.00000002.1515178361.0000000002745000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001D.00000003.1506183840.0000000002736000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000002.2386623399.00000000015FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://bugs.python.org/issue6973.
Source: svchost.exe, 00000004.00000002.2383306605.0000026EDB261000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.ver)
Source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000003.1416968936.000000000381E000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000002.1430135715.00000000038A5000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000003.1537290974.00000000029FC000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000003.1533071893.0000000002965000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000019.00000003.1456617188.00000000035B1000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000019.00000003.1461886305.0000000003647000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001D.00000002.1516003801.0000000002BFF000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001D.00000003.1502705766.0000000002B82000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000002.2398680627.0000000001701000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000002.2386623399.00000000015FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.python.org/3/library/functools.html#functools.lru_cache
Source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000003.1418252565.00000000034B5000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000003.1420484257.00000000031B9000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000002.1429863321.00000000034B3000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000003.1418367126.00000000034B3000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000003.1416665400.000000000345C000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000003.1534549383.0000000002AD0000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000003.1534608692.00000000024D1000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000003.1544307502.00000000024D4000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000003.1539960207.0000000002AD0000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000003.1531724512.0000000002A23000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000019.00000003.1459174688.0000000003213000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000019.00000003.1458534958.00000000031E7000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000019.00000003.1456617188.00000000035B1000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000019.00000003.1461886305.00000000035CA000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000019.00000002.1467750392.00000000035CA000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001D.00000002.1515736032.000000000281E000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001D.00000003.1501662011.00000000027C0000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001D.00000002.1515178361.0000000002745000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001D.00000003.1506183840.0000000002736000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000002.2386623399.00000000015FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.python.org/3/library/subprocess.html
Source: HelpPane.exe, 0000001D.00000003.1501662011.00000000027C0000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001D.00000003.1508909107.00000000027D0000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000002.2398680627.0000000001701000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000002.2377703970.0000000001401000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://docs.python.org/library/socket.html#socket.setdefaulttimeout
Source: svchost.exe, 00000004.00000003.1202794563.0000026EDB140000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr/492350f6-3a01-4f97-b9c0-c7c6ddf67d60/Office/Data/v32_16.0.16827.20
Source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000002.1430135715.00000000038BE000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000003.1416968936.000000000381E000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000003.1538803573.00000000022C9000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000003.1537290974.0000000002A15000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000003.1533071893.0000000002965000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000019.00000003.1456617188.00000000035B1000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000019.00000003.1461886305.0000000003660000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001D.00000002.1516003801.0000000002C18000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001D.00000003.1505560391.0000000002B61000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001D.00000003.1502705766.0000000002B82000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000002.2398680627.0000000001701000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000002.2377703970.0000000001401000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://goo.gl/zeJZl
Source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000003.1531724512.0000000002A23000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://mail.pytho
Source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000003.1418367126.0000000003498000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000003.1420484257.00000000031B9000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000003.1416665400.000000000345C000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000003.1544307502.000000000250E000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000003.1534608692.00000000024D1000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000003.1531724512.0000000002A23000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000019.00000003.1458534958.00000000031E7000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000019.00000003.1459174688.0000000003253000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001D.00000003.1501662011.00000000027C0000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001D.00000003.1505560391.0000000002B61000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001D.00000003.1508909107.0000000002804000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000002.2398680627.0000000001701000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://mail.python.org/pipermail/python-dev/2012-June/120787.html
Source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000003.1416564795.000000000394E000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000003.1418282897.0000000003954000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000003.1531724512.0000000002A23000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000019.00000003.1456617188.00000000035B1000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001D.00000003.1499803297.0000000002CB4000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000002.2386623399.0000000001582000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://motomastyle.com/)
Source: HelpPane.exe, 0000001D.00000003.1506183840.0000000002712000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://proxy.ex
Source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000003.1416564795.000000000394E000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000003.1418282897.0000000003954000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000003.1531724512.0000000002A23000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000019.00000003.1456617188.00000000035B1000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001D.00000003.1499803297.0000000002CB4000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000002.2386623399.0000000001582000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://pyloris.sourceforge.net/).
Source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000002.1437875354.000000006CE41000.00000040.00000001.01000000.00000009.sdmp	String found in binary or memory: http://python.org/dev/peps/pep-0263/
Source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000003.1420182025.000000000334E000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000002.1428962274.000000000338B000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000003.1541999330.00000000023AE000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000019.00000003.1461030906.00000000030FE000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001D.00000003.1507941690.00000000026AE000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000002.2386623399.0000000001582000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tools.ietf.org/html/rfc6125#section-6.4.3
Source: svchost.exe, 00000006.00000002.1370791576.000001F08A413000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.bingmapsportal.com
Source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000002.1422339536.0000000003111000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000003.1418367126.00000000034A5000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000003.1416665400.000000000345C000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000003.1543469992.000000000251B000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000002.1550371359.0000000002221000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000003.1534608692.00000000024D1000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000019.00000003.1459174688.0000000003267000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000019.00000003.1458477420.0000000003261000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000019.00000002.1464630708.0000000002EA1000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001D.00000002.1511726383.0000000002451000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001D.00000003.1501662011.00000000027C0000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001D.00000002.1515555939.00000000027C5000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000002.2386623399.00000000015FD000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000002.2377703970.0000000001401000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.faqs.org/rfcs/rfc2822.html
Source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000003.1418367126.00000000034A5000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000003.1416665400.000000000345C000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000003.1543469992.000000000251B000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000003.1534608692.00000000024D1000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000019.00000003.1459174688.0000000003267000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000019.00000003.1458477420.0000000003261000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001D.00000003.1501662011.00000000027C0000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001D.00000002.1515555939.00000000027C5000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000002.2386623399.00000000015FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.faqs.org/rfcs/rfc822.html
Source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000002.1429985858.0000000003810000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000003.1543469992.000000000251B000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000003.1534608692.00000000024D1000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000019.00000003.1461886305.00000000035B8000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000019.00000003.1456617188.00000000035B1000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001D.00000003.1505560391.0000000002B61000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001D.00000003.1510244840.0000000002B67000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000002.2386623399.00000000015FD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6
Source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000002.1435325332.000000006CBC1000.00000040.00000001.01000000.0000000E.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000002.1436346191.000000006CCD1000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000002.1435325332.000000006CBC1000.00000040.00000001.01000000.0000000E.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000002.1436346191.000000006CCD1000.00000040.00000001.01000000.0000000D.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.htmlC:
Source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000003.1417854362.00000000033E4000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000002.1555333716.0000000002443000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000003.1535853996.000000000242E000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000019.00000003.1459174688.0000000003186000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001D.00000003.1506183840.0000000002736000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000002.2377703970.0000000001401000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.python.org/
Source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000002.1430135715.0000000003945000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000003.1416968936.000000000381E000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000003.1539960207.0000000002AC6000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000003.1531724512.0000000002A23000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000019.00000003.1456617188.00000000035B1000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000019.00000002.1467840304.00000000036F8000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001D.00000002.1516003801.0000000002CA4000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001D.00000003.1502705766.0000000002B82000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000002.2398680627.0000000001701000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.python.org/dev/peps/pep-0205/
Source: cacerts.txt.24.dr	String found in binary or memory: http://www.valicert.com/
Source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000003.1544307502.0000000002502000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000003.1534608692.00000000024D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://.P
Source: svchost.exe, 00000006.00000003.1369480637.000001F08A458000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://appexmapsappupdate.blob.core.windows.net
Source: svchost.exe, 00000006.00000003.1369480637.000001F08A458000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.1371117634.000001F08A459000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/V1/MapControlConfiguration/native/
Source: svchost.exe, 00000006.00000003.1369635460.000001F08A441000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1369480637.000001F08A458000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1369549964.000001F08A45A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1368982864.000001F08A46F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1369181580.000001F08A465000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1369842397.000001F08A466000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000006.00000002.1371153253.000001F08A475000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1368982864.000001F08A46F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/
Source: svchost.exe, 00000006.00000003.1369480637.000001F08A458000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Locations
Source: svchost.exe, 00000006.00000003.1369181580.000001F08A465000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Routes/
Source: svchost.exe, 00000006.00000003.1368721213.000001F08A476000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/REST/v1/Transit/Stops/
Source: svchost.exe, 00000006.00000003.1369480637.000001F08A458000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.ditu.live.com/mapcontrol/logging.ashx
Source: svchost.exe, 00000006.00000002.1370881496.000001F08A42B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1369480637.000001F08A458000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1369549964.000001F08A45A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1369181580.000001F08A465000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000006.00000003.1369480637.000001F08A458000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Locations
Source: svchost.exe, 00000006.00000002.1370881496.000001F08A42B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1369181580.000001F08A465000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/
Source: svchost.exe, 00000006.00000003.1369480637.000001F08A458000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Driving
Source: svchost.exe, 00000006.00000003.1369480637.000001F08A458000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Transit
Source: svchost.exe, 00000006.00000003.1369480637.000001F08A458000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/Walking
Source: svchost.exe, 00000006.00000002.1370881496.000001F08A42B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1369181580.000001F08A465000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Traffic/Incidents/
Source: svchost.exe, 00000006.00000003.1369635460.000001F08A441000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.1371032795.000001F08A444000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/REST/v1/Transit/Schedules/
Source: svchost.exe, 00000006.00000003.1369480637.000001F08A458000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/mapcontrol/logging.ashx
Source: svchost.exe, 00000006.00000003.1369198178.000001F08A462000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?
Source: svchost.exe, 00000006.00000003.1369742491.000001F08A432000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1369198178.000001F08A462000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=
Source: svchost.exe, 00000006.00000002.1371032795.000001F08A444000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=
Source: svchost.exe, 00000006.00000003.1369198178.000001F08A462000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=
Source: svchost.exe, 00000006.00000003.1369635460.000001F08A441000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.api.tiles.ditu.live.com/odvs/gri?pv=1&r=
Source: svchost.exe, 00000006.00000002.1371153253.000001F08A473000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1369181580.000001F08A465000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1369842397.000001F08A466000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.t
Source: svchost.exe, 00000006.00000003.1369480637.000001F08A458000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx
Source: svchost.exe, 00000006.00000003.1369635460.000001F08A441000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/REST/V1/MapControlConfiguration/native/
Source: svchost.exe, 00000006.00000002.1370881496.000001F08A42B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1369181580.000001F08A465000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/
Source: svchost.exe, 00000004.00000003.1202794563.0000026EDB1B3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/Prod-C:
Source: svchost.exe, 00000004.00000003.1202794563.0000026EDB1A2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://g.live.com/odclientsettings/ProdV2-C:
Source: xmrig.exe, 00000028.00000002.2357701679.0000000000401000.00000040.00000001.01000000.0000004C.sdmp	String found in binary or memory: https://gcc.gnu.org/bugs/):
Source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000E.00000003.1403414661.00000000021D1000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000E.00000003.1402901937.00000000021D1000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000E.00000003.1403368802.00000000021D1000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000E.00000003.1399061320.00000000021D1000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000E.00000003.1403288013.00000000021E0000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000E.00000003.1400214876.00000000021D1000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000E.00000003.1403562022.00000000021D1000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000E.00000003.1402629380.00000000021D1000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000002.1434087512.000000001E7C2000.00000004.00000001.01000000.00000012.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000002.1435120797.000000001ECC0000.00000004.00000001.01000000.00000011.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000002.1434310614.000000001E7DD000.00000004.00000001.01000000.00000015.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000002.1434959724.000000001E9BC000.00000004.00000001.01000000.00000014.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000012.00000003.1421334886.00000000030F1000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000012.00000003.1416602430.0000000001516000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000012.00000003.1420959512.0000000001517000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000012.00000003.1419781834.00000000030F1000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000012.00000003.1420807155.0000000003100000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000012.00000003.1420518336.0000000003100000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000012.00000003.1421123127.00000000030F1000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000012.00000003.1418218881.0000000001516000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mhammond/pywin320
Source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000003.1417854362.00000000033E4000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000002.1555333716.0000000002443000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000003.1535853996.000000000242E000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000019.00000003.1459174688.0000000003186000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001D.00000003.1506183840.0000000002736000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000002.2377703970.0000000001401000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mahler:8092/site-updates.py
Source: svchost.exe, 00000006.00000003.1369635460.000001F08A441000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.1371032795.000001F08A449000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtu
Source: svchost.exe, 00000006.00000003.1369635460.000001F08A441000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx
Source: svchost.exe, 00000006.00000002.1371032795.000001F08A449000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=
Source: svchost.exe, 00000006.00000003.1369608452.000001F08A44A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1369480637.000001F08A458000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.1371117634.000001F08A459000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.1371032795.000001F08A449000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=
Source: svchost.exe, 00000006.00000002.1370881496.000001F08A42B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=
Source: svchost.exe, 00000006.00000003.1369480637.000001F08A458000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen
Source: svchost.exe, 00000006.00000003.1369061139.000001F08A46D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t0.tiles.ditu.live.com/tiles/gen
Source: svchost.exe, 00000006.00000003.1369480637.000001F08A458000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.1371117634.000001F08A459000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://tiles.virtualearth.net/tiles/cmd/StreetSideBubbleMetaData?north=
Source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000002.1430135715.0000000003912000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000003.1416968936.000000000381E000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000003.1539960207.0000000002A94000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000003.1531724512.0000000002A23000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000019.00000003.1456617188.00000000035B1000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000019.00000002.1467840304.00000000036C6000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001D.00000002.1516003801.0000000002C72000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001D.00000003.1502705766.0000000002B82000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000002.2398680627.0000000001701000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/accounts/ClientLogin

Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe

Code function: 15_2_1E8C36D0 PyArg_ParseTuple,PyEval_SaveThread,GetKeyboardState,PyEval_RestoreThread,?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z,PyString_FromStringAndSize,

15_2_1E8C36D0

Spam, unwanted Advertisements and Ransom Demands

Writes many files with high entropy

Source: C:\Program Files\7-Zip\7zG.exe	File created: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe entropy: 7.99271522496	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI28682\_ssl.pyd entropy: 7.99647189671	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI28682\_hashlib.pyd entropy: 7.99655727617	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI28682\python27.dll entropy: 7.99025694692	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI57642\_hashlib.pyd entropy: 7.99655727617	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI57642\_ssl.pyd entropy: 7.99647189671	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI57642\python27.dll entropy: 7.99025694692	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\HelpPane.exe entropy: 7.99271522496	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI33482\_hashlib.pyd entropy: 7.99655727617	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI33482\_ssl.pyd entropy: 7.99647189671	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI33482\python27.dll entropy: 7.99025694692	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI14482\python27.dll entropy: 7.99025694692	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI14482\_hashlib.pyd entropy: 7.99655727617	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI14482\_ssl.pyd entropy: 7.99647189671	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI70482\_hashlib.pyd entropy: 7.99655727617	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI70482\_ssl.pyd entropy: 7.99647189671	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI70482\python27.dll entropy: 7.99025694692	Jump to dropped file

Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe

Code function: 15_2_1ECB1D10 PyArg_ParseTuple,?PyWinObject_AsSECURITY_ATTRIBUTES@@YAHPAU_object@@PAPAU_SECURITY_ATTRIBUTES@@H@Z,?PyWinObject_AsWCHAR@@YAHPAU_object@@PAPA_WHPAK@Z,CreateDesktopW,GetLastError,?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z,?PyWinObject_FreeWCHAR@@YAXPA_W@Z,

15_2_1ECB1D10

System Summary

Malicious sample detected (through community Yara rule)

Source: 40.2.xmrig.exe.400000.0.unpack, type: UNPACKEDPE

Matched rule: Detects Monero Crypto Coin Miner Author: Florian Roth

Creates files with lurking names (e.g. Crack.exe)

Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI28682\ftpcrack.exe.manifest	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI57642\ftpcrack.exe.manifest	Jump to behavior
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI33482\ftpcrack.exe.manifest	Jump to behavior
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI14482\ftpcrack.exe.manifest	Jump to behavior
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\TEMP\_MEI70482\ftpcrack.exe.manifest	Jump to behavior

Source: C:\Users\user\HelpPane.exe

Process Stats: CPU usage > 24%

Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 15_2_03252190 PyList_New,GetActiveProcessorCount,PyErr_SetFromWindowsErr,PyExc_RuntimeError,PyErr_SetString,PyErr_NoMemory,NtQuerySystemInformation,Py_BuildValue,PyList_Append,73BB3B4E,73BB3B4E,	15_2_03252190
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 15_2_03253920 PyArg_ParseTuple,NtSetInformationProcess,CloseHandle,_Py_NoneStruct,_Py_NoneStruct,	15_2_03253920
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 15_2_03256100 OpenProcess,GetCurrentProcess,IsWow64Process,IsWow64Process,IsWow64Process,PyErr_Clear,PyErr_Clear,NtQueryInformationProcess,ReadProcessMemory,ReadProcessMemory,ReadProcessMemory,PyErr_NoMemory,ReadProcessMemory,CloseHandle,CloseHandle,73BB3B4E,	15_2_03256100
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 15_2_03256970 CreateEventA,CreateEventA,CreateEventA,RtlInitializeCriticalSection,RtlEnterCriticalSection,GetProcessHeap,PyList_New,GetProcessHeap,HeapFree,GetProcessHeap,RtlAllocateHeap,NtQuerySystemInformation,PyErr_NoMemory,GetCurrentProcess,DuplicateHandle,GetProcessHeap,HeapFree,GetProcessHeap,RtlAllocateHeap,PyUnicodeUCS2_FromWideChar,PyList_Append,GetProcessHeap,HeapFree,CloseHandle,PyErr_SetFromWindowsErr,GetProcessHeap,HeapFree,CloseHandle,GetProcessHeap,HeapFree,RtlLeaveCriticalSection,	15_2_03256970
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 15_2_03252420 PyArg_ParseTuple,PyObject_IsTrue,NtSuspendProcess,NtResumeProcess,CloseHandle,_Py_NoneStruct,_Py_NoneStruct,	15_2_03252420
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 15_2_03251E30 GetProcessHeap,GetProcessHeap,RtlAllocateHeap,NtQueryVirtualMemory,GetProcessHeap,HeapFree,GetProcessHeap,RtlAllocateHeap,NtQueryVirtualMemory,PyExc_RuntimeError,PyErr_SetString,PyErr_Clear,GetProcessHeap,HeapFree,	15_2_03251E30
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 15_2_03255650 GetActiveProcessorCount,PyErr_SetFromWindowsErr,PyExc_RuntimeError,PyErr_SetString,PyErr_NoMemory,NtQuerySystemInformation,PyErr_NoMemory,NtQuerySystemInformation,PyErr_NoMemory,NtQuerySystemInformation,73BB3B4E,73BB3B4E,73BB3B4E,73BB3B4E,73BB3B4E,73BB3B4E,73BB3B4E,73BB3B4E,Py_BuildValue,	15_2_03255650
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 15_2_032564B0 PyExc_RuntimeError,PyErr_SetString,OpenProcess,NtQueryInformationProcess,NtQueryInformationProcess,PyErr_NoMemory,73BB3B4E,CloseHandle,73BB3B4E,CloseHandle,	15_2_032564B0
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 15_2_03256880 WaitForSingleObject,SetEvent,WaitForSingleObject,NtQueryObject,SetEvent,	15_2_03256880
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 15_2_03256C80 PyList_New,RtlAllocateHeap,GetProcessHeap,HeapFree,GetProcessHeap,RtlAllocateHeap,NtQuerySystemInformation,CloseHandle,GetProcessHeap,HeapFree,PyErr_NoMemory,GetCurrentProcess,GetCurrentProcess,DuplicateHandle,CreateFileMappingA,MapViewOfFile,GetCurrentProcess,GetMappedFileNameA,PyUnicodeUCS2_FromWideChar,PyList_Append,UnmapViewOfFile,CloseHandle,CloseHandle,	15_2_03256C80
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 15_2_03253890 PyArg_ParseTuple,NtQueryInformationProcess,CloseHandle,Py_BuildValue,	15_2_03253890
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 15_2_03255CD0 PyErr_NoMemory,73BB3B4E,NtQuerySystemInformation,73BB3B4E,PyErr_NoMemory,73BB3B4E,	15_2_03255CD0

Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe

Code function: 15_2_03253F40: PyDict_New,CreateFileA,DeviceIoControl,GetLastError,DeviceIoControl,__aulldiv,__aulldiv,Py_BuildValue,PyDict_SetItemString,GetLastError,GetLastError,GetLastError,CloseHandle,PyErr_SetFromWindowsErr,CloseHandle,

15_2_03253F40

Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe

Code function: 15_2_1ECB40C0 PyArg_ParseTuple,?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z,PyEval_SaveThread,DeleteService,PyEval_RestoreThread,?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z,_Py_NoneStruct,

15_2_1ECB40C0

Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 15_2_1E8C3FA0 PyArg_ParseTuple,PyEval_SaveThread,ExitWindowsEx,PyEval_RestoreThread,?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z,_Py_NoneStruct,_Py_NoneStruct,		15_2_1E8C3FA0
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 15_2_1E8C3F10 PyArg_ParseTuple,PyEval_SaveThread,ExitWindowsEx,PyEval_RestoreThread,?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z,_Py_NoneStruct,_Py_NoneStruct,		15_2_1E8C3F10

Source: C:\Windows\System32\svchost.exe	File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp			Jump to behavior
Source: C:\Windows\SysWOW64\netsh.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\PeerDistRepub

Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 15_2_03252CC0	15_2_03252CC0
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 15_2_03261ED0	15_2_03261ED0
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 15_2_03277890	15_2_03277890
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 15_2_10002D19	15_2_10002D19
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 15_2_10001000	15_2_10001000
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 15_2_10001700	15_2_10001700
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 15_2_10001CB0	15_2_10001CB0
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 15_2_100014D0	15_2_100014D0
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 15_2_1E7C0FA0	15_2_1E7C0FA0
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 15_2_1E7DB690	15_2_1E7DB690
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 15_2_1E8DF120	15_2_1E8DF120
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 15_2_1E9BA490	15_2_1E9BA490
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 15_2_6CC58C90	15_2_6CC58C90
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 15_2_6CBF6CC0	15_2_6CBF6CC0
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 15_2_6CBF4C18	15_2_6CBF4C18
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 15_2_6CC56D60	15_2_6CC56D60
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 15_2_6CC56F80	15_2_6CC56F80
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 15_2_6CC74F70	15_2_6CC74F70
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 15_2_6CBCE8E0	15_2_6CBCE8E0
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 15_2_6CBE0930	15_2_6CBE0930
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 15_2_6CBF6A80	15_2_6CBF6A80
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 15_2_6CC40A60	15_2_6CC40A60
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 15_2_6CC56A70	15_2_6CC56A70
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 15_2_6CC6ABC0	15_2_6CC6ABC0
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 15_2_6CBF4BDC	15_2_6CBF4BDC
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 15_2_6CC56B40	15_2_6CC56B40
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 15_2_6CC6CB40	15_2_6CC6CB40
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 15_2_6CBD6B40	15_2_6CBD6B40
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 15_2_6CBF4B40	15_2_6CBF4B40
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 15_2_6CBDE6E0	15_2_6CBDE6E0
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 15_2_6CC72660	15_2_6CC72660
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 15_2_6CC587D0	15_2_6CC587D0
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 15_2_6CC567F0	15_2_6CC567F0
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 15_2_6CC22780	15_2_6CC22780
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 15_2_6CC72790	15_2_6CC72790
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 15_2_6CC5808C	15_2_6CC5808C
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 15_2_6CC58000	15_2_6CC58000
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 15_2_6CBD0060	15_2_6CBD0060
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 15_2_6CBD0190	15_2_6CBD0190
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 15_2_6CBEC1D0	15_2_6CBEC1D0
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 15_2_6CC56170	15_2_6CC56170
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 15_2_6CBD0100	15_2_6CBD0100
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 15_2_6CBDE160	15_2_6CBDE160
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 15_2_6CC6E2E0	15_2_6CC6E2E0
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 15_2_6CC5626B	15_2_6CC5626B
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 15_2_6CBDDCB0	15_2_6CBDDCB0
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 19_2_6C794B40	19_2_6C794B40
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 19_2_6C6C4C18	19_2_6C6C4C18
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 19_2_6C6C6CC0	19_2_6C6C6CC0
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 19_2_6C728C90	19_2_6C728C90
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 19_2_6C726D60	19_2_6C726D60
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 19_2_6C726F80	19_2_6C726F80
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 19_2_6C69E8E0	19_2_6C69E8E0
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 19_2_6C6B0930	19_2_6C6B0930
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 19_2_6C726A70	19_2_6C726A70
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 19_2_6C710A60	19_2_6C710A60
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 19_2_6C6C6A80	19_2_6C6C6A80
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 19_2_6C6A6B40	19_2_6C6A6B40
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 19_2_6C6C4B40	19_2_6C6C4B40
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 19_2_6C726B40	19_2_6C726B40
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 19_2_6C73CB40	19_2_6C73CB40
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 19_2_6C6C4BDC	19_2_6C6C4BDC
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 19_2_6C6AE6E0	19_2_6C6AE6E0
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 19_2_6C7267F0	19_2_6C7267F0
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 19_2_6C7287D0	19_2_6C7287D0
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 19_2_6C6F2780	19_2_6C6F2780
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 19_2_6C6A0060	19_2_6C6A0060
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 19_2_6C728000	19_2_6C728000
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 19_2_6C732000	19_2_6C732000
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 19_2_6C72808C	19_2_6C72808C
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 19_2_6C726170	19_2_6C726170
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 19_2_6C6AE160	19_2_6C6AE160
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 19_2_6C6A0100	19_2_6C6A0100
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 19_2_6C6BC1D0	19_2_6C6BC1D0
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 19_2_6C6A0190	19_2_6C6A0190
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 19_2_6C72626B	19_2_6C72626B
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 19_2_6C6ADCB0	19_2_6C6ADCB0
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 19_2_6C73DC80	19_2_6C73DC80
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 19_2_6C6B7D00	19_2_6C6B7D00
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 19_2_6C6B3D00	19_2_6C6B3D00
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 19_2_6C71FD00	19_2_6C71FD00
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 19_2_6C727DB0	19_2_6C727DB0
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 19_2_6C73DE00	19_2_6C73DE00
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 19_2_6C69FE10	19_2_6C69FE10
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 19_2_6C69FEB0	19_2_6C69FEB0
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 19_2_6C69FF50	19_2_6C69FF50
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 19_2_6C71F870	19_2_6C71F870
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 19_2_6C6DD810	19_2_6C6DD810
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 19_2_6C691960	19_2_6C691960
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 19_2_6C6F1AB0	19_2_6C6F1AB0
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 19_2_6C69FB40	19_2_6C69FB40
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 19_2_6C73DB40	19_2_6C73DB40
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 19_2_6C721400	19_2_6C721400
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 19_2_6C6AD4F0	19_2_6C6AD4F0
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 19_2_6C7274C0	19_2_6C7274C0
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 19_2_6C721540	19_2_6C721540
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 19_2_6C6A9520	19_2_6C6A9520
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 19_2_6C7255F0	19_2_6C7255F0
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 19_2_6C6E55C0	19_2_6C6E55C0
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 19_2_6C6F5650	19_2_6C6F5650
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 19_2_6C6ED600	19_2_6C6ED600
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 19_2_6C6EB610	19_2_6C6EB610
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 19_2_6C727750	19_2_6C727750
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 19_2_6C73D710	19_2_6C73D710
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 19_2_6C7257D0	19_2_6C7257D0
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 19_2_6C727160	19_2_6C727160
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 19_2_6C73D180	19_2_6C73D180
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 19_2_6C7472DD	19_2_6C7472DD
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 19_2_6C6912D0	19_2_6C6912D0
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 19_2_6C745317	19_2_6C745317
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 19_2_6C6DD3C0	19_2_6C6DD3C0
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 19_2_6C7113B0	19_2_6C7113B0
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 19_2_6C822C80	19_2_6C822C80
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 19_2_6C826C90	19_2_6C826C90
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 19_2_6C83AC40	19_2_6C83AC40
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 19_2_6C878C70	19_2_6C878C70
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 19_2_6C824D50	19_2_6C824D50
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 19_2_6C852EA0	19_2_6C852EA0
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 19_2_6C828E20	19_2_6C828E20
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 19_2_6C83EFB0	19_2_6C83EFB0
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 19_2_6C7CCFA0	19_2_6C7CCFA0
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 19_2_6C824F70	19_2_6C824F70
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 19_2_6C878F70	19_2_6C878F70
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 19_2_6C7F6840	19_2_6C7F6840
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 19_2_6C824870	19_2_6C824870
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 19_2_6C828960	19_2_6C828960
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 19_2_6C82CAD0	19_2_6C82CAD0
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 19_2_6C830AF0	19_2_6C830AF0
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 19_2_6C824A60	19_2_6C824A60
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 19_2_6C7BCB20	19_2_6C7BCB20
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 19_2_6C824B30	19_2_6C824B30
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 19_2_6C828B40	19_2_6C828B40

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\_MEI14482\Crypto.Cipher._AES.pyd C1A900615C9500C46B9602C30C53F299290B03632208EF1152AF8830AB73AD17
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\_MEI14482\_ctypes.pyd 6456FEA123E04BCEC8A8EED26160E1DF5482E69D187D3E1A0C428995472AC134
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\_MEI14482\_hashlib.pyd 7863E1BEDFE1FFC720B67B2EB7B3491DB9D2B8E56B5574E6A40FF90336B8DAFA

Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: String function: 6CBC4220 appears 535 times
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: String function: 6C694220 appears 159 times
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: String function: 1E7A9F20 appears 44 times
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: String function: 03251090 appears 35 times
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: String function: 6CBCBC60 appears 71 times
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: String function: 6CBC8480 appears 88 times

Source: 40.2.xmrig.exe.400000.0.unpack, type: UNPACKEDPE

Matched rule: MAL_XMR_Miner_May19_1 date = 2019-05-31, author = Florian Roth, description = Detects Monero Crypto Coin Miner, score = d6df423efb576f167bc28b3c08d10c397007ba323a0de92d1e504a3f490752fc, reference = https://www.guardicore.com/2019/05/nansh0u-campaign-hackers-arsenal-grows-stronger/

Source: msvcr90.dll.14.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9932069359756097
Source: python27.dll.14.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9987474020190024
Source: _ssl.pyd.14.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9969374194587629
Source: _hashlib.pyd.14.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9965934530336257
Source: unicodedata.pyd.14.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9941517223011364
Source: msvcr90.dll.18.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9932069359756097
Source: python27.dll.18.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9987474020190024
Source: _hashlib.pyd.18.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9965934530336257
Source: _ssl.pyd.18.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9969374194587629
Source: unicodedata.pyd.18.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9941517223011364
Source: msvcr90.dll.24.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9932069359756097
Source: python27.dll.24.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9987474020190024
Source: unicodedata.pyd.24.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9941517223011364
Source: _hashlib.pyd.24.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9965934530336257
Source: _ssl.pyd.24.dr	Static PE information: Section: UPX1 ZLIB complexity 0.9969374194587629

Source: classification engine

Classification label: mal100.rans.troj.evad.mine.winZIP@56/168@18/100

Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe

Code function: 15_2_1E7A9F20 ?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z,GetLastError,?PyWin_GetErrorMessageModule@@YAPAUHINSTANCE__@@K@Z,FormatMessageA,?PyWinObject_FromTCHAR@@YAPAU_object@@PBDH@Z,?PyWinCoreString_FromString@@YAPAU_object@@PBDH@Z,Py_BuildValue,LocalFree,PyErr_SetObject,

15_2_1E7A9F20

Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe

Code function: 15_2_03256F10 LookupPrivilegeValueA,AdjustTokenPrivileges,AdjustTokenPrivileges,AdjustTokenPrivileges,

15_2_03256F10

Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe

Code function: 15_2_03253C20 PyArg_ParseTuple,PyArg_ParseTuple,PyEval_SaveThread,GetDiskFreeSpaceExW,PyErr_Clear,PyArg_ParseTuple,PyEval_SaveThread,GetDiskFreeSpaceExA,PyEval_RestoreThread,PyErr_SetFromWindowsErrWithFilename,Py_BuildValue,

15_2_03253C20

Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe

Code function: ?PyWinObject_AsMultipleString@@YAHPAU_object@@PAPA_WHPAK@Z,CreateServiceW,?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z,?PyWinObject_FreeMultipleString@@YAXPA_W@Z,Py_BuildValue,?PyWinObject_FreeMultipleString@@YAXPA_W@Z,

15_2_1ECB2120

Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe

Code function: 15_2_03254E20 PyDict_New,CreateToolhelp32Snapshot,PyErr_SetFromWindowsErr,Process32First,Py_BuildValue,Py_BuildValue,Py_BuildValue,PyDict_SetItem,Process32Next,CloseHandle,CloseHandle,

15_2_03254E20

Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe

Code function: 15_2_1E7AA5B0 ?PyWinObject_FreeResourceId@@YAXPA_W@Z,

15_2_1E7AA5B0

Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe

Code function: 15_2_03257AA0 PyArg_ParseTuple,StartServiceA,CloseServiceHandle,_Py_NoneStruct,_Py_NoneStruct,

15_2_03257AA0

Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 15_2_1E7D1C30 PyEval_SaveThread,StartServiceCtrlDispatcherW,PyEval_RestoreThread,?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z,_Py_NoneStruct,_Py_NoneStruct,	15_2_1E7D1C30
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 15_2_1E7D2D10 PythonService_main,GetCommandLineW,CommandLineToArgvW,GetModuleFileNameW,GetModuleHandleW,LoadStringW,PythonService_PrepareToHostSingle,StartServiceCtrlDispatcherW,GetLastError,	15_2_1E7D2D10
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 15_2_1E7D15A0 PythonService_StartServiceCtrlDispatcher,StartServiceCtrlDispatcherW,	15_2_1E7D15A0

Source: C:\Program Files\7-Zip\7zG.exe

File created: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:4940:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:2012:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:6240:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6108:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2712:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:3364:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:400:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:6416:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:6288:120:WilError_03

Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe

File created: C:\Users\user\AppData\Local\Temp\_MEI28682

Jump to behavior

Source: C:\Windows\SysWOW64\taskkill.exe

WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process WHERE ( ProcessId = 2284)

Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\System32\rundll32.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown

Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding

Source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	String found in binary or memory: set-addPolicy
Source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	String found in binary or memory: id-cmc-addExtensions

Source: unknown	Process created: C:\Windows\System32\rundll32.exe C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: unknown	Process created: C:\Program Files\7-Zip\7zG.exe "C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\" -ad -an -ai#7zMap16652:184:7zEvent5233
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
Source: unknown	Process created: C:\Windows\System32\SgrmBroker.exe C:\Windows\system32\SgrmBroker.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k UnistackSvcGroup
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc
Source: unknown	Process created: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe "C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe"
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Process created: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe "C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe"
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Process created: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe "C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe"
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Process created: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe "C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe"
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c copy /y C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe C:\Users\user\HelpPane.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\user\HelpPane.exe --startup auto install
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\HelpPane.exe C:\Users\user\HelpPane.exe --startup auto install
Source: C:\Users\user\HelpPane.exe	Process created: C:\Users\user\HelpPane.exe C:\Users\user\HelpPane.exe --startup auto install
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\user\HelpPane.exe start
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\HelpPane.exe C:\Users\user\HelpPane.exe start
Source: C:\Users\user\HelpPane.exe	Process created: C:\Users\user\HelpPane.exe C:\Users\user\HelpPane.exe start
Source: unknown	Process created: C:\Users\user\HelpPane.exe "C:\Users\user\HelpPane.exe"
Source: C:\Users\user\HelpPane.exe	Process created: C:\Users\user\HelpPane.exe "C:\Users\user\HelpPane.exe"
Source: C:\Users\user\HelpPane.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /pid 2284 /f
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /pid 2284 /f
Source: C:\Users\user\HelpPane.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c copy /y C:\Windows\TEMP\_MEI70~1\xmrig.exe C:\Windows\TEMP\xmrig.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\HelpPane.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c copy /y C:\Windows\TEMP\_MEI70~1\config.json C:\Windows\TEMP\config.json
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\HelpPane.exe	Process created: C:\Windows\Temp\xmrig.exe C:\Windows\TEMP\xmrig.exe
Source: C:\Windows\Temp\xmrig.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\HelpPane.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram C:\Users\user\HelpPane.exe "MyApp" ENABLE
Source: C:\Windows\SysWOW64\netsh.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Windows\System32\spoolsv.exe C:\Windows\System32\spoolsv.exe
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Process created: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe "C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe"	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Process created: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe "C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe"	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c copy /y C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe C:\Users\user\HelpPane.exe	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\user\HelpPane.exe --startup auto install	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\user\HelpPane.exe start	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\HelpPane.exe C:\Users\user\HelpPane.exe --startup auto install	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Process created: C:\Users\user\HelpPane.exe C:\Users\user\HelpPane.exe --startup auto install	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\HelpPane.exe C:\Users\user\HelpPane.exe start	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Process created: C:\Users\user\HelpPane.exe C:\Users\user\HelpPane.exe start	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Process created: C:\Users\user\HelpPane.exe "C:\Users\user\HelpPane.exe"	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /pid 2284 /f
Source: C:\Users\user\HelpPane.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c copy /y C:\Windows\TEMP\_MEI70~1\xmrig.exe C:\Windows\TEMP\xmrig.exe
Source: C:\Users\user\HelpPane.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c copy /y C:\Windows\TEMP\_MEI70~1\config.json C:\Windows\TEMP\config.json
Source: C:\Users\user\HelpPane.exe	Process created: C:\Windows\Temp\xmrig.exe C:\Windows\TEMP\xmrig.exe
Source: C:\Users\user\HelpPane.exe	Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram C:\Users\user\HelpPane.exe "MyApp" ENABLE
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /pid 2284 /f

Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Program Files\7-Zip\7zG.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: moshost.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mapsbtsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mosstorage.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ztrace_maps.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ztrace_maps.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ztrace_maps.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mapconfiguration.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: storsvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: fltlib.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: bcd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: storageusage.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usosvc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: updatepolicy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cabinet.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: upshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usocoreps.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: usoapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: aphostservice.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: networkhelper.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userdataplatformhelperutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mccspal.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: syncutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: syncutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: vaultcli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dmcfgutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dmcmnutils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dmxmlhelputils.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: inproclogger.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.networking.connectivity.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: synccontroller.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pimstore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: aphostclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: accountaccessor.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: dsclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: systemeventsbrokerclient.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userdatalanguageutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: mccsengineshared.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: pimstore.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: cemapi.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: userdatatypehelperutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: phoneutil.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: pywintypes27.dll	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: pywintypes27.dll	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Section loaded: pywintypes27.dll	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Section loaded: pdh.dll	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Section loaded: pywintypes27.dll	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\HelpPane.exe	Section loaded: rsaenh.dll
Source: C:\Users\user\HelpPane.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\HelpPane.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\HelpPane.exe	Section loaded: pdh.dll
Source: C:\Users\user\HelpPane.exe	Section loaded: powrprof.dll
Source: C:\Users\user\HelpPane.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\HelpPane.exe	Section loaded: umpdc.dll
Source: C:\Users\user\HelpPane.exe	Section loaded: winsta.dll
Source: C:\Users\user\HelpPane.exe	Section loaded: pywintypes27.dll
Source: C:\Users\user\HelpPane.exe	Section loaded: version.dll
Source: C:\Users\user\HelpPane.exe	Section loaded: secur32.dll
Source: C:\Users\user\HelpPane.exe	Section loaded: sspicli.dll
Source: C:\Users\user\HelpPane.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\HelpPane.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\HelpPane.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\HelpPane.exe	Section loaded: mswsock.dll
Source: C:\Users\user\HelpPane.exe	Section loaded: apphelp.dll
Source: C:\Users\user\HelpPane.exe	Section loaded: wsock32.dll
Source: C:\Users\user\HelpPane.exe	Section loaded: napinsp.dll
Source: C:\Users\user\HelpPane.exe	Section loaded: pnrpnsp.dll
Source: C:\Users\user\HelpPane.exe	Section loaded: wshbth.dll
Source: C:\Users\user\HelpPane.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\HelpPane.exe	Section loaded: winrnr.dll
Source: C:\Users\user\HelpPane.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\HelpPane.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: framedynos.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: dbghelp.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: winsta.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\taskkill.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: ntmarta.dll
Source: C:\Windows\Temp\xmrig.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\Temp\xmrig.exe	Section loaded: userenv.dll
Source: C:\Windows\Temp\xmrig.exe	Section loaded: powrprof.dll
Source: C:\Windows\Temp\xmrig.exe	Section loaded: umpdc.dll
Source: C:\Windows\Temp\xmrig.exe	Section loaded: mswsock.dll
Source: C:\Windows\Temp\xmrig.exe	Section loaded: napinsp.dll
Source: C:\Windows\Temp\xmrig.exe	Section loaded: pnrpnsp.dll
Source: C:\Windows\Temp\xmrig.exe	Section loaded: wshbth.dll
Source: C:\Windows\Temp\xmrig.exe	Section loaded: nlaapi.dll
Source: C:\Windows\Temp\xmrig.exe	Section loaded: dnsapi.dll
Source: C:\Windows\Temp\xmrig.exe	Section loaded: winrnr.dll
Source: C:\Windows\Temp\xmrig.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\Temp\xmrig.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\Temp\xmrig.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ifmon.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasmontr.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasapi32.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mfc42u.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: authfwcfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwpolicyiomgr.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: firewallapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwbase.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcmonitor.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3cfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dot3api.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: onex.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappcfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ncrypt.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: eappprxy.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ntasn1.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: fwcfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: hnetmon.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netshell.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nlaapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netsetupapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: netiohlp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshhttp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: httpapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshipsec.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: activeds.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: polstore.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winipsec.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: adsldpc.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: nshwfp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cabinet.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2pnetsh.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: p2p.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rpcnsh.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: whhelper.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlancfg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wlanapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wshelper.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wevtapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: peerdistsh.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wcmapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: rmclient.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mobilenetworking.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: slc.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: sppc.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: gpapi.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: ktmw32.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: mprmsg.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\netsh.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\spoolsv.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\spoolsv.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\spoolsv.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\spoolsv.exe	Section loaded: ualapi.dll
Source: C:\Windows\System32\spoolsv.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\spoolsv.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\spoolsv.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\spoolsv.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\spoolsv.exe	Section loaded: mswsock.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: mpclient.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: secur32.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: sspicli.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: version.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: msasn1.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: userenv.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: gpapi.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: wbemcomn.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: amsi.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: profapi.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: wscapi.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: urlmon.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: iertutil.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: srvcli.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: netutils.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: slc.dll
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Section loaded: sppc.dll

Source: C:\Program Files\7-Zip\7zG.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{56FDF344-FD6D-11d0-958A-006097C9A090}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\7-Zip\7zG.exe

Window detected: Number of UI elements: 15

Source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.zip

Static file information: File size 6169802 > 1048576

Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe

File opened: C:\Users\user\AppData\Local\Temp\_MEI28682\msvcr90.dll

Jump to behavior

Source:	Binary string: O:\src\pywin32\build\temp.win32-2.7\Release\_win32sysloader.pdb source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000E.00000003.1399061320.00000000021D1000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000012.00000003.1416602430.0000000001516000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001C.00000003.1476308666.0000000002FB1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\build27\cpython\PCBuild\python27.pdb1v source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000002.1437875354.000000006CE41000.00000040.00000001.01000000.00000009.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000002.1569290197.000000006CB22000.00000040.00000001.01000000.00000016.sdmp, HelpPane.exe, 0000001F.00000002.2451622387.000000006C5F2000.00000040.00000001.01000000.0000003E.sdmp
Source:	Binary string: C:\build27\cpython\PCBuild\_hashlib.pdb% source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000002.1435325332.000000006CBC1000.00000040.00000001.01000000.0000000E.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000002.1562891852.000000006C779000.00000040.00000001.01000000.0000001B.sdmp, HelpPane.exe, 0000001F.00000002.2443718893.000000006C209000.00000040.00000001.01000000.00000043.sdmp
Source:	Binary string: C:\build27\cpython\PCBuild\_ctypes.pdb source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000002.1575915828.0000000073A82000.00000040.00000001.01000000.00000018.sdmp, HelpPane.exe, 0000001F.00000002.2451179086.000000006C3D2000.00000040.00000001.01000000.00000040.sdmp
Source:	Binary string: C:\build27\cpython\PCBuild\_hashlib.pdb source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000002.1562891852.000000006C779000.00000040.00000001.01000000.0000001B.sdmp, HelpPane.exe, 0000001F.00000002.2443718893.000000006C209000.00000040.00000001.01000000.00000043.sdmp
Source:	Binary string: C:\build27\cpython\PCBuild\_socket.pdb source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000002.1575655979.0000000073A51000.00000040.00000001.01000000.00000019.sdmp, HelpPane.exe, 0000001F.00000002.2450848717.000000006C3A1000.00000040.00000001.01000000.00000041.sdmp
Source:	Binary string: O:\src\pywin32\build\temp.win32-2.7\Release\pywintypes.pdb source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000002.1433643030.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp
Source:	Binary string: O:\src\pywin32\build\temp.win32-2.7\Release\servicemanager.pdb source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000002.1434219289.000000001E7D1000.00000040.00000001.01000000.00000015.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000002.1561871341.000000001E7D4000.00000040.00000001.01000000.00000022.sdmp, HelpPane.exe, 0000001F.00000002.2443190696.000000001E7D4000.00000040.00000001.01000000.0000004A.sdmp
Source:	Binary string: O:\src\pywin32\build\temp.win32-2.7\Release\pywintypes.pdb$ source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000002.1433643030.000000001E7A1000.00000040.00000001.01000000.00000012.sdmp
Source:	Binary string: O:\src\pywin32\build\temp.win32-2.7\Release\win32service.pdbl source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000002.1435001879.000000001ECB1000.00000040.00000001.01000000.00000011.sdmp
Source:	Binary string: msvcm90.i386.pdb source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000E.00000003.1399292112.00000000021D1000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000018.00000003.1442751141.00000000025A0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: O:\src\pywin32\build\temp.win32-2.7\Release\win32api.pdb source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp
Source:	Binary string: O:\src\pywin32\build\temp.win32-2.7\Release\win32service.pdb source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000002.1435001879.000000001ECB1000.00000040.00000001.01000000.00000011.sdmp
Source:	Binary string: C:\build27\cpython\PCBuild\python27.pdb source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000002.1437875354.000000006CE41000.00000040.00000001.01000000.00000009.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000002.1569290197.000000006CB22000.00000040.00000001.01000000.00000016.sdmp, HelpPane.exe, 0000001F.00000002.2451622387.000000006C5F2000.00000040.00000001.01000000.0000003E.sdmp
Source:	Binary string: O:\src\pywin32\build\temp.win32-2.7\Release\servicemanager.pdb19 source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000002.1434219289.000000001E7D1000.00000040.00000001.01000000.00000015.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000002.1561871341.000000001E7D4000.00000040.00000001.01000000.00000022.sdmp, HelpPane.exe, 0000001F.00000002.2443190696.000000001E7D4000.00000040.00000001.01000000.0000004A.sdmp
Source:	Binary string: C:\build27\cpython\PCBuild\_ssl.pdb source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000002.1436346191.000000006CCD1000.00000040.00000001.01000000.0000000D.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000002.1565656857.000000006C8DF000.00000040.00000001.01000000.0000001A.sdmp, HelpPane.exe, 0000001F.00000002.2446687040.000000006C36F000.00000040.00000001.01000000.00000042.sdmp
Source:	Binary string: O:\src\pywin32\build\temp.win32-2.7\Release\win32event.pdb source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000002.1434686478.000000001E9B1000.00000040.00000001.01000000.00000014.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000002.1562434901.000000001E9B4000.00000040.00000001.01000000.00000021.sdmp, HelpPane.exe, 0000001F.00000002.2443445446.000000001E9B4000.00000040.00000001.01000000.00000049.sdmp
Source:	Binary string: C:\build27\cpython\PCBuild\_ctypes.pdba source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000002.1442157158.0000000074DE1000.00000040.00000001.01000000.0000000B.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000002.1575915828.0000000073A82000.00000040.00000001.01000000.00000018.sdmp, HelpPane.exe, 0000001F.00000002.2451179086.000000006C3D2000.00000040.00000001.01000000.00000040.sdmp

Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe

Code function: 15_2_1E7AACE0 _DllMain@12,GetModuleHandleA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,RtlInitializeCriticalSection,TlsAlloc,RtlDeleteCriticalSection,TlsFree,

15_2_1E7AACE0

Source: _ssl.pyd.14.dr	Static PE information: section name: UPX2
Source: bz2.pyd.14.dr	Static PE information: section name: UPX2
Source: netifaces.pyd.14.dr	Static PE information: section name: UPX2
Source: psutil._psutil_windows.pyd.14.dr	Static PE information: section name: UPX2
Source: Crypto.Cipher._AES.pyd.14.dr	Static PE information: section name: UPX2
Source: _ctypes.pyd.14.dr	Static PE information: section name: UPX2
Source: _hashlib.pyd.14.dr	Static PE information: section name: UPX2
Source: _socket.pyd.14.dr	Static PE information: section name: UPX2
Source: pyexpat.pyd.14.dr	Static PE information: section name: UPX2
Source: select.pyd.14.dr	Static PE information: section name: UPX2
Source: unicodedata.pyd.14.dr	Static PE information: section name: UPX2
Source: back.jpg.14.dr	Static PE information: section name: UPX2
Source: Crypto.Cipher._AES.pyd.18.dr	Static PE information: section name: UPX2
Source: _ctypes.pyd.18.dr	Static PE information: section name: UPX2
Source: _hashlib.pyd.18.dr	Static PE information: section name: UPX2
Source: _socket.pyd.18.dr	Static PE information: section name: UPX2
Source: _ssl.pyd.18.dr	Static PE information: section name: UPX2
Source: bz2.pyd.18.dr	Static PE information: section name: UPX2
Source: netifaces.pyd.18.dr	Static PE information: section name: UPX2
Source: psutil._psutil_windows.pyd.18.dr	Static PE information: section name: UPX2
Source: pyexpat.pyd.18.dr	Static PE information: section name: UPX2
Source: select.pyd.18.dr	Static PE information: section name: UPX2
Source: unicodedata.pyd.18.dr	Static PE information: section name: UPX2
Source: back.jpg.18.dr	Static PE information: section name: UPX2
Source: unicodedata.pyd.24.dr	Static PE information: section name: UPX2
Source: back.jpg.24.dr	Static PE information: section name: UPX2
Source: Crypto.Cipher._AES.pyd.24.dr	Static PE information: section name: UPX2
Source: _ctypes.pyd.24.dr	Static PE information: section name: UPX2
Source: _hashlib.pyd.24.dr	Static PE information: section name: UPX2
Source: _socket.pyd.24.dr	Static PE information: section name: UPX2
Source: _ssl.pyd.24.dr	Static PE information: section name: UPX2
Source: bz2.pyd.24.dr	Static PE information: section name: UPX2
Source: netifaces.pyd.24.dr	Static PE information: section name: UPX2
Source: psutil._psutil_windows.pyd.24.dr	Static PE information: section name: UPX2
Source: pyexpat.pyd.24.dr	Static PE information: section name: UPX2
Source: select.pyd.24.dr	Static PE information: section name: UPX2

Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 15_2_03258A11 push ecx; ret	15_2_03258A24
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 15_2_1000520B push 0000006Ah; retf	15_2_1000527C
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 15_2_1000520D push 0000006Ah; retf	15_2_1000527C
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 15_2_10003B21 push ecx; ret	15_2_10003B34
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 15_2_100051A3 push 0000006Ah; retf	15_2_1000527C
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 15_2_1E7ABEB5 push ecx; ret	15_2_1E7ABEC8
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 15_2_1E7D391D push ecx; ret	15_2_1E7D3930
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 15_2_1E8CDEE1 push ecx; ret	15_2_1E8CDEF4
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 15_2_1ECBA0C3 push ds; retf	15_2_1ECBA0C4
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 15_2_1ECBA2C3 push ss; retf	15_2_1ECBA2C6
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 15_2_1ECB8650 push edi; retf	15_2_1ECB8652
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 15_2_1ECB860B push ebp; retf	15_2_1ECB860E
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 15_2_1ECB8611 push esi; retf	15_2_1ECB8612
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 15_2_1ECB8631 push esi; retf	15_2_1ECB8632
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 15_2_1ECB85E8 push ebp; retf	15_2_1ECB85F2
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 15_2_1ECB85F3 push ebp; retf	15_2_1ECB85F6
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 15_2_1ECBA183 pushad ; retf	15_2_1ECBA185
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 15_2_1ECB5991 push ecx; ret	15_2_1ECB59A4
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 15_2_1ECB8107 push ecx; retf	15_2_1ECB8112
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 15_2_6CC78511 push ecx; ret	15_2_6CC78524
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 19_2_6C748511 push ecx; ret	19_2_6C748524
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 19_2_6C695691 push esp; ret	19_2_6C695693
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 19_2_6C6BD741 push esp; ret	19_2_6C6BD743
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 19_2_6C7C2981 push esp; ret	19_2_6C7C2983
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 19_2_6C7D8501 push esp; ret	19_2_6C7D8503

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1
Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Persistence and Installation Behavior

Contains functionality to infect the boot sector

Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: PyDict_New,CreateFileA,DeviceIoControl,GetLastError,DeviceIoControl,__aulldiv,__aulldiv,Py_BuildValue,PyDict_SetItemString,GetLastError,GetLastError,GetLastError,CloseHandle,PyErr_SetFromWindowsErr,CloseHandle, \\.\PhysicalDrive%d	15_2_03253F40
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: PyDict_New,CreateFileA,DeviceIoControl,GetLastError,DeviceIoControl,__aulldiv,__aulldiv,Py_BuildValue,PyDict_SetItemString,GetLastError,GetLastError,GetLastError,CloseHandle,PyErr_SetFromWindowsErr,CloseHandle, PhysicalDrive%i	15_2_03253F40
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: PyDict_New,CreateFileA,DeviceIoControl,GetLastError,DeviceIoControl,__aulldiv,__aulldiv,Py_BuildValue,PyDict_SetItemString,GetLastError,GetLastError,GetLastError,CloseHandle,PyErr_SetFromWindowsErr,CloseHandle, DeviceIoControl -> ERROR_INVALID_FUNCTION; ignore PhysicalDrive%i	15_2_03253F40
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: PyDict_New,CreateFileA,DeviceIoControl,GetLastError,DeviceIoControl,__aulldiv,__aulldiv,Py_BuildValue,PyDict_SetItemString,GetLastError,GetLastError,GetLastError,CloseHandle,PyErr_SetFromWindowsErr,CloseHandle, DeviceIoControl -> ERROR_NOT_SUPPORTED; ignore PhysicalDrive%i	15_2_03253F40

Found pyInstaller with non standard icon

Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Process created: "C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe"
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Process created: "C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe"
Source: C:\Users\user\HelpPane.exe	Process created: C:\Users\user\HelpPane.exe --startup auto install
Source: C:\Users\user\HelpPane.exe	Process created: C:\Users\user\HelpPane.exe start

Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI14482\msvcr90.dll	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI28682\bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI28682\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI28682\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI57642\perfmon.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI70482\perfmon.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI33482\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI14482\win32api.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI28682\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI28682\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI57642\xmrig.exe	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI70482\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI57642\msvcr90.dll	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI70482\xmrig.exe	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI14482\perfmon.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI57642\win32evtlog.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI57642\bz2.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI33482\xmrig.exe	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI70482\win32api.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI14482\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI70482\win32service.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI33482\bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI57642\netifaces.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI70482\pywintypes27.dll	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI28682\back.jpg	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI70482\back.jpg	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI14482\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI57642\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI33482\python27.dll	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI28682\python27.dll	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI57642\win32api.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI33482\win32evtlog.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI28682\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI70482\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI57642\msvcm90.dll	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI57642\_socket.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI14482\msvcm90.dll	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI14482\Crypto.Cipher._AES.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI33482\msvcp90.dll	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI70482\psutil._psutil_windows.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI28682\win32evtlog.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI14482\win32evtlog.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI57642\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI14482\xmrig.exe	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI70482\win32evtlog.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI33482\servicemanager.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI14482\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI57642\back.jpg	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI14482\win32service.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI57642\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI70482\bz2.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI33482\perfmon.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI28682\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI14482\_win32sysloader.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI70482\servicemanager.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI28682\msvcp90.dll	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI28682\pywintypes27.dll	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI70482\msvcr90.dll	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI70482\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI33482\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI70482\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI28682\netifaces.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI28682\xmrig.exe	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Users\user\HelpPane.exe	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI14482\servicemanager.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI28682\psutil._psutil_windows.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI28682\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI70482\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI33482\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI33482\Crypto.Cipher._AES.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI28682\win32api.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI33482\win32service.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI57642\psutil._psutil_windows.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI57642\win32service.pyd	Jump to dropped file
Source: C:\Program Files\7-Zip\7zG.exe	File created: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI28682\win32event.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI70482\python27.dll	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI57642\Crypto.Cipher._AES.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI33482\msvcm90.dll	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI33482\win32event.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI14482\bz2.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI14482\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI28682\perfmon.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI14482\psutil._psutil_windows.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI57642\select.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI14482\msvcp90.dll	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI57642\python27.dll	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI57642\servicemanager.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI70482\msvcp90.dll	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI28682\msvcr90.dll	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI57642\_win32sysloader.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI70482\msvcm90.dll	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI33482\psutil._psutil_windows.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI14482\win32event.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI33482\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI57642\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI57642\win32event.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI33482\win32api.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI70482\Crypto.Cipher._AES.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI57642\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI33482\netifaces.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI70482\netifaces.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI28682\_win32sysloader.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI70482\_hashlib.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Windows\Temp\xmrig.exe	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI14482\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI70482\_win32sysloader.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI33482\msvcr90.dll	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI14482\pywintypes27.dll	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI14482\back.jpg	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI57642\pywintypes27.dll	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI33482\_win32sysloader.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI33482\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI57642\msvcp90.dll	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI33482\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI28682\win32service.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI33482\pywintypes27.dll	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI33482\back.jpg	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI14482\_socket.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI70482\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI14482\python27.dll	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI70482\win32event.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI33482\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI28682\msvcm90.dll	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI28682\Crypto.Cipher._AES.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI28682\servicemanager.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI14482\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI14482\netifaces.pyd	Jump to dropped file

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\HelpPane.exe

Jump to dropped file

Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI70482\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI70482\perfmon.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI70482\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI70482\select.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI70482\Crypto.Cipher._AES.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI70482\netifaces.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI70482\psutil._psutil_windows.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI70482\xmrig.exe	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI70482\python27.dll	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI70482\win32evtlog.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI70482\_hashlib.pyd	Jump to dropped file
Source: C:\Windows\SysWOW64\cmd.exe	File created: C:\Windows\Temp\xmrig.exe	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI70482\_win32sysloader.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI70482\win32api.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI70482\bz2.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI70482\win32service.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI70482\servicemanager.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI70482\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI70482\pywintypes27.dll	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI70482\win32event.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI70482\back.jpg	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI70482\msvcp90.dll	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI70482\msvcr90.dll	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI70482\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI70482\_socket.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI70482\msvcm90.dll	Jump to dropped file

Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI28682\back.jpg	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI57642\back.jpg	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI33482\back.jpg	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Users\user\AppData\Local\Temp\_MEI14482\back.jpg	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	File created: C:\Windows\Temp\_MEI70482\back.jpg	Jump to dropped file

Boot Survival

Contains functionality to infect the boot sector

Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: PyDict_New,CreateFileA,DeviceIoControl,GetLastError,DeviceIoControl,__aulldiv,__aulldiv,Py_BuildValue,PyDict_SetItemString,GetLastError,GetLastError,GetLastError,CloseHandle,PyErr_SetFromWindowsErr,CloseHandle, \\.\PhysicalDrive%d	15_2_03253F40
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: PyDict_New,CreateFileA,DeviceIoControl,GetLastError,DeviceIoControl,__aulldiv,__aulldiv,Py_BuildValue,PyDict_SetItemString,GetLastError,GetLastError,GetLastError,CloseHandle,PyErr_SetFromWindowsErr,CloseHandle, PhysicalDrive%i	15_2_03253F40
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: PyDict_New,CreateFileA,DeviceIoControl,GetLastError,DeviceIoControl,__aulldiv,__aulldiv,Py_BuildValue,PyDict_SetItemString,GetLastError,GetLastError,GetLastError,CloseHandle,PyErr_SetFromWindowsErr,CloseHandle, DeviceIoControl -> ERROR_INVALID_FUNCTION; ignore PhysicalDrive%i	15_2_03253F40
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: PyDict_New,CreateFileA,DeviceIoControl,GetLastError,DeviceIoControl,__aulldiv,__aulldiv,Py_BuildValue,PyDict_SetItemString,GetLastError,GetLastError,GetLastError,CloseHandle,PyErr_SetFromWindowsErr,CloseHandle, DeviceIoControl -> ERROR_NOT_SUPPORTED; ignore PhysicalDrive%i	15_2_03253F40

Drops PE files to the user root directory

Source: C:\Windows\SysWOW64\cmd.exe

File created: C:\Users\user\HelpPane.exe

Jump to dropped file

Source: C:\Users\user\HelpPane.exe

Registry key created: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\StateftpService\PythonClass

Jump to behavior

Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe

Code function: 15_2_03257AA0 PyArg_ParseTuple,StartServiceA,CloseServiceHandle,_Py_NoneStruct,_Py_NoneStruct,

15_2_03257AA0

Hooking and other Techniques for Hiding and Protection

Uses known network protocols on non-standard ports

Source: unknown

Network traffic detected: HTTP traffic on port 50126 -> 2121

Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe

15_2_1E7AACE0

Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\HelpPane.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\HelpPane.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\taskkill.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\xmrig.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\Temp\xmrig.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Temp\xmrig.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Windows\System32\svchost.exe

File opened / queried: SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}

Jump to behavior

Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe

Code function: 19_2_6C72D6C0 rdtsc

19_2_6C72D6C0

Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: PyList_New,OpenSCManagerA,EnumServicesStatusExW,EnumServicesStatusExW,GetLastError,73BB3B4E,EnumServicesStatusExW,PyUnicodeUCS2_FromWideChar,PyUnicodeUCS2_FromWideChar,PyUnicodeUCS2_FromWideChar,Py_BuildValue,PyList_Append,CloseServiceHandle,73BB3B4E,CloseServiceHandle,73BB3B4E,	15_2_03257320
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: PyArg_ParseTuple,?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z,PyEval_SaveThread,EnumServicesStatusW,EnumServicesStatusW,GetLastError,EnumServicesStatusW,PyEval_RestoreThread,?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z,PyTuple_New,?PyWinObject_FromOLECHAR@@YAPAU_object@@PB_W@Z,?PyWinObject_FromOLECHAR@@YAPAU_object@@PB_W@Z,?PyWinObject_FromOLECHAR@@YAPAU_object@@PB_W@Z,Py_BuildValue,PyTuple_SetItem,	15_2_1ECB2380
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: _Py_NoneStruct,PyExc_NotImplementedError,PyErr_SetString,?PyWinObject_FreeWCHAR@@YAXPA_W@Z,?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z,?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z,PyArg_ParseTuple,?PyWinObject_FreeWCHAR@@YAXPA_W@Z,PyExc_NotImplementedError,PyErr_SetString,?PyWinObject_FreeWCHAR@@YAXPA_W@Z,?PyWinObject_AsWCHAR@@YAHPAU_object@@PAPA_WHPAK@Z,PyList_New,?PyWinObject_FreeWCHAR@@YAXPA_W@Z,Py_BuildValue,?PyWinObject_FromOLECHAR@@YAPAU_object@@PB_W@Z,PyEval_SaveThread,EnumServicesStatusExW,PyEval_RestoreThread,GetLastError,?PyWinObject_FromOLECHAR@@YAPAU_object@@PB_W@Z,?PyWinObject_FromOLECHAR@@YAPAU_object@@PB_W@Z,Py_BuildValue,PyList_Append,73BB3B4E,?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z,PyErr_NoMemory,73BB3B4E,?PyWinObject_FreeWCHAR@@YAXPA_W@Z,	15_2_1ECB2570

Source: C:\Users\user\HelpPane.exe

Window / User API: threadDelayed 2971

Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI14482\msvcr90.dll	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI28682\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI28682\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI28682\bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI57642\perfmon.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Windows\Temp\_MEI70482\perfmon.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI14482\win32api.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI33482\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI28682\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI28682\select.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Windows\Temp\_MEI70482\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI57642\msvcr90.dll	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI14482\perfmon.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI57642\win32evtlog.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI57642\bz2.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Windows\Temp\_MEI70482\win32api.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Windows\Temp\_MEI70482\win32service.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI14482\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI33482\bz2.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI57642\netifaces.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI28682\back.jpg	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Windows\Temp\_MEI70482\back.jpg	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI14482\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI57642\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI33482\python27.dll	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI28682\python27.dll	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI57642\win32api.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI33482\win32evtlog.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI28682\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Windows\Temp\_MEI70482\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI57642\msvcm90.dll	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI57642\_socket.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI14482\msvcm90.dll	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI14482\Crypto.Cipher._AES.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI33482\msvcp90.dll	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Windows\Temp\_MEI70482\psutil._psutil_windows.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI28682\win32evtlog.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI14482\win32evtlog.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI57642\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Windows\Temp\_MEI70482\win32evtlog.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI33482\servicemanager.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI14482\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI57642\back.jpg	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI14482\win32service.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI57642\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Windows\Temp\_MEI70482\bz2.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI33482\perfmon.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI28682\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Windows\Temp\_MEI70482\servicemanager.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI14482\_win32sysloader.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI28682\msvcp90.dll	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Windows\Temp\_MEI70482\msvcr90.dll	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Windows\Temp\_MEI70482\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI33482\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Windows\Temp\_MEI70482\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI28682\netifaces.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI14482\servicemanager.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI28682\psutil._psutil_windows.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI28682\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Windows\Temp\_MEI70482\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI33482\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI33482\Crypto.Cipher._AES.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI28682\win32api.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI33482\win32service.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI57642\win32service.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI57642\psutil._psutil_windows.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI28682\win32event.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Windows\Temp\_MEI70482\python27.dll	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI57642\Crypto.Cipher._AES.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI33482\msvcm90.dll	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI14482\bz2.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI33482\win32event.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI14482\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI28682\perfmon.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI14482\psutil._psutil_windows.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI57642\select.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI14482\msvcp90.dll	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI57642\servicemanager.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI57642\python27.dll	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Windows\Temp\_MEI70482\msvcp90.dll	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI28682\msvcr90.dll	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI57642\_win32sysloader.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Windows\Temp\_MEI70482\msvcm90.dll	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI33482\psutil._psutil_windows.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI14482\win32event.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI33482\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI57642\win32event.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI57642\unicodedata.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI33482\win32api.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Windows\Temp\_MEI70482\Crypto.Cipher._AES.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI57642\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI33482\netifaces.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Windows\Temp\_MEI70482\netifaces.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI28682\_win32sysloader.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Windows\Temp\_MEI70482\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI14482\pyexpat.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Windows\Temp\_MEI70482\_win32sysloader.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI33482\msvcr90.dll	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI14482\back.jpg	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI33482\_win32sysloader.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI33482\select.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI57642\msvcp90.dll	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI33482\_hashlib.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI28682\win32service.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI33482\back.jpg	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Windows\Temp\_MEI70482\_ctypes.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI14482\_socket.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI14482\python27.dll	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Windows\Temp\_MEI70482\win32event.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI33482\_socket.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI28682\msvcm90.dll	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI28682\Crypto.Cipher._AES.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI14482\_ssl.pyd	Jump to dropped file
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI28682\servicemanager.pyd	Jump to dropped file
Source: C:\Users\user\HelpPane.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\_MEI14482\netifaces.pyd	Jump to dropped file

Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	API coverage: 2.4 %
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	API coverage: 2.2 %

Source: C:\Windows\System32\svchost.exe TID: 6584	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\HelpPane.exe TID: 1108	Thread sleep count: 88 > 30
Source: C:\Users\user\HelpPane.exe TID: 1108	Thread sleep time: -5280000s >= -30000s
Source: C:\Users\user\HelpPane.exe TID: 1108	Thread sleep count: 2971 > 30
Source: C:\Users\user\HelpPane.exe TID: 1108	Thread sleep time: -178260000s >= -30000s
Source: C:\Users\user\HelpPane.exe TID: 1108	Thread sleep time: -60000s >= -30000s

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Users\user\HelpPane.exe	Last function: Thread delayed
Source: C:\Users\user\HelpPane.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\Windows\System32 FullSizeInformation	Jump to behavior

Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 15_2_1E8C1F60 PyArg_ParseTuple,?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z,PyList_New,FindFirstFileA,GetLastError,?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z,PyList_Append,?PyObject_FromWIN32_FIND_DATAA@@YAPAU_object@@PAU_WIN32_FIND_DATAA@@@Z,PyList_Append,FindNextFileA,GetLastError,?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z,?PyWinObject_FreeString@@YAXPAD@Z,FindClose,		15_2_1E8C1F60
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 19_2_6C876D30 FindFirstFileA,FindNextFileA,		19_2_6C876D30

Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe

15_2_032541B0

Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe

Code function: 15_2_03257FF0 GetSystemInfo,

15_2_03257FF0

Source: C:\Users\user\HelpPane.exe	Thread delayed: delay time: 60000
Source: C:\Users\user\HelpPane.exe	Thread delayed: delay time: 60000
Source: C:\Users\user\HelpPane.exe	Thread delayed: delay time: 60000

Source: xmrig.exe, 00000028.00000002.2393808878.0000000000CB8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWx
Source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000002.1421745078.0000000001598000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000008.00000002.2363238427.000001C3FA435000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: (@\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: svchost.exe, 00000008.00000002.2366199663.000001C3FA481000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#disk&ven_vmware&prod_virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000002.1421549635.0000000001564000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll]]3C
Source: svchost.exe, 00000004.00000002.2383306605.0000026EDB261000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000004.00000002.2382689935.0000026EDB25B000.00000004.00000020.00020000.00000000.sdmp, xmrig.exe, 00000028.00000002.2393808878.0000000000CB8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: svchost.exe, 00000008.00000002.2359254016.000001C3FA402000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HvHostWdiSystemHostScDeviceEnumWiaRpctrkwksAudioEndpointBuilderhidservdot3svcUmRdpServiceDsSvcfhsvcvmickvpexchangevmicshutdownvmicguestinterfacevmicvmsessionsvsvcStorSvcWwanSvcvmicvssDevQueryBrokerNgcSvcsysmainNetmanTabletInputServicePcaSvcDisplayEnhancementServiceIPxlatCfgSvcDeviceAssociationServiceNcbServiceEmbeddedModeSensorServicewlansvcCscServiceWPDBusEnumMixedRealityOpenXRSvc
Source: svchost.exe, 00000008.00000002.2366199663.000001C3FA476000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\DosDevices\D:
Source: svchost.exe, 00000008.00000002.2368145747.000001C3FA48E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: svchost.exe, 00000008.00000002.2366199663.000001C3FA476000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000`
Source: svchost.exe, 00000008.00000002.2366199663.000001C3FA464000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: (@SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: HelpPane.exe, 0000001F.00000002.2377703970.0000000001401000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: -ssvcsAppXSvcBDESVCBITSdembthservcamsvcCDPSvcClipSVCDhcpxt'diagsvcDoSvc__dot3svcDsmSvcDsSvc__DusmSvcEaphostfdPHostfhsvcgpsvcgupdatehidservHvHosticssvcIKEEXTKeyIsoKtmRmServerlfsvclltdsvclmhostsLxpSvcmpssvcMSDTCMSiSCSINcaSvcNetmanNgcSvcNlaSvcp2psvcPcaSvcPNRPsvcPowerPowereProfSvcQWAVERasAutoRasManRmSvcRpcSsSamSsSDRSVCSENSSensesmphostSpoolersppsvcSSDPSRVSstpSvcstisvcStorSvcsvsvcswprvSysMainSysMainTapiSrvThemesThemesTrkWksuhssvcUsoSvcVacSvcvmicrdvvmicvssW32TimeWcmsvcwcncsvcWecsvcWerSvcWiaRpcWinmgmtWinRMwisvcWlanSvcwlidsvcwlpasvcWManSvcwscsvcWSearchWwanSvc
Source: svchost.exe, 00000004.00000002.2368636896.0000026ED5C24000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW`
Source: svchost.exe, 00000008.00000002.2363238427.000001C3FA44B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: #Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
Source: HelpPane.exe, 0000001F.00000002.2360627331.0000000000B55000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllvw
Source: cacert.pem.24.dr	Binary or memory string: zJVSk/BwJVmcIGfE7vmLV2H0knZ9P4SNVbfo5azV8fUZVqZa+5Acr5Pr5RzUZ5dd
Source: HelpPane.exe, 00000019.00000002.1464032831.00000000011F5000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001D.00000002.1511186122.00000000008C5000.00000004.00000020.00020000.00000000.sdmp, spoolsv.exe, 0000002C.00000002.2356685361.0000000000F51000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000002.1547812373.00000000006A3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll]]
Source: netsh.exe, 0000002A.00000003.1566389249.00000000007F1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllxx

Source: C:\Users\user\HelpPane.exe

Process information queried: ProcessInformation

Anti Debugging

Found API chain indicative of debugger detection

Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe

Debugger detection routine: QueryPerformanceCounter, DebugActiveProcess, DecisionNodes, ExitProcess or Sleep

graph_15-51588

Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe

Code function: 19_2_6C72D6C0 rdtsc

19_2_6C72D6C0

Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe

Code function: 15_2_03258B0E IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,

15_2_03258B0E

Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe

15_2_1E7AACE0

Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe

Code function: 15_2_03251F60 PyArg_ParseTuple,CloseHandle,GetProcessHeap,HeapFree,CloseHandle,Py_BuildValue,

15_2_03251F60

Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Process token adjusted: Debug
Source: C:\Users\user\HelpPane.exe	Process token adjusted: Debug
Source: C:\Windows\SysWOW64\taskkill.exe	Process token adjusted: Debug

Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 15_2_03258B0E IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	15_2_03258B0E
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 15_2_10003C1E IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	15_2_10003C1E
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 15_2_1E7AC310 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	15_2_1E7AC310
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 15_2_1E7D3A1A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	15_2_1E7D3A1A
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 15_2_1E8CDFDE IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	15_2_1E8CDFDE
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 15_2_1ECB5A9A IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	15_2_1ECB5A9A
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Code function: 19_2_6C747C08 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	19_2_6C747C08

Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe

Code function: 15_2_1E8CABA0 PyArg_ParseTuple,PyEval_SaveThread,keybd_event,PyEval_RestoreThread,_Py_NoneStruct,_Py_NoneStruct,

15_2_1E8CABA0

Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe

Code function: 15_2_1E8CAC20 PyArg_ParseTuple,PyEval_SaveThread,mouse_event,PyEval_RestoreThread,_Py_NoneStruct,_Py_NoneStruct,

15_2_1E8CAC20

Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Process created: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe "C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe"	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Process created: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe "C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe"	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c copy /y C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe C:\Users\user\HelpPane.exe	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\user\HelpPane.exe --startup auto install	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c C:\Users\user\HelpPane.exe start	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\HelpPane.exe C:\Users\user\HelpPane.exe --startup auto install	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Process created: C:\Users\user\HelpPane.exe C:\Users\user\HelpPane.exe --startup auto install	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\HelpPane.exe C:\Users\user\HelpPane.exe start	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Process created: C:\Users\user\HelpPane.exe C:\Users\user\HelpPane.exe start	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Process created: C:\Users\user\HelpPane.exe "C:\Users\user\HelpPane.exe"	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c taskkill /pid 2284 /f
Source: C:\Users\user\HelpPane.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c copy /y C:\Windows\TEMP\_MEI70~1\xmrig.exe C:\Windows\TEMP\xmrig.exe
Source: C:\Users\user\HelpPane.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c copy /y C:\Windows\TEMP\_MEI70~1\config.json C:\Windows\TEMP\config.json
Source: C:\Users\user\HelpPane.exe	Process created: C:\Windows\Temp\xmrig.exe C:\Windows\TEMP\xmrig.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /pid 2284 /f

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\taskkill.exe taskkill /pid 2284 /f

Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe

Code function: 15_2_1E7A6310 ?SetSecurityDescriptorDacl@PySECURITY_DESCRIPTOR@@SAPAU_object@@PAU2@0@Z,PyArg_ParseTuple,?PyWinObject_AsACL@@YAHPAU_object@@PAPAU_ACL@@H@Z,?_MakeAbsoluteSD@@YAHPAXPAPAX@Z,SetSecurityDescriptorDacl,?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z,?SetSD@PySECURITY_DESCRIPTOR@@QAEHPAX@Z,_Py_NoneStruct,73BB3B4E,73BB3B4E,73BB3B4E,

15_2_1E7A6310

Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe

Code function: 15_2_1E7A7760 ?PyWinMethod_NewSID@@YAPAU_object@@PAU1@0@Z,PyArg_ParseTuple,PyArg_ParseTuple,PyErr_Clear,PyErr_Clear,PyArg_ParseTuple,PyErr_Clear,PyArg_ParseTuple,PySequence_Check,PyExc_TypeError,PyErr_SetString,PySequence_Size,PySequence_Tuple,PyArg_ParseTuple,PyExc_TypeError,PyErr_SetString,AllocateAndInitializeSid,?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z,??0PySID@@QAE@PAX@Z,??0PySID@@QAE@HPAX@Z,

15_2_1E7A7760

Source: HelpPane.exe, 00000019.00000003.1454626868.00000000037A4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DOF_PROGMANt
Source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000003.1415771851.000000000396C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DOF_PROGMAN`
Source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000003.1415771851.000000000396C000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000003.1530378189.0000000002AEA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DOF_PROGMAN
Source: HelpPane.exe, 0000001D.00000003.1499803297.0000000002CB4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: DOF_PROGMAN`i

Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe

Code function: 19_2_6C72D4C0 cpuid

19_2_6C72D4C0

Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C: VolumeInformation	Jump to behavior
Source: C:\Windows\System32\svchost.exe	Queries volume information: C: VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI28682\Crypto.Cipher._AES.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI28682\_ctypes.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI28682\_socket.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI28682\_ssl.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI28682\_hashlib.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI28682\psutil._psutil_windows.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI28682\netifaces.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI28682\win32service.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI28682\win32event.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI28682\servicemanager.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI57642\Crypto.Cipher._AES.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI57642\_ctypes.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI57642\_socket.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI57642\_hashlib.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI57642\psutil._psutil_windows.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI57642\netifaces.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI57642\win32service.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI57642\win32event.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI57642\servicemanager.pyd VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33482\Crypto.Cipher._AES.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33482\_ctypes.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33482\_socket.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33482\_hashlib.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33482\psutil._psutil_windows.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33482\netifaces.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33482\win32service.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33482\win32api.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33482\win32event.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI33482\servicemanager.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI14482\Crypto.Cipher._AES.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI14482\_ctypes.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI14482\_socket.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI14482\_ssl.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI14482\_hashlib.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI14482\psutil._psutil_windows.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI14482\netifaces.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI14482\win32service.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI14482\win32event.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_MEI14482\servicemanager.pyd VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\_MEI70482\Crypto.Cipher._AES.pyd VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\_MEI70482\_ctypes.pyd VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\_MEI70482\_socket.pyd VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\_MEI70482\_hashlib.pyd VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\_MEI70482\psutil._psutil_windows.pyd VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\_MEI70482\netifaces.pyd VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\_MEI70482\win32service.pyd VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\_MEI70482\win32api.pyd VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\_MEI70482\win32event.pyd VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\_MEI70482\servicemanager.pyd VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Users\user\HelpPane.exe VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\link.txt VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation
Source: C:\Users\user\HelpPane.exe	Queries volume information: C:\Windows\Temp\config VolumeInformation

Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe

Code function: 15_2_032520B0 GetSystemTimes,PyErr_SetFromWindowsErr,Py_BuildValue,

15_2_032520B0

Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe

Code function: 15_2_1E8C2D40 PyArg_ParseTuple,GetUserNameA,?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z,?PyWinObject_FromTCHAR@@YAPAU_object@@PBDH@Z,

15_2_1E8C2D40

Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe

Code function: 15_2_1E7A7AD0 ?Format@PyTime@@SAPAU_object@@PAU2@0@Z,PyArg_ParseTuple,?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z,VariantTimeToSystemTime,GetTimeZoneInformation,?PyWinCoreString_FromString@@YAPAU_object@@PBDH@Z,?PyWinObject_FreeString@@YAXPAD@Z,PyExc_ValueError,PyErr_SetString,

15_2_1E7A7AD0

Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe

Code function: 15_2_03257EE0 RtlGetVersion,

15_2_03257EE0

Source: C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Changes security center settings (notifications, updates, antivirus, firewall)

Source: C:\Windows\System32\svchost.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center cval

Jump to behavior

Modifies the windows firewall

Source: C:\Users\user\HelpPane.exe

Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram C:\Users\user\HelpPane.exe "MyApp" ENABLE

Uses netsh to modify the Windows network and firewall settings

Source: C:\Users\user\HelpPane.exe

Process created: C:\Windows\SysWOW64\netsh.exe netsh firewall add allowedprogram C:\Users\user\HelpPane.exe "MyApp" ENABLE

Source: svchost.exe, 0000000C.00000002.2369878989.0000027CD2702000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: gramFiles%\Windows Defender\MsMpeng.exe
Source: svchost.exe, 0000000C.00000002.2369878989.0000027CD2702000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\SecurityCenter2 : AntiVirusProduct

Source: HelpPane.exe, 0000001D.00000003.1502705766.0000000002B82000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIN_8t
Source: HelpPane.exe, 0000001D.00000003.1502705766.0000000002B82000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIN_SERVER_2008t
Source: HelpPane.exe, 0000001D.00000003.1502705766.0000000002B82000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIN_SERVER_2003t
Source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000003.1416968936.000000000381E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIN_SERVER_20038
Source: HelpPane.exe, 0000001F.00000002.2398680627.0000000001701000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIN_XP
Source: HelpPane.exe, 0000001F.00000002.2398680627.0000000001701000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: IS_WIN_XP
Source: HelpPane.exe, 0000001F.00000002.2386623399.00000000015FD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tIS_WIN_XPRft
Source: HelpPane.exe, 0000001D.00000003.1502705766.0000000002B82000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIN_SERVER_2008tWIN_VISTAt
Source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000003.1416968936.000000000381E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIN_XP q
Source: HelpPane.exe, 0000001F.00000002.2398680627.0000000001701000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIN_SERVER_2008
Source: HelpPane.exe, 0000001F.00000002.2398680627.0000000001701000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: >>> if get_winver() <= WIN_VISTA:
Source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000003.1531724512.0000000002A23000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIN_78P
Source: HelpPane.exe, 0000001F.00000002.2398680627.0000000001701000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIN_SERVER_2003p
Source: HelpPane.exe, 0000001F.00000002.2398680627.0000000001701000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIN_SERVER_2003
Source: HelpPane.exe, 0000001F.00000002.2398680627.0000000001701000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIN_7
Source: HelpPane.exe, 0000001F.00000002.2398680627.0000000001701000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIN_8
Source: HelpPane.exe, 0000001D.00000003.1502705766.0000000002B82000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIN_XPRCR-
Source: HelpPane.exe, 00000019.00000003.1461886305.000000000369C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIN_SERVER_2003`
Source: HelpPane.exe, 0000001D.00000003.1502705766.0000000002B82000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIN_7t
Source: HelpPane.exe, 00000019.00000003.1461886305.00000000036A0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIN_XP`
Source: HelpPane.exe, 0000001D.00000003.1502705766.0000000002B82000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIN_XP
Source: HelpPane.exe, 0000001D.00000003.1502705766.0000000002B82000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIN_XPRC
Source: HelpPane.exe, 0000001F.00000002.2398680627.0000000001701000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIN_VISTA
Source: HelpPane.exe, 0000001F.00000002.2386623399.00000000015FD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: IS_WIN_XPRf
Source: HelpPane.exe, 00000019.00000003.1461886305.0000000003695000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: IS_WIN_XPom
Source: HelpPane.exe, 0000001D.00000003.1502705766.0000000002B82000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIN_VISTAt
Source: 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000003.1539960207.0000000002A69000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIN_73X

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	31 Disable or Modify Tools	11 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Ingress Tool Transfer	1 Exfiltration Over Alternative Protocol	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	1 Native API	1 Create Account	1 Access Token Manipulation	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	11 Input Capture	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	2 Command and Scripting Interpreter	23 Windows Service	23 Windows Service	31 Obfuscated Files or Information	Security Account Manager	1 System Service Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	11 Non-Standard Port	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	12 Service Execution	1 Bootkit	12 Process Injection	11 Software Packing	NTDS	3 File and Directory Discovery	Distributed Component Object Model	Input Capture	2 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	38 System Information Discovery	SSH	Keylogging	12 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	241 Masquerading	Cached Domain Credentials	271 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	131 Virtualization/Sandbox Evasion	DCSync	131 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Access Token Manipulation	Proc Filesystem	3 Process Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	1 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Bootkit	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	1 Rundll32	Input Capture	System Network Connections Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\_MEI14482\xmrig.exe	100%	Avira	PUA/GM.Miner.OW
C:\Users\user\AppData\Local\Temp\_MEI14482\xmrig.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\_MEI14482\Crypto.Cipher._AES.pyd	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI14482\Crypto.Cipher._AES.pyd	1%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\_MEI14482\_ctypes.pyd	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI14482\_ctypes.pyd	1%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\_MEI14482\_hashlib.pyd	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI14482\_hashlib.pyd	1%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\_MEI14482\_socket.pyd	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI14482\_socket.pyd	1%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\_MEI14482\_ssl.pyd	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI14482\_ssl.pyd	3%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\_MEI14482\_win32sysloader.pyd	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI14482\_win32sysloader.pyd	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\_MEI14482\back.jpg	70%	ReversingLabs	Win32.Trojan.Mozi
C:\Users\user\AppData\Local\Temp\_MEI14482\back.jpg	69%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\_MEI14482\bz2.pyd	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI14482\bz2.pyd	3%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\_MEI14482\msvcm90.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI14482\msvcm90.dll	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\_MEI14482\msvcp90.dll	7%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI14482\msvcp90.dll	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\_MEI14482\msvcr90.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI14482\msvcr90.dll	1%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\_MEI14482\netifaces.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI14482\netifaces.pyd	2%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\_MEI14482\perfmon.pyd	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI14482\perfmon.pyd	1%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\_MEI14482\psutil._psutil_windows.pyd	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI14482\psutil._psutil_windows.pyd	3%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\_MEI14482\pyexpat.pyd	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI14482\pyexpat.pyd	3%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\_MEI14482\python27.dll	7%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI14482\python27.dll	0%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\_MEI14482\pywintypes27.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI14482\pywintypes27.dll	1%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\_MEI14482\select.pyd	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI14482\select.pyd	1%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\_MEI14482\servicemanager.pyd	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI14482\servicemanager.pyd	1%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\_MEI14482\unicodedata.pyd	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI14482\unicodedata.pyd	3%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\_MEI14482\win32api.pyd	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI14482\win32api.pyd	1%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\_MEI14482\win32event.pyd	3%	ReversingLabs
C:\Users\user\AppData\Local\Temp\_MEI14482\win32event.pyd	1%	Virustotal		Browse

Source	Detection	Scanner	Label	Link
https://dynamic.t	0%	URL Reputation	safe
http://mail.pytho	0%	Avira URL Cloud	safe
http://www.valicert.com/	0%	Avira URL Cloud	safe
http://motomastyle.com/)	0%	Avira URL Cloud	safe
https://mahler:8092/site-updates.py	0%	Avira URL Cloud	safe
http://proxy.ex	0%	Avira URL Cloud	safe
http://crl.ver)	0%	Avira URL Cloud	safe
https://.P	0%	Avira URL Cloud	safe
http://motomastyle.com/)	0%	Virustotal		Browse
http://www.valicert.com/	0%	Virustotal		Browse
https://t0.ssl.ak.dynamic.tiles.virtu	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
dht.transmissionbt.com	87.98.162.88	true	false	high
bttracker.acc.umu.se	130.239.18.158	true	false	high
router.bittorrent.com	67.215.246.10	true	false	high
router.utorrent.com	82.221.103.244	true	false	high
xmr.crypto-pool.fr	unknown	unknown	false	high
bttracker.debian.org	unknown	unknown	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://gcc.gnu.org/bugs/):	xmrig.exe, 00000028.00000002.2357701679.0000000000401000.00000040.00000001.01000000.0000004C.sdmp	false		high
https://mahler:8092/site-updates.py	5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000003.1417854362.00000000033E4000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000002.1555333716.0000000002443000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000003.1535853996.000000000242E000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000019.00000003.1459174688.0000000003186000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001D.00000003.1506183840.0000000002736000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000002.2377703970.0000000001401000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://docs.python.org/3/library/functools.html#functools.lru_cache	5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000003.1416968936.000000000381E000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000002.1430135715.00000000038A5000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000003.1537290974.00000000029FC000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000003.1533071893.0000000002965000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000019.00000003.1456617188.00000000035B1000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000019.00000003.1461886305.0000000003647000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001D.00000002.1516003801.0000000002BFF000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001D.00000003.1502705766.0000000002B82000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000002.2398680627.0000000001701000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000002.2386623399.00000000015FD000.00000004.00000020.00020000.00000000.sdmp	false		high
http://mail.pytho	5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000003.1531724512.0000000002A23000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://dev.ditu.live.com/REST/v1/Routes/	svchost.exe, 00000006.00000003.1369181580.000001F08A465000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/Driving	svchost.exe, 00000006.00000003.1369480637.000001F08A458000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/comp/gen.ashx	svchost.exe, 00000006.00000003.1369635460.000001F08A441000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t0.tiles.ditu.live.com/tiles/gen	svchost.exe, 00000006.00000003.1369061139.000001F08A46D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.python.org/	5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000003.1417854362.00000000033E4000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000002.1555333716.0000000002443000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000003.1535853996.000000000242E000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000019.00000003.1459174688.0000000003186000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001D.00000003.1506183840.0000000002736000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000002.2377703970.0000000001401000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/Walking	svchost.exe, 00000006.00000003.1369480637.000001F08A458000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.google.com/accounts/ClientLogin	5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000002.1430135715.0000000003912000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000003.1416968936.000000000381E000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000003.1539960207.0000000002A94000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000003.1531724512.0000000002A23000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000019.00000003.1456617188.00000000035B1000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000019.00000002.1467840304.00000000036C6000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001D.00000002.1516003801.0000000002C72000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001D.00000003.1502705766.0000000002B82000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000002.2398680627.0000000001701000.00000004.00000020.00020000.00000000.sdmp	false		high
http://proxy.ex	HelpPane.exe, 0000001D.00000003.1506183840.0000000002712000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.openssl.org/support/faq.html	5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000002.1435325332.000000006CBC1000.00000040.00000001.01000000.0000000E.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000002.1436346191.000000006CCD1000.00000040.00000001.01000000.0000000D.sdmp	false		high
https://dev.ditu.live.com/mapcontrol/logging.ashx	svchost.exe, 00000006.00000003.1369480637.000001F08A458000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Imagery/Copyright/	svchost.exe, 00000006.00000003.1369635460.000001F08A441000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1369480637.000001F08A458000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1369549964.000001F08A45A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1368982864.000001F08A46F000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1369181580.000001F08A465000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1369842397.000001F08A466000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gri?pv=1&r=	svchost.exe, 00000006.00000002.1370881496.000001F08A42B000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.iana.org/assignments/tls-parameters/tls-parameters.xml#tls-parameters-6	5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000002.1429985858.0000000003810000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000003.1543469992.000000000251B000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000003.1534608692.00000000024D1000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000019.00000003.1461886305.00000000035B8000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000019.00000003.1456617188.00000000035B1000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001D.00000003.1505560391.0000000002B61000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001D.00000003.1510244840.0000000002B67000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000002.2386623399.00000000015FD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Transit/Schedules/	svchost.exe, 00000006.00000003.1369635460.000001F08A441000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.1371032795.000001F08A444000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.faqs.org/rfcs/rfc2822.html	5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000002.1422339536.0000000003111000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000003.1418367126.00000000034A5000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000003.1416665400.000000000345C000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000003.1543469992.000000000251B000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000002.1550371359.0000000002221000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000003.1534608692.00000000024D1000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000019.00000003.1459174688.0000000003267000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000019.00000003.1458477420.0000000003261000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000019.00000002.1464630708.0000000002EA1000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001D.00000002.1511726383.0000000002451000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001D.00000003.1501662011.00000000027C0000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001D.00000002.1515555939.00000000027C5000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000002.2386623399.00000000015FD000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000002.2377703970.0000000001401000.00000004.00000020.00020000.00000000.sdmp	false		high
http://mail.python.org/pipermail/python-dev/2012-June/120787.html	5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000003.1418367126.0000000003498000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000003.1420484257.00000000031B9000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000003.1416665400.000000000345C000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000003.1544307502.000000000250E000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000003.1534608692.00000000024D1000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000003.1531724512.0000000002A23000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000019.00000003.1458534958.00000000031E7000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000019.00000003.1459174688.0000000003253000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001D.00000003.1501662011.00000000027C0000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001D.00000003.1505560391.0000000002B61000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001D.00000003.1508909107.0000000002804000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000002.2398680627.0000000001701000.00000004.00000020.00020000.00000000.sdmp	false		high
http://docs.python.org/3/library/subprocess.html	5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000003.1418252565.00000000034B5000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000003.1420484257.00000000031B9000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000002.1429863321.00000000034B3000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000003.1418367126.00000000034B3000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000003.1416665400.000000000345C000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000003.1534549383.0000000002AD0000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000003.1534608692.00000000024D1000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000003.1544307502.00000000024D4000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000003.1539960207.0000000002AD0000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000003.1531724512.0000000002A23000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000019.00000003.1459174688.0000000003213000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000019.00000003.1458534958.00000000031E7000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000019.00000003.1456617188.00000000035B1000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000019.00000003.1461886305.00000000035CA000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000019.00000002.1467750392.00000000035CA000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001D.00000002.1515736032.000000000281E000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001D.00000003.1501662011.00000000027C0000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001D.00000002.1515178361.0000000002745000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001D.00000003.1506183840.0000000002736000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000002.2386623399.00000000015FD000.00000004.00000020.00020000.00000000.sdmp	false		high
http://goo.gl/zeJZl	5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000002.1430135715.00000000038BE000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000003.1416968936.000000000381E000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000003.1538803573.00000000022C9000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000003.1537290974.0000000002A15000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000003.1533071893.0000000002965000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000019.00000003.1456617188.00000000035B1000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000019.00000003.1461886305.0000000003660000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001D.00000002.1516003801.0000000002C18000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001D.00000003.1505560391.0000000002B61000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001D.00000003.1502705766.0000000002B82000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000002.2398680627.0000000001701000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000002.2377703970.0000000001401000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.python.org/dev/peps/pep-0205/	5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000002.1430135715.0000000003945000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000003.1416968936.000000000381E000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000003.1539960207.0000000002AC6000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000003.1531724512.0000000002A23000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000019.00000003.1456617188.00000000035B1000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000019.00000002.1467840304.00000000036F8000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001D.00000002.1516003801.0000000002CA4000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001D.00000003.1502705766.0000000002B82000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000002.2398680627.0000000001701000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.bingmapsportal.com	svchost.exe, 00000006.00000002.1370791576.000001F08A413000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Imagery/Copyright/	svchost.exe, 00000006.00000002.1370881496.000001F08A42B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1369480637.000001F08A458000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1369549964.000001F08A45A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1369181580.000001F08A465000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ecn.dev.virtualearth.net/REST/v1/Imagery/Copyright/	svchost.exe, 00000006.00000002.1370881496.000001F08A42B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1369181580.000001F08A465000.00000004.00000020.00020000.00000000.sdmp	false		high
http://pyloris.sourceforge.net/).	5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000003.1416564795.000000000394E000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000003.1418282897.0000000003954000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000003.1531724512.0000000002A23000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000019.00000003.1456617188.00000000035B1000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001D.00000003.1499803297.0000000002CB4000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000002.2386623399.0000000001582000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dynamic.t0.tiles.ditu.live.com/comp/gen.ashx	svchost.exe, 00000006.00000003.1369480637.000001F08A458000.00000004.00000020.00020000.00000000.sdmp	false		high
http://python.org/dev/peps/pep-0263/	5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000002.1437875354.000000006CE41000.00000040.00000001.01000000.00000009.sdmp	false		high
http://www.valicert.com/	cacerts.txt.24.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://motomastyle.com/)	5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000003.1416564795.000000000394E000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000003.1418282897.0000000003954000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000003.1531724512.0000000002A23000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000019.00000003.1456617188.00000000035B1000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001D.00000003.1499803297.0000000002CB4000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000002.2386623399.0000000001582000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://dev.ditu.live.com/REST/v1/Transit/Stops/	svchost.exe, 00000006.00000003.1368721213.000001F08A476000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/	svchost.exe, 00000006.00000002.1370881496.000001F08A42B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1369181580.000001F08A465000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Traffic/Incidents/	svchost.exe, 00000006.00000002.1370881496.000001F08A42B000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1369181580.000001F08A465000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gdi?pv=1&r=	svchost.exe, 00000006.00000003.1369608452.000001F08A44A000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1369480637.000001F08A458000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.1371117634.000001F08A459000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.1371032795.000001F08A449000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dynamic.api.tiles.ditu.live.com/odvs/gri?pv=1&r=	svchost.exe, 00000006.00000003.1369635460.000001F08A441000.00000004.00000020.00020000.00000000.sdmp	false		high
http://crl.ver)	svchost.exe, 00000004.00000002.2383306605.0000026EDB261000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://dev.virtualearth.net/webservices/v1/LoggingService/LoggingService.svc/Log?	svchost.exe, 00000006.00000003.1369198178.000001F08A462000.00000004.00000020.00020000.00000000.sdmp	false		high
http://bugs.python.org/issue6973.	5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000003.1418252565.00000000034B5000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000003.1420484257.00000000031B9000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000002.1429863321.00000000034B3000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000003.1418367126.00000000034B3000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000003.1416665400.000000000345C000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000003.1534549383.0000000002AD0000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000003.1534608692.00000000024D1000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000003.1544307502.00000000024D4000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000003.1539960207.0000000002AD0000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000003.1531724512.0000000002A23000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000019.00000003.1459174688.0000000003213000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000019.00000003.1458534958.00000000031E7000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000019.00000003.1456617188.00000000035B1000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000019.00000003.1461886305.00000000035CA000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000019.00000002.1467750392.00000000035CA000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001D.00000002.1515736032.000000000281E000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001D.00000003.1501662011.00000000027C0000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001D.00000002.1515178361.0000000002745000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001D.00000003.1506183840.0000000002736000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000002.2386623399.00000000015FD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtualearth.net/odvs/gd?pv=1&r=	svchost.exe, 00000006.00000002.1371032795.000001F08A449000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ecn.dev.virtualearth.net/REST/V1/MapControlConfiguration/native/	svchost.exe, 00000006.00000003.1369635460.000001F08A441000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Locations	svchost.exe, 00000006.00000003.1369480637.000001F08A458000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.ditu.live.com/REST/V1/MapControlConfiguration/native/	svchost.exe, 00000006.00000003.1369480637.000001F08A458000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.1371117634.000001F08A459000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.virtualearth.net/mapcontrol/logging.ashx	svchost.exe, 00000006.00000003.1369480637.000001F08A458000.00000004.00000020.00020000.00000000.sdmp	false		high
http://breakingcode.wordpress.com/)	5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000003.1416564795.000000000394E000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000003.1418282897.0000000003954000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000003.1531724512.0000000002A23000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000019.00000003.1456617188.00000000035B1000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001D.00000003.1499803297.0000000002CB4000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000002.2386623399.0000000001582000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dynamic.api.tiles.ditu.live.com/odvs/gdi?pv=1&r=	svchost.exe, 00000006.00000002.1371032795.000001F08A444000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dynamic.t	svchost.exe, 00000006.00000002.1371153253.000001F08A473000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1369181580.000001F08A465000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1369842397.000001F08A466000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://g.live.com/odclientsettings/Prod-C:	svchost.exe, 00000004.00000003.1202794563.0000026EDB1B3000.00000004.00000800.00020000.00000000.sdmp	false		high
http://tools.ietf.org/html/rfc6125#section-6.4.3	5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000003.1420182025.000000000334E000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000002.1428962274.000000000338B000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000003.1541999330.00000000023AE000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000019.00000003.1461030906.00000000030FE000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001D.00000003.1507941690.00000000026AE000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000002.2386623399.0000000001582000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.openssl.org/support/faq.htmlC:	5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000002.1435325332.000000006CBC1000.00000040.00000001.01000000.0000000E.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000002.1436346191.000000006CCD1000.00000040.00000001.01000000.0000000D.sdmp	false		high
https://dev.virtualearth.net/REST/v1/Routes/Transit	svchost.exe, 00000006.00000003.1369480637.000001F08A458000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/mhammond/pywin320	5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000E.00000003.1403414661.00000000021D1000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000E.00000003.1402901937.00000000021D1000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000E.00000003.1403368802.00000000021D1000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000E.00000003.1399061320.00000000021D1000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000E.00000003.1403288013.00000000021E0000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000E.00000003.1400214876.00000000021D1000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000E.00000003.1403562022.00000000021D1000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000E.00000003.1402629380.00000000021D1000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000002.1434087512.000000001E7C2000.00000004.00000001.01000000.00000012.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000002.1435120797.000000001ECC0000.00000004.00000001.01000000.00000011.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000002.1434310614.000000001E7DD000.00000004.00000001.01000000.00000015.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000002.1434959724.000000001E9BC000.00000004.00000001.01000000.00000014.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000012.00000003.1421334886.00000000030F1000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000012.00000003.1416602430.0000000001516000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000012.00000003.1420959512.0000000001517000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000012.00000003.1419781834.00000000030F1000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000012.00000003.1420807155.0000000003100000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000012.00000003.1420518336.0000000003100000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000012.00000003.1421123127.00000000030F1000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000012.00000003.1418218881.0000000001516000.00000004.00000020.00020000.00000000.sdmp	false		high
https://g.live.com/odclientsettings/ProdV2-C:	svchost.exe, 00000004.00000003.1202794563.0000026EDB1A2000.00000004.00000800.00020000.00000000.sdmp	false		high
https://.P	5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000003.1544307502.0000000002502000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000003.1534608692.00000000024D1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://t0.ssl.ak.tiles.virtualearth.net/tiles/gen	svchost.exe, 00000006.00000003.1369480637.000001F08A458000.00000004.00000020.00020000.00000000.sdmp	false		high
https://tiles.virtualearth.net/tiles/cmd/StreetSideBubbleMetaData?north=	svchost.exe, 00000006.00000003.1369480637.000001F08A458000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.1371117634.000001F08A459000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dynamic.api.tiles.ditu.live.com/odvs/gdv?pv=1&r=	svchost.exe, 00000006.00000003.1369198178.000001F08A462000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.faqs.org/rfcs/rfc822.html	5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000003.1418367126.00000000034A5000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 0000000F.00000003.1416665400.000000000345C000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000003.1543469992.000000000251B000.00000004.00000020.00020000.00000000.sdmp, 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe, 00000013.00000003.1534608692.00000000024D1000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000019.00000003.1459174688.0000000003267000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 00000019.00000003.1458477420.0000000003261000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001D.00000003.1501662011.00000000027C0000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001D.00000002.1515555939.00000000027C5000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000002.2386623399.00000000015FD000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.ditu.live.com/REST/v1/Locations	svchost.exe, 00000006.00000003.1369480637.000001F08A458000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t0.ssl.ak.dynamic.tiles.virtu	svchost.exe, 00000006.00000003.1369635460.000001F08A441000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000002.1371032795.000001F08A449000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://docs.python.org/library/socket.html#socket.setdefaulttimeout	HelpPane.exe, 0000001D.00000003.1501662011.00000000027C0000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001D.00000003.1508909107.00000000027D0000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000002.2398680627.0000000001701000.00000004.00000020.00020000.00000000.sdmp, HelpPane.exe, 0000001F.00000002.2377703970.0000000001401000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dev.ditu.live.com/REST/v1/JsonFilter/VenueMaps/data/	svchost.exe, 00000006.00000002.1371153253.000001F08A475000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1368982864.000001F08A46F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://dynamic.api.tiles.ditu.live.com/odvs/gd?pv=1&r=	svchost.exe, 00000006.00000003.1369742491.000001F08A432000.00000004.00000020.00020000.00000000.sdmp, svchost.exe, 00000006.00000003.1369198178.000001F08A462000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
71.221.126.225	unknown	United States	209	CENTURYLINK-US-LEGACY-QWESTUS	false
140.108.194.87	unknown	United States	33052	VZUNETUS	false
117.90.247.237	unknown	China	4134	CHINANET-BACKBONENo31Jin-rongStreetCN	false
117.204.203.72	unknown	India	9829	BSNL-NIBNationalInternetBackboneIN	false
65.119.229.26	unknown	United States	1742	HARVARD-UNIVUS	false
117.204.203.73	unknown	India	9829	BSNL-NIBNationalInternetBackboneIN	false
95.57.233.38	unknown	Kazakhstan	9198	KAZTELECOM-ASKZ	false
99.140.119.229	unknown	United States	7018	ATT-INTERNET4US	false
221.55.216.129	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
70.227.202.179	unknown	United States	7018	ATT-INTERNET4US	false
50.165.122.9	unknown	United States	7922	COMCAST-7922US	false
82.61.252.30	unknown	Italy	3269	ASN-IBSNAZIT	false
151.53.156.120	unknown	Italy	1267	ASN-WINDTREIUNETEU	false
36.13.225.183	unknown	Japan	2516	KDDIKDDICORPORATIONJP	false
98.214.132.109	unknown	United States	7922	COMCAST-7922US	false
125.44.36.16	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
43.70.37.217	unknown	Japan	4249	LILLY-ASUS	false
198.236.210.207	unknown	United States	36416	CLACKESDUS	false
122.21.106.30	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
125.125.211.109	unknown	China	58461	CT-HANGZHOU-IDCNo288Fu-chunRoadCN	false
211.203.192.131	unknown	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	false
61.84.74.119	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
98.26.186.53	unknown	United States	11426	TWC-11426-CAROLINASUS	false
191.128.90.159	unknown	Brazil	26615	TIMSABR	false
201.17.110.194	unknown	Brazil	28573	CLAROSABR	false
178.72.78.170	unknown	Russian Federation	44257	TNGS-SOUTHRU	false
126.204.118.24	unknown	Japan	17676	GIGAINFRASoftbankBBCorpJP	false
118.155.201.137	unknown	Japan	2516	KDDIKDDICORPORATIONJP	false
6.53.111.46	unknown	United States	1464	DNIC-ASBLK-01464-01465US	false
120.20.155.234	unknown	Australia	133612	VODAFONE-AS-APVodafoneAustraliaPtyLtdAU	false
118.8.227.76	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
150.156.128.15	unknown	United States	20337	SUNYPOLY-ASNUS	false
119.204.19.238	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
119.193.74.194	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
197.237.98.149	unknown	Kenya	15399	WANANCHI-KE	false
153.163.61.125	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
40.184.207.203	unknown	United States	4249	LILLY-ASUS	false
85.168.61.126	unknown	France	21502	ASN-NUMERICABLEFR	false
105.214.99.140	unknown	South Africa	16637	MTNNS-ASZA	false
123.15.159.248	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
220.198.240.128	unknown	China	17622	CNCGROUP-GZChinaUnicomGuangzhounetworkCN	false
114.78.247.166	unknown	Australia	4804	MPX-ASMicroplexPTYLTDAU	false
1.241.172.105	unknown	Korea Republic of	38408	GOEAY-AS-KRGYEONGGIPROVINCIALANYANGOFFICEOFEDUCATION	true
117.204.203.91	unknown	India	9829	BSNL-NIBNationalInternetBackboneIN	true
68.179.69.27	unknown	Canada	20161	TRGOCA	false
91.146.9.12	unknown	Russian Federation	3226	MARK-ITT-ASRU	false
91.127.252.253	unknown	Slovakia (SLOVAK Republic)	6855	SK-TELEKOMSK	false
95.83.17.9	unknown	Russian Federation	12389	ROSTELECOM-ASRU	false
84.20.235.151	unknown	Slovenia	3212	TELEMACHBroadbandAccessCarrierServicesSI	false
5.142.92.11	unknown	Russian Federation	12389	ROSTELECOM-ASRU	false
1.81.81.184	unknown	China	134768	CHINANET-SHAANXI-CLOUD-BASECHINANETSHAANXIprovinceCloud	false
112.80.232.5	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
176.77.11.83	unknown	Russian Federation	12714	TI-ASMoscowRussiaRU	false
101.98.183.156	unknown	New Zealand	9790	VOCUSGROUPNZVocusGroupNZ	false
86.17.186.211	unknown	United Kingdom	5089	NTLGB	false
193.107.183.90	unknown	Russian Federation	50750	TK-CENTER-LTD-ASRU	false
156.114.21.239	unknown	Netherlands	13639	ING-AMERICAS-WHOLESALEUS	false
211.17.6.154	unknown	Japan	4713	OCNNTTCommunicationsCorporationJP	false
83.158.181.217	unknown	France	12322	PROXADFR	false
94.50.19.42	unknown	Russian Federation	12389	ROSTELECOM-ASRU	false
21.63.221.57	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
54.236.234.52	unknown	United States	14618	AMAZON-AESUS	false
70.19.70.116	unknown	United States	701	UUNETUS	false
3.29.236.43	unknown	United States	16509	AMAZON-02US	false
125.136.218.222	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
40.231.106.212	unknown	United States	4249	LILLY-ASUS	false
42.192.179.207	unknown	China	4249	LILLY-ASUS	false
117.204.203.85	unknown	India	9829	BSNL-NIBNationalInternetBackboneIN	false
117.204.203.84	unknown	India	9829	BSNL-NIBNationalInternetBackboneIN	true
86.193.210.142	unknown	France	3215	FranceTelecom-OrangeFR	false
187.184.203.20	unknown	Mexico	28554	CablemasTelecomunicacionesSAdeCVMX	false
39.64.69.198	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
37.52.88.18	unknown	Ukraine	6849	UKRTELNETUA	false
52.251.253.134	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
223.100.5.56	unknown	China	56044	CMNET-AS-LIAONINGChinaMobilecommunicationscorporationC	false
138.67.220.218	unknown	United States	36704	CSM-ASUS	false
111.197.247.49	unknown	China	4808	CHINA169-BJChinaUnicomBeijingProvinceNetworkCN	false
177.230.146.176	unknown	Mexico	13999	MegaCableSAdeCVMX	false
174.245.176.198	unknown	United States	22394	CELLCOUS	false
52.7.125.172	unknown	United States	14618	AMAZON-AESUS	false
4.49.166.159	unknown	United States	3356	LEVEL3US	false
22.189.24.237	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
117.204.203.90	unknown	India	9829	BSNL-NIBNationalInternetBackboneIN	true
199.19.225.48	unknown	United States	53667	PONYNETUS	false
175.203.170.52	unknown	Korea Republic of	4766	KIXS-AS-KRKoreaTelecomKR	false
45.91.104.5	unknown	Hungary	209196	ELEKTRONET-HU	false
191.41.165.22	unknown	Brazil	7738	TelemarNorteLesteSABR	false
182.127.183.40	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	true
68.203.208.111	unknown	United States	11427	TWC-11427-TEXASUS	false
125.43.93.177	unknown	China	4837	CHINA169-BACKBONECHINAUNICOMChina169BackboneCN	false
26.3.158.61	unknown	United States	7922	COMCAST-7922US	false
89.162.86.210	unknown	Norway	29695	ALTIBOX_ASNorwayNO	false
210.69.114.68	unknown	Taiwan; Republic of China (ROC)	4782	GSNETDataCommunicationBusinessGroupTW	false
36.245.54.10	unknown	Japan	37903	EMOBILEYmobileCorporationJP	false
33.224.113.159	unknown	United States	2686	ATGS-MMD-ASUS	false
82.39.124.216	unknown	United Kingdom	5089	NTLGB	false
37.48.244.25	unknown	United Kingdom	48954	AIMES-ASGB	false
78.108.29.116	unknown	Hungary	44945	OLAHHU	false
171.4.223.222	unknown	Thailand	45758	TRIPLETNET-AS-APTripleTInternetTripleTBroadbandTH	false
131.204.52.84	unknown	United States	6112	AUBURNUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1436588
Start date and time:	2024-05-06 04:55:22 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 12m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	46
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.zip
Detection:	MAL
Classification:	mal100.rans.troj.evad.mine.winZIP@56/168@18/100
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 93% Number of executed functions: 15 Number of non-executed functions: 383
Cookbook Comments:	Found application associated with file extension: .zip

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, consent.exe, SIHClient.exe, MoUsoCoreWorker.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.196.177.159
Excluded domains from analysis (whitelisted): fs.microsoft.com, slscr.update.microsoft.com, e16604.g.akamaiedge.net, prod.fs.microsoft.com.akadns.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtQueryVolumeInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
04:55:59	API Interceptor	2x Sleep call for process: svchost.exe modified
04:56:34	API Interceptor	6269x Sleep call for process: HelpPane.exe modified
04:57:07	API Interceptor	1x Sleep call for process: MpCmdRun.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
211.203.192.131	SecuriteInfo.com.Trojan.InstallCore.4086.15026.2213.exe	Get hash	malicious	PrivateLoader, PureLog Stealer	Browse
197.237.98.149	MsdeSNMM2r.elf	Get hash	malicious	Mirai, Moobot	Browse
197.237.98.149	arm.elf	Get hash	malicious	Mirai, Moobot	Browse
95.57.233.38	SecuriteInfo.com.Trojan.InstallCore.4086.15026.2213.exe	Get hash	malicious	PrivateLoader, PureLog Stealer	Browse
126.204.118.24	arm-20220601-2200	Get hash	malicious	Moobot	Browse
36.13.225.183	p68LUdLrA8.elf	Get hash	malicious	Mirai	Browse
1.241.172.105	Photo.scr.exe	Get hash	malicious	Xmrig	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
bttracker.acc.umu.se	na.elf	Get hash	malicious	Mirai	Browse	130.239.18.158
	Photo.scr.exe	Get hash	malicious	Xmrig	Browse	130.239.18.158
	bin.sh	Get hash	malicious	Mirai	Browse	130.239.18.158
	bin.sh	Get hash	malicious	Mirai	Browse	130.239.18.158
	AV.scr	Get hash	malicious	Xmrig	Browse	130.239.18.158
	Photo.scr	Get hash	malicious	Xmrig	Browse	130.239.18.158
	AV.scr	Get hash	malicious	Xmrig	Browse	130.239.18.158
	3aakN9FzA5	Get hash	malicious	Gafgyt Mirai	Browse	130.239.18.158
	Mozi.m.3	Get hash	malicious	Mirai	Browse	130.239.18.158
	ZFvtIZszMd	Get hash	malicious	Mirai	Browse	130.239.18.158
router.bittorrent.com	BitTorrent-7.6.exe	Get hash	malicious	Unknown	Browse	67.215.246.10
	BitTorrent-7.6.exe	Get hash	malicious	Unknown	Browse	67.215.246.10
	na.elf	Get hash	malicious	Mirai	Browse	67.215.246.10
	SecuriteInfo.com.W32.uTorrent.A.gen.Eldorado.30680.8608.exe	Get hash	malicious	Unknown	Browse	67.215.246.10
	SecuriteInfo.com.W32.uTorrent.A.gen.Eldorado.30680.8608.exe	Get hash	malicious	Unknown	Browse	67.215.246.10
	Photo.scr.exe	Get hash	malicious	Xmrig	Browse	67.215.246.10
	bin.sh	Get hash	malicious	Mirai	Browse	67.215.246.10
	bin.sh	Get hash	malicious	Mirai	Browse	67.215.246.10
	ubuntu-22.10-desktop-amd64.iso.torrent	Get hash	malicious	Unknown	Browse	67.215.246.10
	SecuriteInfo.com.Linux.Mirai.4338.285.20673.elf	Get hash	malicious	Mirai	Browse	67.215.246.10
router.utorrent.com	BitTorrent-7.6.exe	Get hash	malicious	Unknown	Browse	82.221.103.244
	BitTorrent-7.6.exe	Get hash	malicious	Unknown	Browse	82.221.103.244
	na.elf	Get hash	malicious	Mirai	Browse	82.221.103.244
	SecuriteInfo.com.W32.uTorrent.A.gen.Eldorado.30680.8608.exe	Get hash	malicious	Unknown	Browse	82.221.103.244
	SecuriteInfo.com.W32.uTorrent.A.gen.Eldorado.30680.8608.exe	Get hash	malicious	Unknown	Browse	82.221.103.244
	Photo.scr.exe	Get hash	malicious	Xmrig	Browse	82.221.103.244
	bin.sh	Get hash	malicious	Mirai	Browse	82.221.103.244
	bin.sh	Get hash	malicious	Mirai	Browse	82.221.103.244
	ubuntu-22.10-desktop-amd64.iso.torrent	Get hash	malicious	Unknown	Browse	82.221.103.244
	SecuriteInfo.com.Linux.Mirai.4338.285.20673.elf	Get hash	malicious	Mirai	Browse	82.221.103.244
dht.transmissionbt.com	na.elf	Get hash	malicious	Mirai	Browse	87.98.162.88
	Photo.scr.exe	Get hash	malicious	Xmrig	Browse	87.98.162.88
	bin.sh	Get hash	malicious	Mirai	Browse	212.129.33.59
	bin.sh	Get hash	malicious	Mirai	Browse	212.129.33.59
	AV.scr	Get hash	malicious	Xmrig	Browse	212.129.33.59
	Photo.scr	Get hash	malicious	Xmrig	Browse	87.98.162.88
	AV.scr	Get hash	malicious	Xmrig	Browse	212.129.33.59
	3aakN9FzA5	Get hash	malicious	Gafgyt Mirai	Browse	87.98.162.88
	Mozi.m.3	Get hash	malicious	Mirai	Browse	87.98.162.88
	ZFvtIZszMd	Get hash	malicious	Mirai	Browse	87.98.162.88

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CENTURYLINK-US-LEGACY-QWESTUS	Y0gm1e2z6O.elf	Get hash	malicious	Mirai	Browse	75.169.214.29
	bot.x86_64.elf	Get hash	malicious	Mirai	Browse	75.122.160.79
	hdqqxiAaUa.elf	Get hash	malicious	Mirai	Browse	71.215.163.161
	IQU2qqn8AZ.elf	Get hash	malicious	Mirai	Browse	75.122.159.60
	https://www.steamvr.com/de/	Get hash	malicious	Unknown	Browse	23.1.198.56
	sora.x86-20240504-0115.elf	Get hash	malicious	Mirai	Browse	71.221.237.61
	Krnl.exe	Get hash	malicious	Xmrig	Browse	162.19.139.184
	x86.elf	Get hash	malicious	Unknown	Browse	205.168.114.41
	https://herozheng.com/	Get hash	malicious	Unknown	Browse	162.19.138.82
	https://wywljs.com/	Get hash	malicious	Unknown	Browse	162.19.138.116
VZUNETUS	i82lYmiFrF.elf	Get hash	malicious	Mirai	Browse	140.108.112.196
	Invoice-353.html	Get hash	malicious	Unknown	Browse	140.108.21.103
	Vbdpz74ndQ.elf	Get hash	malicious	Mirai, Moobot	Browse	140.108.182.67
	z0r0.x86.elf	Get hash	malicious	Mirai	Browse	140.108.112.179
	skyljne.arm5.elf	Get hash	malicious	Mirai	Browse	140.108.247.137
	TR3JlKc7z1.elf	Get hash	malicious	Mirai	Browse	140.108.157.99
	7cF3SPSPe7.elf	Get hash	malicious	Unknown	Browse	140.108.194.59
	LyLemdrILE.elf	Get hash	malicious	Mirai	Browse	140.108.103.137
	jKqk9FzBU7.elf	Get hash	malicious	Unknown	Browse	140.108.232.24
	YFeDaKmAH6.elf	Get hash	malicious	Mirai, Moobot	Browse	140.108.170.71
BSNL-NIBNationalInternetBackboneIN	YLvVXuRyhA.elf	Get hash	malicious	Mirai	Browse	117.227.70.243
	Y0gm1e2z6O.elf	Get hash	malicious	Mirai	Browse	117.232.143.100
	bot.arm.elf	Get hash	malicious	Mirai	Browse	117.241.147.114
	bot.mpsl.elf	Get hash	malicious	Mirai	Browse	117.236.33.251
	H0RZizYUEv.elf	Get hash	malicious	Mirai	Browse	117.234.157.83
	TsDTSDr8mU.elf	Get hash	malicious	Mirai	Browse	59.97.56.230
	BnH5cceMGl.elf	Get hash	malicious	Mirai	Browse	103.69.59.13
	MFi6N2M1QF.elf	Get hash	malicious	Mirai	Browse	117.216.29.212
	357oRnNepg.elf	Get hash	malicious	Unknown	Browse	117.246.144.119
	mbkraX1GtP.elf	Get hash	malicious	Mirai	Browse	117.220.37.84
CHINANET-BACKBONENo31Jin-rongStreetCN	https://yxl.oha.mybluehost.me/DO/net/login.php	Get hash	malicious	Unknown	Browse	63.140.39.240
	YLvVXuRyhA.elf	Get hash	malicious	Mirai	Browse	183.23.255.236
	Y0gm1e2z6O.elf	Get hash	malicious	Mirai	Browse	116.27.71.100
	pDWZMd3100.elf	Get hash	malicious	Mirai, Gafgyt	Browse	117.66.49.253
	bot.mips.elf	Get hash	malicious	Unknown	Browse	113.82.59.219
	bot.arm.elf	Get hash	malicious	Mirai	Browse	59.51.93.31
	bot.x86.elf	Get hash	malicious	Mirai	Browse	58.62.51.195
	bot.arm6.elf	Get hash	malicious	Mirai	Browse	182.40.134.249
	bot.arm7.elf	Get hash	malicious	Mirai	Browse	119.102.32.173
	bot.mpsl.elf	Get hash	malicious	Mirai	Browse	115.226.181.36

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\_MEI14482\_hashlib.pyd	240424-ll91tsge34_pw_infected.zip	Get hash	malicious	Xmrig	Browse
	Photo.scr.exe	Get hash	malicious	Xmrig	Browse
	AV.scr	Get hash	malicious	Xmrig	Browse
	Photo.scr	Get hash	malicious	Xmrig	Browse
	AV.scr	Get hash	malicious	Xmrig	Browse
C:\Users\user\AppData\Local\Temp\_MEI14482\_ctypes.pyd	240424-ll91tsge34_pw_infected.zip	Get hash	malicious	Xmrig	Browse
	Photo.scr.exe	Get hash	malicious	Xmrig	Browse
	AV.scr	Get hash	malicious	Xmrig	Browse
	Photo.scr	Get hash	malicious	Xmrig	Browse
	AV.scr	Get hash	malicious	Xmrig	Browse
C:\Users\user\AppData\Local\Temp\_MEI14482\Crypto.Cipher._AES.pyd	240424-ll91tsge34_pw_infected.zip	Get hash	malicious	Xmrig	Browse
	Photo.scr.exe	Get hash	malicious	Xmrig	Browse
	AV.scr	Get hash	malicious	Xmrig	Browse
	Photo.scr	Get hash	malicious	Xmrig	Browse
	AV.scr	Get hash	malicious	Xmrig	Browse

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7945978433778681
Encrypted:	false
SSDEEP:	3072:yJjAgNE4Pj5vHcjTcyBP9UjaaQ/ka4qWT:QAgN8nj/ka4
MD5:	5DDA913B4A6744DA37499B69AB47AC14
SHA1:	D689F62670DEC81D4928E45900E59CE2F7379DC0
SHA-256:	A8801893E5E3D3516D2EDBB3BEB0F098B5000364C27005E8BC01E5BED5A1FE4F
SHA-512:	1A0407143BA8B057C57A9416508962E6246D3814776718D81B73264314C0B5B8EC26B9102DF8E9D9A69826FC99B8B450C124377BE47ED4C02A1C3A4EC0A955B8
Malicious:	false
Preview:	..6.........@..@.....{...;...{..........<...D./..;...{..................C:\ProgramData\Microsoft\Network\Downloader\.........................................................................................................................................................................................................................C:\ProgramData\Microsoft\Network\Downloader\..........................................................................................................................................................................................................................0u..................@...@....................................d6d6.#.........`h.................h.......6.......X\...;...{..................C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.M.i.c.r.o.s.o.f.t.\.N.e.t.w.o.r.k.\.D.o.w.n.l.o.a.d.e.r.\.q.m.g.r...d.b....................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	Extensible storage engine DataBase, version 0x620, checksum 0xa2188a86, page size 16384, DirtyShutdown, Windows version 10.0
Category:	dropped
Size (bytes):	1310720
Entropy (8bit):	0.7864674722024068
Encrypted:	false
SSDEEP:	1536:TSB2ESB2SSjlK/6vDfi5Wy10MctJ+t9ka4XQ0/Ykr3g16L2UPkLk+kyt4eCu3uZB:Tazaovh7uka4Es2U1RFNp3pvHzrHBHz
MD5:	9AA51E1AB467065AC011EC3532E343F6
SHA1:	CA26BE28A6B7296ECA337A7960C0A95A038CE9B2
SHA-256:	D53C1AE658ABC823C911F38519E56D22C9C1D178770E9A3E0E2380019F3A3C26
SHA-512:	AF8F30720CAFCF160F8975B97F2CE1827C2566B79F5AF0F71AA9024AC2DDF3A9E46E5A0D622ACE7379D8E694BAB657D16B95E5FA9E0439F8A8841E11DBB6E90D
Malicious:	false
Preview:	....... ...............X\...;...{......................0.z...... ...{..;7...\|..h.\|.........................D./..;...{..........................................................................................................eJ......n....@...................................................................................................... ............{...............................................................................................................................................................................................2...{...................................H..;7...\|.=.................../;7...\|...........................#......h.\|.....................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	0.08132342935531206
Encrypted:	false
SSDEEP:	3:nSXKYepUowppMsjv/Ss/IGYZX/8wF6cwptlAllSdLvl+/rS56/:yKzpLsYUWKAQN0e
MD5:	FB34C34A00BE43C77566F4F3385E45E1
SHA1:	63F627577E078991C907F4CDA0BB7C512BCFD298
SHA-256:	7D3B732ED868CB5E8C5DFB560DAF9D60ED2951BBE54479E73650E9E459AFFA6C
SHA-512:	C9FD866FF61ECC38B2BBB6B3476A8E39CC8AD04C69C689EA66C41AA6F8214276AF2E20C8E497100DC703E8D82FBB3DEA1B5C424D0D07FCFF7158A38397D29B9C
Malicious:	false
Preview:	..q.....................................;...{..;7...\|... ...{........... ...{... ...{..#.#.. ...{.\|.................../;7...\|..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\USOShared\Logs\System\UpdateSessionOrchestration.7ae3c485-636a-4b66-a35a-b2059d1e6bb9.1.etl

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	data
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	1.19636096613595
Encrypted:	false
SSDEEP:	12:rjqj2xX/7ETOnk56GWtbgjO3s7Nxk56GzS3XRkVF3N:rt1Gtm2jGtEXeVF3N
MD5:	95CC8E28603A65BF2CAC4B350AF5DBD3
SHA1:	F8499E80C127EC0C45160CC0FD09C11E8E2B3161
SHA-256:	F6747E6AE2ACA6E07529F92BD11E3CAC06854DCEC389A735E96F682AC9420E38
SHA-512:	864494402E8B5DEEB811859B1694DF907875337D43217E6E1E5421E168438E11516AA225C288B691EB1DD2D805E643ED5CC860D657DEBD88BCC5741E5AFA1492
Malicious:	false
Preview:	............................................................................D...............`...................eJ..............Zb..K....(..........................................@.t.z.r.e.s...d.l.l.,.-.3.2.2.......................................................@.t.z.r.e.s...d.l.l.,.-.3.2.1................................................................Y..............`...........U.p.d.a.t.e.S.e.s.s.i.o.n.O.r.c.h.e.s.t.r.a.t.i.o.n...C.:.\.P.r.o.g.r.a.m.D.a.t.a.\.U.S.O.S.h.a.r.e.d.\.L.o.g.s.\.S.y.s.t.e.m.\.U.p.d.a.t.e.S.e.s.s.i.o.n.O.r.c.h.e.s.t.r.a.t.i.o.n...7.a.e.3.c.4.8.5.-.6.3.6.a.-.4.b.6.6.-.a.3.5.a.-.b.2.0.5.9.d.1.e.6.b.b.9...1...e.t.l...........P.P..........;..`...................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI14482\Crypto.Cipher._AES.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	7.553130526678379
Encrypted:	false
SSDEEP:	384:50Q1C9jViLl7hDB6n/PtHU2wr8gj93KqmilaNJawcudoD7U:dC8LU/PBU8itClnbcuyD7U
MD5:	371397E80A55D432DA47311B8EF25317
SHA1:	71617777D6A2500D6464D7B394C8BE5F1E4E119E
SHA-256:	C1A900615C9500C46B9602C30C53F299290B03632208EF1152AF8830AB73AD17
SHA-512:	3139E2848ACF02CC8475449F213873D2C2B7196F6A55C70D2D8F8B487020387740364E5CA0AA584624D1B9B01B965146A2F0E15EEF34830C7C0ECBB8637DAE03
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3% Antivirus: Virustotal, Detection: 1%, Browse
Joe Sandbox View:	Filename: 240424-ll91tsge34_pw_infected.zip, Detection: malicious, Browse Filename: Photo.scr.exe, Detection: malicious, Browse Filename: AV.scr, Detection: malicious, Browse Filename: Photo.scr, Detection: malicious, Browse Filename: AV.scr, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........+\8.J2k.J2k.J2k.Ik.J2k...k.J2k...k.J2k...k.J2k.2.k.J2k.J3k.J2k...k.J2k...k.J2k...k.J2kRich.J2k........PE..L....4.S...........!.....@..........`...................................................................................D...........................................................................8...H...........................................UPX0....................................UPX1.....@.......:..................@...UPX2.................>..............@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI14482\Include\pyconfig.h

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	21321
Entropy (8bit):	5.345136937906198
Encrypted:	false
SSDEEP:	384:pGpFpaU1kgCw8r+MIP8Bj5DvVySh3awQBoerw8W+PYV0FGYfN/+:pGpFpb+IU99UShATrw8W+AKF/+
MD5:	BC185DE8B2437963368A85FDD9852951
SHA1:	1459F1428214FCCA7F203FB3A3AFF28E16EB9C1B
SHA-256:	8B130D901E0F83B55699D565F103F2F8F1B3A51712EBB4B9646EA517CC1F04D6
SHA-512:	918469D9A59FE059F3C7C93F34C8D2D07CB8A9BF5E953A1527922ED5C65FF4A2DF50BBC78ED9CE146BF3A1FB6F1763F061262FA4A937BEEEE1FEB8A99E31339E
Malicious:	false
Preview:	#ifndef Py_CONFIG_H.#define Py_CONFIG_H../* pyconfig.h. NOT Generated automatically by configure...This is a manually maintained version used for the Watcom,.Borland and Microsoft Visual C++ compilers. It is a.standard part of the Python distribution...WINDOWS DEFINES:.The code specific to Windows should be wrapped around one of.the following #defines..MS_WIN64 - Code specific to the MS Win64 API.MS_WIN32 - Code specific to the MS Win32 (and Win64) API (obsolete, this covers all supported APIs).MS_WINDOWS - Code specific to Windows, but all versions..MS_WINCE - Code specific to Windows CE.Py_ENABLE_SHARED - Code if the Python core is built as a DLL...Also note that neither "_M_IX86" or "_MSC_VER" should be used for.any purpose other than "Windows Intel x86 specific" and "Microsoft.compiler specific". Therefore, these should be very rare....NOTE: The following symbols are deprecated:.NT, USE_DL_EXPORT, USE_DL_IMPORT, DL_EXPORT, DL_IMPORT.MS_CORE_DLL...WIN32 is still required for the

C:\Users\user\AppData\Local\Temp\_MEI14482\Microsoft.VC90.CRT.manifest

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1050
Entropy (8bit):	5.382436822526041
Encrypted:	false
SSDEEP:	24:2dtn3mGv+zg4NnEN4XKHVJrMmV6LSWV5rcb3S:ch35+zg4i0KHVVdOmS
MD5:	BFB93876892CCA8E2AD0021585C34C8B
SHA1:	0DDE1B225C98825A09D8FF85F462571C9C862E35
SHA-256:	0D060ED7C25159B7B75F16D449963BFD639C15B3C5280BC7897403268C2B9F35
SHA-512:	FE70540B3B3FA88B32DFB2FF7406A3A9819E7862B850D871B932996BBEFFDBC70D7192D6E3196A8583B2DB756CA9CC278505AFBE585BA30EB1222D4F8BE15B7B
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v1">.. <noInheritable/>.. <assemblyIdentity name="Microsoft.VC90.CRT" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b" type="win32" version="9.0.30729.6161"/>.. <file hash="7021457b391b35606e708c69987e4b6f606609ee" hashalg="SHA1" name="msvcr90.dll"/>.. <file hash="88549dd3ce8eaa62ca8aad0e96ddd9fec2203628" hashalg="SHA1" name="msvcp90.dll"/>.. <file hash="65ef374affa5b48827e539b35b3275c201b41fc9" hashalg="SHA1" name="msvcm90.dll"/>.. <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">.. <application>.. <supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/>.. <supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/>.. <supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/>.. <supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>.. <supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/>..

C:\Users\user\AppData\Local\Temp\_MEI14482\_ctypes.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	37888
Entropy (8bit):	7.848484052157707
Encrypted:	false
SSDEEP:	768:pAXLisB/qV2nQnf33sWcCRWKZac3VWw6cLA3zReukhRnbcuyD7U:pAnBi8nQf3sYToclt6cLUCRnouy8
MD5:	6CB8B560EFBC381651D2045F1571D7C8
SHA1:	15283A7A467ADB7B6D7A7182F660DD783F90E483
SHA-256:	6456FEA123E04BCEC8A8EED26160E1DF5482E69D187D3E1A0C428995472AC134
SHA-512:	CA2958095E8E08B5EF05EC9DE15B7D1EB180923A40B90356DB56A124101C96D8E745001948B89DBE9D6B9CE3C2029F7E9EAF20C73FA1D410A821D6605830BFC0
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3% Antivirus: Virustotal, Detection: 1%, Browse
Joe Sandbox View:	Filename: 240424-ll91tsge34_pw_infected.zip, Detection: malicious, Browse Filename: Photo.scr.exe, Detection: malicious, Browse Filename: AV.scr, Detection: malicious, Browse Filename: Photo.scr, Detection: malicious, Browse Filename: AV.scr, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...................F.....W.....P......@..........Z.....A.....B...Rich..................PE..L...*>CX...........!............. .. ....0................................................@.........................<...........<.......................................................................H...........................................UPX0..... ..............................UPX1.........0......................@...UPX2................................@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI14482\_hashlib.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	351744
Entropy (8bit):	7.996557276168139
Encrypted:	true
SSDEEP:	6144:Xh0byJKrtKOFhjnTtMoy8gpVI/xxWo/nX0NKOzyGFmJ559Vq2SeTsRgIIGYMowwZ:2bymtjF1TtMod/xweDK7FmJ5rLVYTIGm
MD5:	EE134421FBABEB565E4F3CA721331C2E
SHA1:	4B03BDD142C6A7BB6F74ABE968C5B76B63E06059
SHA-256:	7863E1BEDFE1FFC720B67B2EB7B3491DB9D2B8E56B5574E6A40FF90336B8DAFA
SHA-512:	D27FF65B6A8BF2E5E70D2865E72EEE6930E76C2A3990428C54FC998743D3C540C5C984B5D1429E8FFBE3D160AE1F6782CD6D3CA40822F81D2052BA168595D1FA
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3% Antivirus: Virustotal, Detection: 1%, Browse
Joe Sandbox View:	Filename: 240424-ll91tsge34_pw_infected.zip, Detection: malicious, Browse Filename: Photo.scr.exe, Detection: malicious, Browse Filename: AV.scr, Detection: malicious, Browse Filename: Photo.scr, Detection: malicious, Browse Filename: AV.scr, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......z.$.>.J.>.J.>.J.7...4.J.7...1.J.7...<.J.7...3.J.>.K..J.>.J...J.7...Y.J.7...?.J.7...?.J.Rich>.J.........................PE..L....>CX...........!.....`..........@K.......`...............................p............@.........................pa..L....`..p............................a.......................................W..H...........................................UPX0....................................UPX1.....`.......X..................@...UPX2.........`.......\..............@......................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI14482\_socket.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	7.706254752795193
Encrypted:	false
SSDEEP:	384:CCNDRisVUlkycq27U4r0rOc606B8k4gG35aiQjgO6OPjGL2e1ua7aNJawcudoD7P:v7VUcq27Jr0rOmbwE4jGLhohnbcuyD7B
MD5:	BE47363992C7DD90019276D35FA8DA76
SHA1:	CCF7EBBE829DA08EFD95A53D4BA0C0D4938F6169
SHA-256:	BE10254B111713BEF20A13D561DE61CA3C74A34C64DDC5B10825C64AB2C46734
SHA-512:	573F9111535A9A136FCAAA5C1A16C347F7327626768D849513D69C9848406B1002DCC5B8C17A291EF2E6519587533CA806018EE471A39D330F032A9E7E635EA7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3% Antivirus: Virustotal, Detection: 1%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......AV2..7\..7\..7\..O..7\..O..7\..O..7\..7]..7\..O..7\..O..7\..O..7\..O..7\.Rich.7\.........................PE..L...X>CX...........!.....P..........0.....................................................@.............................d...................................d...........................................H...........................................UPX0....................................UPX1.....P.......P..................@...UPX2.................T..............@..............................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI14482\_ssl.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	498688
Entropy (8bit):	7.996471896707535
Encrypted:	true
SSDEEP:	12288:FHNz5hZdNGitmdIA8byo3k4Ff9m3fTByPf6So+2RON1jjoS:P3fNTtmd2bkof43fTkR2gH
MD5:	68C3AD86E0A8833C29AD1BE10D3C025D
SHA1:	04488362814B2F3AE07C4E8DF8E45868D48B447F
SHA-256:	C236271B92A0F1D3304337F2E2444107F34D8E26272981F48C47DB347133566C
SHA-512:	BB2819D913033CC26DCD1E5CBF015DACDBF747D29C72BFD41BFE0D74BB77E51A61CF9BE4B67B6348938837125F1D0F80AF0AC33531E00CEA1585535952A22785
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3% Antivirus: Virustotal, Detection: 3%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........HFu.)(&.)(&.)(&.Q.&.)(&.Q.&.)(&.Q.&.)(&.)(&.)(&.))&9)(&.Q.&.)(&.Q.&.((&.Q.&.)(&.Q.&.)(&Rich.)(&................PE..L...q>CX...........!.................e....................................................@............................D............................................................................q..H...........................................UPX0....................................UPX1................................@...UPX2................................@..............................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI14482\_win32sysloader.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	4.992693298555373
Encrypted:	false
SSDEEP:	192:t2VnGV7o5QUEZWm6Uk3fvf3X7THIL3YO+8I:tVU5QUEz6hfLTH98
MD5:	B4A567D80CCC08FB1C7FBB765847AFDA
SHA1:	B7FF2C68BA2887AAF5D029F41922E626C72B716D
SHA-256:	DBB0F9C499A710BBC8BCDE4ECC3577A6C9548262D6CE4434ED5A0708CBC787DD
SHA-512:	DDFEC25304BABE2DF55958F512F61AFD9AF88DDA499FE87931D17A9EEBF048449885A06A24BDDBC8604E11F07CED3C2ECE7F89C28290CAB5D1BF3816D22128DB
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......M.oC.............J.............................../........................Rich............PE..L......[...........!......................... ....;..........................`......................................P&..Z...\"..P....@..l....................P....... ..............................8!..@............ ...............................text...`........................... ..`.rdata....... ......................@..@.data........0......................@....rsrc...l....@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI14482\back.jpg

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	47107
Entropy (8bit):	6.2032294727594985
Encrypted:	false
SSDEEP:	768:z9v1zJKaohy0Za9jwmrALVaka3sgBXHDizIdI9e2E:5v1zJ3nuswbLVgZsceO
MD5:	4AE078DD5085E97D3605F20DC079412A
SHA1:	1BABFCF2D374AE590970A3BE2E0E27BC04922546
SHA-256:	ED551536FF22587CDF7701A279E088EB370A4121E7A3FA1F3C8B121E767318A2
SHA-512:	BF163C63120CC5035087E4FF0035D9DAEB100218C62969AA6AA75D539108323295EB9CC28ABB0906C21CE8AEA25DACD1D0AAB3F3FE9C765D35348F0A7DA000AE
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 70% Antivirus: Virustotal, Detection: 69%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......]....S......"...8.P....... ..`u...0.................................................... .....................................................................................................................................................UPX0..... ..............................UPX1.....P...0...H..................@...UPX2.................J..............@...3.93.UPX!.....3r#l..JW..CE...0..&.......U..S...........t?........'.........9.r.....t...'.....s.t&...$....,1....$6.....X[]._V`..u....tG..oo.t$lE_D$.....=......."....1......uG...c..4....uF1..e.[^]..o...f.L.!.+.y..........................8</....fp.v..U..$........../...........O/...e..]...........#3f.E.f.E......m.._..;.}e.......f.t"............U.1.3-...}..~2.k......!..........7{..+...7..\|...............G.:..S........w. ........ ..%+{.n..$...e.>.m....u..,(.....k_.'lk.C2$C&'(.5.`cv/..

C:\Users\user\AppData\Local\Temp\_MEI14482\bz2.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	35840
Entropy (8bit):	7.816957595202127
Encrypted:	false
SSDEEP:	768:IHCeOgq+kCitCVj5rz2Ya+r9qLYp9R9JoWnbcuyD7UiT:IHXr8CBd9NpfXxnouy8
MD5:	C9C00BC854A39E66B27787D188F9E8D7
SHA1:	21F20CF6C628B529DB4BDB853B679F9BF23590E3
SHA-256:	29520DF660A5BBD704B9106A6650A66E4F5766B904D05F97146668D41DBF5839
SHA-512:	8887B5CA542220CAC04D5A6A22A06F95DB560F4FE0F9A128CEB642ED9716ABCFFBA2146CCE682EB16C4DA3F423649A61904A73C4357D9FDBD5DDF606790199A3
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3% Antivirus: Virustotal, Detection: 3%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}.S.9.=K9.=K9.=K..K:.=K0..K:.=K0..K7.=K0..K;.=K0..K>.=K9.<KS.=K0..K1.=K0..K8.=K0..K8.=KRich9.=K................PE..L...?>CX...........!.................W.......p............................................@..........................p..D....p...............................q.......................................c..H...........................................UPX0....................................UPX1................................@...UPX2.........p......................@..............................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI14482\certifi\cacert.pem

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	284518
Entropy (8bit):	6.05114864026174
Encrypted:	false
SSDEEP:	6144:GriCfLXd1YU58fVuKlnm5plZ0PXCRrcMBbADwYC+MslE:GrdT3YZuz5LwCRrcMije
MD5:	DD2DD543395692705F7DDA0F5E7750FA
SHA1:	40D7CE60393978A29FB0E0B1E849658E48CF7887
SHA-256:	397B833E5ACF89A2709B964401A9ACA68D24B62349B72BBE38684E586AA07A27
SHA-512:	3BA0D6AD8B6838B04FBFDEBAD20EB5544C093BA592B517AA383708A34CE2BD215DB2BF010090251674DBCFD4EDA3C44F770C9FBF314304DE918D7E59E2596CF2
Malicious:	false
Preview:	.# Issuer: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Subject: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Label: "GlobalSign Root CA".# Serial: 4835703278459707669005204.# MD5 Fingerprint: 3e:45:52:15:09:51:92:e1:b7:5d:37:9f:b1:87:29:8a.# SHA1 Fingerprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c.# SHA256 Fingerprint: eb:d4:10:40:e4:bb:3e:c7:42:c9:e3:81:d3:1e:f2:a4:1a:48:b6:68:5c:96:e7:ce:f3:c1:df:6c:d4:33:1c:99.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG.A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv.b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw.MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i.YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT.aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ.jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp.xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz

C:\Users\user\AppData\Local\Temp\_MEI14482\config.json

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1206
Entropy (8bit):	4.275024024623091
Encrypted:	false
SSDEEP:	24:pCKENTHgbeZlE1jCAh1RHEdOgNanAOSWSula:UKuTHgbYlUZHEdrNAla
MD5:	50CC63E4A1B24622CF61ED566B03E98F
SHA1:	92E5874785BB76E4579559BA70E116A6149349F5
SHA-256:	348F388C57DFB77B0CAACD8304725E10DC69A52EEC41AE695327787AD1853C92
SHA-512:	9A291DB9CF396687F3878590B1EB65CD7DA2E6FC3D6DE64A3B8CB08116B646371F432100E16B0ECD4F2916D05D67830F949AC2A3CA559A3A8D56616DF2BE98C7
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: C:\Users\user\AppData\Local\Temp\_MEI14482\config.json, Author: Joe Security
Preview:	{. "algo": "cryptonight",. "api": {. "port": 0,. "access-token": null,. "id": null,. "worker-id": null,. "ipv6": false,. "restricted": true. },. "autosave": true,. "av": 0,. "background": true,. "colors": true,. "cpu-affinity": null,. "cpu-priority": null,. "donate-level": 1,. "huge-pages": true,. "hw-aes": null,. "log-file": null,. "max-cpu-usage": 70,. "pools": [. {. "url": "xmr.crypto-pool.fr:3333",. "user": "47BD6QNfkWf8ZMQSdqp2tY1AdG8ofsEPf4mcDp1YB4AX32hUjoLjuDaNrYzXk7cQcoPBzAuQrmQTgNgpo6XPqSBLCnfsjaV",. "pass": "x",. "rig-id": null,. "nicehash": false,. "keepalive": false,. "variant": -1,. "enabled": true,. "tls": false,. "tls-fingerprint": null. }. ],. "print-time": 60,. "retries": 5,. "retry-pause": 5,. "safe": false,. "threads": [. {.

C:\Users\user\AppData\Local\Temp\_MEI14482\ftpcrack.exe.manifest

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1345
Entropy (8bit):	5.283640732769631
Encrypted:	false
SSDEEP:	24:2dtn3ZoWglN2v+zg4NnEN4XKDmc0+bLg4fNRme5rcb3S:ch3DgX2+zg4i0KDmJ+bLg4VRmemS
MD5:	B5DEA49B86C5BB5D9CD8D64A09F70065
SHA1:	487EF676EBD244EBC3CF197F70DA7A5E393FB96E
SHA-256:	78B1160F6ADAB34D144AD19A0F4B83F83453F1E18460BBDFBE17AD354B62AF7D
SHA-512:	1B5914F4C52F47A33C57F5F6428482E6766099BF43D4E8616CE4AABC4A917C24B2E0C98C841F0D7E7B8A202F40FF960885535539BF70CC7C7ED8687C7ECE010C
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v1">.. <assemblyIdentity name="ftpcrack" processorArchitecture="x86" type="win32" version="1.0.0.0"/>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity name="Microsoft.VC90.CRT" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b" type="win32" version="9.0.30729.6161"/>.. <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"/>.. </dependentAssembly>.. </dependency>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity language="*" name="Microsoft.Windows.Common-Controls" processorArchitecture="x86" publicKeyToken="6595b64144ccf1df" type="win32" version="6.0.0.0"/>.. <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"/>.. </dependentAssembly>.. </dependency>.. <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">.. <application>.. <supportedOS Id="{1f676c76-80e

C:\Users\user\AppData\Local\Temp\_MEI14482\httplib2\cacerts.txt

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	135546
Entropy (8bit):	6.039525643754334
Encrypted:	false
SSDEEP:	3072:FVrovvEjVplrqHSdX+zpfQq7ZiyZOF5mdFENAKHn1HtYfei8i31MCSjfpVpKbIcf:3cmHuBfaUFENX3YfEl3plcs+
MD5:	14BA876BA2515A25BBB511F24BF06653
SHA1:	291DCDEE67E880B21FD7001CB8350C3ECEE4CAC8
SHA-256:	2039836A620F956EC094EAAE7C9B41A04C76F31130898B11014D9E83C905F0DE
SHA-512:	5035F82DF06308A14F6626C54382B3AB34B6D664C8394B48F75275F69DCC2B93266D843B51F0B586E5F12FCD70FE3660B5B08AFC20738DF6D8C812592C0D71E4
Malicious:	false
Preview:	# Issuer: CN=GTE CyberTrust Global Root O=GTE Corporation OU=GTE CyberTrust Solutions, Inc..# Subject: CN=GTE CyberTrust Global Root O=GTE Corporation OU=GTE CyberTrust Solutions, Inc..# Label: "GTE CyberTrust Global Root".# Serial: 421.# MD5 Fingerprint: ca:3d:d3:68:f1:03:5c:d0:32:fa:b8:2b:59:e8:5a:db.# SHA1 Fingerprint: 97:81:79:50:d8:1c:96:70:cc:34:d8:09:cf:79:44:31:36:7e:f4:74.# SHA256 Fingerprint: a5:31:25:18:8d:21:10:aa:96:4b:02:c7:b7:c6:da:32:03:17:08:94:e5:fb:71:ff:fb:66:67:d5:e6:81:0a:36.-----BEGIN CERTIFICATE-----.MIICWjCCAcMCAgGlMA0GCSqGSIb3DQEBBAUAMHUxCzAJBgNVBAYTAlVTMRgwFgYD.VQQKEw9HVEUgQ29ycG9yYXRpb24xJzAlBgNVBAsTHkdURSBDeWJlclRydXN0IFNv.bHV0aW9ucywgSW5jLjEjMCEGA1UEAxMaR1RFIEN5YmVyVHJ1c3QgR2xvYmFsIFJv.b3QwHhcNOTgwODEzMDAyOTAwWhcNMTgwODEzMjM1OTAwWjB1MQswCQYDVQQGEwJV.UzEYMBYGA1UEChMPR1RFIENvcnBvcmF0aW9uMScwJQYDVQQLEx5HVEUgQ3liZXJU.cnVzdCBTb2x1dGlvbnMsIEluYy4xIzAhBgNVBAMTGkdURSBDeWJlclRydXN0IEds.b2JhbCBSb290MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCVD6C28FCc6HrH.iM3dFw4usJTQGz0

C:\Users\user\AppData\Local\Temp\_MEI14482\msvcm90.dll

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	225280
Entropy (8bit):	6.034911041879855
Encrypted:	false
SSDEEP:	3072:6yZeocziNzMLSMOYscmLWbAX+dP4Upoh86Goao14JU87/amFYw8fF01OyASLE:PYOMqc8oAXGP4Upoe6fa3/amiX2Oyp
MD5:	D34A527493F39AF4491B3E909DC697CA
SHA1:	AFEE32FCD9CE160680371357A072F58C5F790D48
SHA-256:	7A74DA389FBD10A710C294C2E914DC6F18E05F028F07958A2FA53AC44F0E4B90
SHA-512:	0DABC5455EB02601D7C40A9C49B3ADE750B1118934EF3785FB314FA313437BC02B243571ABA25F1661A69DCEA36838530C12762A2E6602D14A9B03770A82CCA6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;...h...h...h..ah...h1.dh...h..gh...h...h...h.-.h...h...h...h..qh...h..vh...h..`h...h..fh...h..ch...hRich...h........................PE..L.....M...........!.....:..........Z........P....?x.........................0......^.....@......................... 3..4....&..d...............................d...P...............................H...@...............(...........p...H............text...T9.......:.................. ..`.data........P.......>..............@....rsrc................H..............@..@.reloc...#.......$...L..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI14482\msvcp90.dll

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	335184
Entropy (8bit):	6.343962999919931
Encrypted:	false
SSDEEP:	6144:fmIIPLSg4p0t4271NWoSYEMS6VhUgiW6QR7t5183Ooc8SHkC2eQ:fmIeLSgo0S271QoSQhUgiW6QR7t51831
MD5:	92EA2DB0E788894C43753C550216A886
SHA1:	DA8C7A178BA0CA80D321666F5642A7436B640602
SHA-256:	9694756F43B20ABC50F95646C54E9E36CD6EDF8EED3DB846064567399F4E7566
SHA-512:	90E72A68C7267E8D0986A75247AE7B2339E4C2A981D686342B2EF90B1FCF9695B558D0BD5932F7C53524E02CC664B974BA76783FDE919B24EB36795DB3300BA6
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 7% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........#%..Mv..Mv..Mv.66v..Mv...v..Mv..Lv:.Mv...v..Mv...v..Mv...v..Mv...v..Mv...v..Mv...v..Mv...v..MvRich..Mv........................PE..L.....M...........!................P.... ...0....Hx.........................0............@.........................p4..,....3.......0.......................&......................................()..H...........................................UPX0....................................UPX1......... ......................@....rsrc........0......................@..............................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI14482\msvcr90.dll

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	250192
Entropy (8bit):	7.900323441964523
Encrypted:	false
SSDEEP:	6144:EODM4c99eLswEOva4g4fpgMf4FfIoSNjbZdGJCJLuEyKIqqOmiqsEqmQI0wye/c:EODM1HagYaMf4FAoSNjHmHyyc
MD5:	199D34B03C7D0EB804A6D9869184B8D4
SHA1:	03148854519D0970C1BBDC089D3E8DE1AED61C47
SHA-256:	DF86421E354F817607F2BAFC9188569242FCF9DD564B28F3E2915C86A0BA1F54
SHA-512:	E4269CA993393422A90231DAABD390771A635EEB0817A9D00DCCEF496372BB4B57B615529F26A2E8132BDE825CDACA07D965D207421C02EA6471DA214354361E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 1%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................6.........!.R...7.....&.....0.....6.....3...Rich..........PE..L.....M...........!.....@.......0..0f...@........Rx......................................@.........................@....\|.....x....................................................................r..H...........................................UPX0.....0..............................UPX1.....@...@...4..................@....rsrc................8..............@..............................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI14482\netifaces.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	7.145184945732974
Encrypted:	false
SSDEEP:	192:uKqSCMOF44HPPtLm+9a3ozToPmzYUaFaNJhLkwcud2DH9VwGfctH:ubS9s44vPtLR9aUPJ+aNJawcudoD7U
MD5:	C7807680A69196C3EE66C4CFB3E271AC
SHA1:	D3EA74C9E3B810C6A1EE4296B97E20F2F45C9461
SHA-256:	1A6C57AC8031582477B1D3463A65B6EB006EEA704E27C8C4B812B99EA910428D
SHA-512:	A5D893132AD889E98B434DA7FD5CA377AFB1800FD8D3230CCED5E9FDE576FCEC943DD22FA48810BA6D93C510EBAA8AC5A94EC1B9D639FD6C533C5BBD4737CF15
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 2%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......FL...-...-...-...U...-...U...-...-..J-...U...-...U...-...U...-...U...-..Rich.-..........................PE..L...,.-\...........!.....0.......P...x...`..........................................................................4...P.......4...................................................................p...H...........................................UPX0.....P..............................UPX1.....0...`...&..................@...UPX2.................*..............@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI14482\perfmon.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	6.948652527580434
Encrypted:	false
SSDEEP:	192:0xeSnTQM3MsUjU+viJBctKiyiLKPfFaNJhLkwcud2DH9VwGfct0XlpoI6J:0xe4R3scJBcMWYdaNJawcudoD7UmlSI
MD5:	EE813500A441B5FFDACD853E95BEE669
SHA1:	7F05F1493380AF3FE08F55524F6FF90C47C0CC4D
SHA-256:	AC491704AF920BE0E503F0243D2D371E230622E213E9F082347B52C0A7B009C2
SHA-512:	060D079A93ADD067EB062D2B1CB9977719BE68AE1223B0219DBB14CC9C6C66FF47D9929945636B577BC7F1BB84D5500B88ACD5F7BF636CC63BD4C88534AF724E
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3% Antivirus: Virustotal, Detection: 1%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........0...c...c...c..9c...c.gc...c.qc...c.ac...c...c...c.vc...c.`c...c.cc...cRich...c................PE..L...C..[...........!.....0.......`.......p........n.................................................................t...L...P...$.......P...............................................................H...........................................UPX0.....`..............................UPX1.....0...p..."..................@....rsrc................&..............@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI14482\psutil._psutil_windows.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	25600
Entropy (8bit):	7.700665778298437
Encrypted:	false
SSDEEP:	384:3qUURhEUVDrn5EMvG04YMJIoa67+5pGr0qLWMAUm7NFYGz45/+aNJawcudoD7ULt:aUjUXBjPAGHqLm7N/z4dnbcuyD7UL
MD5:	2FC800FCC46A597921C2ED447AEB09AC
SHA1:	72004227E5C60C8460F835A170798AA22861B79E
SHA-256:	2E4AD3D08118DA77C928C4614BFECB34397CFAF53F5D46D7C7E5F1DA3172C1F1
SHA-512:	A17022B364615B45A1873AEA0DE922A2988E4D75A8F4E63ECB9CA7DD46263E684B1F28B82BD77B046BBE2AD03CE65C5DACF98EACCAE861A30F137E0118A87225
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3% Antivirus: Virustotal, Detection: 3%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......E.6...X...X...X......X......X......X...Y...X......X......X......X.Rich..X.........PE..L...;b.\...........!.....`...................0...............................@.......................................2..\....0...............................2.......................................*..H...........................................UPX0....................................UPX1.....`.......\..................@...UPX2.........0.......`..............@......................................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI14482\pyexpat.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	52736
Entropy (8bit):	7.904524114628073
Encrypted:	false
SSDEEP:	1536:omazZr7ECJ0E6kFg85F/rFi2LU60XZlofDYq0nouy8:9aFr9mE6kF7hrcCU6Qlewout
MD5:	AD560121EFD8E249FC3414200D98F75F
SHA1:	73040F9BC04E733A85DA00E364EF85583F505636
SHA-256:	0BEB3B16F9A11F93137365A1179D2062A414ADABA337BCAC05A083A921775B50
SHA-512:	6DA2B01773DCE658DCFD9219DD8D093F60EAFF669ED600C9A62EFC39FB3E362F051A499FAC85777C1B8F364B1AD2E134E080CAE720FC5477711A7ED7F191A5C7
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3% Antivirus: Virustotal, Detection: 3%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........2.\...\...\......\......\......\......\...]..\......\......\......\.Rich..\.................PE..L...4>CX...........!................Pj....................................................@............................L...................................$.......................................(v..H...........................................UPX0....................................UPX1................................@...UPX2................................@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI14482\python27.dll

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	898048
Entropy (8bit):	7.990256946915668
Encrypted:	true
SSDEEP:	24576:I0cNEHSDC9XmwbTV/mv+nQW0mj7IaqtsoejWg3c:jHhmhmI9eo63
MD5:	8C44826A640B3CF0B32B0258C65FEE07
SHA1:	E3F9FE6366D0876BFA8B903B20D2ACF06416F1BC
SHA-256:	FBAD053D962BAC96865AC3372958D697711800FDC46F36C87011BB5E89026614
SHA-512:	884E2C01C088B9AE86D4605FED1CF8E9B17F99CF887EFC5644F4A91959ECD89148CCA3E9FDAA6AB9E8C4DFD2D61DBDFD442A95B13DAB7E5CD027B4782D473355
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 7% Antivirus: Virustotal, Detection: 0%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#..^g.y.g.y.g.y....~.y.n...l.y.n...i.y.n...e.y.n...l.y.g.x.[.y.n.....y.n...f.y.n...f.y.n...f.y.Richg.y.................PE..L... >CX...........!.....0.......0...Z..@...p...............................+...........@.........................pz.t\|..,y.D....p.,...........................................................f.H...........................................UPX0.....0..............................UPX1.....0...@...(..................@....rsrc........p......,..............@......................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI14482\pywintypes27.dll

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	53248
Entropy (8bit):	7.425128830518154
Encrypted:	false
SSDEEP:	1536:eTwUerP24SfDRd2TACkwqyfnouy81cSPDuwQ0:eTleODRd2ew/Pout1cSru
MD5:	07B436BFA1C7B4FFC21FB39358158060
SHA1:	7F5A47CDAB9A7D93BBBD204CEDFFCA61D3F80C84
SHA-256:	82C2926CB03A04392FA479801D505E2A387446BCA978FF930177121DB2FDB461
SHA-512:	13EBCB83F478C859CA808003933769B84290E108648B69F33043653263C5B4BD37ED5CA8D521B46A1D9122EB232F7E5D05A25E16F250D5573CF85CD5CDEFB2EF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 1%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qz.Y5...5...5....Tz.7...+Iy.6...+Io.8.....".4...+I..1.....'.>...5.......+Ih.$...+I~.4...+I}.4...Rich5...................PE..L...:..[...........!.........P............... ....z..........................p.......................................%..PJ..h#....... ..h...................Po..........................................H...........................................UPX0....................................UPX1.............\|..................@....rsrc....P... ...P..................@......................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI14482\select.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	9216
Entropy (8bit):	7.003407892450472
Encrypted:	false
SSDEEP:	192:qhogHS4TaqZXRQKKXYVEvySc3IFaNJhLkwcud2DH9VwGfctX:qhLS4TaqxhfCHc38aNJawcudoD7U
MD5:	57EB00056AC8C38CD4F3153FB9507F13
SHA1:	DDEE8E74FCC81B6301145F27C0F1CCF4B9185E1C
SHA-256:	7B90EC138AC8415D9B747612063D19147FEC2B1E99DE97C3B5636E8CA40B346E
SHA-512:	05F7EF6BD065D7DB3F41DFA95187FA40A14F58FA5D4705F2DF5982DB18EEB6D4E93C473D05932436BF645E76E0B23532867011E92EF953EC247B55648ED9C6EF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3% Antivirus: Virustotal, Detection: 1%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........i)...z...z...z...z...z...z...z...z...z...z...z...z...z...z...z...z...z...z...zRich...z........PE..L...5>CX...........!..... .......P..pq...`................................................@.............................H...................................H.......................................P}..H...........................................UPX0.....P..............................UPX1..... ...`......................@...UPX2................."..............@..............................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI14482\servicemanager.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	7.2228399102917615
Encrypted:	false
SSDEEP:	384:FVtYwprbL7fLBtdYzKNg13ZOPaNJawcudoD7UfMX:vawBbLFYzKNg1plnbcuyD7UfMX
MD5:	6A95BCF45E4BE23CC2634EF5BAD17660
SHA1:	7D13B791588CB800C2ADD75FF8E74C3C493A8143
SHA-256:	60DA4B4E628B7DC1115615128AC554AEB29B50A61629AD5AEEB5CC9D2BD86202
SHA-512:	D3C80B025647444F42D42E82CAD50C4383728F7F8C9E16AA9D87450CA864B0B97B5F8F47E80328A4A2B67CE7D06C9A8F1DAE8C5B3C798DE1B2A50164161E69C8
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0% Antivirus: Virustotal, Detection: 1%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........o....K...K...K...K...K...K...K...K...KR..K...K...K...K...K...K...K...K...K...K...K...KRich...K........................PE..L......[...........!.....@........................}.....................................................................\...........................................................................h...H...........................................UPX0....................................UPX1.....@.......4..................@....rsrc................8..............@......................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI14482\unicodedata.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	181760
Entropy (8bit):	7.989160583257678
Encrypted:	false
SSDEEP:	3072:Rfe2dO8KvTdjKGssSXwgtXZT32qenyxHBKs//4wd3RP29sZ6lI883out:Rfe2bKvEw+k2kw/4wZRPS3coS
MD5:	9A465CFAA788E29E7B1366C012EBC75C
SHA1:	10D9C49BB6652D9B04E17608D9ED35B036112647
SHA-256:	35C84D824DB175DD71046806A59BC711021ABCE04698FA304B1E2A9855E50A9C
SHA-512:	31BEE259C78CEB1E4F5C52E7B2CBD0EB62A071FC9C748DF47AB824E383EFDC3B218168700341B96D139DABFB3E4D7644341F22E52982B7C7F135A9E35B300B00
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3% Antivirus: Virustotal, Detection: 3%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......{H..?).?).?).6QE.=).6QS.1).6QT.=).6QC.8).?)..).6QY.>).6QB.>).6QA.>).Rich?).................PE..L...6>CX...........!......................................................................@.............................T...................................,.......................................x...H...........................................UPX0....................................UPX1................................@...UPX2................................@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI14482\win32api.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	34816
Entropy (8bit):	7.794879575971907
Encrypted:	false
SSDEEP:	768:etKTLIw2eRBsqBvKddE/wW68vEvfW2qmSOyinbcuyD7Uqmx:DCeLrGderDH2FXyinouy8qmx
MD5:	42C475231F4835BB1A5F94B0D3DA4520
SHA1:	FCFAE296DD10C92D973A57D61BBF5C0F4A15ED6B
SHA-256:	87CEEB1B7586DB730F48988A07018F9C8AF57934FF7F173A869542207F46B0F1
SHA-512:	D1A699B8497E8843F990F6F719A904A7751FE2A9404CB195BE2D94341728A7372CD93D379B576E6031980E1DA53F2336805C6BF59E799B63565CD63D4931C02A
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3% Antivirus: Virustotal, Detection: 1%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......[-..L...L...L.......L.......L.......L...J..L...L..UM.......L.......L.......L..Rich.L..................PE..L......[...........!.............p.. ...............................................................................P.......X...........X...............................................................H....................B..@...................UPX0.....p..............................UPX1.............~..................@....rsrc...............................@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI14482\win32event.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	6.799438399701252
Encrypted:	false
SSDEEP:	192:jNxmpzSvHU53Uon53eXqY1K/CjrELQc432Xq0FaNJhLkwcud2DH9VwGfctLj/t:Xmp2/UR95aP1pgEc432XBaNJawcudoDU
MD5:	796306BE7A1ABCFFB8853EE9CEB5BEAE
SHA1:	93762CF53958A3A99B674986FCF3C53C489133ED
SHA-256:	26E6D883E9E61BF872425526A9B8C7BB229C3B9D2F82BB3C0BF500660DBE1995
SHA-512:	5919A837FA1FCAEA91B14D02DA306928D5E523E4591DCA290422C9EB9BE15F2EE626A8379F5C953F2B08E7A6B2CD67618652B9EFA9ACE8ABD47A8BD7CD8C2F64
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 3% Antivirus: Virustotal, Detection: 1%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........k..{8..{8..{8..8..{8..8..{8..8..{8 ..8..{8..z8..{8..8..{8..8..{8..8..{8Rich..{8................PE..L...T..[...........!.....0..............................................................................................P...`...\.......`...........................................................h...H...........................................UPX0....................................UPX1.....0......."..................@....rsrc................&..............@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI14482\win32evtlog.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	19968
Entropy (8bit):	7.436093769968754
Encrypted:	false
SSDEEP:	384:Wo5FgP/m1xaGAONAt4ZvFqQggg3LgsAWUh31lA2W1waNJawcudoD7UGwGS:WmuP+TOONp5UQ/Zs8FlAfnbcuyD7UGwX
MD5:	317360BE68901D11F3D02AF1C151A4DC
SHA1:	570BF03BE1A737CF3D0CF3FC8E77261CF64E2051
SHA-256:	AC9C5C4BAA4DE19BDDF55313F29182F26EB80312C31266413672C61424A5C6E0
SHA-512:	25C25C23DD4FE1957CDFAD833D4570553C2627775008F3939525B6A3D1892F8B6CB7A9F20D454166338DF4DFC8A98306A1160016AE4CB2E9464944945AFA0A82
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........E..i+..i+..i+.E&...i+..;...i+..;...i+..;...i+.%...i+..i*.hi+..;...i+..;...i+..;...i+..;...i+.Rich.i+.................PE..L......[...........!.....P...................0...............................@.......................................4..T....3..P....0......................L5.......................................!..H.......................@...................UPX0....................................UPX1.....P.......D..................@....rsrc........0.......H..............@......................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI14482\win32service.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	18432
Entropy (8bit):	7.513143648749714
Encrypted:	false
SSDEEP:	384:DvSTTJQxdZ3goCVdvSbw66apC1aNJawcudoD7U46:LSTT+1KF1onbcuyD7U46
MD5:	F23A62491BD945C050E3E1D13909E9E7
SHA1:	B8DAC4E00163533157A17E3B56D05E049A2375A2
SHA-256:	E52B5532A6764AAAE67DB557412B3F77EBDC8A14A72771A1C6414A83BB3FC15C
SHA-512:	52200CF9687752DB43BBAE703192C841694D5BD976FA56C0F25E0478CFB97681BC77677C1A8907167612DDF9FE6A561945FBEB0180022670AF97BF41B5B11766
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........[..[..[.....Z..E.-.Z..E.;.V..E.+.]...!s.\..[.....E.<.^..E.*.Z..E.,.Z..E.).Z..Rich[..........PE..L...q..[...........!.....@..........................................................................................8...T...............................................................................H...........................................UPX0....................................UPX1.....@.......>..................@....rsrc................B..............@..............................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI14482\xmrig.exe

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	1905664
Entropy (8bit):	7.9235088812144
Encrypted:	false
SSDEEP:	49152:jeXVwyagUSymDH29F4+rthFTo6YZfnH8:0VKgUSymDH29ttzToX1nc
MD5:	13BDD9CD9F7E51746172996262B5A873
SHA1:	3834F8179ABD7A827E927505F3C226AC8BBCF3EE
SHA-256:	4BF737B29FF521BC263EB1F2C1C5EA04B47470CCCD1BEAE245D98DEF389929BD
SHA-512:	49879918505D042312F20B2FC8310A8C4A58AA266ED1AB05E0481F7E11385DA0920CF9D756F842EB98E4394F14725385B74A99B38FC8A60222FA4CC873CB8040
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: C:\Users\user\AppData\Local\Temp\_MEI14482\xmrig.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....\.....................`...0>...Z..@>...[...@..........................`[............... ...................... X.x....][.<.....[..]....................................................Z.....................................................UPX0.....0>.............................UPX1.........@>.....................@....rsrc....`....[..`..................@...3.94.UPX!....E.G...@.`.Z.....$Z.$/.w.......&...'....1.f.=.@9....MZ..,......($..#...th.....82..tJ......$.,./,......+.l..Ho..~B.......:..6....L.=Dc..tm....-<h....f..<2...u..?PEl..u..Q....-l..~?....j..x.......]...........K".v.g?w...k+...yt`,........o..7>,. ..D$...............7......b..0.{..,.~...[U......WV.U.S..\|.0~....+..).b.........@....................5.o.E.....d....x....l0.9..9...3....o._..........=...u...;.v.f...R..0..`.lm...--...I...X/(......9J9..~?.v...&+.. P.kSn.l......LJ...

C:\Users\user\AppData\Local\Temp\_MEI28682\Crypto.Cipher._AES.pyd

Download File

Process:	C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	7.553130526678379
Encrypted:	false
SSDEEP:	384:50Q1C9jViLl7hDB6n/PtHU2wr8gj93KqmilaNJawcudoD7U:dC8LU/PBU8itClnbcuyD7U
MD5:	371397E80A55D432DA47311B8EF25317
SHA1:	71617777D6A2500D6464D7B394C8BE5F1E4E119E
SHA-256:	C1A900615C9500C46B9602C30C53F299290B03632208EF1152AF8830AB73AD17
SHA-512:	3139E2848ACF02CC8475449F213873D2C2B7196F6A55C70D2D8F8B487020387740364E5CA0AA584624D1B9B01B965146A2F0E15EEF34830C7C0ECBB8637DAE03
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........+\8.J2k.J2k.J2k.Ik.J2k...k.J2k...k.J2k...k.J2k.2.k.J2k.J3k.J2k...k.J2k...k.J2k...k.J2kRich.J2k........PE..L....4.S...........!.....@..........`...................................................................................D...........................................................................8...H...........................................UPX0....................................UPX1.....@.......:..................@...UPX2.................>..............@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI28682\Include\pyconfig.h

Download File

Process:	C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	21321
Entropy (8bit):	5.345136937906198
Encrypted:	false
SSDEEP:	384:pGpFpaU1kgCw8r+MIP8Bj5DvVySh3awQBoerw8W+PYV0FGYfN/+:pGpFpb+IU99UShATrw8W+AKF/+
MD5:	BC185DE8B2437963368A85FDD9852951
SHA1:	1459F1428214FCCA7F203FB3A3AFF28E16EB9C1B
SHA-256:	8B130D901E0F83B55699D565F103F2F8F1B3A51712EBB4B9646EA517CC1F04D6
SHA-512:	918469D9A59FE059F3C7C93F34C8D2D07CB8A9BF5E953A1527922ED5C65FF4A2DF50BBC78ED9CE146BF3A1FB6F1763F061262FA4A937BEEEE1FEB8A99E31339E
Malicious:	false
Preview:	#ifndef Py_CONFIG_H.#define Py_CONFIG_H../* pyconfig.h. NOT Generated automatically by configure...This is a manually maintained version used for the Watcom,.Borland and Microsoft Visual C++ compilers. It is a.standard part of the Python distribution...WINDOWS DEFINES:.The code specific to Windows should be wrapped around one of.the following #defines..MS_WIN64 - Code specific to the MS Win64 API.MS_WIN32 - Code specific to the MS Win32 (and Win64) API (obsolete, this covers all supported APIs).MS_WINDOWS - Code specific to Windows, but all versions..MS_WINCE - Code specific to Windows CE.Py_ENABLE_SHARED - Code if the Python core is built as a DLL...Also note that neither "_M_IX86" or "_MSC_VER" should be used for.any purpose other than "Windows Intel x86 specific" and "Microsoft.compiler specific". Therefore, these should be very rare....NOTE: The following symbols are deprecated:.NT, USE_DL_EXPORT, USE_DL_IMPORT, DL_EXPORT, DL_IMPORT.MS_CORE_DLL...WIN32 is still required for the

C:\Users\user\AppData\Local\Temp\_MEI28682\Microsoft.VC90.CRT.manifest

Download File

Process:	C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1050
Entropy (8bit):	5.382436822526041
Encrypted:	false
SSDEEP:	24:2dtn3mGv+zg4NnEN4XKHVJrMmV6LSWV5rcb3S:ch35+zg4i0KHVVdOmS
MD5:	BFB93876892CCA8E2AD0021585C34C8B
SHA1:	0DDE1B225C98825A09D8FF85F462571C9C862E35
SHA-256:	0D060ED7C25159B7B75F16D449963BFD639C15B3C5280BC7897403268C2B9F35
SHA-512:	FE70540B3B3FA88B32DFB2FF7406A3A9819E7862B850D871B932996BBEFFDBC70D7192D6E3196A8583B2DB756CA9CC278505AFBE585BA30EB1222D4F8BE15B7B
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v1">.. <noInheritable/>.. <assemblyIdentity name="Microsoft.VC90.CRT" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b" type="win32" version="9.0.30729.6161"/>.. <file hash="7021457b391b35606e708c69987e4b6f606609ee" hashalg="SHA1" name="msvcr90.dll"/>.. <file hash="88549dd3ce8eaa62ca8aad0e96ddd9fec2203628" hashalg="SHA1" name="msvcp90.dll"/>.. <file hash="65ef374affa5b48827e539b35b3275c201b41fc9" hashalg="SHA1" name="msvcm90.dll"/>.. <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">.. <application>.. <supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/>.. <supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/>.. <supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/>.. <supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>.. <supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/>..

C:\Users\user\AppData\Local\Temp\_MEI28682\_ctypes.pyd

Download File

Process:	C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	37888
Entropy (8bit):	7.848484052157707
Encrypted:	false
SSDEEP:	768:pAXLisB/qV2nQnf33sWcCRWKZac3VWw6cLA3zReukhRnbcuyD7U:pAnBi8nQf3sYToclt6cLUCRnouy8
MD5:	6CB8B560EFBC381651D2045F1571D7C8
SHA1:	15283A7A467ADB7B6D7A7182F660DD783F90E483
SHA-256:	6456FEA123E04BCEC8A8EED26160E1DF5482E69D187D3E1A0C428995472AC134
SHA-512:	CA2958095E8E08B5EF05EC9DE15B7D1EB180923A40B90356DB56A124101C96D8E745001948B89DBE9D6B9CE3C2029F7E9EAF20C73FA1D410A821D6605830BFC0
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...................F.....W.....P......@..........Z.....A.....B...Rich..................PE..L...*>CX...........!............. .. ....0................................................@.........................<...........<.......................................................................H...........................................UPX0..... ..............................UPX1.........0......................@...UPX2................................@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI28682\_hashlib.pyd

Download File

Process:	C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	351744
Entropy (8bit):	7.996557276168139
Encrypted:	true
SSDEEP:	6144:Xh0byJKrtKOFhjnTtMoy8gpVI/xxWo/nX0NKOzyGFmJ559Vq2SeTsRgIIGYMowwZ:2bymtjF1TtMod/xweDK7FmJ5rLVYTIGm
MD5:	EE134421FBABEB565E4F3CA721331C2E
SHA1:	4B03BDD142C6A7BB6F74ABE968C5B76B63E06059
SHA-256:	7863E1BEDFE1FFC720B67B2EB7B3491DB9D2B8E56B5574E6A40FF90336B8DAFA
SHA-512:	D27FF65B6A8BF2E5E70D2865E72EEE6930E76C2A3990428C54FC998743D3C540C5C984B5D1429E8FFBE3D160AE1F6782CD6D3CA40822F81D2052BA168595D1FA
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......z.$.>.J.>.J.>.J.7...4.J.7...1.J.7...<.J.7...3.J.>.K..J.>.J...J.7...Y.J.7...?.J.7...?.J.Rich>.J.........................PE..L....>CX...........!.....`..........@K.......`...............................p............@.........................pa..L....`..p............................a.......................................W..H...........................................UPX0....................................UPX1.....`.......X..................@...UPX2.........`.......\..............@......................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI28682\_socket.pyd

Download File

Process:	C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	7.706254752795193
Encrypted:	false
SSDEEP:	384:CCNDRisVUlkycq27U4r0rOc606B8k4gG35aiQjgO6OPjGL2e1ua7aNJawcudoD7P:v7VUcq27Jr0rOmbwE4jGLhohnbcuyD7B
MD5:	BE47363992C7DD90019276D35FA8DA76
SHA1:	CCF7EBBE829DA08EFD95A53D4BA0C0D4938F6169
SHA-256:	BE10254B111713BEF20A13D561DE61CA3C74A34C64DDC5B10825C64AB2C46734
SHA-512:	573F9111535A9A136FCAAA5C1A16C347F7327626768D849513D69C9848406B1002DCC5B8C17A291EF2E6519587533CA806018EE471A39D330F032A9E7E635EA7
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......AV2..7\..7\..7\..O..7\..O..7\..O..7\..7]..7\..O..7\..O..7\..O..7\..O..7\.Rich.7\.........................PE..L...X>CX...........!.....P..........0.....................................................@.............................d...................................d...........................................H...........................................UPX0....................................UPX1.....P.......P..................@...UPX2.................T..............@..............................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI28682\_ssl.pyd

Download File

Process:	C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	498688
Entropy (8bit):	7.996471896707535
Encrypted:	true
SSDEEP:	12288:FHNz5hZdNGitmdIA8byo3k4Ff9m3fTByPf6So+2RON1jjoS:P3fNTtmd2bkof43fTkR2gH
MD5:	68C3AD86E0A8833C29AD1BE10D3C025D
SHA1:	04488362814B2F3AE07C4E8DF8E45868D48B447F
SHA-256:	C236271B92A0F1D3304337F2E2444107F34D8E26272981F48C47DB347133566C
SHA-512:	BB2819D913033CC26DCD1E5CBF015DACDBF747D29C72BFD41BFE0D74BB77E51A61CF9BE4B67B6348938837125F1D0F80AF0AC33531E00CEA1585535952A22785
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........HFu.)(&.)(&.)(&.Q.&.)(&.Q.&.)(&.Q.&.)(&.)(&.)(&.))&9)(&.Q.&.)(&.Q.&.((&.Q.&.)(&.Q.&.)(&Rich.)(&................PE..L...q>CX...........!.................e....................................................@............................D............................................................................q..H...........................................UPX0....................................UPX1................................@...UPX2................................@..............................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI28682\_win32sysloader.pyd

Download File

Process:	C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	4.992693298555373
Encrypted:	false
SSDEEP:	192:t2VnGV7o5QUEZWm6Uk3fvf3X7THIL3YO+8I:tVU5QUEz6hfLTH98
MD5:	B4A567D80CCC08FB1C7FBB765847AFDA
SHA1:	B7FF2C68BA2887AAF5D029F41922E626C72B716D
SHA-256:	DBB0F9C499A710BBC8BCDE4ECC3577A6C9548262D6CE4434ED5A0708CBC787DD
SHA-512:	DDFEC25304BABE2DF55958F512F61AFD9AF88DDA499FE87931D17A9EEBF048449885A06A24BDDBC8604E11F07CED3C2ECE7F89C28290CAB5D1BF3816D22128DB
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......M.oC.............J.............................../........................Rich............PE..L......[...........!......................... ....;..........................`......................................P&..Z...\"..P....@..l....................P....... ..............................8!..@............ ...............................text...`........................... ..`.rdata....... ......................@..@.data........0......................@....rsrc...l....@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI28682\back.jpg

Download File

Process:	C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	47107
Entropy (8bit):	6.2032294727594985
Encrypted:	false
SSDEEP:	768:z9v1zJKaohy0Za9jwmrALVaka3sgBXHDizIdI9e2E:5v1zJ3nuswbLVgZsceO
MD5:	4AE078DD5085E97D3605F20DC079412A
SHA1:	1BABFCF2D374AE590970A3BE2E0E27BC04922546
SHA-256:	ED551536FF22587CDF7701A279E088EB370A4121E7A3FA1F3C8B121E767318A2
SHA-512:	BF163C63120CC5035087E4FF0035D9DAEB100218C62969AA6AA75D539108323295EB9CC28ABB0906C21CE8AEA25DACD1D0AAB3F3FE9C765D35348F0A7DA000AE
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......]....S......"...8.P....... ..`u...0.................................................... .....................................................................................................................................................UPX0..... ..............................UPX1.....P...0...H..................@...UPX2.................J..............@...3.93.UPX!.....3r#l..JW..CE...0..&.......U..S...........t?........'.........9.r.....t...'.....s.t&...$....,1....$6.....X[]._V`..u....tG..oo.t$lE_D$.....=......."....1......uG...c..4....uF1..e.[^]..o...f.L.!.+.y..........................8</....fp.v..U..$........../...........O/...e..]...........#3f.E.f.E......m.._..;.}e.......f.t"............U.1.3-...}..~2.k......!..........7{..+...7..\|...............G.:..S........w. ........ ..%+{.n..$...e.>.m....u..,(.....k_.'lk.C2$C&'(.5.`cv/..

C:\Users\user\AppData\Local\Temp\_MEI28682\bz2.pyd

Download File

Process:	C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	35840
Entropy (8bit):	7.816957595202127
Encrypted:	false
SSDEEP:	768:IHCeOgq+kCitCVj5rz2Ya+r9qLYp9R9JoWnbcuyD7UiT:IHXr8CBd9NpfXxnouy8
MD5:	C9C00BC854A39E66B27787D188F9E8D7
SHA1:	21F20CF6C628B529DB4BDB853B679F9BF23590E3
SHA-256:	29520DF660A5BBD704B9106A6650A66E4F5766B904D05F97146668D41DBF5839
SHA-512:	8887B5CA542220CAC04D5A6A22A06F95DB560F4FE0F9A128CEB642ED9716ABCFFBA2146CCE682EB16C4DA3F423649A61904A73C4357D9FDBD5DDF606790199A3
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}.S.9.=K9.=K9.=K..K:.=K0..K:.=K0..K7.=K0..K;.=K0..K>.=K9.<KS.=K0..K1.=K0..K8.=K0..K8.=KRich9.=K................PE..L...?>CX...........!.................W.......p............................................@..........................p..D....p...............................q.......................................c..H...........................................UPX0....................................UPX1................................@...UPX2.........p......................@..............................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI28682\certifi\cacert.pem

Download File

Process:	C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	284518
Entropy (8bit):	6.05114864026174
Encrypted:	false
SSDEEP:	6144:GriCfLXd1YU58fVuKlnm5plZ0PXCRrcMBbADwYC+MslE:GrdT3YZuz5LwCRrcMije
MD5:	DD2DD543395692705F7DDA0F5E7750FA
SHA1:	40D7CE60393978A29FB0E0B1E849658E48CF7887
SHA-256:	397B833E5ACF89A2709B964401A9ACA68D24B62349B72BBE38684E586AA07A27
SHA-512:	3BA0D6AD8B6838B04FBFDEBAD20EB5544C093BA592B517AA383708A34CE2BD215DB2BF010090251674DBCFD4EDA3C44F770C9FBF314304DE918D7E59E2596CF2
Malicious:	false
Preview:	.# Issuer: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Subject: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Label: "GlobalSign Root CA".# Serial: 4835703278459707669005204.# MD5 Fingerprint: 3e:45:52:15:09:51:92:e1:b7:5d:37:9f:b1:87:29:8a.# SHA1 Fingerprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c.# SHA256 Fingerprint: eb:d4:10:40:e4:bb:3e:c7:42:c9:e3:81:d3:1e:f2:a4:1a:48:b6:68:5c:96:e7:ce:f3:c1:df:6c:d4:33:1c:99.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG.A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv.b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw.MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i.YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT.aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ.jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp.xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz

C:\Users\user\AppData\Local\Temp\_MEI28682\config.json

Download File

Process:	C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1206
Entropy (8bit):	4.275024024623091
Encrypted:	false
SSDEEP:	24:pCKENTHgbeZlE1jCAh1RHEdOgNanAOSWSula:UKuTHgbYlUZHEdrNAla
MD5:	50CC63E4A1B24622CF61ED566B03E98F
SHA1:	92E5874785BB76E4579559BA70E116A6149349F5
SHA-256:	348F388C57DFB77B0CAACD8304725E10DC69A52EEC41AE695327787AD1853C92
SHA-512:	9A291DB9CF396687F3878590B1EB65CD7DA2E6FC3D6DE64A3B8CB08116B646371F432100E16B0ECD4F2916D05D67830F949AC2A3CA559A3A8D56616DF2BE98C7
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: C:\Users\user\AppData\Local\Temp\_MEI28682\config.json, Author: Joe Security
Preview:	{. "algo": "cryptonight",. "api": {. "port": 0,. "access-token": null,. "id": null,. "worker-id": null,. "ipv6": false,. "restricted": true. },. "autosave": true,. "av": 0,. "background": true,. "colors": true,. "cpu-affinity": null,. "cpu-priority": null,. "donate-level": 1,. "huge-pages": true,. "hw-aes": null,. "log-file": null,. "max-cpu-usage": 70,. "pools": [. {. "url": "xmr.crypto-pool.fr:3333",. "user": "47BD6QNfkWf8ZMQSdqp2tY1AdG8ofsEPf4mcDp1YB4AX32hUjoLjuDaNrYzXk7cQcoPBzAuQrmQTgNgpo6XPqSBLCnfsjaV",. "pass": "x",. "rig-id": null,. "nicehash": false,. "keepalive": false,. "variant": -1,. "enabled": true,. "tls": false,. "tls-fingerprint": null. }. ],. "print-time": 60,. "retries": 5,. "retry-pause": 5,. "safe": false,. "threads": [. {.

C:\Users\user\AppData\Local\Temp\_MEI28682\ftpcrack.exe.manifest

Download File

Process:	C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1345
Entropy (8bit):	5.283640732769631
Encrypted:	false
SSDEEP:	24:2dtn3ZoWglN2v+zg4NnEN4XKDmc0+bLg4fNRme5rcb3S:ch3DgX2+zg4i0KDmJ+bLg4VRmemS
MD5:	B5DEA49B86C5BB5D9CD8D64A09F70065
SHA1:	487EF676EBD244EBC3CF197F70DA7A5E393FB96E
SHA-256:	78B1160F6ADAB34D144AD19A0F4B83F83453F1E18460BBDFBE17AD354B62AF7D
SHA-512:	1B5914F4C52F47A33C57F5F6428482E6766099BF43D4E8616CE4AABC4A917C24B2E0C98C841F0D7E7B8A202F40FF960885535539BF70CC7C7ED8687C7ECE010C
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v1">.. <assemblyIdentity name="ftpcrack" processorArchitecture="x86" type="win32" version="1.0.0.0"/>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity name="Microsoft.VC90.CRT" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b" type="win32" version="9.0.30729.6161"/>.. <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"/>.. </dependentAssembly>.. </dependency>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity language="*" name="Microsoft.Windows.Common-Controls" processorArchitecture="x86" publicKeyToken="6595b64144ccf1df" type="win32" version="6.0.0.0"/>.. <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"/>.. </dependentAssembly>.. </dependency>.. <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">.. <application>.. <supportedOS Id="{1f676c76-80e

C:\Users\user\AppData\Local\Temp\_MEI28682\httplib2\cacerts.txt

Download File

Process:	C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	135546
Entropy (8bit):	6.039525643754334
Encrypted:	false
SSDEEP:	3072:FVrovvEjVplrqHSdX+zpfQq7ZiyZOF5mdFENAKHn1HtYfei8i31MCSjfpVpKbIcf:3cmHuBfaUFENX3YfEl3plcs+
MD5:	14BA876BA2515A25BBB511F24BF06653
SHA1:	291DCDEE67E880B21FD7001CB8350C3ECEE4CAC8
SHA-256:	2039836A620F956EC094EAAE7C9B41A04C76F31130898B11014D9E83C905F0DE
SHA-512:	5035F82DF06308A14F6626C54382B3AB34B6D664C8394B48F75275F69DCC2B93266D843B51F0B586E5F12FCD70FE3660B5B08AFC20738DF6D8C812592C0D71E4
Malicious:	false
Preview:	# Issuer: CN=GTE CyberTrust Global Root O=GTE Corporation OU=GTE CyberTrust Solutions, Inc..# Subject: CN=GTE CyberTrust Global Root O=GTE Corporation OU=GTE CyberTrust Solutions, Inc..# Label: "GTE CyberTrust Global Root".# Serial: 421.# MD5 Fingerprint: ca:3d:d3:68:f1:03:5c:d0:32:fa:b8:2b:59:e8:5a:db.# SHA1 Fingerprint: 97:81:79:50:d8:1c:96:70:cc:34:d8:09:cf:79:44:31:36:7e:f4:74.# SHA256 Fingerprint: a5:31:25:18:8d:21:10:aa:96:4b:02:c7:b7:c6:da:32:03:17:08:94:e5:fb:71:ff:fb:66:67:d5:e6:81:0a:36.-----BEGIN CERTIFICATE-----.MIICWjCCAcMCAgGlMA0GCSqGSIb3DQEBBAUAMHUxCzAJBgNVBAYTAlVTMRgwFgYD.VQQKEw9HVEUgQ29ycG9yYXRpb24xJzAlBgNVBAsTHkdURSBDeWJlclRydXN0IFNv.bHV0aW9ucywgSW5jLjEjMCEGA1UEAxMaR1RFIEN5YmVyVHJ1c3QgR2xvYmFsIFJv.b3QwHhcNOTgwODEzMDAyOTAwWhcNMTgwODEzMjM1OTAwWjB1MQswCQYDVQQGEwJV.UzEYMBYGA1UEChMPR1RFIENvcnBvcmF0aW9uMScwJQYDVQQLEx5HVEUgQ3liZXJU.cnVzdCBTb2x1dGlvbnMsIEluYy4xIzAhBgNVBAMTGkdURSBDeWJlclRydXN0IEds.b2JhbCBSb290MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCVD6C28FCc6HrH.iM3dFw4usJTQGz0

C:\Users\user\AppData\Local\Temp\_MEI28682\msvcm90.dll

Download File

Process:	C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	225280
Entropy (8bit):	6.034911041879855
Encrypted:	false
SSDEEP:	3072:6yZeocziNzMLSMOYscmLWbAX+dP4Upoh86Goao14JU87/amFYw8fF01OyASLE:PYOMqc8oAXGP4Upoe6fa3/amiX2Oyp
MD5:	D34A527493F39AF4491B3E909DC697CA
SHA1:	AFEE32FCD9CE160680371357A072F58C5F790D48
SHA-256:	7A74DA389FBD10A710C294C2E914DC6F18E05F028F07958A2FA53AC44F0E4B90
SHA-512:	0DABC5455EB02601D7C40A9C49B3ADE750B1118934EF3785FB314FA313437BC02B243571ABA25F1661A69DCEA36838530C12762A2E6602D14A9B03770A82CCA6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;...h...h...h..ah...h1.dh...h..gh...h...h...h.-.h...h...h...h..qh...h..vh...h..`h...h..fh...h..ch...hRich...h........................PE..L.....M...........!.....:..........Z........P....?x.........................0......^.....@......................... 3..4....&..d...............................d...P...............................H...@...............(...........p...H............text...T9.......:.................. ..`.data........P.......>..............@....rsrc................H..............@..@.reloc...#.......$...L..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI28682\msvcp90.dll

Download File

Process:	C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	335184
Entropy (8bit):	6.343962999919931
Encrypted:	false
SSDEEP:	6144:fmIIPLSg4p0t4271NWoSYEMS6VhUgiW6QR7t5183Ooc8SHkC2eQ:fmIeLSgo0S271QoSQhUgiW6QR7t51831
MD5:	92EA2DB0E788894C43753C550216A886
SHA1:	DA8C7A178BA0CA80D321666F5642A7436B640602
SHA-256:	9694756F43B20ABC50F95646C54E9E36CD6EDF8EED3DB846064567399F4E7566
SHA-512:	90E72A68C7267E8D0986A75247AE7B2339E4C2A981D686342B2EF90B1FCF9695B558D0BD5932F7C53524E02CC664B974BA76783FDE919B24EB36795DB3300BA6
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........#%..Mv..Mv..Mv.66v..Mv...v..Mv..Lv:.Mv...v..Mv...v..Mv...v..Mv...v..Mv...v..Mv...v..Mv...v..MvRich..Mv........................PE..L.....M...........!................P.... ...0....Hx.........................0............@.........................p4..,....3.......0.......................&......................................()..H...........................................UPX0....................................UPX1......... ......................@....rsrc........0......................@..............................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI28682\msvcr90.dll

Download File

Process:	C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	250192
Entropy (8bit):	7.900323441964523
Encrypted:	false
SSDEEP:	6144:EODM4c99eLswEOva4g4fpgMf4FfIoSNjbZdGJCJLuEyKIqqOmiqsEqmQI0wye/c:EODM1HagYaMf4FAoSNjHmHyyc
MD5:	199D34B03C7D0EB804A6D9869184B8D4
SHA1:	03148854519D0970C1BBDC089D3E8DE1AED61C47
SHA-256:	DF86421E354F817607F2BAFC9188569242FCF9DD564B28F3E2915C86A0BA1F54
SHA-512:	E4269CA993393422A90231DAABD390771A635EEB0817A9D00DCCEF496372BB4B57B615529F26A2E8132BDE825CDACA07D965D207421C02EA6471DA214354361E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................6.........!.R...7.....&.....0.....6.....3...Rich..........PE..L.....M...........!.....@.......0..0f...@........Rx......................................@.........................@....\|.....x....................................................................r..H...........................................UPX0.....0..............................UPX1.....@...@...4..................@....rsrc................8..............@..............................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI28682\netifaces.pyd

Download File

Process:	C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	7.145184945732974
Encrypted:	false
SSDEEP:	192:uKqSCMOF44HPPtLm+9a3ozToPmzYUaFaNJhLkwcud2DH9VwGfctH:ubS9s44vPtLR9aUPJ+aNJawcudoD7U
MD5:	C7807680A69196C3EE66C4CFB3E271AC
SHA1:	D3EA74C9E3B810C6A1EE4296B97E20F2F45C9461
SHA-256:	1A6C57AC8031582477B1D3463A65B6EB006EEA704E27C8C4B812B99EA910428D
SHA-512:	A5D893132AD889E98B434DA7FD5CA377AFB1800FD8D3230CCED5E9FDE576FCEC943DD22FA48810BA6D93C510EBAA8AC5A94EC1B9D639FD6C533C5BBD4737CF15
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......FL...-...-...-...U...-...U...-...-..J-...U...-...U...-...U...-...U...-..Rich.-..........................PE..L...,.-\...........!.....0.......P...x...`..........................................................................4...P.......4...................................................................p...H...........................................UPX0.....P..............................UPX1.....0...`...&..................@...UPX2.................*..............@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI28682\perfmon.pyd

Download File

Process:	C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	6.948652527580434
Encrypted:	false
SSDEEP:	192:0xeSnTQM3MsUjU+viJBctKiyiLKPfFaNJhLkwcud2DH9VwGfct0XlpoI6J:0xe4R3scJBcMWYdaNJawcudoD7UmlSI
MD5:	EE813500A441B5FFDACD853E95BEE669
SHA1:	7F05F1493380AF3FE08F55524F6FF90C47C0CC4D
SHA-256:	AC491704AF920BE0E503F0243D2D371E230622E213E9F082347B52C0A7B009C2
SHA-512:	060D079A93ADD067EB062D2B1CB9977719BE68AE1223B0219DBB14CC9C6C66FF47D9929945636B577BC7F1BB84D5500B88ACD5F7BF636CC63BD4C88534AF724E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........0...c...c...c..9c...c.gc...c.qc...c.ac...c...c...c.vc...c.`c...c.cc...cRich...c................PE..L...C..[...........!.....0.......`.......p........n.................................................................t...L...P...$.......P...............................................................H...........................................UPX0.....`..............................UPX1.....0...p..."..................@....rsrc................&..............@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI28682\psutil._psutil_windows.pyd

Download File

Process:	C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	25600
Entropy (8bit):	7.700665778298437
Encrypted:	false
SSDEEP:	384:3qUURhEUVDrn5EMvG04YMJIoa67+5pGr0qLWMAUm7NFYGz45/+aNJawcudoD7ULt:aUjUXBjPAGHqLm7N/z4dnbcuyD7UL
MD5:	2FC800FCC46A597921C2ED447AEB09AC
SHA1:	72004227E5C60C8460F835A170798AA22861B79E
SHA-256:	2E4AD3D08118DA77C928C4614BFECB34397CFAF53F5D46D7C7E5F1DA3172C1F1
SHA-512:	A17022B364615B45A1873AEA0DE922A2988E4D75A8F4E63ECB9CA7DD46263E684B1F28B82BD77B046BBE2AD03CE65C5DACF98EACCAE861A30F137E0118A87225
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......E.6...X...X...X......X......X......X...Y...X......X......X......X.Rich..X.........PE..L...;b.\...........!.....`...................0...............................@.......................................2..\....0...............................2.......................................*..H...........................................UPX0....................................UPX1.....`.......\..................@...UPX2.........0.......`..............@......................................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI28682\pyexpat.pyd

Download File

Process:	C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	52736
Entropy (8bit):	7.904524114628073
Encrypted:	false
SSDEEP:	1536:omazZr7ECJ0E6kFg85F/rFi2LU60XZlofDYq0nouy8:9aFr9mE6kF7hrcCU6Qlewout
MD5:	AD560121EFD8E249FC3414200D98F75F
SHA1:	73040F9BC04E733A85DA00E364EF85583F505636
SHA-256:	0BEB3B16F9A11F93137365A1179D2062A414ADABA337BCAC05A083A921775B50
SHA-512:	6DA2B01773DCE658DCFD9219DD8D093F60EAFF669ED600C9A62EFC39FB3E362F051A499FAC85777C1B8F364B1AD2E134E080CAE720FC5477711A7ED7F191A5C7
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........2.\...\...\......\......\......\......\...]..\......\......\......\.Rich..\.................PE..L...4>CX...........!................Pj....................................................@............................L...................................$.......................................(v..H...........................................UPX0....................................UPX1................................@...UPX2................................@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI28682\python27.dll

Download File

Process:	C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	898048
Entropy (8bit):	7.990256946915668
Encrypted:	true
SSDEEP:	24576:I0cNEHSDC9XmwbTV/mv+nQW0mj7IaqtsoejWg3c:jHhmhmI9eo63
MD5:	8C44826A640B3CF0B32B0258C65FEE07
SHA1:	E3F9FE6366D0876BFA8B903B20D2ACF06416F1BC
SHA-256:	FBAD053D962BAC96865AC3372958D697711800FDC46F36C87011BB5E89026614
SHA-512:	884E2C01C088B9AE86D4605FED1CF8E9B17F99CF887EFC5644F4A91959ECD89148CCA3E9FDAA6AB9E8C4DFD2D61DBDFD442A95B13DAB7E5CD027B4782D473355
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#..^g.y.g.y.g.y....~.y.n...l.y.n...i.y.n...e.y.n...l.y.g.x.[.y.n.....y.n...f.y.n...f.y.n...f.y.Richg.y.................PE..L... >CX...........!.....0.......0...Z..@...p...............................+...........@.........................pz.t\|..,y.D....p.,...........................................................f.H...........................................UPX0.....0..............................UPX1.....0...@...(..................@....rsrc........p......,..............@......................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI28682\pywintypes27.dll

Download File

Process:	C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	53248
Entropy (8bit):	7.425128830518154
Encrypted:	false
SSDEEP:	1536:eTwUerP24SfDRd2TACkwqyfnouy81cSPDuwQ0:eTleODRd2ew/Pout1cSru
MD5:	07B436BFA1C7B4FFC21FB39358158060
SHA1:	7F5A47CDAB9A7D93BBBD204CEDFFCA61D3F80C84
SHA-256:	82C2926CB03A04392FA479801D505E2A387446BCA978FF930177121DB2FDB461
SHA-512:	13EBCB83F478C859CA808003933769B84290E108648B69F33043653263C5B4BD37ED5CA8D521B46A1D9122EB232F7E5D05A25E16F250D5573CF85CD5CDEFB2EF
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qz.Y5...5...5....Tz.7...+Iy.6...+Io.8.....".4...+I..1.....'.>...5.......+Ih.$...+I~.4...+I}.4...Rich5...................PE..L...:..[...........!.........P............... ....z..........................p.......................................%..PJ..h#....... ..h...................Po..........................................H...........................................UPX0....................................UPX1.............\|..................@....rsrc....P... ...P..................@......................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI28682\select.pyd

Download File

Process:	C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	9216
Entropy (8bit):	7.003407892450472
Encrypted:	false
SSDEEP:	192:qhogHS4TaqZXRQKKXYVEvySc3IFaNJhLkwcud2DH9VwGfctX:qhLS4TaqxhfCHc38aNJawcudoD7U
MD5:	57EB00056AC8C38CD4F3153FB9507F13
SHA1:	DDEE8E74FCC81B6301145F27C0F1CCF4B9185E1C
SHA-256:	7B90EC138AC8415D9B747612063D19147FEC2B1E99DE97C3B5636E8CA40B346E
SHA-512:	05F7EF6BD065D7DB3F41DFA95187FA40A14F58FA5D4705F2DF5982DB18EEB6D4E93C473D05932436BF645E76E0B23532867011E92EF953EC247B55648ED9C6EF
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........i)...z...z...z...z...z...z...z...z...z...z...z...z...z...z...z...z...z...z...zRich...z........PE..L...5>CX...........!..... .......P..pq...`................................................@.............................H...................................H.......................................P}..H...........................................UPX0.....P..............................UPX1..... ...`......................@...UPX2................."..............@..............................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI28682\servicemanager.pyd

Download File

Process:	C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	7.2228399102917615
Encrypted:	false
SSDEEP:	384:FVtYwprbL7fLBtdYzKNg13ZOPaNJawcudoD7UfMX:vawBbLFYzKNg1plnbcuyD7UfMX
MD5:	6A95BCF45E4BE23CC2634EF5BAD17660
SHA1:	7D13B791588CB800C2ADD75FF8E74C3C493A8143
SHA-256:	60DA4B4E628B7DC1115615128AC554AEB29B50A61629AD5AEEB5CC9D2BD86202
SHA-512:	D3C80B025647444F42D42E82CAD50C4383728F7F8C9E16AA9D87450CA864B0B97B5F8F47E80328A4A2B67CE7D06C9A8F1DAE8C5B3C798DE1B2A50164161E69C8
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........o....K...K...K...K...K...K...K...K...KR..K...K...K...K...K...K...K...K...K...K...K...KRich...K........................PE..L......[...........!.....@........................}.....................................................................\...........................................................................h...H...........................................UPX0....................................UPX1.....@.......4..................@....rsrc................8..............@......................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI28682\unicodedata.pyd

Download File

Process:	C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	181760
Entropy (8bit):	7.989160583257678
Encrypted:	false
SSDEEP:	3072:Rfe2dO8KvTdjKGssSXwgtXZT32qenyxHBKs//4wd3RP29sZ6lI883out:Rfe2bKvEw+k2kw/4wZRPS3coS
MD5:	9A465CFAA788E29E7B1366C012EBC75C
SHA1:	10D9C49BB6652D9B04E17608D9ED35B036112647
SHA-256:	35C84D824DB175DD71046806A59BC711021ABCE04698FA304B1E2A9855E50A9C
SHA-512:	31BEE259C78CEB1E4F5C52E7B2CBD0EB62A071FC9C748DF47AB824E383EFDC3B218168700341B96D139DABFB3E4D7644341F22E52982B7C7F135A9E35B300B00
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......{H..?).?).?).6QE.=).6QS.1).6QT.=).6QC.8).?)..).6QY.>).6QB.>).6QA.>).Rich?).................PE..L...6>CX...........!......................................................................@.............................T...................................,.......................................x...H...........................................UPX0....................................UPX1................................@...UPX2................................@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI28682\win32api.pyd

Download File

Process:	C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	34816
Entropy (8bit):	7.794879575971907
Encrypted:	false
SSDEEP:	768:etKTLIw2eRBsqBvKddE/wW68vEvfW2qmSOyinbcuyD7Uqmx:DCeLrGderDH2FXyinouy8qmx
MD5:	42C475231F4835BB1A5F94B0D3DA4520
SHA1:	FCFAE296DD10C92D973A57D61BBF5C0F4A15ED6B
SHA-256:	87CEEB1B7586DB730F48988A07018F9C8AF57934FF7F173A869542207F46B0F1
SHA-512:	D1A699B8497E8843F990F6F719A904A7751FE2A9404CB195BE2D94341728A7372CD93D379B576E6031980E1DA53F2336805C6BF59E799B63565CD63D4931C02A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......[-..L...L...L.......L.......L.......L...J..L...L..UM.......L.......L.......L..Rich.L..................PE..L......[...........!.............p.. ...............................................................................P.......X...........X...............................................................H....................B..@...................UPX0.....p..............................UPX1.............~..................@....rsrc...............................@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI28682\win32event.pyd

Download File

Process:	C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	6.799438399701252
Encrypted:	false
SSDEEP:	192:jNxmpzSvHU53Uon53eXqY1K/CjrELQc432Xq0FaNJhLkwcud2DH9VwGfctLj/t:Xmp2/UR95aP1pgEc432XBaNJawcudoDU
MD5:	796306BE7A1ABCFFB8853EE9CEB5BEAE
SHA1:	93762CF53958A3A99B674986FCF3C53C489133ED
SHA-256:	26E6D883E9E61BF872425526A9B8C7BB229C3B9D2F82BB3C0BF500660DBE1995
SHA-512:	5919A837FA1FCAEA91B14D02DA306928D5E523E4591DCA290422C9EB9BE15F2EE626A8379F5C953F2B08E7A6B2CD67618652B9EFA9ACE8ABD47A8BD7CD8C2F64
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........k..{8..{8..{8..8..{8..8..{8..8..{8 ..8..{8..z8..{8..8..{8..8..{8..8..{8Rich..{8................PE..L...T..[...........!.....0..............................................................................................P...`...\.......`...........................................................h...H...........................................UPX0....................................UPX1.....0......."..................@....rsrc................&..............@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI28682\win32evtlog.pyd

Download File

Process:	C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	19968
Entropy (8bit):	7.436093769968754
Encrypted:	false
SSDEEP:	384:Wo5FgP/m1xaGAONAt4ZvFqQggg3LgsAWUh31lA2W1waNJawcudoD7UGwGS:WmuP+TOONp5UQ/Zs8FlAfnbcuyD7UGwX
MD5:	317360BE68901D11F3D02AF1C151A4DC
SHA1:	570BF03BE1A737CF3D0CF3FC8E77261CF64E2051
SHA-256:	AC9C5C4BAA4DE19BDDF55313F29182F26EB80312C31266413672C61424A5C6E0
SHA-512:	25C25C23DD4FE1957CDFAD833D4570553C2627775008F3939525B6A3D1892F8B6CB7A9F20D454166338DF4DFC8A98306A1160016AE4CB2E9464944945AFA0A82
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........E..i+..i+..i+.E&...i+..;...i+..;...i+..;...i+.%...i+..i*.hi+..;...i+..;...i+..;...i+..;...i+.Rich.i+.................PE..L......[...........!.....P...................0...............................@.......................................4..T....3..P....0......................L5.......................................!..H.......................@...................UPX0....................................UPX1.....P.......D..................@....rsrc........0.......H..............@......................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI28682\win32service.pyd

Download File

Process:	C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	18432
Entropy (8bit):	7.513143648749714
Encrypted:	false
SSDEEP:	384:DvSTTJQxdZ3goCVdvSbw66apC1aNJawcudoD7U46:LSTT+1KF1onbcuyD7U46
MD5:	F23A62491BD945C050E3E1D13909E9E7
SHA1:	B8DAC4E00163533157A17E3B56D05E049A2375A2
SHA-256:	E52B5532A6764AAAE67DB557412B3F77EBDC8A14A72771A1C6414A83BB3FC15C
SHA-512:	52200CF9687752DB43BBAE703192C841694D5BD976FA56C0F25E0478CFB97681BC77677C1A8907167612DDF9FE6A561945FBEB0180022670AF97BF41B5B11766
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........[..[..[.....Z..E.-.Z..E.;.V..E.+.]...!s.\..[.....E.<.^..E.*.Z..E.,.Z..E.).Z..Rich[..........PE..L...q..[...........!.....@..........................................................................................8...T...............................................................................H...........................................UPX0....................................UPX1.....@.......>..................@....rsrc................B..............@..............................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI28682\xmrig.exe

Download File

Process:	C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	1905664
Entropy (8bit):	7.9235088812144
Encrypted:	false
SSDEEP:	49152:jeXVwyagUSymDH29F4+rthFTo6YZfnH8:0VKgUSymDH29ttzToX1nc
MD5:	13BDD9CD9F7E51746172996262B5A873
SHA1:	3834F8179ABD7A827E927505F3C226AC8BBCF3EE
SHA-256:	4BF737B29FF521BC263EB1F2C1C5EA04B47470CCCD1BEAE245D98DEF389929BD
SHA-512:	49879918505D042312F20B2FC8310A8C4A58AA266ED1AB05E0481F7E11385DA0920CF9D756F842EB98E4394F14725385B74A99B38FC8A60222FA4CC873CB8040
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: C:\Users\user\AppData\Local\Temp\_MEI28682\xmrig.exe, Author: Joe Security
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....\.....................`...0>...Z..@>...[...@..........................`[............... ...................... X.x....][.<.....[..]....................................................Z.....................................................UPX0.....0>.............................UPX1.........@>.....................@....rsrc....`....[..`..................@...3.94.UPX!....E.G...@.`.Z.....$Z.$/.w.......&...'....1.f.=.@9....MZ..,......($..#...th.....82..tJ......$.,./,......+.l..Ho..~B.......:..6....L.=Dc..tm....-<h....f..<2...u..?PEl..u..Q....-l..~?....j..x.......]...........K".v.g?w...k+...yt`,........o..7>,. ..D$...............7......b..0.{..,.~...[U......WV.U.S..\|.0~....+..).b.........@....................5.o.E.....d....x....l0.9..9...3....o._..........=...u...;.v.f...R..0..`.lm...--...I...X/(......9J9..~?.v...&+.. P.kSn.l......LJ...

C:\Users\user\AppData\Local\Temp\_MEI33482\Crypto.Cipher._AES.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	7.553130526678379
Encrypted:	false
SSDEEP:	384:50Q1C9jViLl7hDB6n/PtHU2wr8gj93KqmilaNJawcudoD7U:dC8LU/PBU8itClnbcuyD7U
MD5:	371397E80A55D432DA47311B8EF25317
SHA1:	71617777D6A2500D6464D7B394C8BE5F1E4E119E
SHA-256:	C1A900615C9500C46B9602C30C53F299290B03632208EF1152AF8830AB73AD17
SHA-512:	3139E2848ACF02CC8475449F213873D2C2B7196F6A55C70D2D8F8B487020387740364E5CA0AA584624D1B9B01B965146A2F0E15EEF34830C7C0ECBB8637DAE03
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........+\8.J2k.J2k.J2k.Ik.J2k...k.J2k...k.J2k...k.J2k.2.k.J2k.J3k.J2k...k.J2k...k.J2k...k.J2kRich.J2k........PE..L....4.S...........!.....@..........`...................................................................................D...........................................................................8...H...........................................UPX0....................................UPX1.....@.......:..................@...UPX2.................>..............@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI33482\Include\pyconfig.h

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	21321
Entropy (8bit):	5.345136937906198
Encrypted:	false
SSDEEP:	384:pGpFpaU1kgCw8r+MIP8Bj5DvVySh3awQBoerw8W+PYV0FGYfN/+:pGpFpb+IU99UShATrw8W+AKF/+
MD5:	BC185DE8B2437963368A85FDD9852951
SHA1:	1459F1428214FCCA7F203FB3A3AFF28E16EB9C1B
SHA-256:	8B130D901E0F83B55699D565F103F2F8F1B3A51712EBB4B9646EA517CC1F04D6
SHA-512:	918469D9A59FE059F3C7C93F34C8D2D07CB8A9BF5E953A1527922ED5C65FF4A2DF50BBC78ED9CE146BF3A1FB6F1763F061262FA4A937BEEEE1FEB8A99E31339E
Malicious:	false
Preview:	#ifndef Py_CONFIG_H.#define Py_CONFIG_H../* pyconfig.h. NOT Generated automatically by configure...This is a manually maintained version used for the Watcom,.Borland and Microsoft Visual C++ compilers. It is a.standard part of the Python distribution...WINDOWS DEFINES:.The code specific to Windows should be wrapped around one of.the following #defines..MS_WIN64 - Code specific to the MS Win64 API.MS_WIN32 - Code specific to the MS Win32 (and Win64) API (obsolete, this covers all supported APIs).MS_WINDOWS - Code specific to Windows, but all versions..MS_WINCE - Code specific to Windows CE.Py_ENABLE_SHARED - Code if the Python core is built as a DLL...Also note that neither "_M_IX86" or "_MSC_VER" should be used for.any purpose other than "Windows Intel x86 specific" and "Microsoft.compiler specific". Therefore, these should be very rare....NOTE: The following symbols are deprecated:.NT, USE_DL_EXPORT, USE_DL_IMPORT, DL_EXPORT, DL_IMPORT.MS_CORE_DLL...WIN32 is still required for the

C:\Users\user\AppData\Local\Temp\_MEI33482\Microsoft.VC90.CRT.manifest

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1050
Entropy (8bit):	5.382436822526041
Encrypted:	false
SSDEEP:	24:2dtn3mGv+zg4NnEN4XKHVJrMmV6LSWV5rcb3S:ch35+zg4i0KHVVdOmS
MD5:	BFB93876892CCA8E2AD0021585C34C8B
SHA1:	0DDE1B225C98825A09D8FF85F462571C9C862E35
SHA-256:	0D060ED7C25159B7B75F16D449963BFD639C15B3C5280BC7897403268C2B9F35
SHA-512:	FE70540B3B3FA88B32DFB2FF7406A3A9819E7862B850D871B932996BBEFFDBC70D7192D6E3196A8583B2DB756CA9CC278505AFBE585BA30EB1222D4F8BE15B7B
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v1">.. <noInheritable/>.. <assemblyIdentity name="Microsoft.VC90.CRT" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b" type="win32" version="9.0.30729.6161"/>.. <file hash="7021457b391b35606e708c69987e4b6f606609ee" hashalg="SHA1" name="msvcr90.dll"/>.. <file hash="88549dd3ce8eaa62ca8aad0e96ddd9fec2203628" hashalg="SHA1" name="msvcp90.dll"/>.. <file hash="65ef374affa5b48827e539b35b3275c201b41fc9" hashalg="SHA1" name="msvcm90.dll"/>.. <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">.. <application>.. <supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/>.. <supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/>.. <supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/>.. <supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>.. <supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/>..

C:\Users\user\AppData\Local\Temp\_MEI33482\_ctypes.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	37888
Entropy (8bit):	7.848484052157707
Encrypted:	false
SSDEEP:	768:pAXLisB/qV2nQnf33sWcCRWKZac3VWw6cLA3zReukhRnbcuyD7U:pAnBi8nQf3sYToclt6cLUCRnouy8
MD5:	6CB8B560EFBC381651D2045F1571D7C8
SHA1:	15283A7A467ADB7B6D7A7182F660DD783F90E483
SHA-256:	6456FEA123E04BCEC8A8EED26160E1DF5482E69D187D3E1A0C428995472AC134
SHA-512:	CA2958095E8E08B5EF05EC9DE15B7D1EB180923A40B90356DB56A124101C96D8E745001948B89DBE9D6B9CE3C2029F7E9EAF20C73FA1D410A821D6605830BFC0
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...................F.....W.....P......@..........Z.....A.....B...Rich..................PE..L...*>CX...........!............. .. ....0................................................@.........................<...........<.......................................................................H...........................................UPX0..... ..............................UPX1.........0......................@...UPX2................................@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI33482\_hashlib.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	351744
Entropy (8bit):	7.996557276168139
Encrypted:	true
SSDEEP:	6144:Xh0byJKrtKOFhjnTtMoy8gpVI/xxWo/nX0NKOzyGFmJ559Vq2SeTsRgIIGYMowwZ:2bymtjF1TtMod/xweDK7FmJ5rLVYTIGm
MD5:	EE134421FBABEB565E4F3CA721331C2E
SHA1:	4B03BDD142C6A7BB6F74ABE968C5B76B63E06059
SHA-256:	7863E1BEDFE1FFC720B67B2EB7B3491DB9D2B8E56B5574E6A40FF90336B8DAFA
SHA-512:	D27FF65B6A8BF2E5E70D2865E72EEE6930E76C2A3990428C54FC998743D3C540C5C984B5D1429E8FFBE3D160AE1F6782CD6D3CA40822F81D2052BA168595D1FA
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......z.$.>.J.>.J.>.J.7...4.J.7...1.J.7...<.J.7...3.J.>.K..J.>.J...J.7...Y.J.7...?.J.7...?.J.Rich>.J.........................PE..L....>CX...........!.....`..........@K.......`...............................p............@.........................pa..L....`..p............................a.......................................W..H...........................................UPX0....................................UPX1.....`.......X..................@...UPX2.........`.......\..............@......................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI33482\_socket.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	7.706254752795193
Encrypted:	false
SSDEEP:	384:CCNDRisVUlkycq27U4r0rOc606B8k4gG35aiQjgO6OPjGL2e1ua7aNJawcudoD7P:v7VUcq27Jr0rOmbwE4jGLhohnbcuyD7B
MD5:	BE47363992C7DD90019276D35FA8DA76
SHA1:	CCF7EBBE829DA08EFD95A53D4BA0C0D4938F6169
SHA-256:	BE10254B111713BEF20A13D561DE61CA3C74A34C64DDC5B10825C64AB2C46734
SHA-512:	573F9111535A9A136FCAAA5C1A16C347F7327626768D849513D69C9848406B1002DCC5B8C17A291EF2E6519587533CA806018EE471A39D330F032A9E7E635EA7
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......AV2..7\..7\..7\..O..7\..O..7\..O..7\..7]..7\..O..7\..O..7\..O..7\..O..7\.Rich.7\.........................PE..L...X>CX...........!.....P..........0.....................................................@.............................d...................................d...........................................H...........................................UPX0....................................UPX1.....P.......P..................@...UPX2.................T..............@..............................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI33482\_ssl.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	498688
Entropy (8bit):	7.996471896707535
Encrypted:	true
SSDEEP:	12288:FHNz5hZdNGitmdIA8byo3k4Ff9m3fTByPf6So+2RON1jjoS:P3fNTtmd2bkof43fTkR2gH
MD5:	68C3AD86E0A8833C29AD1BE10D3C025D
SHA1:	04488362814B2F3AE07C4E8DF8E45868D48B447F
SHA-256:	C236271B92A0F1D3304337F2E2444107F34D8E26272981F48C47DB347133566C
SHA-512:	BB2819D913033CC26DCD1E5CBF015DACDBF747D29C72BFD41BFE0D74BB77E51A61CF9BE4B67B6348938837125F1D0F80AF0AC33531E00CEA1585535952A22785
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........HFu.)(&.)(&.)(&.Q.&.)(&.Q.&.)(&.Q.&.)(&.)(&.)(&.))&9)(&.Q.&.)(&.Q.&.((&.Q.&.)(&.Q.&.)(&Rich.)(&................PE..L...q>CX...........!.................e....................................................@............................D............................................................................q..H...........................................UPX0....................................UPX1................................@...UPX2................................@..............................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI33482\_win32sysloader.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	4.992693298555373
Encrypted:	false
SSDEEP:	192:t2VnGV7o5QUEZWm6Uk3fvf3X7THIL3YO+8I:tVU5QUEz6hfLTH98
MD5:	B4A567D80CCC08FB1C7FBB765847AFDA
SHA1:	B7FF2C68BA2887AAF5D029F41922E626C72B716D
SHA-256:	DBB0F9C499A710BBC8BCDE4ECC3577A6C9548262D6CE4434ED5A0708CBC787DD
SHA-512:	DDFEC25304BABE2DF55958F512F61AFD9AF88DDA499FE87931D17A9EEBF048449885A06A24BDDBC8604E11F07CED3C2ECE7F89C28290CAB5D1BF3816D22128DB
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......M.oC.............J.............................../........................Rich............PE..L......[...........!......................... ....;..........................`......................................P&..Z...\"..P....@..l....................P....... ..............................8!..@............ ...............................text...`........................... ..`.rdata....... ......................@..@.data........0......................@....rsrc...l....@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI33482\back.jpg

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	47107
Entropy (8bit):	6.2032294727594985
Encrypted:	false
SSDEEP:	768:z9v1zJKaohy0Za9jwmrALVaka3sgBXHDizIdI9e2E:5v1zJ3nuswbLVgZsceO
MD5:	4AE078DD5085E97D3605F20DC079412A
SHA1:	1BABFCF2D374AE590970A3BE2E0E27BC04922546
SHA-256:	ED551536FF22587CDF7701A279E088EB370A4121E7A3FA1F3C8B121E767318A2
SHA-512:	BF163C63120CC5035087E4FF0035D9DAEB100218C62969AA6AA75D539108323295EB9CC28ABB0906C21CE8AEA25DACD1D0AAB3F3FE9C765D35348F0A7DA000AE
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......]....S......"...8.P....... ..`u...0.................................................... .....................................................................................................................................................UPX0..... ..............................UPX1.....P...0...H..................@...UPX2.................J..............@...3.93.UPX!.....3r#l..JW..CE...0..&.......U..S...........t?........'.........9.r.....t...'.....s.t&...$....,1....$6.....X[]._V`..u....tG..oo.t$lE_D$.....=......."....1......uG...c..4....uF1..e.[^]..o...f.L.!.+.y..........................8</....fp.v..U..$........../...........O/...e..]...........#3f.E.f.E......m.._..;.}e.......f.t"............U.1.3-...}..~2.k......!..........7{..+...7..\|...............G.:..S........w. ........ ..%+{.n..$...e.>.m....u..,(.....k_.'lk.C2$C&'(.5.`cv/..

C:\Users\user\AppData\Local\Temp\_MEI33482\bz2.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	35840
Entropy (8bit):	7.816957595202127
Encrypted:	false
SSDEEP:	768:IHCeOgq+kCitCVj5rz2Ya+r9qLYp9R9JoWnbcuyD7UiT:IHXr8CBd9NpfXxnouy8
MD5:	C9C00BC854A39E66B27787D188F9E8D7
SHA1:	21F20CF6C628B529DB4BDB853B679F9BF23590E3
SHA-256:	29520DF660A5BBD704B9106A6650A66E4F5766B904D05F97146668D41DBF5839
SHA-512:	8887B5CA542220CAC04D5A6A22A06F95DB560F4FE0F9A128CEB642ED9716ABCFFBA2146CCE682EB16C4DA3F423649A61904A73C4357D9FDBD5DDF606790199A3
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}.S.9.=K9.=K9.=K..K:.=K0..K:.=K0..K7.=K0..K;.=K0..K>.=K9.<KS.=K0..K1.=K0..K8.=K0..K8.=KRich9.=K................PE..L...?>CX...........!.................W.......p............................................@..........................p..D....p...............................q.......................................c..H...........................................UPX0....................................UPX1................................@...UPX2.........p......................@..............................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI33482\certifi\cacert.pem

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	284518
Entropy (8bit):	6.05114864026174
Encrypted:	false
SSDEEP:	6144:GriCfLXd1YU58fVuKlnm5plZ0PXCRrcMBbADwYC+MslE:GrdT3YZuz5LwCRrcMije
MD5:	DD2DD543395692705F7DDA0F5E7750FA
SHA1:	40D7CE60393978A29FB0E0B1E849658E48CF7887
SHA-256:	397B833E5ACF89A2709B964401A9ACA68D24B62349B72BBE38684E586AA07A27
SHA-512:	3BA0D6AD8B6838B04FBFDEBAD20EB5544C093BA592B517AA383708A34CE2BD215DB2BF010090251674DBCFD4EDA3C44F770C9FBF314304DE918D7E59E2596CF2
Malicious:	false
Preview:	.# Issuer: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Subject: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Label: "GlobalSign Root CA".# Serial: 4835703278459707669005204.# MD5 Fingerprint: 3e:45:52:15:09:51:92:e1:b7:5d:37:9f:b1:87:29:8a.# SHA1 Fingerprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c.# SHA256 Fingerprint: eb:d4:10:40:e4:bb:3e:c7:42:c9:e3:81:d3:1e:f2:a4:1a:48:b6:68:5c:96:e7:ce:f3:c1:df:6c:d4:33:1c:99.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG.A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv.b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw.MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i.YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT.aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ.jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp.xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz

C:\Users\user\AppData\Local\Temp\_MEI33482\config.json

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1206
Entropy (8bit):	4.275024024623091
Encrypted:	false
SSDEEP:	24:pCKENTHgbeZlE1jCAh1RHEdOgNanAOSWSula:UKuTHgbYlUZHEdrNAla
MD5:	50CC63E4A1B24622CF61ED566B03E98F
SHA1:	92E5874785BB76E4579559BA70E116A6149349F5
SHA-256:	348F388C57DFB77B0CAACD8304725E10DC69A52EEC41AE695327787AD1853C92
SHA-512:	9A291DB9CF396687F3878590B1EB65CD7DA2E6FC3D6DE64A3B8CB08116B646371F432100E16B0ECD4F2916D05D67830F949AC2A3CA559A3A8D56616DF2BE98C7
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: C:\Users\user\AppData\Local\Temp\_MEI33482\config.json, Author: Joe Security
Preview:	{. "algo": "cryptonight",. "api": {. "port": 0,. "access-token": null,. "id": null,. "worker-id": null,. "ipv6": false,. "restricted": true. },. "autosave": true,. "av": 0,. "background": true,. "colors": true,. "cpu-affinity": null,. "cpu-priority": null,. "donate-level": 1,. "huge-pages": true,. "hw-aes": null,. "log-file": null,. "max-cpu-usage": 70,. "pools": [. {. "url": "xmr.crypto-pool.fr:3333",. "user": "47BD6QNfkWf8ZMQSdqp2tY1AdG8ofsEPf4mcDp1YB4AX32hUjoLjuDaNrYzXk7cQcoPBzAuQrmQTgNgpo6XPqSBLCnfsjaV",. "pass": "x",. "rig-id": null,. "nicehash": false,. "keepalive": false,. "variant": -1,. "enabled": true,. "tls": false,. "tls-fingerprint": null. }. ],. "print-time": 60,. "retries": 5,. "retry-pause": 5,. "safe": false,. "threads": [. {.

C:\Users\user\AppData\Local\Temp\_MEI33482\ftpcrack.exe.manifest

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1345
Entropy (8bit):	5.283640732769631
Encrypted:	false
SSDEEP:	24:2dtn3ZoWglN2v+zg4NnEN4XKDmc0+bLg4fNRme5rcb3S:ch3DgX2+zg4i0KDmJ+bLg4VRmemS
MD5:	B5DEA49B86C5BB5D9CD8D64A09F70065
SHA1:	487EF676EBD244EBC3CF197F70DA7A5E393FB96E
SHA-256:	78B1160F6ADAB34D144AD19A0F4B83F83453F1E18460BBDFBE17AD354B62AF7D
SHA-512:	1B5914F4C52F47A33C57F5F6428482E6766099BF43D4E8616CE4AABC4A917C24B2E0C98C841F0D7E7B8A202F40FF960885535539BF70CC7C7ED8687C7ECE010C
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v1">.. <assemblyIdentity name="ftpcrack" processorArchitecture="x86" type="win32" version="1.0.0.0"/>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity name="Microsoft.VC90.CRT" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b" type="win32" version="9.0.30729.6161"/>.. <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"/>.. </dependentAssembly>.. </dependency>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity language="*" name="Microsoft.Windows.Common-Controls" processorArchitecture="x86" publicKeyToken="6595b64144ccf1df" type="win32" version="6.0.0.0"/>.. <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"/>.. </dependentAssembly>.. </dependency>.. <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">.. <application>.. <supportedOS Id="{1f676c76-80e

C:\Users\user\AppData\Local\Temp\_MEI33482\httplib2\cacerts.txt

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	135546
Entropy (8bit):	6.039525643754334
Encrypted:	false
SSDEEP:	3072:FVrovvEjVplrqHSdX+zpfQq7ZiyZOF5mdFENAKHn1HtYfei8i31MCSjfpVpKbIcf:3cmHuBfaUFENX3YfEl3plcs+
MD5:	14BA876BA2515A25BBB511F24BF06653
SHA1:	291DCDEE67E880B21FD7001CB8350C3ECEE4CAC8
SHA-256:	2039836A620F956EC094EAAE7C9B41A04C76F31130898B11014D9E83C905F0DE
SHA-512:	5035F82DF06308A14F6626C54382B3AB34B6D664C8394B48F75275F69DCC2B93266D843B51F0B586E5F12FCD70FE3660B5B08AFC20738DF6D8C812592C0D71E4
Malicious:	false
Preview:	# Issuer: CN=GTE CyberTrust Global Root O=GTE Corporation OU=GTE CyberTrust Solutions, Inc..# Subject: CN=GTE CyberTrust Global Root O=GTE Corporation OU=GTE CyberTrust Solutions, Inc..# Label: "GTE CyberTrust Global Root".# Serial: 421.# MD5 Fingerprint: ca:3d:d3:68:f1:03:5c:d0:32:fa:b8:2b:59:e8:5a:db.# SHA1 Fingerprint: 97:81:79:50:d8:1c:96:70:cc:34:d8:09:cf:79:44:31:36:7e:f4:74.# SHA256 Fingerprint: a5:31:25:18:8d:21:10:aa:96:4b:02:c7:b7:c6:da:32:03:17:08:94:e5:fb:71:ff:fb:66:67:d5:e6:81:0a:36.-----BEGIN CERTIFICATE-----.MIICWjCCAcMCAgGlMA0GCSqGSIb3DQEBBAUAMHUxCzAJBgNVBAYTAlVTMRgwFgYD.VQQKEw9HVEUgQ29ycG9yYXRpb24xJzAlBgNVBAsTHkdURSBDeWJlclRydXN0IFNv.bHV0aW9ucywgSW5jLjEjMCEGA1UEAxMaR1RFIEN5YmVyVHJ1c3QgR2xvYmFsIFJv.b3QwHhcNOTgwODEzMDAyOTAwWhcNMTgwODEzMjM1OTAwWjB1MQswCQYDVQQGEwJV.UzEYMBYGA1UEChMPR1RFIENvcnBvcmF0aW9uMScwJQYDVQQLEx5HVEUgQ3liZXJU.cnVzdCBTb2x1dGlvbnMsIEluYy4xIzAhBgNVBAMTGkdURSBDeWJlclRydXN0IEds.b2JhbCBSb290MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCVD6C28FCc6HrH.iM3dFw4usJTQGz0

C:\Users\user\AppData\Local\Temp\_MEI33482\msvcm90.dll

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	225280
Entropy (8bit):	6.034911041879855
Encrypted:	false
SSDEEP:	3072:6yZeocziNzMLSMOYscmLWbAX+dP4Upoh86Goao14JU87/amFYw8fF01OyASLE:PYOMqc8oAXGP4Upoe6fa3/amiX2Oyp
MD5:	D34A527493F39AF4491B3E909DC697CA
SHA1:	AFEE32FCD9CE160680371357A072F58C5F790D48
SHA-256:	7A74DA389FBD10A710C294C2E914DC6F18E05F028F07958A2FA53AC44F0E4B90
SHA-512:	0DABC5455EB02601D7C40A9C49B3ADE750B1118934EF3785FB314FA313437BC02B243571ABA25F1661A69DCEA36838530C12762A2E6602D14A9B03770A82CCA6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;...h...h...h..ah...h1.dh...h..gh...h...h...h.-.h...h...h...h..qh...h..vh...h..`h...h..fh...h..ch...hRich...h........................PE..L.....M...........!.....:..........Z........P....?x.........................0......^.....@......................... 3..4....&..d...............................d...P...............................H...@...............(...........p...H............text...T9.......:.................. ..`.data........P.......>..............@....rsrc................H..............@..@.reloc...#.......$...L..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI33482\msvcp90.dll

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	335184
Entropy (8bit):	6.343962999919931
Encrypted:	false
SSDEEP:	6144:fmIIPLSg4p0t4271NWoSYEMS6VhUgiW6QR7t5183Ooc8SHkC2eQ:fmIeLSgo0S271QoSQhUgiW6QR7t51831
MD5:	92EA2DB0E788894C43753C550216A886
SHA1:	DA8C7A178BA0CA80D321666F5642A7436B640602
SHA-256:	9694756F43B20ABC50F95646C54E9E36CD6EDF8EED3DB846064567399F4E7566
SHA-512:	90E72A68C7267E8D0986A75247AE7B2339E4C2A981D686342B2EF90B1FCF9695B558D0BD5932F7C53524E02CC664B974BA76783FDE919B24EB36795DB3300BA6
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........#%..Mv..Mv..Mv.66v..Mv...v..Mv..Lv:.Mv...v..Mv...v..Mv...v..Mv...v..Mv...v..Mv...v..Mv...v..MvRich..Mv........................PE..L.....M...........!................P.... ...0....Hx.........................0............@.........................p4..,....3.......0.......................&......................................()..H...........................................UPX0....................................UPX1......... ......................@....rsrc........0......................@..............................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI33482\msvcr90.dll

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	250192
Entropy (8bit):	7.900323441964523
Encrypted:	false
SSDEEP:	6144:EODM4c99eLswEOva4g4fpgMf4FfIoSNjbZdGJCJLuEyKIqqOmiqsEqmQI0wye/c:EODM1HagYaMf4FAoSNjHmHyyc
MD5:	199D34B03C7D0EB804A6D9869184B8D4
SHA1:	03148854519D0970C1BBDC089D3E8DE1AED61C47
SHA-256:	DF86421E354F817607F2BAFC9188569242FCF9DD564B28F3E2915C86A0BA1F54
SHA-512:	E4269CA993393422A90231DAABD390771A635EEB0817A9D00DCCEF496372BB4B57B615529F26A2E8132BDE825CDACA07D965D207421C02EA6471DA214354361E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................6.........!.R...7.....&.....0.....6.....3...Rich..........PE..L.....M...........!.....@.......0..0f...@........Rx......................................@.........................@....\|.....x....................................................................r..H...........................................UPX0.....0..............................UPX1.....@...@...4..................@....rsrc................8..............@..............................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI33482\netifaces.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	7.145184945732974
Encrypted:	false
SSDEEP:	192:uKqSCMOF44HPPtLm+9a3ozToPmzYUaFaNJhLkwcud2DH9VwGfctH:ubS9s44vPtLR9aUPJ+aNJawcudoD7U
MD5:	C7807680A69196C3EE66C4CFB3E271AC
SHA1:	D3EA74C9E3B810C6A1EE4296B97E20F2F45C9461
SHA-256:	1A6C57AC8031582477B1D3463A65B6EB006EEA704E27C8C4B812B99EA910428D
SHA-512:	A5D893132AD889E98B434DA7FD5CA377AFB1800FD8D3230CCED5E9FDE576FCEC943DD22FA48810BA6D93C510EBAA8AC5A94EC1B9D639FD6C533C5BBD4737CF15
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......FL...-...-...-...U...-...U...-...-..J-...U...-...U...-...U...-...U...-..Rich.-..........................PE..L...,.-\...........!.....0.......P...x...`..........................................................................4...P.......4...................................................................p...H...........................................UPX0.....P..............................UPX1.....0...`...&..................@...UPX2.................*..............@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI33482\perfmon.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	6.948652527580434
Encrypted:	false
SSDEEP:	192:0xeSnTQM3MsUjU+viJBctKiyiLKPfFaNJhLkwcud2DH9VwGfct0XlpoI6J:0xe4R3scJBcMWYdaNJawcudoD7UmlSI
MD5:	EE813500A441B5FFDACD853E95BEE669
SHA1:	7F05F1493380AF3FE08F55524F6FF90C47C0CC4D
SHA-256:	AC491704AF920BE0E503F0243D2D371E230622E213E9F082347B52C0A7B009C2
SHA-512:	060D079A93ADD067EB062D2B1CB9977719BE68AE1223B0219DBB14CC9C6C66FF47D9929945636B577BC7F1BB84D5500B88ACD5F7BF636CC63BD4C88534AF724E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........0...c...c...c..9c...c.gc...c.qc...c.ac...c...c...c.vc...c.`c...c.cc...cRich...c................PE..L...C..[...........!.....0.......`.......p........n.................................................................t...L...P...$.......P...............................................................H...........................................UPX0.....`..............................UPX1.....0...p..."..................@....rsrc................&..............@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI33482\psutil._psutil_windows.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	25600
Entropy (8bit):	7.700665778298437
Encrypted:	false
SSDEEP:	384:3qUURhEUVDrn5EMvG04YMJIoa67+5pGr0qLWMAUm7NFYGz45/+aNJawcudoD7ULt:aUjUXBjPAGHqLm7N/z4dnbcuyD7UL
MD5:	2FC800FCC46A597921C2ED447AEB09AC
SHA1:	72004227E5C60C8460F835A170798AA22861B79E
SHA-256:	2E4AD3D08118DA77C928C4614BFECB34397CFAF53F5D46D7C7E5F1DA3172C1F1
SHA-512:	A17022B364615B45A1873AEA0DE922A2988E4D75A8F4E63ECB9CA7DD46263E684B1F28B82BD77B046BBE2AD03CE65C5DACF98EACCAE861A30F137E0118A87225
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......E.6...X...X...X......X......X......X...Y...X......X......X......X.Rich..X.........PE..L...;b.\...........!.....`...................0...............................@.......................................2..\....0...............................2.......................................*..H...........................................UPX0....................................UPX1.....`.......\..................@...UPX2.........0.......`..............@......................................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI33482\pyexpat.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	52736
Entropy (8bit):	7.904524114628073
Encrypted:	false
SSDEEP:	1536:omazZr7ECJ0E6kFg85F/rFi2LU60XZlofDYq0nouy8:9aFr9mE6kF7hrcCU6Qlewout
MD5:	AD560121EFD8E249FC3414200D98F75F
SHA1:	73040F9BC04E733A85DA00E364EF85583F505636
SHA-256:	0BEB3B16F9A11F93137365A1179D2062A414ADABA337BCAC05A083A921775B50
SHA-512:	6DA2B01773DCE658DCFD9219DD8D093F60EAFF669ED600C9A62EFC39FB3E362F051A499FAC85777C1B8F364B1AD2E134E080CAE720FC5477711A7ED7F191A5C7
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........2.\...\...\......\......\......\......\...]..\......\......\......\.Rich..\.................PE..L...4>CX...........!................Pj....................................................@............................L...................................$.......................................(v..H...........................................UPX0....................................UPX1................................@...UPX2................................@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI33482\python27.dll

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	898048
Entropy (8bit):	7.990256946915668
Encrypted:	true
SSDEEP:	24576:I0cNEHSDC9XmwbTV/mv+nQW0mj7IaqtsoejWg3c:jHhmhmI9eo63
MD5:	8C44826A640B3CF0B32B0258C65FEE07
SHA1:	E3F9FE6366D0876BFA8B903B20D2ACF06416F1BC
SHA-256:	FBAD053D962BAC96865AC3372958D697711800FDC46F36C87011BB5E89026614
SHA-512:	884E2C01C088B9AE86D4605FED1CF8E9B17F99CF887EFC5644F4A91959ECD89148CCA3E9FDAA6AB9E8C4DFD2D61DBDFD442A95B13DAB7E5CD027B4782D473355
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#..^g.y.g.y.g.y....~.y.n...l.y.n...i.y.n...e.y.n...l.y.g.x.[.y.n.....y.n...f.y.n...f.y.n...f.y.Richg.y.................PE..L... >CX...........!.....0.......0...Z..@...p...............................+...........@.........................pz.t\|..,y.D....p.,...........................................................f.H...........................................UPX0.....0..............................UPX1.....0...@...(..................@....rsrc........p......,..............@......................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI33482\pywintypes27.dll

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	53248
Entropy (8bit):	7.425128830518154
Encrypted:	false
SSDEEP:	1536:eTwUerP24SfDRd2TACkwqyfnouy81cSPDuwQ0:eTleODRd2ew/Pout1cSru
MD5:	07B436BFA1C7B4FFC21FB39358158060
SHA1:	7F5A47CDAB9A7D93BBBD204CEDFFCA61D3F80C84
SHA-256:	82C2926CB03A04392FA479801D505E2A387446BCA978FF930177121DB2FDB461
SHA-512:	13EBCB83F478C859CA808003933769B84290E108648B69F33043653263C5B4BD37ED5CA8D521B46A1D9122EB232F7E5D05A25E16F250D5573CF85CD5CDEFB2EF
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qz.Y5...5...5....Tz.7...+Iy.6...+Io.8.....".4...+I..1.....'.>...5.......+Ih.$...+I~.4...+I}.4...Rich5...................PE..L...:..[...........!.........P............... ....z..........................p.......................................%..PJ..h#....... ..h...................Po..........................................H...........................................UPX0....................................UPX1.............\|..................@....rsrc....P... ...P..................@......................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI33482\select.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	9216
Entropy (8bit):	7.003407892450472
Encrypted:	false
SSDEEP:	192:qhogHS4TaqZXRQKKXYVEvySc3IFaNJhLkwcud2DH9VwGfctX:qhLS4TaqxhfCHc38aNJawcudoD7U
MD5:	57EB00056AC8C38CD4F3153FB9507F13
SHA1:	DDEE8E74FCC81B6301145F27C0F1CCF4B9185E1C
SHA-256:	7B90EC138AC8415D9B747612063D19147FEC2B1E99DE97C3B5636E8CA40B346E
SHA-512:	05F7EF6BD065D7DB3F41DFA95187FA40A14F58FA5D4705F2DF5982DB18EEB6D4E93C473D05932436BF645E76E0B23532867011E92EF953EC247B55648ED9C6EF
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........i)...z...z...z...z...z...z...z...z...z...z...z...z...z...z...z...z...z...z...zRich...z........PE..L...5>CX...........!..... .......P..pq...`................................................@.............................H...................................H.......................................P}..H...........................................UPX0.....P..............................UPX1..... ...`......................@...UPX2................."..............@..............................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI33482\servicemanager.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	7.2228399102917615
Encrypted:	false
SSDEEP:	384:FVtYwprbL7fLBtdYzKNg13ZOPaNJawcudoD7UfMX:vawBbLFYzKNg1plnbcuyD7UfMX
MD5:	6A95BCF45E4BE23CC2634EF5BAD17660
SHA1:	7D13B791588CB800C2ADD75FF8E74C3C493A8143
SHA-256:	60DA4B4E628B7DC1115615128AC554AEB29B50A61629AD5AEEB5CC9D2BD86202
SHA-512:	D3C80B025647444F42D42E82CAD50C4383728F7F8C9E16AA9D87450CA864B0B97B5F8F47E80328A4A2B67CE7D06C9A8F1DAE8C5B3C798DE1B2A50164161E69C8
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........o....K...K...K...K...K...K...K...K...KR..K...K...K...K...K...K...K...K...K...K...K...KRich...K........................PE..L......[...........!.....@........................}.....................................................................\...........................................................................h...H...........................................UPX0....................................UPX1.....@.......4..................@....rsrc................8..............@......................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI33482\unicodedata.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	181760
Entropy (8bit):	7.989160583257678
Encrypted:	false
SSDEEP:	3072:Rfe2dO8KvTdjKGssSXwgtXZT32qenyxHBKs//4wd3RP29sZ6lI883out:Rfe2bKvEw+k2kw/4wZRPS3coS
MD5:	9A465CFAA788E29E7B1366C012EBC75C
SHA1:	10D9C49BB6652D9B04E17608D9ED35B036112647
SHA-256:	35C84D824DB175DD71046806A59BC711021ABCE04698FA304B1E2A9855E50A9C
SHA-512:	31BEE259C78CEB1E4F5C52E7B2CBD0EB62A071FC9C748DF47AB824E383EFDC3B218168700341B96D139DABFB3E4D7644341F22E52982B7C7F135A9E35B300B00
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......{H..?).?).?).6QE.=).6QS.1).6QT.=).6QC.8).?)..).6QY.>).6QB.>).6QA.>).Rich?).................PE..L...6>CX...........!......................................................................@.............................T...................................,.......................................x...H...........................................UPX0....................................UPX1................................@...UPX2................................@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI33482\win32api.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	34816
Entropy (8bit):	7.794879575971907
Encrypted:	false
SSDEEP:	768:etKTLIw2eRBsqBvKddE/wW68vEvfW2qmSOyinbcuyD7Uqmx:DCeLrGderDH2FXyinouy8qmx
MD5:	42C475231F4835BB1A5F94B0D3DA4520
SHA1:	FCFAE296DD10C92D973A57D61BBF5C0F4A15ED6B
SHA-256:	87CEEB1B7586DB730F48988A07018F9C8AF57934FF7F173A869542207F46B0F1
SHA-512:	D1A699B8497E8843F990F6F719A904A7751FE2A9404CB195BE2D94341728A7372CD93D379B576E6031980E1DA53F2336805C6BF59E799B63565CD63D4931C02A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......[-..L...L...L.......L.......L.......L...J..L...L..UM.......L.......L.......L..Rich.L..................PE..L......[...........!.............p.. ...............................................................................P.......X...........X...............................................................H....................B..@...................UPX0.....p..............................UPX1.............~..................@....rsrc...............................@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI33482\win32event.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	6.799438399701252
Encrypted:	false
SSDEEP:	192:jNxmpzSvHU53Uon53eXqY1K/CjrELQc432Xq0FaNJhLkwcud2DH9VwGfctLj/t:Xmp2/UR95aP1pgEc432XBaNJawcudoDU
MD5:	796306BE7A1ABCFFB8853EE9CEB5BEAE
SHA1:	93762CF53958A3A99B674986FCF3C53C489133ED
SHA-256:	26E6D883E9E61BF872425526A9B8C7BB229C3B9D2F82BB3C0BF500660DBE1995
SHA-512:	5919A837FA1FCAEA91B14D02DA306928D5E523E4591DCA290422C9EB9BE15F2EE626A8379F5C953F2B08E7A6B2CD67618652B9EFA9ACE8ABD47A8BD7CD8C2F64
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........k..{8..{8..{8..8..{8..8..{8..8..{8 ..8..{8..z8..{8..8..{8..8..{8..8..{8Rich..{8................PE..L...T..[...........!.....0..............................................................................................P...`...\.......`...........................................................h...H...........................................UPX0....................................UPX1.....0......."..................@....rsrc................&..............@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI33482\win32evtlog.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	19968
Entropy (8bit):	7.436093769968754
Encrypted:	false
SSDEEP:	384:Wo5FgP/m1xaGAONAt4ZvFqQggg3LgsAWUh31lA2W1waNJawcudoD7UGwGS:WmuP+TOONp5UQ/Zs8FlAfnbcuyD7UGwX
MD5:	317360BE68901D11F3D02AF1C151A4DC
SHA1:	570BF03BE1A737CF3D0CF3FC8E77261CF64E2051
SHA-256:	AC9C5C4BAA4DE19BDDF55313F29182F26EB80312C31266413672C61424A5C6E0
SHA-512:	25C25C23DD4FE1957CDFAD833D4570553C2627775008F3939525B6A3D1892F8B6CB7A9F20D454166338DF4DFC8A98306A1160016AE4CB2E9464944945AFA0A82
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........E..i+..i+..i+.E&...i+..;...i+..;...i+..;...i+.%...i+..i*.hi+..;...i+..;...i+..;...i+..;...i+.Rich.i+.................PE..L......[...........!.....P...................0...............................@.......................................4..T....3..P....0......................L5.......................................!..H.......................@...................UPX0....................................UPX1.....P.......D..................@....rsrc........0.......H..............@......................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI33482\win32service.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	18432
Entropy (8bit):	7.513143648749714
Encrypted:	false
SSDEEP:	384:DvSTTJQxdZ3goCVdvSbw66apC1aNJawcudoD7U46:LSTT+1KF1onbcuyD7U46
MD5:	F23A62491BD945C050E3E1D13909E9E7
SHA1:	B8DAC4E00163533157A17E3B56D05E049A2375A2
SHA-256:	E52B5532A6764AAAE67DB557412B3F77EBDC8A14A72771A1C6414A83BB3FC15C
SHA-512:	52200CF9687752DB43BBAE703192C841694D5BD976FA56C0F25E0478CFB97681BC77677C1A8907167612DDF9FE6A561945FBEB0180022670AF97BF41B5B11766
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........[..[..[.....Z..E.-.Z..E.;.V..E.+.]...!s.\..[.....E.<.^..E.*.Z..E.,.Z..E.).Z..Rich[..........PE..L...q..[...........!.....@..........................................................................................8...T...............................................................................H...........................................UPX0....................................UPX1.....@.......>..................@....rsrc................B..............@..............................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI33482\xmrig.exe

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	1905664
Entropy (8bit):	7.9235088812144
Encrypted:	false
SSDEEP:	49152:jeXVwyagUSymDH29F4+rthFTo6YZfnH8:0VKgUSymDH29ttzToX1nc
MD5:	13BDD9CD9F7E51746172996262B5A873
SHA1:	3834F8179ABD7A827E927505F3C226AC8BBCF3EE
SHA-256:	4BF737B29FF521BC263EB1F2C1C5EA04B47470CCCD1BEAE245D98DEF389929BD
SHA-512:	49879918505D042312F20B2FC8310A8C4A58AA266ED1AB05E0481F7E11385DA0920CF9D756F842EB98E4394F14725385B74A99B38FC8A60222FA4CC873CB8040
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: C:\Users\user\AppData\Local\Temp\_MEI33482\xmrig.exe, Author: Joe Security
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....\.....................`...0>...Z..@>...[...@..........................`[............... ...................... X.x....][.<.....[..]....................................................Z.....................................................UPX0.....0>.............................UPX1.........@>.....................@....rsrc....`....[..`..................@...3.94.UPX!....E.G...@.`.Z.....$Z.$/.w.......&...'....1.f.=.@9....MZ..,......($..#...th.....82..tJ......$.,./,......+.l..Ho..~B.......:..6....L.=Dc..tm....-<h....f..<2...u..?PEl..u..Q....-l..~?....j..x.......]...........K".v.g?w...k+...yt`,........o..7>,. ..D$...............7......b..0.{..,.~...[U......WV.U.S..\|.0~....+..).b.........@....................5.o.E.....d....x....l0.9..9...3....o._..........=...u...;.v.f...R..0..`.lm...--...I...X/(......9J9..~?.v...&+.. P.kSn.l......LJ...

C:\Users\user\AppData\Local\Temp\_MEI57642\Crypto.Cipher._AES.pyd

Download File

Process:	C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	7.553130526678379
Encrypted:	false
SSDEEP:	384:50Q1C9jViLl7hDB6n/PtHU2wr8gj93KqmilaNJawcudoD7U:dC8LU/PBU8itClnbcuyD7U
MD5:	371397E80A55D432DA47311B8EF25317
SHA1:	71617777D6A2500D6464D7B394C8BE5F1E4E119E
SHA-256:	C1A900615C9500C46B9602C30C53F299290B03632208EF1152AF8830AB73AD17
SHA-512:	3139E2848ACF02CC8475449F213873D2C2B7196F6A55C70D2D8F8B487020387740364E5CA0AA584624D1B9B01B965146A2F0E15EEF34830C7C0ECBB8637DAE03
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........+\8.J2k.J2k.J2k.Ik.J2k...k.J2k...k.J2k...k.J2k.2.k.J2k.J3k.J2k...k.J2k...k.J2k...k.J2kRich.J2k........PE..L....4.S...........!.....@..........`...................................................................................D...........................................................................8...H...........................................UPX0....................................UPX1.....@.......:..................@...UPX2.................>..............@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI57642\Include\pyconfig.h

Download File

Process:	C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	21321
Entropy (8bit):	5.345136937906198
Encrypted:	false
SSDEEP:	384:pGpFpaU1kgCw8r+MIP8Bj5DvVySh3awQBoerw8W+PYV0FGYfN/+:pGpFpb+IU99UShATrw8W+AKF/+
MD5:	BC185DE8B2437963368A85FDD9852951
SHA1:	1459F1428214FCCA7F203FB3A3AFF28E16EB9C1B
SHA-256:	8B130D901E0F83B55699D565F103F2F8F1B3A51712EBB4B9646EA517CC1F04D6
SHA-512:	918469D9A59FE059F3C7C93F34C8D2D07CB8A9BF5E953A1527922ED5C65FF4A2DF50BBC78ED9CE146BF3A1FB6F1763F061262FA4A937BEEEE1FEB8A99E31339E
Malicious:	false
Preview:	#ifndef Py_CONFIG_H.#define Py_CONFIG_H../* pyconfig.h. NOT Generated automatically by configure...This is a manually maintained version used for the Watcom,.Borland and Microsoft Visual C++ compilers. It is a.standard part of the Python distribution...WINDOWS DEFINES:.The code specific to Windows should be wrapped around one of.the following #defines..MS_WIN64 - Code specific to the MS Win64 API.MS_WIN32 - Code specific to the MS Win32 (and Win64) API (obsolete, this covers all supported APIs).MS_WINDOWS - Code specific to Windows, but all versions..MS_WINCE - Code specific to Windows CE.Py_ENABLE_SHARED - Code if the Python core is built as a DLL...Also note that neither "_M_IX86" or "_MSC_VER" should be used for.any purpose other than "Windows Intel x86 specific" and "Microsoft.compiler specific". Therefore, these should be very rare....NOTE: The following symbols are deprecated:.NT, USE_DL_EXPORT, USE_DL_IMPORT, DL_EXPORT, DL_IMPORT.MS_CORE_DLL...WIN32 is still required for the

C:\Users\user\AppData\Local\Temp\_MEI57642\Microsoft.VC90.CRT.manifest

Download File

Process:	C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1050
Entropy (8bit):	5.382436822526041
Encrypted:	false
SSDEEP:	24:2dtn3mGv+zg4NnEN4XKHVJrMmV6LSWV5rcb3S:ch35+zg4i0KHVVdOmS
MD5:	BFB93876892CCA8E2AD0021585C34C8B
SHA1:	0DDE1B225C98825A09D8FF85F462571C9C862E35
SHA-256:	0D060ED7C25159B7B75F16D449963BFD639C15B3C5280BC7897403268C2B9F35
SHA-512:	FE70540B3B3FA88B32DFB2FF7406A3A9819E7862B850D871B932996BBEFFDBC70D7192D6E3196A8583B2DB756CA9CC278505AFBE585BA30EB1222D4F8BE15B7B
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v1">.. <noInheritable/>.. <assemblyIdentity name="Microsoft.VC90.CRT" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b" type="win32" version="9.0.30729.6161"/>.. <file hash="7021457b391b35606e708c69987e4b6f606609ee" hashalg="SHA1" name="msvcr90.dll"/>.. <file hash="88549dd3ce8eaa62ca8aad0e96ddd9fec2203628" hashalg="SHA1" name="msvcp90.dll"/>.. <file hash="65ef374affa5b48827e539b35b3275c201b41fc9" hashalg="SHA1" name="msvcm90.dll"/>.. <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">.. <application>.. <supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/>.. <supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/>.. <supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/>.. <supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>.. <supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/>..

C:\Users\user\AppData\Local\Temp\_MEI57642\_ctypes.pyd

Download File

Process:	C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	37888
Entropy (8bit):	7.848484052157707
Encrypted:	false
SSDEEP:	768:pAXLisB/qV2nQnf33sWcCRWKZac3VWw6cLA3zReukhRnbcuyD7U:pAnBi8nQf3sYToclt6cLUCRnouy8
MD5:	6CB8B560EFBC381651D2045F1571D7C8
SHA1:	15283A7A467ADB7B6D7A7182F660DD783F90E483
SHA-256:	6456FEA123E04BCEC8A8EED26160E1DF5482E69D187D3E1A0C428995472AC134
SHA-512:	CA2958095E8E08B5EF05EC9DE15B7D1EB180923A40B90356DB56A124101C96D8E745001948B89DBE9D6B9CE3C2029F7E9EAF20C73FA1D410A821D6605830BFC0
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...................F.....W.....P......@..........Z.....A.....B...Rich..................PE..L...*>CX...........!............. .. ....0................................................@.........................<...........<.......................................................................H...........................................UPX0..... ..............................UPX1.........0......................@...UPX2................................@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI57642\_hashlib.pyd

Download File

Process:	C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	351744
Entropy (8bit):	7.996557276168139
Encrypted:	true
SSDEEP:	6144:Xh0byJKrtKOFhjnTtMoy8gpVI/xxWo/nX0NKOzyGFmJ559Vq2SeTsRgIIGYMowwZ:2bymtjF1TtMod/xweDK7FmJ5rLVYTIGm
MD5:	EE134421FBABEB565E4F3CA721331C2E
SHA1:	4B03BDD142C6A7BB6F74ABE968C5B76B63E06059
SHA-256:	7863E1BEDFE1FFC720B67B2EB7B3491DB9D2B8E56B5574E6A40FF90336B8DAFA
SHA-512:	D27FF65B6A8BF2E5E70D2865E72EEE6930E76C2A3990428C54FC998743D3C540C5C984B5D1429E8FFBE3D160AE1F6782CD6D3CA40822F81D2052BA168595D1FA
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......z.$.>.J.>.J.>.J.7...4.J.7...1.J.7...<.J.7...3.J.>.K..J.>.J...J.7...Y.J.7...?.J.7...?.J.Rich>.J.........................PE..L....>CX...........!.....`..........@K.......`...............................p............@.........................pa..L....`..p............................a.......................................W..H...........................................UPX0....................................UPX1.....`.......X..................@...UPX2.........`.......\..............@......................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI57642\_socket.pyd

Download File

Process:	C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	7.706254752795193
Encrypted:	false
SSDEEP:	384:CCNDRisVUlkycq27U4r0rOc606B8k4gG35aiQjgO6OPjGL2e1ua7aNJawcudoD7P:v7VUcq27Jr0rOmbwE4jGLhohnbcuyD7B
MD5:	BE47363992C7DD90019276D35FA8DA76
SHA1:	CCF7EBBE829DA08EFD95A53D4BA0C0D4938F6169
SHA-256:	BE10254B111713BEF20A13D561DE61CA3C74A34C64DDC5B10825C64AB2C46734
SHA-512:	573F9111535A9A136FCAAA5C1A16C347F7327626768D849513D69C9848406B1002DCC5B8C17A291EF2E6519587533CA806018EE471A39D330F032A9E7E635EA7
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......AV2..7\..7\..7\..O..7\..O..7\..O..7\..7]..7\..O..7\..O..7\..O..7\..O..7\.Rich.7\.........................PE..L...X>CX...........!.....P..........0.....................................................@.............................d...................................d...........................................H...........................................UPX0....................................UPX1.....P.......P..................@...UPX2.................T..............@..............................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI57642\_ssl.pyd

Download File

Process:	C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	498688
Entropy (8bit):	7.996471896707535
Encrypted:	true
SSDEEP:	12288:FHNz5hZdNGitmdIA8byo3k4Ff9m3fTByPf6So+2RON1jjoS:P3fNTtmd2bkof43fTkR2gH
MD5:	68C3AD86E0A8833C29AD1BE10D3C025D
SHA1:	04488362814B2F3AE07C4E8DF8E45868D48B447F
SHA-256:	C236271B92A0F1D3304337F2E2444107F34D8E26272981F48C47DB347133566C
SHA-512:	BB2819D913033CC26DCD1E5CBF015DACDBF747D29C72BFD41BFE0D74BB77E51A61CF9BE4B67B6348938837125F1D0F80AF0AC33531E00CEA1585535952A22785
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........HFu.)(&.)(&.)(&.Q.&.)(&.Q.&.)(&.Q.&.)(&.)(&.)(&.))&9)(&.Q.&.)(&.Q.&.((&.Q.&.)(&.Q.&.)(&Rich.)(&................PE..L...q>CX...........!.................e....................................................@............................D............................................................................q..H...........................................UPX0....................................UPX1................................@...UPX2................................@..............................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI57642\_win32sysloader.pyd

Download File

Process:	C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	4.992693298555373
Encrypted:	false
SSDEEP:	192:t2VnGV7o5QUEZWm6Uk3fvf3X7THIL3YO+8I:tVU5QUEz6hfLTH98
MD5:	B4A567D80CCC08FB1C7FBB765847AFDA
SHA1:	B7FF2C68BA2887AAF5D029F41922E626C72B716D
SHA-256:	DBB0F9C499A710BBC8BCDE4ECC3577A6C9548262D6CE4434ED5A0708CBC787DD
SHA-512:	DDFEC25304BABE2DF55958F512F61AFD9AF88DDA499FE87931D17A9EEBF048449885A06A24BDDBC8604E11F07CED3C2ECE7F89C28290CAB5D1BF3816D22128DB
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......M.oC.............J.............................../........................Rich............PE..L......[...........!......................... ....;..........................`......................................P&..Z...\"..P....@..l....................P....... ..............................8!..@............ ...............................text...`........................... ..`.rdata....... ......................@..@.data........0......................@....rsrc...l....@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI57642\back.jpg

Download File

Process:	C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	47107
Entropy (8bit):	6.2032294727594985
Encrypted:	false
SSDEEP:	768:z9v1zJKaohy0Za9jwmrALVaka3sgBXHDizIdI9e2E:5v1zJ3nuswbLVgZsceO
MD5:	4AE078DD5085E97D3605F20DC079412A
SHA1:	1BABFCF2D374AE590970A3BE2E0E27BC04922546
SHA-256:	ED551536FF22587CDF7701A279E088EB370A4121E7A3FA1F3C8B121E767318A2
SHA-512:	BF163C63120CC5035087E4FF0035D9DAEB100218C62969AA6AA75D539108323295EB9CC28ABB0906C21CE8AEA25DACD1D0AAB3F3FE9C765D35348F0A7DA000AE
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......]....S......"...8.P....... ..`u...0.................................................... .....................................................................................................................................................UPX0..... ..............................UPX1.....P...0...H..................@...UPX2.................J..............@...3.93.UPX!.....3r#l..JW..CE...0..&.......U..S...........t?........'.........9.r.....t...'.....s.t&...$....,1....$6.....X[]._V`..u....tG..oo.t$lE_D$.....=......."....1......uG...c..4....uF1..e.[^]..o...f.L.!.+.y..........................8</....fp.v..U..$........../...........O/...e..]...........#3f.E.f.E......m.._..;.}e.......f.t"............U.1.3-...}..~2.k......!..........7{..+...7..\|...............G.:..S........w. ........ ..%+{.n..$...e.>.m....u..,(.....k_.'lk.C2$C&'(.5.`cv/..

C:\Users\user\AppData\Local\Temp\_MEI57642\bz2.pyd

Download File

Process:	C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	35840
Entropy (8bit):	7.816957595202127
Encrypted:	false
SSDEEP:	768:IHCeOgq+kCitCVj5rz2Ya+r9qLYp9R9JoWnbcuyD7UiT:IHXr8CBd9NpfXxnouy8
MD5:	C9C00BC854A39E66B27787D188F9E8D7
SHA1:	21F20CF6C628B529DB4BDB853B679F9BF23590E3
SHA-256:	29520DF660A5BBD704B9106A6650A66E4F5766B904D05F97146668D41DBF5839
SHA-512:	8887B5CA542220CAC04D5A6A22A06F95DB560F4FE0F9A128CEB642ED9716ABCFFBA2146CCE682EB16C4DA3F423649A61904A73C4357D9FDBD5DDF606790199A3
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}.S.9.=K9.=K9.=K..K:.=K0..K:.=K0..K7.=K0..K;.=K0..K>.=K9.<KS.=K0..K1.=K0..K8.=K0..K8.=KRich9.=K................PE..L...?>CX...........!.................W.......p............................................@..........................p..D....p...............................q.......................................c..H...........................................UPX0....................................UPX1................................@...UPX2.........p......................@..............................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI57642\certifi\cacert.pem

Download File

Process:	C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	284518
Entropy (8bit):	6.05114864026174
Encrypted:	false
SSDEEP:	6144:GriCfLXd1YU58fVuKlnm5plZ0PXCRrcMBbADwYC+MslE:GrdT3YZuz5LwCRrcMije
MD5:	DD2DD543395692705F7DDA0F5E7750FA
SHA1:	40D7CE60393978A29FB0E0B1E849658E48CF7887
SHA-256:	397B833E5ACF89A2709B964401A9ACA68D24B62349B72BBE38684E586AA07A27
SHA-512:	3BA0D6AD8B6838B04FBFDEBAD20EB5544C093BA592B517AA383708A34CE2BD215DB2BF010090251674DBCFD4EDA3C44F770C9FBF314304DE918D7E59E2596CF2
Malicious:	false
Preview:	.# Issuer: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Subject: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Label: "GlobalSign Root CA".# Serial: 4835703278459707669005204.# MD5 Fingerprint: 3e:45:52:15:09:51:92:e1:b7:5d:37:9f:b1:87:29:8a.# SHA1 Fingerprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c.# SHA256 Fingerprint: eb:d4:10:40:e4:bb:3e:c7:42:c9:e3:81:d3:1e:f2:a4:1a:48:b6:68:5c:96:e7:ce:f3:c1:df:6c:d4:33:1c:99.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG.A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv.b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw.MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i.YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT.aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ.jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp.xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz

C:\Users\user\AppData\Local\Temp\_MEI57642\config.json

Download File

Process:	C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1206
Entropy (8bit):	4.275024024623091
Encrypted:	false
SSDEEP:	24:pCKENTHgbeZlE1jCAh1RHEdOgNanAOSWSula:UKuTHgbYlUZHEdrNAla
MD5:	50CC63E4A1B24622CF61ED566B03E98F
SHA1:	92E5874785BB76E4579559BA70E116A6149349F5
SHA-256:	348F388C57DFB77B0CAACD8304725E10DC69A52EEC41AE695327787AD1853C92
SHA-512:	9A291DB9CF396687F3878590B1EB65CD7DA2E6FC3D6DE64A3B8CB08116B646371F432100E16B0ECD4F2916D05D67830F949AC2A3CA559A3A8D56616DF2BE98C7
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: C:\Users\user\AppData\Local\Temp\_MEI57642\config.json, Author: Joe Security
Preview:	{. "algo": "cryptonight",. "api": {. "port": 0,. "access-token": null,. "id": null,. "worker-id": null,. "ipv6": false,. "restricted": true. },. "autosave": true,. "av": 0,. "background": true,. "colors": true,. "cpu-affinity": null,. "cpu-priority": null,. "donate-level": 1,. "huge-pages": true,. "hw-aes": null,. "log-file": null,. "max-cpu-usage": 70,. "pools": [. {. "url": "xmr.crypto-pool.fr:3333",. "user": "47BD6QNfkWf8ZMQSdqp2tY1AdG8ofsEPf4mcDp1YB4AX32hUjoLjuDaNrYzXk7cQcoPBzAuQrmQTgNgpo6XPqSBLCnfsjaV",. "pass": "x",. "rig-id": null,. "nicehash": false,. "keepalive": false,. "variant": -1,. "enabled": true,. "tls": false,. "tls-fingerprint": null. }. ],. "print-time": 60,. "retries": 5,. "retry-pause": 5,. "safe": false,. "threads": [. {.

C:\Users\user\AppData\Local\Temp\_MEI57642\ftpcrack.exe.manifest

Download File

Process:	C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1345
Entropy (8bit):	5.283640732769631
Encrypted:	false
SSDEEP:	24:2dtn3ZoWglN2v+zg4NnEN4XKDmc0+bLg4fNRme5rcb3S:ch3DgX2+zg4i0KDmJ+bLg4VRmemS
MD5:	B5DEA49B86C5BB5D9CD8D64A09F70065
SHA1:	487EF676EBD244EBC3CF197F70DA7A5E393FB96E
SHA-256:	78B1160F6ADAB34D144AD19A0F4B83F83453F1E18460BBDFBE17AD354B62AF7D
SHA-512:	1B5914F4C52F47A33C57F5F6428482E6766099BF43D4E8616CE4AABC4A917C24B2E0C98C841F0D7E7B8A202F40FF960885535539BF70CC7C7ED8687C7ECE010C
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v1">.. <assemblyIdentity name="ftpcrack" processorArchitecture="x86" type="win32" version="1.0.0.0"/>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity name="Microsoft.VC90.CRT" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b" type="win32" version="9.0.30729.6161"/>.. <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"/>.. </dependentAssembly>.. </dependency>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity language="*" name="Microsoft.Windows.Common-Controls" processorArchitecture="x86" publicKeyToken="6595b64144ccf1df" type="win32" version="6.0.0.0"/>.. <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"/>.. </dependentAssembly>.. </dependency>.. <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">.. <application>.. <supportedOS Id="{1f676c76-80e

C:\Users\user\AppData\Local\Temp\_MEI57642\httplib2\cacerts.txt

Download File

Process:	C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	135546
Entropy (8bit):	6.039525643754334
Encrypted:	false
SSDEEP:	3072:FVrovvEjVplrqHSdX+zpfQq7ZiyZOF5mdFENAKHn1HtYfei8i31MCSjfpVpKbIcf:3cmHuBfaUFENX3YfEl3plcs+
MD5:	14BA876BA2515A25BBB511F24BF06653
SHA1:	291DCDEE67E880B21FD7001CB8350C3ECEE4CAC8
SHA-256:	2039836A620F956EC094EAAE7C9B41A04C76F31130898B11014D9E83C905F0DE
SHA-512:	5035F82DF06308A14F6626C54382B3AB34B6D664C8394B48F75275F69DCC2B93266D843B51F0B586E5F12FCD70FE3660B5B08AFC20738DF6D8C812592C0D71E4
Malicious:	false
Preview:	# Issuer: CN=GTE CyberTrust Global Root O=GTE Corporation OU=GTE CyberTrust Solutions, Inc..# Subject: CN=GTE CyberTrust Global Root O=GTE Corporation OU=GTE CyberTrust Solutions, Inc..# Label: "GTE CyberTrust Global Root".# Serial: 421.# MD5 Fingerprint: ca:3d:d3:68:f1:03:5c:d0:32:fa:b8:2b:59:e8:5a:db.# SHA1 Fingerprint: 97:81:79:50:d8:1c:96:70:cc:34:d8:09:cf:79:44:31:36:7e:f4:74.# SHA256 Fingerprint: a5:31:25:18:8d:21:10:aa:96:4b:02:c7:b7:c6:da:32:03:17:08:94:e5:fb:71:ff:fb:66:67:d5:e6:81:0a:36.-----BEGIN CERTIFICATE-----.MIICWjCCAcMCAgGlMA0GCSqGSIb3DQEBBAUAMHUxCzAJBgNVBAYTAlVTMRgwFgYD.VQQKEw9HVEUgQ29ycG9yYXRpb24xJzAlBgNVBAsTHkdURSBDeWJlclRydXN0IFNv.bHV0aW9ucywgSW5jLjEjMCEGA1UEAxMaR1RFIEN5YmVyVHJ1c3QgR2xvYmFsIFJv.b3QwHhcNOTgwODEzMDAyOTAwWhcNMTgwODEzMjM1OTAwWjB1MQswCQYDVQQGEwJV.UzEYMBYGA1UEChMPR1RFIENvcnBvcmF0aW9uMScwJQYDVQQLEx5HVEUgQ3liZXJU.cnVzdCBTb2x1dGlvbnMsIEluYy4xIzAhBgNVBAMTGkdURSBDeWJlclRydXN0IEds.b2JhbCBSb290MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCVD6C28FCc6HrH.iM3dFw4usJTQGz0

C:\Users\user\AppData\Local\Temp\_MEI57642\msvcm90.dll

Download File

Process:	C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	225280
Entropy (8bit):	6.034911041879855
Encrypted:	false
SSDEEP:	3072:6yZeocziNzMLSMOYscmLWbAX+dP4Upoh86Goao14JU87/amFYw8fF01OyASLE:PYOMqc8oAXGP4Upoe6fa3/amiX2Oyp
MD5:	D34A527493F39AF4491B3E909DC697CA
SHA1:	AFEE32FCD9CE160680371357A072F58C5F790D48
SHA-256:	7A74DA389FBD10A710C294C2E914DC6F18E05F028F07958A2FA53AC44F0E4B90
SHA-512:	0DABC5455EB02601D7C40A9C49B3ADE750B1118934EF3785FB314FA313437BC02B243571ABA25F1661A69DCEA36838530C12762A2E6602D14A9B03770A82CCA6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;...h...h...h..ah...h1.dh...h..gh...h...h...h.-.h...h...h...h..qh...h..vh...h..`h...h..fh...h..ch...hRich...h........................PE..L.....M...........!.....:..........Z........P....?x.........................0......^.....@......................... 3..4....&..d...............................d...P...............................H...@...............(...........p...H............text...T9.......:.................. ..`.data........P.......>..............@....rsrc................H..............@..@.reloc...#.......$...L..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_MEI57642\msvcp90.dll

Download File

Process:	C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	335184
Entropy (8bit):	6.343962999919931
Encrypted:	false
SSDEEP:	6144:fmIIPLSg4p0t4271NWoSYEMS6VhUgiW6QR7t5183Ooc8SHkC2eQ:fmIeLSgo0S271QoSQhUgiW6QR7t51831
MD5:	92EA2DB0E788894C43753C550216A886
SHA1:	DA8C7A178BA0CA80D321666F5642A7436B640602
SHA-256:	9694756F43B20ABC50F95646C54E9E36CD6EDF8EED3DB846064567399F4E7566
SHA-512:	90E72A68C7267E8D0986A75247AE7B2339E4C2A981D686342B2EF90B1FCF9695B558D0BD5932F7C53524E02CC664B974BA76783FDE919B24EB36795DB3300BA6
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........#%..Mv..Mv..Mv.66v..Mv...v..Mv..Lv:.Mv...v..Mv...v..Mv...v..Mv...v..Mv...v..Mv...v..Mv...v..MvRich..Mv........................PE..L.....M...........!................P.... ...0....Hx.........................0............@.........................p4..,....3.......0.......................&......................................()..H...........................................UPX0....................................UPX1......... ......................@....rsrc........0......................@..............................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI57642\msvcr90.dll

Download File

Process:	C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	250192
Entropy (8bit):	7.900323441964523
Encrypted:	false
SSDEEP:	6144:EODM4c99eLswEOva4g4fpgMf4FfIoSNjbZdGJCJLuEyKIqqOmiqsEqmQI0wye/c:EODM1HagYaMf4FAoSNjHmHyyc
MD5:	199D34B03C7D0EB804A6D9869184B8D4
SHA1:	03148854519D0970C1BBDC089D3E8DE1AED61C47
SHA-256:	DF86421E354F817607F2BAFC9188569242FCF9DD564B28F3E2915C86A0BA1F54
SHA-512:	E4269CA993393422A90231DAABD390771A635EEB0817A9D00DCCEF496372BB4B57B615529F26A2E8132BDE825CDACA07D965D207421C02EA6471DA214354361E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................6.........!.R...7.....&.....0.....6.....3...Rich..........PE..L.....M...........!.....@.......0..0f...@........Rx......................................@.........................@....\|.....x....................................................................r..H...........................................UPX0.....0..............................UPX1.....@...@...4..................@....rsrc................8..............@..............................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI57642\netifaces.pyd

Download File

Process:	C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	7.145184945732974
Encrypted:	false
SSDEEP:	192:uKqSCMOF44HPPtLm+9a3ozToPmzYUaFaNJhLkwcud2DH9VwGfctH:ubS9s44vPtLR9aUPJ+aNJawcudoD7U
MD5:	C7807680A69196C3EE66C4CFB3E271AC
SHA1:	D3EA74C9E3B810C6A1EE4296B97E20F2F45C9461
SHA-256:	1A6C57AC8031582477B1D3463A65B6EB006EEA704E27C8C4B812B99EA910428D
SHA-512:	A5D893132AD889E98B434DA7FD5CA377AFB1800FD8D3230CCED5E9FDE576FCEC943DD22FA48810BA6D93C510EBAA8AC5A94EC1B9D639FD6C533C5BBD4737CF15
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......FL...-...-...-...U...-...U...-...-..J-...U...-...U...-...U...-...U...-..Rich.-..........................PE..L...,.-\...........!.....0.......P...x...`..........................................................................4...P.......4...................................................................p...H...........................................UPX0.....P..............................UPX1.....0...`...&..................@...UPX2.................*..............@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI57642\perfmon.pyd

Download File

Process:	C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	6.948652527580434
Encrypted:	false
SSDEEP:	192:0xeSnTQM3MsUjU+viJBctKiyiLKPfFaNJhLkwcud2DH9VwGfct0XlpoI6J:0xe4R3scJBcMWYdaNJawcudoD7UmlSI
MD5:	EE813500A441B5FFDACD853E95BEE669
SHA1:	7F05F1493380AF3FE08F55524F6FF90C47C0CC4D
SHA-256:	AC491704AF920BE0E503F0243D2D371E230622E213E9F082347B52C0A7B009C2
SHA-512:	060D079A93ADD067EB062D2B1CB9977719BE68AE1223B0219DBB14CC9C6C66FF47D9929945636B577BC7F1BB84D5500B88ACD5F7BF636CC63BD4C88534AF724E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........0...c...c...c..9c...c.gc...c.qc...c.ac...c...c...c.vc...c.`c...c.cc...cRich...c................PE..L...C..[...........!.....0.......`.......p........n.................................................................t...L...P...$.......P...............................................................H...........................................UPX0.....`..............................UPX1.....0...p..."..................@....rsrc................&..............@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI57642\psutil._psutil_windows.pyd

Download File

Process:	C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	25600
Entropy (8bit):	7.700665778298437
Encrypted:	false
SSDEEP:	384:3qUURhEUVDrn5EMvG04YMJIoa67+5pGr0qLWMAUm7NFYGz45/+aNJawcudoD7ULt:aUjUXBjPAGHqLm7N/z4dnbcuyD7UL
MD5:	2FC800FCC46A597921C2ED447AEB09AC
SHA1:	72004227E5C60C8460F835A170798AA22861B79E
SHA-256:	2E4AD3D08118DA77C928C4614BFECB34397CFAF53F5D46D7C7E5F1DA3172C1F1
SHA-512:	A17022B364615B45A1873AEA0DE922A2988E4D75A8F4E63ECB9CA7DD46263E684B1F28B82BD77B046BBE2AD03CE65C5DACF98EACCAE861A30F137E0118A87225
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......E.6...X...X...X......X......X......X...Y...X......X......X......X.Rich..X.........PE..L...;b.\...........!.....`...................0...............................@.......................................2..\....0...............................2.......................................*..H...........................................UPX0....................................UPX1.....`.......\..................@...UPX2.........0.......`..............@......................................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI57642\pyexpat.pyd

Download File

Process:	C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	52736
Entropy (8bit):	7.904524114628073
Encrypted:	false
SSDEEP:	1536:omazZr7ECJ0E6kFg85F/rFi2LU60XZlofDYq0nouy8:9aFr9mE6kF7hrcCU6Qlewout
MD5:	AD560121EFD8E249FC3414200D98F75F
SHA1:	73040F9BC04E733A85DA00E364EF85583F505636
SHA-256:	0BEB3B16F9A11F93137365A1179D2062A414ADABA337BCAC05A083A921775B50
SHA-512:	6DA2B01773DCE658DCFD9219DD8D093F60EAFF669ED600C9A62EFC39FB3E362F051A499FAC85777C1B8F364B1AD2E134E080CAE720FC5477711A7ED7F191A5C7
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........2.\...\...\......\......\......\......\...]..\......\......\......\.Rich..\.................PE..L...4>CX...........!................Pj....................................................@............................L...................................$.......................................(v..H...........................................UPX0....................................UPX1................................@...UPX2................................@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI57642\python27.dll

Download File

Process:	C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	898048
Entropy (8bit):	7.990256946915668
Encrypted:	true
SSDEEP:	24576:I0cNEHSDC9XmwbTV/mv+nQW0mj7IaqtsoejWg3c:jHhmhmI9eo63
MD5:	8C44826A640B3CF0B32B0258C65FEE07
SHA1:	E3F9FE6366D0876BFA8B903B20D2ACF06416F1BC
SHA-256:	FBAD053D962BAC96865AC3372958D697711800FDC46F36C87011BB5E89026614
SHA-512:	884E2C01C088B9AE86D4605FED1CF8E9B17F99CF887EFC5644F4A91959ECD89148CCA3E9FDAA6AB9E8C4DFD2D61DBDFD442A95B13DAB7E5CD027B4782D473355
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#..^g.y.g.y.g.y....~.y.n...l.y.n...i.y.n...e.y.n...l.y.g.x.[.y.n.....y.n...f.y.n...f.y.n...f.y.Richg.y.................PE..L... >CX...........!.....0.......0...Z..@...p...............................+...........@.........................pz.t\|..,y.D....p.,...........................................................f.H...........................................UPX0.....0..............................UPX1.....0...@...(..................@....rsrc........p......,..............@......................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI57642\pywintypes27.dll

Download File

Process:	C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	53248
Entropy (8bit):	7.425128830518154
Encrypted:	false
SSDEEP:	1536:eTwUerP24SfDRd2TACkwqyfnouy81cSPDuwQ0:eTleODRd2ew/Pout1cSru
MD5:	07B436BFA1C7B4FFC21FB39358158060
SHA1:	7F5A47CDAB9A7D93BBBD204CEDFFCA61D3F80C84
SHA-256:	82C2926CB03A04392FA479801D505E2A387446BCA978FF930177121DB2FDB461
SHA-512:	13EBCB83F478C859CA808003933769B84290E108648B69F33043653263C5B4BD37ED5CA8D521B46A1D9122EB232F7E5D05A25E16F250D5573CF85CD5CDEFB2EF
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qz.Y5...5...5....Tz.7...+Iy.6...+Io.8.....".4...+I..1.....'.>...5.......+Ih.$...+I~.4...+I}.4...Rich5...................PE..L...:..[...........!.........P............... ....z..........................p.......................................%..PJ..h#....... ..h...................Po..........................................H...........................................UPX0....................................UPX1.............\|..................@....rsrc....P... ...P..................@......................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI57642\select.pyd

Download File

Process:	C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	9216
Entropy (8bit):	7.003407892450472
Encrypted:	false
SSDEEP:	192:qhogHS4TaqZXRQKKXYVEvySc3IFaNJhLkwcud2DH9VwGfctX:qhLS4TaqxhfCHc38aNJawcudoD7U
MD5:	57EB00056AC8C38CD4F3153FB9507F13
SHA1:	DDEE8E74FCC81B6301145F27C0F1CCF4B9185E1C
SHA-256:	7B90EC138AC8415D9B747612063D19147FEC2B1E99DE97C3B5636E8CA40B346E
SHA-512:	05F7EF6BD065D7DB3F41DFA95187FA40A14F58FA5D4705F2DF5982DB18EEB6D4E93C473D05932436BF645E76E0B23532867011E92EF953EC247B55648ED9C6EF
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........i)...z...z...z...z...z...z...z...z...z...z...z...z...z...z...z...z...z...z...zRich...z........PE..L...5>CX...........!..... .......P..pq...`................................................@.............................H...................................H.......................................P}..H...........................................UPX0.....P..............................UPX1..... ...`......................@...UPX2................."..............@..............................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI57642\servicemanager.pyd

Download File

Process:	C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	7.2228399102917615
Encrypted:	false
SSDEEP:	384:FVtYwprbL7fLBtdYzKNg13ZOPaNJawcudoD7UfMX:vawBbLFYzKNg1plnbcuyD7UfMX
MD5:	6A95BCF45E4BE23CC2634EF5BAD17660
SHA1:	7D13B791588CB800C2ADD75FF8E74C3C493A8143
SHA-256:	60DA4B4E628B7DC1115615128AC554AEB29B50A61629AD5AEEB5CC9D2BD86202
SHA-512:	D3C80B025647444F42D42E82CAD50C4383728F7F8C9E16AA9D87450CA864B0B97B5F8F47E80328A4A2B67CE7D06C9A8F1DAE8C5B3C798DE1B2A50164161E69C8
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........o....K...K...K...K...K...K...K...K...KR..K...K...K...K...K...K...K...K...K...K...K...KRich...K........................PE..L......[...........!.....@........................}.....................................................................\...........................................................................h...H...........................................UPX0....................................UPX1.....@.......4..................@....rsrc................8..............@......................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI57642\unicodedata.pyd

Download File

Process:	C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	181760
Entropy (8bit):	7.989160583257678
Encrypted:	false
SSDEEP:	3072:Rfe2dO8KvTdjKGssSXwgtXZT32qenyxHBKs//4wd3RP29sZ6lI883out:Rfe2bKvEw+k2kw/4wZRPS3coS
MD5:	9A465CFAA788E29E7B1366C012EBC75C
SHA1:	10D9C49BB6652D9B04E17608D9ED35B036112647
SHA-256:	35C84D824DB175DD71046806A59BC711021ABCE04698FA304B1E2A9855E50A9C
SHA-512:	31BEE259C78CEB1E4F5C52E7B2CBD0EB62A071FC9C748DF47AB824E383EFDC3B218168700341B96D139DABFB3E4D7644341F22E52982B7C7F135A9E35B300B00
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......{H..?).?).?).6QE.=).6QS.1).6QT.=).6QC.8).?)..).6QY.>).6QB.>).6QA.>).Rich?).................PE..L...6>CX...........!......................................................................@.............................T...................................,.......................................x...H...........................................UPX0....................................UPX1................................@...UPX2................................@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI57642\win32api.pyd

Download File

Process:	C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	34816
Entropy (8bit):	7.794879575971907
Encrypted:	false
SSDEEP:	768:etKTLIw2eRBsqBvKddE/wW68vEvfW2qmSOyinbcuyD7Uqmx:DCeLrGderDH2FXyinouy8qmx
MD5:	42C475231F4835BB1A5F94B0D3DA4520
SHA1:	FCFAE296DD10C92D973A57D61BBF5C0F4A15ED6B
SHA-256:	87CEEB1B7586DB730F48988A07018F9C8AF57934FF7F173A869542207F46B0F1
SHA-512:	D1A699B8497E8843F990F6F719A904A7751FE2A9404CB195BE2D94341728A7372CD93D379B576E6031980E1DA53F2336805C6BF59E799B63565CD63D4931C02A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......[-..L...L...L.......L.......L.......L...J..L...L..UM.......L.......L.......L..Rich.L..................PE..L......[...........!.............p.. ...............................................................................P.......X...........X...............................................................H....................B..@...................UPX0.....p..............................UPX1.............~..................@....rsrc...............................@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI57642\win32event.pyd

Download File

Process:	C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	6.799438399701252
Encrypted:	false
SSDEEP:	192:jNxmpzSvHU53Uon53eXqY1K/CjrELQc432Xq0FaNJhLkwcud2DH9VwGfctLj/t:Xmp2/UR95aP1pgEc432XBaNJawcudoDU
MD5:	796306BE7A1ABCFFB8853EE9CEB5BEAE
SHA1:	93762CF53958A3A99B674986FCF3C53C489133ED
SHA-256:	26E6D883E9E61BF872425526A9B8C7BB229C3B9D2F82BB3C0BF500660DBE1995
SHA-512:	5919A837FA1FCAEA91B14D02DA306928D5E523E4591DCA290422C9EB9BE15F2EE626A8379F5C953F2B08E7A6B2CD67618652B9EFA9ACE8ABD47A8BD7CD8C2F64
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........k..{8..{8..{8..8..{8..8..{8..8..{8 ..8..{8..z8..{8..8..{8..8..{8..8..{8Rich..{8................PE..L...T..[...........!.....0..............................................................................................P...`...\.......`...........................................................h...H...........................................UPX0....................................UPX1.....0......."..................@....rsrc................&..............@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI57642\win32evtlog.pyd

Download File

Process:	C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	19968
Entropy (8bit):	7.436093769968754
Encrypted:	false
SSDEEP:	384:Wo5FgP/m1xaGAONAt4ZvFqQggg3LgsAWUh31lA2W1waNJawcudoD7UGwGS:WmuP+TOONp5UQ/Zs8FlAfnbcuyD7UGwX
MD5:	317360BE68901D11F3D02AF1C151A4DC
SHA1:	570BF03BE1A737CF3D0CF3FC8E77261CF64E2051
SHA-256:	AC9C5C4BAA4DE19BDDF55313F29182F26EB80312C31266413672C61424A5C6E0
SHA-512:	25C25C23DD4FE1957CDFAD833D4570553C2627775008F3939525B6A3D1892F8B6CB7A9F20D454166338DF4DFC8A98306A1160016AE4CB2E9464944945AFA0A82
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........E..i+..i+..i+.E&...i+..;...i+..;...i+..;...i+.%...i+..i*.hi+..;...i+..;...i+..;...i+..;...i+.Rich.i+.................PE..L......[...........!.....P...................0...............................@.......................................4..T....3..P....0......................L5.......................................!..H.......................@...................UPX0....................................UPX1.....P.......D..................@....rsrc........0.......H..............@......................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI57642\win32service.pyd

Download File

Process:	C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	18432
Entropy (8bit):	7.513143648749714
Encrypted:	false
SSDEEP:	384:DvSTTJQxdZ3goCVdvSbw66apC1aNJawcudoD7U46:LSTT+1KF1onbcuyD7U46
MD5:	F23A62491BD945C050E3E1D13909E9E7
SHA1:	B8DAC4E00163533157A17E3B56D05E049A2375A2
SHA-256:	E52B5532A6764AAAE67DB557412B3F77EBDC8A14A72771A1C6414A83BB3FC15C
SHA-512:	52200CF9687752DB43BBAE703192C841694D5BD976FA56C0F25E0478CFB97681BC77677C1A8907167612DDF9FE6A561945FBEB0180022670AF97BF41B5B11766
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........[..[..[.....Z..E.-.Z..E.;.V..E.+.]...!s.\..[.....E.<.^..E.*.Z..E.,.Z..E.).Z..Rich[..........PE..L...q..[...........!.....@..........................................................................................8...T...............................................................................H...........................................UPX0....................................UPX1.....@.......>..................@....rsrc................B..............@..............................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Users\user\AppData\Local\Temp\_MEI57642\xmrig.exe

Download File

Process:	C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	1905664
Entropy (8bit):	7.9235088812144
Encrypted:	false
SSDEEP:	49152:jeXVwyagUSymDH29F4+rthFTo6YZfnH8:0VKgUSymDH29ttzToX1nc
MD5:	13BDD9CD9F7E51746172996262B5A873
SHA1:	3834F8179ABD7A827E927505F3C226AC8BBCF3EE
SHA-256:	4BF737B29FF521BC263EB1F2C1C5EA04B47470CCCD1BEAE245D98DEF389929BD
SHA-512:	49879918505D042312F20B2FC8310A8C4A58AA266ED1AB05E0481F7E11385DA0920CF9D756F842EB98E4394F14725385B74A99B38FC8A60222FA4CC873CB8040
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: C:\Users\user\AppData\Local\Temp\_MEI57642\xmrig.exe, Author: Joe Security
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....\.....................`...0>...Z..@>...[...@..........................`[............... ...................... X.x....][.<.....[..]....................................................Z.....................................................UPX0.....0>.............................UPX1.........@>.....................@....rsrc....`....[..`..................@...3.94.UPX!....E.G...@.`.Z.....$Z.$/.w.......&...'....1.f.=.@9....MZ..,......($..#...th.....82..tJ......$.,./,......+.l..Ho..~B.......:..6....L.=Dc..tm....-<h....f..<2...u..?PEl..u..Q....-l..~?....j..x.......]...........K".v.g?w...k+...yt`,........o..7>,. ..D$...............7......b..0.{..,.~...[U......WV.U.S..\|.0~....+..).b.........@....................5.o.E.....d....x....l0.9..9...3....o._..........=...u...;.v.f...R..0..`.lm...--...I...X/(......9J9..~?.v...&+.. P.kSn.l......LJ...

C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe

Download File

Process:	C:\Program Files\7-Zip\7zG.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6271268
Entropy (8bit):	7.992715224964703
Encrypted:	true
SSDEEP:	98304:RLVSThOfTCiFBXmfFs+JMHpCVoR8oMEOJ6Ty3RvX+jb5jC3ajz4F4VRc:HBfTCiUswVSLOJgyBGv5jGQW4VR
MD5:	A9D4007C9419A6E8D55805B8F8F52DE0
SHA1:	9F9D47EC6DD80BFCB4C3E0A1530B89D2D587C230
SHA-256:	5D9FE2735D4399D98E6E6A792B1FEB26D6F2D9A5D77944ECACB4B4837E5E5FCA
SHA-512:	DF727118E22BE2C36C14BCA3D084A7260F085BF528BFDC1DA8467BC5ADB654C34E20367ED733593810D9D54E9CA0137C015A4A34F09CB06D1145E60CBF16AECF
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........hZ............,Y......,Y..4...,Y..............................E:......................................Rich............................PE..L......[.........."..................y............@.......................................@.................................\...P......................................................................@............................................text...4........................... ..`.rdata..d...........................@..@.data...............................@....gfids..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................

C:\Users\user\HelpPane.exe

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6271268
Entropy (8bit):	7.992715224964703
Encrypted:	true
SSDEEP:	98304:RLVSThOfTCiFBXmfFs+JMHpCVoR8oMEOJ6Ty3RvX+jb5jC3ajz4F4VRc:HBfTCiUswVSLOJgyBGv5jGQW4VR
MD5:	A9D4007C9419A6E8D55805B8F8F52DE0
SHA1:	9F9D47EC6DD80BFCB4C3E0A1530B89D2D587C230
SHA-256:	5D9FE2735D4399D98E6E6A792B1FEB26D6F2D9A5D77944ECACB4B4837E5E5FCA
SHA-512:	DF727118E22BE2C36C14BCA3D084A7260F085BF528BFDC1DA8467BC5ADB654C34E20367ED733593810D9D54E9CA0137C015A4A34F09CB06D1145E60CBF16AECF
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........hZ............,Y......,Y..4...,Y..............................E:......................................Rich............................PE..L......[.........."..................y............@.......................................@.................................\...P......................................................................@............................................text...4........................... ..`.rdata..d...........................@..@.data...............................@....gfids..............................@..@.rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................

C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp

Download File

Process:	C:\Windows\System32\svchost.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	55
Entropy (8bit):	4.306461250274409
Encrypted:	false
SSDEEP:	3:YDQRWu83XfAw2fHbY:YMRl83Xt2f7Y
MD5:	DCA83F08D448911A14C22EBCACC5AD57
SHA1:	91270525521B7FE0D986DB19747F47D34B6318AD
SHA-256:	2B4B2D4A06044AD0BD2AE3287CFCBECD90B959FEB2F503AC258D7C0A235D6FE9
SHA-512:	96F3A02DC4AE302A30A376FC7082002065C7A35ECB74573DE66254EFD701E8FD9E9D867A2C8ABEB4C482738291B715D4965A0D2412663FDF1EE6CBC0BA9FBACA
Malicious:	false
Preview:	{"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\MpCmdRun.log

Download File

Process:	C:\Program Files\Windows Defender\MpCmdRun.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	modified
Size (bytes):	4926
Entropy (8bit):	3.2452118899970688
Encrypted:	false
SSDEEP:	48:FaqdF78F7B+AAHdKoqKFxcxkFiF7KaqdF7sW+AAHdKoqKFxcxkFiw:cEOB+AAsoJjykePEsW+AAsoJjyk8w
MD5:	26559AF09C31551089EC6BF0CD2451DE
SHA1:	E0FFECD2C1084A74DB7A5B37894DB220F86FB046
SHA-256:	A24252473EE267D6CD2F6761C61B18709FE28C92C3F44BE0F6305D8AA57134CD
SHA-512:	11740FE561262A448D6639DAF56A9E21C7658A520A21E9437C97B09301E4EEB0BEA2A81F7249E21FC251C6B597D5266CB7F837618770E56D9AEBB21A0015E281
Malicious:	false
Preview:	..........-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....M.p.C.m.d.R.u.n.:. .C.o.m.m.a.n.d. .L.i.n.e.:. .".C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.m.p.c.m.d.r.u.n...e.x.e.". .-.w.d.e.n.a.b.l.e..... .S.t.a.r.t. .T.i.m.e.:. .. F.r.i. .. O.c.t. .. 0.6. .. 2.0.2.3. .1.1.:.3.5.:.2.9.........M.p.E.n.s.u.r.e.P.r.o.c.e.s.s.M.i.t.i.g.a.t.i.o.n.P.o.l.i.c.y.:. .h.r. .=. .0.x.1.....W.D.E.n.a.b.l.e........................................ .W.S.C. .S.t.a.t.e. .I.n.f.o. ................................................................. .A.n.t.i.V.i.r.u.s.P.r.o.d.u.c.t. ..............................d.i.s.p.l.a.y.N.a.m.e. .=. .[.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.].....p.a.t.h.T.o.S.i.g.n.e.d.P.r.o.d.u.c.t.E.x.e. .=. .[.w.i.n.d.o.w.s.d.

C:\Windows\Temp\_MEI70482\Crypto.Cipher._AES.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	7.553130526678379
Encrypted:	false
SSDEEP:	384:50Q1C9jViLl7hDB6n/PtHU2wr8gj93KqmilaNJawcudoD7U:dC8LU/PBU8itClnbcuyD7U
MD5:	371397E80A55D432DA47311B8EF25317
SHA1:	71617777D6A2500D6464D7B394C8BE5F1E4E119E
SHA-256:	C1A900615C9500C46B9602C30C53F299290B03632208EF1152AF8830AB73AD17
SHA-512:	3139E2848ACF02CC8475449F213873D2C2B7196F6A55C70D2D8F8B487020387740364E5CA0AA584624D1B9B01B965146A2F0E15EEF34830C7C0ECBB8637DAE03
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........+\8.J2k.J2k.J2k.Ik.J2k...k.J2k...k.J2k...k.J2k.2.k.J2k.J3k.J2k...k.J2k...k.J2k...k.J2kRich.J2k........PE..L....4.S...........!.....@..........`...................................................................................D...........................................................................8...H...........................................UPX0....................................UPX1.....@.......:..................@...UPX2.................>..............@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Windows\Temp\_MEI70482\Include\pyconfig.h

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	C source, ASCII text
Category:	dropped
Size (bytes):	21321
Entropy (8bit):	5.345136937906198
Encrypted:	false
SSDEEP:	384:pGpFpaU1kgCw8r+MIP8Bj5DvVySh3awQBoerw8W+PYV0FGYfN/+:pGpFpb+IU99UShATrw8W+AKF/+
MD5:	BC185DE8B2437963368A85FDD9852951
SHA1:	1459F1428214FCCA7F203FB3A3AFF28E16EB9C1B
SHA-256:	8B130D901E0F83B55699D565F103F2F8F1B3A51712EBB4B9646EA517CC1F04D6
SHA-512:	918469D9A59FE059F3C7C93F34C8D2D07CB8A9BF5E953A1527922ED5C65FF4A2DF50BBC78ED9CE146BF3A1FB6F1763F061262FA4A937BEEEE1FEB8A99E31339E
Malicious:	false
Preview:	#ifndef Py_CONFIG_H.#define Py_CONFIG_H../* pyconfig.h. NOT Generated automatically by configure...This is a manually maintained version used for the Watcom,.Borland and Microsoft Visual C++ compilers. It is a.standard part of the Python distribution...WINDOWS DEFINES:.The code specific to Windows should be wrapped around one of.the following #defines..MS_WIN64 - Code specific to the MS Win64 API.MS_WIN32 - Code specific to the MS Win32 (and Win64) API (obsolete, this covers all supported APIs).MS_WINDOWS - Code specific to Windows, but all versions..MS_WINCE - Code specific to Windows CE.Py_ENABLE_SHARED - Code if the Python core is built as a DLL...Also note that neither "_M_IX86" or "_MSC_VER" should be used for.any purpose other than "Windows Intel x86 specific" and "Microsoft.compiler specific". Therefore, these should be very rare....NOTE: The following symbols are deprecated:.NT, USE_DL_EXPORT, USE_DL_IMPORT, DL_EXPORT, DL_IMPORT.MS_CORE_DLL...WIN32 is still required for the

C:\Windows\Temp\_MEI70482\Microsoft.VC90.CRT.manifest

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1050
Entropy (8bit):	5.382436822526041
Encrypted:	false
SSDEEP:	24:2dtn3mGv+zg4NnEN4XKHVJrMmV6LSWV5rcb3S:ch35+zg4i0KHVVdOmS
MD5:	BFB93876892CCA8E2AD0021585C34C8B
SHA1:	0DDE1B225C98825A09D8FF85F462571C9C862E35
SHA-256:	0D060ED7C25159B7B75F16D449963BFD639C15B3C5280BC7897403268C2B9F35
SHA-512:	FE70540B3B3FA88B32DFB2FF7406A3A9819E7862B850D871B932996BBEFFDBC70D7192D6E3196A8583B2DB756CA9CC278505AFBE585BA30EB1222D4F8BE15B7B
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v1">.. <noInheritable/>.. <assemblyIdentity name="Microsoft.VC90.CRT" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b" type="win32" version="9.0.30729.6161"/>.. <file hash="7021457b391b35606e708c69987e4b6f606609ee" hashalg="SHA1" name="msvcr90.dll"/>.. <file hash="88549dd3ce8eaa62ca8aad0e96ddd9fec2203628" hashalg="SHA1" name="msvcp90.dll"/>.. <file hash="65ef374affa5b48827e539b35b3275c201b41fc9" hashalg="SHA1" name="msvcm90.dll"/>.. <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">.. <application>.. <supportedOS Id="{1f676c76-80e1-4239-95bb-83d0f6d0da78}"/>.. <supportedOS Id="{4a2f28e3-53b9-4441-ba9c-d69d4a4a6e38}"/>.. <supportedOS Id="{e2011457-1546-43c5-a5fe-008deee3d3f0}"/>.. <supportedOS Id="{35138b9a-5d96-4fbd-8e2d-a2440225f93a}"/>.. <supportedOS Id="{8e0f7a12-bfb3-4fe8-b9a5-48fd50a15a9a}"/>..

C:\Windows\Temp\_MEI70482\_ctypes.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	37888
Entropy (8bit):	7.848484052157707
Encrypted:	false
SSDEEP:	768:pAXLisB/qV2nQnf33sWcCRWKZac3VWw6cLA3zReukhRnbcuyD7U:pAnBi8nQf3sYToclt6cLUCRnouy8
MD5:	6CB8B560EFBC381651D2045F1571D7C8
SHA1:	15283A7A467ADB7B6D7A7182F660DD783F90E483
SHA-256:	6456FEA123E04BCEC8A8EED26160E1DF5482E69D187D3E1A0C428995472AC134
SHA-512:	CA2958095E8E08B5EF05EC9DE15B7D1EB180923A40B90356DB56A124101C96D8E745001948B89DBE9D6B9CE3C2029F7E9EAF20C73FA1D410A821D6605830BFC0
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...................F.....W.....P......@..........Z.....A.....B...Rich..................PE..L...*>CX...........!............. .. ....0................................................@.........................<...........<.......................................................................H...........................................UPX0..... ..............................UPX1.........0......................@...UPX2................................@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Windows\Temp\_MEI70482\_hashlib.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	351744
Entropy (8bit):	7.996557276168139
Encrypted:	true
SSDEEP:	6144:Xh0byJKrtKOFhjnTtMoy8gpVI/xxWo/nX0NKOzyGFmJ559Vq2SeTsRgIIGYMowwZ:2bymtjF1TtMod/xweDK7FmJ5rLVYTIGm
MD5:	EE134421FBABEB565E4F3CA721331C2E
SHA1:	4B03BDD142C6A7BB6F74ABE968C5B76B63E06059
SHA-256:	7863E1BEDFE1FFC720B67B2EB7B3491DB9D2B8E56B5574E6A40FF90336B8DAFA
SHA-512:	D27FF65B6A8BF2E5E70D2865E72EEE6930E76C2A3990428C54FC998743D3C540C5C984B5D1429E8FFBE3D160AE1F6782CD6D3CA40822F81D2052BA168595D1FA
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......z.$.>.J.>.J.>.J.7...4.J.7...1.J.7...<.J.7...3.J.>.K..J.>.J...J.7...Y.J.7...?.J.7...?.J.Rich>.J.........................PE..L....>CX...........!.....`..........@K.......`...............................p............@.........................pa..L....`..p............................a.......................................W..H...........................................UPX0....................................UPX1.....`.......X..................@...UPX2.........`.......\..............@......................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Windows\Temp\_MEI70482\_socket.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	22016
Entropy (8bit):	7.706254752795193
Encrypted:	false
SSDEEP:	384:CCNDRisVUlkycq27U4r0rOc606B8k4gG35aiQjgO6OPjGL2e1ua7aNJawcudoD7P:v7VUcq27Jr0rOmbwE4jGLhohnbcuyD7B
MD5:	BE47363992C7DD90019276D35FA8DA76
SHA1:	CCF7EBBE829DA08EFD95A53D4BA0C0D4938F6169
SHA-256:	BE10254B111713BEF20A13D561DE61CA3C74A34C64DDC5B10825C64AB2C46734
SHA-512:	573F9111535A9A136FCAAA5C1A16C347F7327626768D849513D69C9848406B1002DCC5B8C17A291EF2E6519587533CA806018EE471A39D330F032A9E7E635EA7
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......AV2..7\..7\..7\..O..7\..O..7\..O..7\..7]..7\..O..7\..O..7\..O..7\..O..7\.Rich.7\.........................PE..L...X>CX...........!.....P..........0.....................................................@.............................d...................................d...........................................H...........................................UPX0....................................UPX1.....P.......P..................@...UPX2.................T..............@..............................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Windows\Temp\_MEI70482\_ssl.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	498688
Entropy (8bit):	7.996471896707535
Encrypted:	true
SSDEEP:	12288:FHNz5hZdNGitmdIA8byo3k4Ff9m3fTByPf6So+2RON1jjoS:P3fNTtmd2bkof43fTkR2gH
MD5:	68C3AD86E0A8833C29AD1BE10D3C025D
SHA1:	04488362814B2F3AE07C4E8DF8E45868D48B447F
SHA-256:	C236271B92A0F1D3304337F2E2444107F34D8E26272981F48C47DB347133566C
SHA-512:	BB2819D913033CC26DCD1E5CBF015DACDBF747D29C72BFD41BFE0D74BB77E51A61CF9BE4B67B6348938837125F1D0F80AF0AC33531E00CEA1585535952A22785
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........HFu.)(&.)(&.)(&.Q.&.)(&.Q.&.)(&.Q.&.)(&.)(&.)(&.))&9)(&.Q.&.)(&.Q.&.((&.Q.&.)(&.Q.&.)(&Rich.)(&................PE..L...q>CX...........!.................e....................................................@............................D............................................................................q..H...........................................UPX0....................................UPX1................................@...UPX2................................@..............................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Windows\Temp\_MEI70482\_win32sysloader.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	4.992693298555373
Encrypted:	false
SSDEEP:	192:t2VnGV7o5QUEZWm6Uk3fvf3X7THIL3YO+8I:tVU5QUEz6hfLTH98
MD5:	B4A567D80CCC08FB1C7FBB765847AFDA
SHA1:	B7FF2C68BA2887AAF5D029F41922E626C72B716D
SHA-256:	DBB0F9C499A710BBC8BCDE4ECC3577A6C9548262D6CE4434ED5A0708CBC787DD
SHA-512:	DDFEC25304BABE2DF55958F512F61AFD9AF88DDA499FE87931D17A9EEBF048449885A06A24BDDBC8604E11F07CED3C2ECE7F89C28290CAB5D1BF3816D22128DB
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......M.oC.............J.............................../........................Rich............PE..L......[...........!......................... ....;..........................`......................................P&..Z...\"..P....@..l....................P....... ..............................8!..@............ ...............................text...`........................... ..`.rdata....... ......................@..@.data........0......................@....rsrc...l....@......................@..@.reloc.......P......................@..B........................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\_MEI70482\back.jpg

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	47107
Entropy (8bit):	6.2032294727594985
Encrypted:	false
SSDEEP:	768:z9v1zJKaohy0Za9jwmrALVaka3sgBXHDizIdI9e2E:5v1zJ3nuswbLVgZsceO
MD5:	4AE078DD5085E97D3605F20DC079412A
SHA1:	1BABFCF2D374AE590970A3BE2E0E27BC04922546
SHA-256:	ED551536FF22587CDF7701A279E088EB370A4121E7A3FA1F3C8B121E767318A2
SHA-512:	BF163C63120CC5035087E4FF0035D9DAEB100218C62969AA6AA75D539108323295EB9CC28ABB0906C21CE8AEA25DACD1D0AAB3F3FE9C765D35348F0A7DA000AE
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......]....S......"...8.P....... ..`u...0.................................................... .....................................................................................................................................................UPX0..... ..............................UPX1.....P...0...H..................@...UPX2.................J..............@...3.93.UPX!.....3r#l..JW..CE...0..&.......U..S...........t?........'.........9.r.....t...'.....s.t&...$....,1....$6.....X[]._V`..u....tG..oo.t$lE_D$.....=......."....1......uG...c..4....uF1..e.[^]..o...f.L.!.+.y..........................8</....fp.v..U..$........../...........O/...e..]...........#3f.E.f.E......m.._..;.}e.......f.t"............U.1.3-...}..~2.k......!..........7{..+...7..\|...............G.:..S........w. ........ ..%+{.n..$...e.>.m....u..,(.....k_.'lk.C2$C&'(.5.`cv/..

C:\Windows\Temp\_MEI70482\bz2.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	35840
Entropy (8bit):	7.816957595202127
Encrypted:	false
SSDEEP:	768:IHCeOgq+kCitCVj5rz2Ya+r9qLYp9R9JoWnbcuyD7UiT:IHXr8CBd9NpfXxnouy8
MD5:	C9C00BC854A39E66B27787D188F9E8D7
SHA1:	21F20CF6C628B529DB4BDB853B679F9BF23590E3
SHA-256:	29520DF660A5BBD704B9106A6650A66E4F5766B904D05F97146668D41DBF5839
SHA-512:	8887B5CA542220CAC04D5A6A22A06F95DB560F4FE0F9A128CEB642ED9716ABCFFBA2146CCE682EB16C4DA3F423649A61904A73C4357D9FDBD5DDF606790199A3
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......}.S.9.=K9.=K9.=K..K:.=K0..K:.=K0..K7.=K0..K;.=K0..K>.=K9.<KS.=K0..K1.=K0..K8.=K0..K8.=KRich9.=K................PE..L...?>CX...........!.................W.......p............................................@..........................p..D....p...............................q.......................................c..H...........................................UPX0....................................UPX1................................@...UPX2.........p......................@..............................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Windows\Temp\_MEI70482\certifi\cacert.pem

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	284518
Entropy (8bit):	6.05114864026174
Encrypted:	false
SSDEEP:	6144:GriCfLXd1YU58fVuKlnm5plZ0PXCRrcMBbADwYC+MslE:GrdT3YZuz5LwCRrcMije
MD5:	DD2DD543395692705F7DDA0F5E7750FA
SHA1:	40D7CE60393978A29FB0E0B1E849658E48CF7887
SHA-256:	397B833E5ACF89A2709B964401A9ACA68D24B62349B72BBE38684E586AA07A27
SHA-512:	3BA0D6AD8B6838B04FBFDEBAD20EB5544C093BA592B517AA383708A34CE2BD215DB2BF010090251674DBCFD4EDA3C44F770C9FBF314304DE918D7E59E2596CF2
Malicious:	false
Preview:	.# Issuer: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Subject: CN=GlobalSign Root CA O=GlobalSign nv-sa OU=Root CA.# Label: "GlobalSign Root CA".# Serial: 4835703278459707669005204.# MD5 Fingerprint: 3e:45:52:15:09:51:92:e1:b7:5d:37:9f:b1:87:29:8a.# SHA1 Fingerprint: b1:bc:96:8b:d4:f4:9d:62:2a:a8:9a:81:f2:15:01:52:a4:1d:82:9c.# SHA256 Fingerprint: eb:d4:10:40:e4:bb:3e:c7:42:c9:e3:81:d3:1e:f2:a4:1a:48:b6:68:5c:96:e7:ce:f3:c1:df:6c:d4:33:1c:99.-----BEGIN CERTIFICATE-----.MIIDdTCCAl2gAwIBAgILBAAAAAABFUtaw5QwDQYJKoZIhvcNAQEFBQAwVzELMAkG.A1UEBhMCQkUxGTAXBgNVBAoTEEdsb2JhbFNpZ24gbnYtc2ExEDAOBgNVBAsTB1Jv.b3QgQ0ExGzAZBgNVBAMTEkdsb2JhbFNpZ24gUm9vdCBDQTAeFw05ODA5MDExMjAw.MDBaFw0yODAxMjgxMjAwMDBaMFcxCzAJBgNVBAYTAkJFMRkwFwYDVQQKExBHbG9i.YWxTaWduIG52LXNhMRAwDgYDVQQLEwdSb290IENBMRswGQYDVQQDExJHbG9iYWxT.aWduIFJvb3QgQ0EwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDaDuaZ.jc6j40+Kfvvxi4Mla+pIH/EqsLmVEQS98GPR4mdmzxzdzxtIK+6NiY6arymAZavp.xy0Sy6scTHAHoT0KMM0VjU/43dSMUBUc71DuxC73/OlS8pF94G3VNTCOXkNz

C:\Windows\Temp\_MEI70482\config.json

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1206
Entropy (8bit):	4.275024024623091
Encrypted:	false
SSDEEP:	24:pCKENTHgbeZlE1jCAh1RHEdOgNanAOSWSula:UKuTHgbYlUZHEdrNAla
MD5:	50CC63E4A1B24622CF61ED566B03E98F
SHA1:	92E5874785BB76E4579559BA70E116A6149349F5
SHA-256:	348F388C57DFB77B0CAACD8304725E10DC69A52EEC41AE695327787AD1853C92
SHA-512:	9A291DB9CF396687F3878590B1EB65CD7DA2E6FC3D6DE64A3B8CB08116B646371F432100E16B0ECD4F2916D05D67830F949AC2A3CA559A3A8D56616DF2BE98C7
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: C:\Windows\Temp\_MEI70482\config.json, Author: Joe Security
Preview:	{. "algo": "cryptonight",. "api": {. "port": 0,. "access-token": null,. "id": null,. "worker-id": null,. "ipv6": false,. "restricted": true. },. "autosave": true,. "av": 0,. "background": true,. "colors": true,. "cpu-affinity": null,. "cpu-priority": null,. "donate-level": 1,. "huge-pages": true,. "hw-aes": null,. "log-file": null,. "max-cpu-usage": 70,. "pools": [. {. "url": "xmr.crypto-pool.fr:3333",. "user": "47BD6QNfkWf8ZMQSdqp2tY1AdG8ofsEPf4mcDp1YB4AX32hUjoLjuDaNrYzXk7cQcoPBzAuQrmQTgNgpo6XPqSBLCnfsjaV",. "pass": "x",. "rig-id": null,. "nicehash": false,. "keepalive": false,. "variant": -1,. "enabled": true,. "tls": false,. "tls-fingerprint": null. }. ],. "print-time": 60,. "retries": 5,. "retry-pause": 5,. "safe": false,. "threads": [. {.

C:\Windows\Temp\_MEI70482\ftpcrack.exe.manifest

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1345
Entropy (8bit):	5.283640732769631
Encrypted:	false
SSDEEP:	24:2dtn3ZoWglN2v+zg4NnEN4XKDmc0+bLg4fNRme5rcb3S:ch3DgX2+zg4i0KDmJ+bLg4VRmemS
MD5:	B5DEA49B86C5BB5D9CD8D64A09F70065
SHA1:	487EF676EBD244EBC3CF197F70DA7A5E393FB96E
SHA-256:	78B1160F6ADAB34D144AD19A0F4B83F83453F1E18460BBDFBE17AD354B62AF7D
SHA-512:	1B5914F4C52F47A33C57F5F6428482E6766099BF43D4E8616CE4AABC4A917C24B2E0C98C841F0D7E7B8A202F40FF960885535539BF70CC7C7ED8687C7ECE010C
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<assembly manifestVersion="1.0" xmlns="urn:schemas-microsoft-com:asm.v1">.. <assemblyIdentity name="ftpcrack" processorArchitecture="x86" type="win32" version="1.0.0.0"/>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity name="Microsoft.VC90.CRT" processorArchitecture="x86" publicKeyToken="1fc8b3b9a1e18e3b" type="win32" version="9.0.30729.6161"/>.. <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"/>.. </dependentAssembly>.. </dependency>.. <dependency>.. <dependentAssembly>.. <assemblyIdentity language="*" name="Microsoft.Windows.Common-Controls" processorArchitecture="x86" publicKeyToken="6595b64144ccf1df" type="win32" version="6.0.0.0"/>.. <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1"/>.. </dependentAssembly>.. </dependency>.. <compatibility xmlns="urn:schemas-microsoft-com:compatibility.v1">.. <application>.. <supportedOS Id="{1f676c76-80e

C:\Windows\Temp\_MEI70482\httplib2\cacerts.txt

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	135546
Entropy (8bit):	6.039525643754334
Encrypted:	false
SSDEEP:	3072:FVrovvEjVplrqHSdX+zpfQq7ZiyZOF5mdFENAKHn1HtYfei8i31MCSjfpVpKbIcf:3cmHuBfaUFENX3YfEl3plcs+
MD5:	14BA876BA2515A25BBB511F24BF06653
SHA1:	291DCDEE67E880B21FD7001CB8350C3ECEE4CAC8
SHA-256:	2039836A620F956EC094EAAE7C9B41A04C76F31130898B11014D9E83C905F0DE
SHA-512:	5035F82DF06308A14F6626C54382B3AB34B6D664C8394B48F75275F69DCC2B93266D843B51F0B586E5F12FCD70FE3660B5B08AFC20738DF6D8C812592C0D71E4
Malicious:	false
Preview:	# Issuer: CN=GTE CyberTrust Global Root O=GTE Corporation OU=GTE CyberTrust Solutions, Inc..# Subject: CN=GTE CyberTrust Global Root O=GTE Corporation OU=GTE CyberTrust Solutions, Inc..# Label: "GTE CyberTrust Global Root".# Serial: 421.# MD5 Fingerprint: ca:3d:d3:68:f1:03:5c:d0:32:fa:b8:2b:59:e8:5a:db.# SHA1 Fingerprint: 97:81:79:50:d8:1c:96:70:cc:34:d8:09:cf:79:44:31:36:7e:f4:74.# SHA256 Fingerprint: a5:31:25:18:8d:21:10:aa:96:4b:02:c7:b7:c6:da:32:03:17:08:94:e5:fb:71:ff:fb:66:67:d5:e6:81:0a:36.-----BEGIN CERTIFICATE-----.MIICWjCCAcMCAgGlMA0GCSqGSIb3DQEBBAUAMHUxCzAJBgNVBAYTAlVTMRgwFgYD.VQQKEw9HVEUgQ29ycG9yYXRpb24xJzAlBgNVBAsTHkdURSBDeWJlclRydXN0IFNv.bHV0aW9ucywgSW5jLjEjMCEGA1UEAxMaR1RFIEN5YmVyVHJ1c3QgR2xvYmFsIFJv.b3QwHhcNOTgwODEzMDAyOTAwWhcNMTgwODEzMjM1OTAwWjB1MQswCQYDVQQGEwJV.UzEYMBYGA1UEChMPR1RFIENvcnBvcmF0aW9uMScwJQYDVQQLEx5HVEUgQ3liZXJU.cnVzdCBTb2x1dGlvbnMsIEluYy4xIzAhBgNVBAMTGkdURSBDeWJlclRydXN0IEds.b2JhbCBSb290MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCVD6C28FCc6HrH.iM3dFw4usJTQGz0

C:\Windows\Temp\_MEI70482\msvcm90.dll

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	225280
Entropy (8bit):	6.034911041879855
Encrypted:	false
SSDEEP:	3072:6yZeocziNzMLSMOYscmLWbAX+dP4Upoh86Goao14JU87/amFYw8fF01OyASLE:PYOMqc8oAXGP4Upoe6fa3/amiX2Oyp
MD5:	D34A527493F39AF4491B3E909DC697CA
SHA1:	AFEE32FCD9CE160680371357A072F58C5F790D48
SHA-256:	7A74DA389FBD10A710C294C2E914DC6F18E05F028F07958A2FA53AC44F0E4B90
SHA-512:	0DABC5455EB02601D7C40A9C49B3ADE750B1118934EF3785FB314FA313437BC02B243571ABA25F1661A69DCEA36838530C12762A2E6602D14A9B03770A82CCA6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........;...h...h...h..ah...h1.dh...h..gh...h...h...h.-.h...h...h...h..qh...h..vh...h..`h...h..fh...h..ch...hRich...h........................PE..L.....M...........!.....:..........Z........P....?x.........................0......^.....@......................... 3..4....&..d...............................d...P...............................H...@...............(...........p...H............text...T9.......:.................. ..`.data........P.......>..............@....rsrc................H..............@..@.reloc...#.......$...L..............@..B........................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\_MEI70482\msvcp90.dll

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	335184
Entropy (8bit):	6.343962999919931
Encrypted:	false
SSDEEP:	6144:fmIIPLSg4p0t4271NWoSYEMS6VhUgiW6QR7t5183Ooc8SHkC2eQ:fmIeLSgo0S271QoSQhUgiW6QR7t51831
MD5:	92EA2DB0E788894C43753C550216A886
SHA1:	DA8C7A178BA0CA80D321666F5642A7436B640602
SHA-256:	9694756F43B20ABC50F95646C54E9E36CD6EDF8EED3DB846064567399F4E7566
SHA-512:	90E72A68C7267E8D0986A75247AE7B2339E4C2A981D686342B2EF90B1FCF9695B558D0BD5932F7C53524E02CC664B974BA76783FDE919B24EB36795DB3300BA6
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........#%..Mv..Mv..Mv.66v..Mv...v..Mv..Lv:.Mv...v..Mv...v..Mv...v..Mv...v..Mv...v..Mv...v..Mv...v..MvRich..Mv........................PE..L.....M...........!................P.... ...0....Hx.........................0............@.........................p4..,....3.......0.......................&......................................()..H...........................................UPX0....................................UPX1......... ......................@....rsrc........0......................@..............................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Windows\Temp\_MEI70482\msvcr90.dll

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	250192
Entropy (8bit):	7.900323441964523
Encrypted:	false
SSDEEP:	6144:EODM4c99eLswEOva4g4fpgMf4FfIoSNjbZdGJCJLuEyKIqqOmiqsEqmQI0wye/c:EODM1HagYaMf4FAoSNjHmHyyc
MD5:	199D34B03C7D0EB804A6D9869184B8D4
SHA1:	03148854519D0970C1BBDC089D3E8DE1AED61C47
SHA-256:	DF86421E354F817607F2BAFC9188569242FCF9DD564B28F3E2915C86A0BA1F54
SHA-512:	E4269CA993393422A90231DAABD390771A635EEB0817A9D00DCCEF496372BB4B57B615529F26A2E8132BDE825CDACA07D965D207421C02EA6471DA214354361E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..................6.........!.R...7.....&.....0.....6.....3...Rich..........PE..L.....M...........!.....@.......0..0f...@........Rx......................................@.........................@....\|.....x....................................................................r..H...........................................UPX0.....0..............................UPX1.....@...@...4..................@....rsrc................8..............@..............................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Windows\Temp\_MEI70482\netifaces.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	7.145184945732974
Encrypted:	false
SSDEEP:	192:uKqSCMOF44HPPtLm+9a3ozToPmzYUaFaNJhLkwcud2DH9VwGfctH:ubS9s44vPtLR9aUPJ+aNJawcudoD7U
MD5:	C7807680A69196C3EE66C4CFB3E271AC
SHA1:	D3EA74C9E3B810C6A1EE4296B97E20F2F45C9461
SHA-256:	1A6C57AC8031582477B1D3463A65B6EB006EEA704E27C8C4B812B99EA910428D
SHA-512:	A5D893132AD889E98B434DA7FD5CA377AFB1800FD8D3230CCED5E9FDE576FCEC943DD22FA48810BA6D93C510EBAA8AC5A94EC1B9D639FD6C533C5BBD4737CF15
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......FL...-...-...-...U...-...U...-...-..J-...U...-...U...-...U...-...U...-..Rich.-..........................PE..L...,.-\...........!.....0.......P...x...`..........................................................................4...P.......4...................................................................p...H...........................................UPX0.....P..............................UPX1.....0...`...&..................@...UPX2.................*..............@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Windows\Temp\_MEI70482\perfmon.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	6.948652527580434
Encrypted:	false
SSDEEP:	192:0xeSnTQM3MsUjU+viJBctKiyiLKPfFaNJhLkwcud2DH9VwGfct0XlpoI6J:0xe4R3scJBcMWYdaNJawcudoD7UmlSI
MD5:	EE813500A441B5FFDACD853E95BEE669
SHA1:	7F05F1493380AF3FE08F55524F6FF90C47C0CC4D
SHA-256:	AC491704AF920BE0E503F0243D2D371E230622E213E9F082347B52C0A7B009C2
SHA-512:	060D079A93ADD067EB062D2B1CB9977719BE68AE1223B0219DBB14CC9C6C66FF47D9929945636B577BC7F1BB84D5500B88ACD5F7BF636CC63BD4C88534AF724E
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........0...c...c...c..9c...c.gc...c.qc...c.ac...c...c...c.vc...c.`c...c.cc...cRich...c................PE..L...C..[...........!.....0.......`.......p........n.................................................................t...L...P...$.......P...............................................................H...........................................UPX0.....`..............................UPX1.....0...p..."..................@....rsrc................&..............@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Windows\Temp\_MEI70482\psutil._psutil_windows.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	25600
Entropy (8bit):	7.700665778298437
Encrypted:	false
SSDEEP:	384:3qUURhEUVDrn5EMvG04YMJIoa67+5pGr0qLWMAUm7NFYGz45/+aNJawcudoD7ULt:aUjUXBjPAGHqLm7N/z4dnbcuyD7UL
MD5:	2FC800FCC46A597921C2ED447AEB09AC
SHA1:	72004227E5C60C8460F835A170798AA22861B79E
SHA-256:	2E4AD3D08118DA77C928C4614BFECB34397CFAF53F5D46D7C7E5F1DA3172C1F1
SHA-512:	A17022B364615B45A1873AEA0DE922A2988E4D75A8F4E63ECB9CA7DD46263E684B1F28B82BD77B046BBE2AD03CE65C5DACF98EACCAE861A30F137E0118A87225
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......E.6...X...X...X......X......X......X...Y...X......X......X......X.Rich..X.........PE..L...;b.\...........!.....`...................0...............................@.......................................2..\....0...............................2.......................................*..H...........................................UPX0....................................UPX1.....`.......\..................@...UPX2.........0.......`..............@......................................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Windows\Temp\_MEI70482\pyexpat.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	52736
Entropy (8bit):	7.904524114628073
Encrypted:	false
SSDEEP:	1536:omazZr7ECJ0E6kFg85F/rFi2LU60XZlofDYq0nouy8:9aFr9mE6kF7hrcCU6Qlewout
MD5:	AD560121EFD8E249FC3414200D98F75F
SHA1:	73040F9BC04E733A85DA00E364EF85583F505636
SHA-256:	0BEB3B16F9A11F93137365A1179D2062A414ADABA337BCAC05A083A921775B50
SHA-512:	6DA2B01773DCE658DCFD9219DD8D093F60EAFF669ED600C9A62EFC39FB3E362F051A499FAC85777C1B8F364B1AD2E134E080CAE720FC5477711A7ED7F191A5C7
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........2.\...\...\......\......\......\......\...]..\......\......\......\.Rich..\.................PE..L...4>CX...........!................Pj....................................................@............................L...................................$.......................................(v..H...........................................UPX0....................................UPX1................................@...UPX2................................@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Windows\Temp\_MEI70482\python27.dll

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	898048
Entropy (8bit):	7.990256946915668
Encrypted:	true
SSDEEP:	24576:I0cNEHSDC9XmwbTV/mv+nQW0mj7IaqtsoejWg3c:jHhmhmI9eo63
MD5:	8C44826A640B3CF0B32B0258C65FEE07
SHA1:	E3F9FE6366D0876BFA8B903B20D2ACF06416F1BC
SHA-256:	FBAD053D962BAC96865AC3372958D697711800FDC46F36C87011BB5E89026614
SHA-512:	884E2C01C088B9AE86D4605FED1CF8E9B17F99CF887EFC5644F4A91959ECD89148CCA3E9FDAA6AB9E8C4DFD2D61DBDFD442A95B13DAB7E5CD027B4782D473355
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......#..^g.y.g.y.g.y....~.y.n...l.y.n...i.y.n...e.y.n...l.y.g.x.[.y.n.....y.n...f.y.n...f.y.n...f.y.Richg.y.................PE..L... >CX...........!.....0.......0...Z..@...p...............................+...........@.........................pz.t\|..,y.D....p.,...........................................................f.H...........................................UPX0.....0..............................UPX1.....0...@...(..................@....rsrc........p......,..............@......................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Windows\Temp\_MEI70482\pywintypes27.dll

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	53248
Entropy (8bit):	7.425128830518154
Encrypted:	false
SSDEEP:	1536:eTwUerP24SfDRd2TACkwqyfnouy81cSPDuwQ0:eTleODRd2ew/Pout1cSru
MD5:	07B436BFA1C7B4FFC21FB39358158060
SHA1:	7F5A47CDAB9A7D93BBBD204CEDFFCA61D3F80C84
SHA-256:	82C2926CB03A04392FA479801D505E2A387446BCA978FF930177121DB2FDB461
SHA-512:	13EBCB83F478C859CA808003933769B84290E108648B69F33043653263C5B4BD37ED5CA8D521B46A1D9122EB232F7E5D05A25E16F250D5573CF85CD5CDEFB2EF
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......qz.Y5...5...5....Tz.7...+Iy.6...+Io.8.....".4...+I..1.....'.>...5.......+Ih.$...+I~.4...+I}.4...Rich5...................PE..L...:..[...........!.........P............... ....z..........................p.......................................%..PJ..h#....... ..h...................Po..........................................H...........................................UPX0....................................UPX1.............\|..................@....rsrc....P... ...P..................@......................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Windows\Temp\_MEI70482\select.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	9216
Entropy (8bit):	7.003407892450472
Encrypted:	false
SSDEEP:	192:qhogHS4TaqZXRQKKXYVEvySc3IFaNJhLkwcud2DH9VwGfctX:qhLS4TaqxhfCHc38aNJawcudoD7U
MD5:	57EB00056AC8C38CD4F3153FB9507F13
SHA1:	DDEE8E74FCC81B6301145F27C0F1CCF4B9185E1C
SHA-256:	7B90EC138AC8415D9B747612063D19147FEC2B1E99DE97C3B5636E8CA40B346E
SHA-512:	05F7EF6BD065D7DB3F41DFA95187FA40A14F58FA5D4705F2DF5982DB18EEB6D4E93C473D05932436BF645E76E0B23532867011E92EF953EC247B55648ED9C6EF
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........i)...z...z...z...z...z...z...z...z...z...z...z...z...z...z...z...z...z...z...zRich...z........PE..L...5>CX...........!..... .......P..pq...`................................................@.............................H...................................H.......................................P}..H...........................................UPX0.....P..............................UPX1..... ...`......................@...UPX2................."..............@..............................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Windows\Temp\_MEI70482\servicemanager.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	16384
Entropy (8bit):	7.2228399102917615
Encrypted:	false
SSDEEP:	384:FVtYwprbL7fLBtdYzKNg13ZOPaNJawcudoD7UfMX:vawBbLFYzKNg1plnbcuyD7UfMX
MD5:	6A95BCF45E4BE23CC2634EF5BAD17660
SHA1:	7D13B791588CB800C2ADD75FF8E74C3C493A8143
SHA-256:	60DA4B4E628B7DC1115615128AC554AEB29B50A61629AD5AEEB5CC9D2BD86202
SHA-512:	D3C80B025647444F42D42E82CAD50C4383728F7F8C9E16AA9D87450CA864B0B97B5F8F47E80328A4A2B67CE7D06C9A8F1DAE8C5B3C798DE1B2A50164161E69C8
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........o....K...K...K...K...K...K...K...K...KR..K...K...K...K...K...K...K...K...K...K...K...KRich...K........................PE..L......[...........!.....@........................}.....................................................................\...........................................................................h...H...........................................UPX0....................................UPX1.....@.......4..................@....rsrc................8..............@......................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Windows\Temp\_MEI70482\unicodedata.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	181760
Entropy (8bit):	7.989160583257678
Encrypted:	false
SSDEEP:	3072:Rfe2dO8KvTdjKGssSXwgtXZT32qenyxHBKs//4wd3RP29sZ6lI883out:Rfe2bKvEw+k2kw/4wZRPS3coS
MD5:	9A465CFAA788E29E7B1366C012EBC75C
SHA1:	10D9C49BB6652D9B04E17608D9ED35B036112647
SHA-256:	35C84D824DB175DD71046806A59BC711021ABCE04698FA304B1E2A9855E50A9C
SHA-512:	31BEE259C78CEB1E4F5C52E7B2CBD0EB62A071FC9C748DF47AB824E383EFDC3B218168700341B96D139DABFB3E4D7644341F22E52982B7C7F135A9E35B300B00
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......{H..?).?).?).6QE.=).6QS.1).6QT.=).6QC.8).?)..).6QY.>).6QB.>).6QA.>).Rich?).................PE..L...6>CX...........!......................................................................@.............................T...................................,.......................................x...H...........................................UPX0....................................UPX1................................@...UPX2................................@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Windows\Temp\_MEI70482\win32api.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	34816
Entropy (8bit):	7.794879575971907
Encrypted:	false
SSDEEP:	768:etKTLIw2eRBsqBvKddE/wW68vEvfW2qmSOyinbcuyD7Uqmx:DCeLrGderDH2FXyinouy8qmx
MD5:	42C475231F4835BB1A5F94B0D3DA4520
SHA1:	FCFAE296DD10C92D973A57D61BBF5C0F4A15ED6B
SHA-256:	87CEEB1B7586DB730F48988A07018F9C8AF57934FF7F173A869542207F46B0F1
SHA-512:	D1A699B8497E8843F990F6F719A904A7751FE2A9404CB195BE2D94341728A7372CD93D379B576E6031980E1DA53F2336805C6BF59E799B63565CD63D4931C02A
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......[-..L...L...L.......L.......L.......L...J..L...L..UM.......L.......L.......L..Rich.L..................PE..L......[...........!.............p.. ...............................................................................P.......X...........X...............................................................H....................B..@...................UPX0.....p..............................UPX1.............~..................@....rsrc...............................@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Windows\Temp\_MEI70482\win32event.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	11264
Entropy (8bit):	6.799438399701252
Encrypted:	false
SSDEEP:	192:jNxmpzSvHU53Uon53eXqY1K/CjrELQc432Xq0FaNJhLkwcud2DH9VwGfctLj/t:Xmp2/UR95aP1pgEc432XBaNJawcudoDU
MD5:	796306BE7A1ABCFFB8853EE9CEB5BEAE
SHA1:	93762CF53958A3A99B674986FCF3C53C489133ED
SHA-256:	26E6D883E9E61BF872425526A9B8C7BB229C3B9D2F82BB3C0BF500660DBE1995
SHA-512:	5919A837FA1FCAEA91B14D02DA306928D5E523E4591DCA290422C9EB9BE15F2EE626A8379F5C953F2B08E7A6B2CD67618652B9EFA9ACE8ABD47A8BD7CD8C2F64
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........k..{8..{8..{8..8..{8..8..{8..8..{8 ..8..{8..z8..{8..8..{8..8..{8..8..{8Rich..{8................PE..L...T..[...........!.....0..............................................................................................P...`...\.......`...........................................................h...H...........................................UPX0....................................UPX1.....0......."..................@....rsrc................&..............@......................................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Windows\Temp\_MEI70482\win32evtlog.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	19968
Entropy (8bit):	7.436093769968754
Encrypted:	false
SSDEEP:	384:Wo5FgP/m1xaGAONAt4ZvFqQggg3LgsAWUh31lA2W1waNJawcudoD7UGwGS:WmuP+TOONp5UQ/Zs8FlAfnbcuyD7UGwX
MD5:	317360BE68901D11F3D02AF1C151A4DC
SHA1:	570BF03BE1A737CF3D0CF3FC8E77261CF64E2051
SHA-256:	AC9C5C4BAA4DE19BDDF55313F29182F26EB80312C31266413672C61424A5C6E0
SHA-512:	25C25C23DD4FE1957CDFAD833D4570553C2627775008F3939525B6A3D1892F8B6CB7A9F20D454166338DF4DFC8A98306A1160016AE4CB2E9464944945AFA0A82
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........E..i+..i+..i+.E&...i+..;...i+..;...i+..;...i+.%...i+..i*.hi+..;...i+..;...i+..;...i+..;...i+.Rich.i+.................PE..L......[...........!.....P...................0...............................@.......................................4..T....3..P....0......................L5.......................................!..H.......................@...................UPX0....................................UPX1.....P.......D..................@....rsrc........0.......H..............@......................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Windows\Temp\_MEI70482\win32service.pyd

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	18432
Entropy (8bit):	7.513143648749714
Encrypted:	false
SSDEEP:	384:DvSTTJQxdZ3goCVdvSbw66apC1aNJawcudoD7U46:LSTT+1KF1onbcuyD7U46
MD5:	F23A62491BD945C050E3E1D13909E9E7
SHA1:	B8DAC4E00163533157A17E3B56D05E049A2375A2
SHA-256:	E52B5532A6764AAAE67DB557412B3F77EBDC8A14A72771A1C6414A83BB3FC15C
SHA-512:	52200CF9687752DB43BBAE703192C841694D5BD976FA56C0F25E0478CFB97681BC77677C1A8907167612DDF9FE6A561945FBEB0180022670AF97BF41B5B11766
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........[..[..[.....Z..E.-.Z..E.;.V..E.+.]...!s.\..[.....E.<.^..E.*.Z..E.,.Z..E.).Z..Rich[..........PE..L...q..[...........!.....@..........................................................................................8...T...............................................................................H...........................................UPX0....................................UPX1.....@.......>..................@....rsrc................B..............@..............................................................................................................................................................................................................................................................................................................................................................................................3.94.UPX!....

C:\Windows\Temp\_MEI70482\xmrig.exe

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	1905664
Entropy (8bit):	7.9235088812144
Encrypted:	false
SSDEEP:	49152:jeXVwyagUSymDH29F4+rthFTo6YZfnH8:0VKgUSymDH29ttzToX1nc
MD5:	13BDD9CD9F7E51746172996262B5A873
SHA1:	3834F8179ABD7A827E927505F3C226AC8BBCF3EE
SHA-256:	4BF737B29FF521BC263EB1F2C1C5EA04B47470CCCD1BEAE245D98DEF389929BD
SHA-512:	49879918505D042312F20B2FC8310A8C4A58AA266ED1AB05E0481F7E11385DA0920CF9D756F842EB98E4394F14725385B74A99B38FC8A60222FA4CC873CB8040
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: C:\Windows\Temp\_MEI70482\xmrig.exe, Author: Joe Security
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....\.....................`...0>...Z..@>...[...@..........................`[............... ...................... X.x....][.<.....[..]....................................................Z.....................................................UPX0.....0>.............................UPX1.........@>.....................@....rsrc....`....[..`..................@...3.94.UPX!....E.G...@.`.Z.....$Z.$/.w.......&...'....1.f.=.@9....MZ..,......($..#...th.....82..tJ......$.,./,......+.l..Ho..~B.......:..6....L.=Dc..tm....-<h....f..<2...u..?PEl..u..Q....-l..~?....j..x.......]...........K".v.g?w...k+...yt`,........o..7>,. ..D$...............7......b..0.{..,.~...[U......WV.U.S..\|.0~....+..).b.........@....................5.o.E.....d....x....l0.9..9...3....o._..........=...u...;.v.f...R..0..`.lm...--...I...X/(......9J9..~?.v...&+.. P.kSn.l......LJ...

C:\Windows\Temp\config

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	34
Entropy (8bit):	4.006436738245532
Encrypted:	false
SSDEEP:	3:KUc+TQmb4D3KN0:KUc+5cDf
MD5:	FA9A2993C7D47BD87FCDD7810A417C9D
SHA1:	2D2B7AEB5F8D39B283ADE33AC0BD7BC4CD582530
SHA-256:	F6B5EDA891BCA6AFDCA2D6068FF33309306456A4199D3024FF793427A39CFB98
SHA-512:	B666DAC7EE7E66E14245AC4BC35E51E51A4CF44C9481087AD3E40D10B478FF4B1E9FAE6F59E8F50DD0FE4E9F286907876217CF71BB9DC5F0E5C9C625FF724D5B
Malicious:	true
Preview:	1619016288..[rn]GET[/rn][sv]0[/sv]

C:\Windows\Temp\config.json

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1206
Entropy (8bit):	4.275024024623091
Encrypted:	false
SSDEEP:	24:pCKENTHgbeZlE1jCAh1RHEdOgNanAOSWSula:UKuTHgbYlUZHEdrNAla
MD5:	50CC63E4A1B24622CF61ED566B03E98F
SHA1:	92E5874785BB76E4579559BA70E116A6149349F5
SHA-256:	348F388C57DFB77B0CAACD8304725E10DC69A52EEC41AE695327787AD1853C92
SHA-512:	9A291DB9CF396687F3878590B1EB65CD7DA2E6FC3D6DE64A3B8CB08116B646371F432100E16B0ECD4F2916D05D67830F949AC2A3CA559A3A8D56616DF2BE98C7
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: C:\Windows\Temp\config.json, Author: Joe Security
Preview:	{. "algo": "cryptonight",. "api": {. "port": 0,. "access-token": null,. "id": null,. "worker-id": null,. "ipv6": false,. "restricted": true. },. "autosave": true,. "av": 0,. "background": true,. "colors": true,. "cpu-affinity": null,. "cpu-priority": null,. "donate-level": 1,. "huge-pages": true,. "hw-aes": null,. "log-file": null,. "max-cpu-usage": 70,. "pools": [. {. "url": "xmr.crypto-pool.fr:3333",. "user": "47BD6QNfkWf8ZMQSdqp2tY1AdG8ofsEPf4mcDp1YB4AX32hUjoLjuDaNrYzXk7cQcoPBzAuQrmQTgNgpo6XPqSBLCnfsjaV",. "pass": "x",. "rig-id": null,. "nicehash": false,. "keepalive": false,. "variant": -1,. "enabled": true,. "tls": false,. "tls-fingerprint": null. }. ],. "print-time": 60,. "retries": 5,. "retry-pause": 5,. "safe": false,. "threads": [. {.

C:\Windows\Temp\link.txt

Download File

Process:	C:\Users\user\HelpPane.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has command line arguments, Archive, ctime=Sun May 26 13:48:06 2019, mtime=Sun Jun 2 09:48:11 2019, atime=Sun May 26 13:48:06 2019, length=3933296, window=hide
Category:	dropped
Size (bytes):	1952
Entropy (8bit):	3.3086042907696407
Encrypted:	false
SSDEEP:	24:8NqDOlC82vUKJU1+IMJ941y2bY6HoIab/C8fn1vURXTUmu3+IMmmt:8aVnvZJUdMs1yE3HVabhlUymu3fMm
MD5:	3A9349AF006440C7E0DA677724551239
SHA1:	70075BB3B999E825E328302B462DEB1AA337B663
SHA-256:	00401651AF3194EDE5157004B6DBE1EDF836A94CA182221F2C034201FE55E4DC
SHA-512:	588D9EA0C7D770ADF1BE9C887EF2F2CDB42A7205D2DD1288CDA193CD1D99EB689B5DC68765E17724F093EF312B7769290968610C4C6F2BE0432D52D483FF15C0
Malicious:	false
Preview:	L..................F.... ....">.......Q.0.....@.....p.<..........................P.O. .:i.....+00.../C:\...................V.1......N....Windows.@......L...N(V.........................._J..W.i.n.d.o.w.s.....f.2.p.<..N.v .explorer.exe..J......N.v.N.V....Q...........\.........f...e.x.p.l.o.r.e.r...e.x.e.......M...............4.......L...........d.{.....Windows.C:\Windows\explorer.exe..#.....\.....\.....\.....\.....\.W.i.n.d.o.w.s.\.e.x.p.l.o.r.e.r...e.x.e...P.h.o.t.o...s.c.r.........%SystemRoot%\explorer.exe...........................................................................................................................................................................................................................................%.S.y.s.t.e.m.R.o.o.t.%.\.e.x.p.l.o.r.e.r...e.x.e.........................................................................................................................................................................................................

C:\Windows\Temp\xmrig.exe

Download File

Process:	C:\Windows\SysWOW64\cmd.exe
File Type:	PE32 executable (console) Intel 80386 (stripped to external PDB), for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	1905664
Entropy (8bit):	7.9235088812144
Encrypted:	false
SSDEEP:	49152:jeXVwyagUSymDH29F4+rthFTo6YZfnH8:0VKgUSymDH29ttzToX1nc
MD5:	13BDD9CD9F7E51746172996262B5A873
SHA1:	3834F8179ABD7A827E927505F3C226AC8BBCF3EE
SHA-256:	4BF737B29FF521BC263EB1F2C1C5EA04B47470CCCD1BEAE245D98DEF389929BD
SHA-512:	49879918505D042312F20B2FC8310A8C4A58AA266ED1AB05E0481F7E11385DA0920CF9D756F842EB98E4394F14725385B74A99B38FC8A60222FA4CC873CB8040
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: C:\Windows\Temp\xmrig.exe, Author: Joe Security
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....\.....................`...0>...Z..@>...[...@..........................`[............... ...................... X.x....][.<.....[..]....................................................Z.....................................................UPX0.....0>.............................UPX1.........@>.....................@....rsrc....`....[..`..................@...3.94.UPX!....E.G...@.`.Z.....$Z.$/.w.......&...'....1.f.=.@9....MZ..,......($..#...th.....82..tJ......$.,./,......+.l..Ho..~B.......:..6....L.=Dc..tm....-<h....f..<2...u..?PEl..u..Q....-l..~?....j..x.......]...........K".v.g?w...k+...yt`,........o..7>,. ..D$...............7......b..0.{..,.~...[U......WV.U.S..\|.0~....+..).b.........@....................5.o.E.....d....x....l0.9..9...3....o._..........=...u...;.v.f...R..0..`.lm...--...I...X/(......9J9..~?.v...&+.. P.kSn.l......LJ...

\Device\ConDrv

Download File

Process:	C:\Windows\SysWOW64\netsh.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	313
Entropy (8bit):	4.971939296804078
Encrypted:	false
SSDEEP:	6:/ojfKsUTGN8Ypox42k9L+DbGMKeQE+vigqAZs2E+AYeDPO+Yswyha:wjPIGNrkHk9iaeIM6ADDPOHyha
MD5:	689E2126A85BF55121488295EE068FA1
SHA1:	09BAAA253A49D80C18326DFBCA106551EBF22DD6
SHA-256:	D968A966EF474068E41256321F77807A042F1965744633D37A203A705662EC25
SHA-512:	C3736A8FC7E6573FA1B26FE6A901C05EE85C55A4A276F8F569D9EADC9A58BEC507D1BB90DBF9EA62AE79A6783178C69304187D6B90441D82E46F5F56172B5C5C
Malicious:	false
Preview:	..IMPORTANT: Command executed successfully...However, "netsh firewall" is deprecated;..use "netsh advfirewall firewall" instead...For more information on using "netsh advfirewall firewall" commands..instead of "netsh firewall", see KB article 947709..at https://go.microsoft.com/fwlink/?linkid=121488 .....Ok.....

Static File Info

General

File type:	Zip archive data, at least v5.1 to extract, compression method=AES Encrypted
Entropy (8bit):	7.999970383778711
TrID:	ZIP compressed archive (8000/1) 100.00%
File name:	5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.zip
File size:	6'169'802 bytes
MD5:	712479d0327772ab6f33210166864396
SHA1:	3f1eb29d0df58e6894885deb81c9e768852c5b81
SHA256:	e6de7ada1b561986658c12fb727f83287c6835142754b30b149a53c410d52c59
SHA512:	038d3a00bf42c1183cde0ec6217f5e62bda4d54d095994d7d73291660e7c59259bc0c250fba3307837320968df891a8773f02583867d2a202c5c4784f9fb3cbe
SSDEEP:	98304:nPSVZGDjSLYNkHoZBXc0Csy8OJN+wmZrTR+75Phy3J1SNFspH0sr0Pn2D6wqd0G3:nKVZGWi/3r5g/+wO87xs51SGon2XGh/p
TLSH:	475633FD9C64B095C2D34A4BDE60B545D9926B6806B4F7AF70F882E1BCC16C194AFC23
File Content Preview:	PK..3...c....X..\..#^.$._.D...5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe......AE.....z...W\.D1.5.Z.q .].Ib..T......H.6.....+.V.Gb..!=,.l...AI9d.......\|e.........."Rs..%.'_..S.......b.9.o}B.Ev.......rQ..f.) h<.DD.Lj_.. TB.]A..;.

File Icon


Icon Hash:	1c1c1e4e4ececedc

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
05/06/24-04:57:20.701168	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6881	8000	115.55.114.39	192.168.2.16
05/06/24-04:57:24.728974	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	53753	8000	61.3.83.110	192.168.2.16
05/06/24-04:57:00.858786	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	45784	8000	42.235.37.39	192.168.2.16
05/06/24-04:57:53.493742	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	39360	8000	1.10.212.35	192.168.2.16
05/06/24-04:57:42.308680	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8081	8000	59.89.6.36	192.168.2.16
05/06/24-04:57:41.688292	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	46687	8000	178.141.150.131	192.168.2.16
05/06/24-04:57:25.790079	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	7460	8000	123.8.13.239	192.168.2.16
05/06/24-04:57:05.828537	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	20866	8000	117.204.200.185	192.168.2.16
05/06/24-04:57:52.907136	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8000	8000	179.164.223.187	192.168.2.16
05/06/24-04:57:04.714545	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30301	8000	117.204.204.30	192.168.2.16
05/06/24-04:57:46.955606	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6881	8000	117.248.32.234	192.168.2.16
05/06/24-04:57:40.065806	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	26667	8000	112.94.99.16	192.168.2.16
05/06/24-04:57:05.829772	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	11211	8000	117.204.203.44	192.168.2.16
05/06/24-04:57:47.308933	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	16065	8000	120.85.113.225	192.168.2.16
05/06/24-04:57:16.726170	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8872	8000	117.200.182.4	192.168.2.16
05/06/24-04:57:32.214318	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8081	8000	42.7.135.20	192.168.2.16
05/06/24-04:57:13.898632	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	28409	8000	115.63.48.177	192.168.2.16
05/06/24-04:57:00.646534	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6881	8000	123.11.74.193	192.168.2.16
05/06/24-04:57:33.547854	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	7937	8000	182.126.124.234	192.168.2.16
05/06/24-04:57:53.390516	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5060	8000	148.66.134.158	192.168.2.16
05/06/24-04:57:03.357855	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30301	8000	198.16.58.241	192.168.2.16
05/06/24-04:57:03.525540	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	40118	8000	182.116.55.56	192.168.2.16
05/06/24-04:56:48.901071	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1434	8000	59.89.201.99	192.168.2.16
05/06/24-04:57:17.513096	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	47288	8000	59.93.23.182	192.168.2.16
05/06/24-04:56:47.299605	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	11211	8000	121.231.203.147	192.168.2.16
05/06/24-04:57:10.393028	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8081	8000	47.76.76.152	192.168.2.16
05/06/24-04:57:36.315557	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5060	8000	119.178.200.213	192.168.2.16
05/06/24-04:57:49.134973	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	23835	8000	117.235.118.223	192.168.2.16
05/06/24-04:57:52.998144	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	7440	8000	123.13.117.143	192.168.2.16
05/06/24-04:57:35.816217	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1027	8000	117.206.182.201	192.168.2.16
05/06/24-04:56:50.019257	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5353	8000	178.141.229.85	192.168.2.16
05/06/24-04:57:48.915506	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	14585	8000	220.198.241.1	192.168.2.16
05/06/24-04:57:23.359068	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4000	8000	117.204.198.205	192.168.2.16
05/06/24-04:57:39.791300	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	44426	8000	182.123.194.51	192.168.2.16
05/06/24-04:57:47.999833	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	32766	8000	120.85.183.143	192.168.2.16
05/06/24-04:56:57.952837	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	54346	8000	180.180.203.148	192.168.2.16
05/06/24-04:57:45.793328	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8083	8000	27.207.186.223	192.168.2.16
05/06/24-04:57:05.156228	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	50264	8000	39.86.4.202	192.168.2.16
05/06/24-04:57:13.145343	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4000	8000	117.199.5.238	192.168.2.16
05/06/24-04:57:40.347518	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	63208	8000	117.251.167.95	192.168.2.16
05/06/24-04:56:51.168479	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	25095	8000	117.206.183.119	192.168.2.16
05/06/24-04:57:30.366553	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	59537	8000	117.204.192.42	192.168.2.16
05/06/24-04:57:26.509858	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	11211	8000	117.204.207.186	192.168.2.16
05/06/24-04:57:47.283912	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	20654	8000	120.57.217.11	192.168.2.16
05/06/24-04:57:33.032442	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8082	8000	89.208.66.152	192.168.2.16
05/06/24-04:57:44.932507	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	45920	8000	112.239.22.116	192.168.2.16
05/06/24-04:57:45.293713	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4000	8000	59.93.185.153	192.168.2.16
05/06/24-04:57:32.908912	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8082	8000	182.126.125.219	192.168.2.16
05/06/24-04:57:45.716974	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8083	8000	117.204.201.168	192.168.2.16
05/06/24-04:57:09.155049	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	55440	8000	59.93.183.141	192.168.2.16
05/06/24-04:57:25.210146	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8083	8000	117.194.172.112	192.168.2.16
05/06/24-04:57:43.855073	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	48740	8000	121.237.46.126	192.168.2.16
05/06/24-04:56:47.797234	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	62064	8000	175.174.27.230	192.168.2.16
05/06/24-04:56:53.560680	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8081	8000	178.141.230.54	192.168.2.16
05/06/24-04:57:24.800609	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4000	8000	27.215.86.87	192.168.2.16
05/06/24-04:56:46.654114	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	21207	8000	120.86.255.37	192.168.2.16
05/06/24-04:57:43.930713	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	41335	8000	117.204.201.127	192.168.2.16
05/06/24-04:57:51.959190	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8080	8000	212.15.143.127	192.168.2.16
05/06/24-04:57:06.461794	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	43100	8000	117.204.195.30	192.168.2.16
05/06/24-04:57:40.446509	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8083	8000	117.220.97.164	192.168.2.16
05/06/24-04:57:14.080621	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	40306	8000	61.53.153.24	192.168.2.16
05/06/24-04:57:29.890971	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	27548	8000	117.204.200.12	192.168.2.16
05/06/24-04:57:47.710034	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	42309	8000	119.117.247.228	192.168.2.16
05/06/24-04:57:32.194725	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1900	8000	113.238.126.129	192.168.2.16
05/06/24-04:56:54.506187	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	12290	8000	121.239.56.243	192.168.2.16
05/06/24-04:57:19.609423	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	65292	8000	1.10.212.38	192.168.2.16
05/06/24-04:57:24.198039	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	49423	8000	117.201.4.37	192.168.2.16
05/06/24-04:57:15.635078	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	53905	8000	117.197.170.93	192.168.2.16
05/06/24-04:57:00.106843	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	9634	8000	178.72.76.235	192.168.2.16
05/06/24-04:57:52.477609	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4000	8000	117.217.85.206	192.168.2.16
05/06/24-04:57:38.705805	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	33513	8000	117.199.77.246	192.168.2.16
05/06/24-04:57:22.772546	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	20348	8000	117.200.183.158	192.168.2.16
05/06/24-04:57:24.601577	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	60648	8000	39.88.118.172	192.168.2.16
05/06/24-04:57:38.298685	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30301	8000	117.213.86.207	192.168.2.16
05/06/24-04:57:30.081694	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	20172	8000	120.85.117.132	192.168.2.16
05/06/24-04:57:47.081662	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	9238	8000	220.71.236.115	192.168.2.16
05/06/24-04:57:53.042703	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30301	8000	59.184.50.75	192.168.2.16
05/06/24-04:57:18.150664	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8081	8000	117.204.192.206	192.168.2.16
05/06/24-04:57:45.110302	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1288	8000	95.32.200.22	192.168.2.16
05/06/24-04:57:04.668219	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6881	8000	59.93.28.230	192.168.2.16
05/06/24-04:56:56.857057	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	20906	8000	117.200.181.142	192.168.2.16
05/06/24-04:57:50.767225	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8275	8000	61.52.32.10	192.168.2.16
05/06/24-04:57:27.915046	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5060	8000	106.56.48.164	192.168.2.16
05/06/24-04:57:10.129801	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5634	8000	178.141.33.56	192.168.2.16
05/06/24-04:57:49.608745	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	24449	8000	27.213.104.161	192.168.2.16
05/06/24-04:57:01.374339	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5353	8000	117.204.203.84	192.168.2.16
05/06/24-04:57:38.265697	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6881	8000	42.228.84.63	192.168.2.16
05/06/24-04:57:14.253732	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8000	8000	178.80.172.62	192.168.2.16
05/06/24-04:57:34.169248	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8080	8000	117.194.165.129	192.168.2.16
05/06/24-04:57:26.963391	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8082	8000	117.217.36.189	192.168.2.16
05/06/24-04:57:04.656669	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8000	8000	59.99.136.155	192.168.2.16
05/06/24-04:56:51.476783	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8000	8000	59.95.131.182	192.168.2.16
05/06/24-04:56:48.942129	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5353	8000	117.194.217.78	192.168.2.16
05/06/24-04:57:36.099305	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4000	8000	117.220.148.243	192.168.2.16
05/06/24-04:57:42.300689	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8082	8000	125.45.11.195	192.168.2.16
05/06/24-04:57:19.939246	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	40605	8000	117.204.194.43	192.168.2.16
05/06/24-04:57:49.886907	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8800	8000	89.130.132.127	192.168.2.16
05/06/24-04:57:09.153740	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	19461	8000	182.123.231.0	192.168.2.16
05/06/24-04:57:14.079490	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30301	8000	117.222.233.3	192.168.2.16
05/06/24-04:56:59.224750	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	28705	8000	222.140.159.103	192.168.2.16
05/06/24-04:57:21.344757	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	10594	8000	220.143.16.169	192.168.2.16
05/06/24-04:56:57.211614	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8081	8000	42.233.105.228	192.168.2.16
05/06/24-04:57:53.052115	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8083	8000	117.201.13.236	192.168.2.16
05/06/24-04:57:40.771931	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	27465	8000	219.155.192.224	192.168.2.16
05/06/24-04:57:37.082852	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30301	8000	117.204.194.119	192.168.2.16
05/06/24-04:57:24.569110	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8080	8000	175.178.238.26	192.168.2.16
05/06/24-04:57:27.772585	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8082	8000	117.213.89.25	192.168.2.16
05/06/24-04:57:49.330080	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	7039	8000	115.55.245.41	192.168.2.16
05/06/24-04:57:49.162402	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	20331	8000	59.89.207.165	192.168.2.16
05/06/24-04:57:48.323294	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	57279	8000	117.220.75.159	192.168.2.16
05/06/24-04:57:31.717141	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1848	8000	42.235.172.106	192.168.2.16
05/06/24-04:57:08.500727	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	56641	8000	222.138.101.166	192.168.2.16
05/06/24-04:57:33.226043	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4947	8000	182.116.92.17	192.168.2.16
05/06/24-04:57:48.255296	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8000	8000	125.45.65.178	192.168.2.16
05/06/24-04:57:49.896207	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8083	8000	191.53.124.59	192.168.2.16
05/06/24-04:57:46.440135	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1976	8000	187.120.94.122	192.168.2.16
05/06/24-04:57:28.405175	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	11211	8000	61.2.108.221	192.168.2.16
05/06/24-04:57:52.815368	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	34054	8000	42.228.221.204	192.168.2.16
05/06/24-04:57:45.642336	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8082	8000	59.98.124.62	192.168.2.16
05/06/24-04:57:26.464047	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	21310	8000	117.254.180.225	192.168.2.16
05/06/24-04:57:35.503724	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30301	8000	182.123.211.52	192.168.2.16
05/06/24-04:57:48.856331	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	14275	8000	1.10.212.37	192.168.2.16
05/06/24-04:57:28.026746	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5060	8000	112.109.205.237	192.168.2.16
05/06/24-04:57:28.046885	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	63487	8000	222.137.107.8	192.168.2.16
05/06/24-04:56:43.298303	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	11211	8000	61.3.178.148	192.168.2.16
05/06/24-04:56:57.542054	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8081	8000	123.129.105.142	192.168.2.16
05/06/24-04:57:19.069700	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	11774	8000	171.117.189.215	192.168.2.16
05/06/24-04:57:33.219750	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	17414	8000	178.72.69.50	192.168.2.16
05/06/24-04:57:53.291152	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6881	8000	123.11.242.2	192.168.2.16
05/06/24-04:57:04.716837	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	46833	8000	117.204.207.163	192.168.2.16
05/06/24-04:57:23.163067	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8000	8000	182.119.230.142	192.168.2.16
05/06/24-04:57:27.435765	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	49936	8000	171.119.199.150	192.168.2.16
05/06/24-04:56:39.177721	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30301	8000	123.10.155.147	192.168.2.16
05/06/24-04:57:52.657822	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8082	8000	222.134.174.205	192.168.2.16
05/06/24-04:57:11.205241	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8082	8000	1.70.100.11	192.168.2.16
05/06/24-04:57:48.850816	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	19695	8000	175.8.122.45	192.168.2.16
05/06/24-04:57:17.559507	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	59364	8000	117.211.209.44	192.168.2.16
05/06/24-04:57:48.749288	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	16470	8000	58.55.135.118	192.168.2.16
05/06/24-04:57:53.429577	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	49165	8000	1.10.212.35	192.168.2.16
05/06/24-04:57:52.516696	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	50827	8000	115.52.5.90	192.168.2.16
05/06/24-04:57:22.076916	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	17716	8000	117.204.194.220	192.168.2.16
05/06/24-04:57:53.565579	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	62245	8000	1.10.212.35	192.168.2.16
05/06/24-04:57:46.701858	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	50989	8000	117.204.195.7	192.168.2.16
05/06/24-04:57:14.668698	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	13453	8000	178.72.75.89	192.168.2.16
05/06/24-04:57:17.066178	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	58903	8000	125.40.26.161	192.168.2.16
05/06/24-04:56:43.332050	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6881	8000	60.18.227.43	192.168.2.16
05/06/24-04:57:12.908916	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4000	8000	112.242.239.197	192.168.2.16
05/06/24-04:57:15.013099	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8080	8000	117.217.39.174	192.168.2.16
05/06/24-04:57:29.099337	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	28409	8000	182.116.13.143	192.168.2.16
05/06/24-04:57:32.583908	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	37424	8000	117.251.174.176	192.168.2.16
05/06/24-04:57:51.343479	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8083	8000	59.89.198.54	192.168.2.16
05/06/24-04:56:55.380743	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	62063	8000	221.15.194.248	192.168.2.16
05/06/24-04:57:19.147182	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	31718	8000	117.204.206.234	192.168.2.16
05/06/24-04:57:11.888714	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6881	8000	112.242.107.168	192.168.2.16
05/06/24-04:57:46.645942	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8083	8000	117.199.0.12	192.168.2.16
05/06/24-04:57:01.323756	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	51688	8000	117.217.38.180	192.168.2.16
05/06/24-04:57:42.382140	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	54956	8000	103.83.184.86	192.168.2.16
05/06/24-04:56:48.945353	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	2067	8000	117.204.201.115	192.168.2.16
05/06/24-04:56:47.772137	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5353	8000	117.217.86.30	192.168.2.16
05/06/24-04:57:04.665335	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	36088	8000	178.141.110.131	192.168.2.16
05/06/24-04:57:31.265010	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8080	8000	221.0.160.131	192.168.2.16
05/06/24-04:57:35.788497	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	41763	8000	59.97.208.113	192.168.2.16
05/06/24-04:57:49.041781	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6881	8000	221.1.224.184	192.168.2.16
05/06/24-04:57:31.279443	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8080	8000	27.215.48.40	192.168.2.16
05/06/24-04:56:58.131947	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8082	8000	117.204.196.38	192.168.2.16
05/06/24-04:57:34.177291	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	11211	8000	117.235.63.112	192.168.2.16
05/06/24-04:57:40.444773	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	15400	8000	178.72.88.14	192.168.2.16
05/06/24-04:56:57.409025	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	59628	8000	117.204.192.165	192.168.2.16
05/06/24-04:57:53.495530	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	27157	8000	117.222.249.71	192.168.2.16
05/06/24-04:57:09.111728	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	42664	8000	117.199.190.33	192.168.2.16
05/06/24-04:57:53.240362	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4000	8000	59.92.219.115	192.168.2.16
05/06/24-04:57:17.507933	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	7586	8000	59.99.143.20	192.168.2.16
05/06/24-04:56:48.883504	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1027	8000	59.178.244.79	192.168.2.16
05/06/24-04:56:48.914721	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8082	8000	60.16.234.149	192.168.2.16
05/06/24-04:57:08.010987	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	62553	8000	175.174.51.163	192.168.2.16
05/06/24-04:57:04.047187	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	49097	8000	59.182.240.16	192.168.2.16
05/06/24-04:57:19.140722	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4000	8000	59.92.47.125	192.168.2.16
05/06/24-04:57:15.068909	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	56462	8000	117.204.203.208	192.168.2.16
05/06/24-04:57:22.148176	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8081	8000	117.204.201.230	192.168.2.16
05/06/24-04:57:31.306072	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	19210	8000	117.204.199.104	192.168.2.16
05/06/24-04:56:54.582376	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	60738	8000	117.204.195.189	192.168.2.16
05/06/24-04:57:35.633887	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8080	8000	81.235.157.102	192.168.2.16
05/06/24-04:57:00.659253	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	33665	8000	61.168.142.14	192.168.2.16
05/06/24-04:57:27.473229	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	55523	8000	117.215.220.220	192.168.2.16
05/06/24-04:57:43.302372	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	27777	8000	115.54.95.66	192.168.2.16
05/06/24-04:57:40.568067	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	49350	8000	178.141.11.8	192.168.2.16
05/06/24-04:57:13.131309	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8080	8000	117.194.171.192	192.168.2.16
05/06/24-04:57:17.469241	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	16433	8000	112.248.190.167	192.168.2.16
05/06/24-04:57:53.592938	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	22302	8000	117.253.217.105	192.168.2.16
05/06/24-04:56:56.668991	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	21532	8000	178.141.27.188	192.168.2.16
05/06/24-04:56:44.426127	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	44033	8000	42.6.50.171	192.168.2.16
05/06/24-04:57:31.273517	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	19570	8000	117.248.57.119	192.168.2.16
05/06/24-04:57:49.372464	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8081	8000	117.194.217.109	192.168.2.16
05/06/24-04:57:42.507304	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30301	8000	42.231.88.178	192.168.2.16
05/06/24-04:56:53.378431	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	27244	8000	113.236.254.106	192.168.2.16
05/06/24-04:57:18.055697	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6881	8000	221.214.149.101	192.168.2.16
05/06/24-04:57:28.134466	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8082	8000	117.220.61.10	192.168.2.16
05/06/24-04:57:46.457933	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	41073	8000	40.133.224.20	192.168.2.16
05/06/24-04:57:44.404699	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8000	8000	59.92.40.26	192.168.2.16
05/06/24-04:56:52.263582	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6881	8000	113.239.64.251	192.168.2.16
05/06/24-04:56:51.350512	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	44426	8000	123.11.76.9	192.168.2.16
05/06/24-04:57:00.764937	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8081	8000	42.235.83.133	192.168.2.16
05/06/24-04:56:57.905358	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	11211	8000	117.204.207.112	192.168.2.16
05/06/24-04:56:56.788020	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8083	8000	117.211.213.60	192.168.2.16
05/06/24-04:57:09.710134	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6881	8000	221.14.122.195	192.168.2.16
05/06/24-04:57:34.324556	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8083	8000	31.162.62.77	192.168.2.16
05/06/24-04:57:28.270760	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5353	8000	39.74.124.34	192.168.2.16
05/06/24-04:57:15.296552	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	27854	8000	117.248.29.38	192.168.2.16
05/06/24-04:57:32.588605	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	61362	8000	117.200.189.131	192.168.2.16
05/06/24-04:57:47.368388	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	45784	8000	123.11.78.171	192.168.2.16
05/06/24-04:57:47.420225	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	63457	8000	117.253.211.156	192.168.2.16
05/06/24-04:57:30.804631	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6482	8000	117.252.205.5	192.168.2.16
05/06/24-04:57:34.061426	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5060	8000	115.55.248.7	192.168.2.16
05/06/24-04:56:46.703419	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	19287	8000	117.204.193.241	192.168.2.16
05/06/24-04:57:18.056778	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1434	8000	59.89.198.137	192.168.2.16
05/06/24-04:57:40.466980	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6881	8000	27.210.217.205	192.168.2.16
05/06/24-04:57:12.236122	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6881	8000	222.137.213.159	192.168.2.16
05/06/24-04:57:27.431831	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30301	8000	117.217.33.2	192.168.2.16
05/06/24-04:56:58.988556	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1027	8000	117.252.161.210	192.168.2.16
05/06/24-04:57:04.299807	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	21770	8000	117.199.14.27	192.168.2.16
05/06/24-04:57:04.984598	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	15073	8000	58.178.116.82	192.168.2.16
05/06/24-04:57:34.463417	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	40124	8000	182.127.113.64	192.168.2.16
05/06/24-04:57:27.012825	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1900	8000	123.156.51.58	192.168.2.16
05/06/24-04:57:29.409645	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30301	8000	116.111.31.44	192.168.2.16
05/06/24-04:57:30.838104	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	44426	8000	115.55.253.126	192.168.2.16
05/06/24-04:57:24.624286	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	33548	8000	117.204.204.38	192.168.2.16
05/06/24-04:57:38.313771	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	65494	8000	117.213.87.169	192.168.2.16
05/06/24-04:57:31.384673	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	60916	8000	182.60.13.105	192.168.2.16
05/06/24-04:56:48.942040	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6881	8000	59.93.191.192	192.168.2.16
05/06/24-04:57:16.412002	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1027	8000	219.155.2.231	192.168.2.16
05/06/24-04:57:44.778301	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6881	8000	222.135.207.188	192.168.2.16
05/06/24-04:57:15.019549	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	56641	8000	221.15.62.202	192.168.2.16
05/06/24-04:57:23.395395	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1027	8000	117.204.195.28	192.168.2.16
05/06/24-04:57:02.911661	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	17510	8000	120.85.119.53	192.168.2.16
05/06/24-04:57:47.830072	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8000	8000	115.55.245.71	192.168.2.16
05/06/24-04:57:44.354482	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8082	8000	123.10.141.176	192.168.2.16
05/06/24-04:57:15.899656	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8198	8000	178.72.75.29	192.168.2.16
05/06/24-04:57:25.378919	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	61642	8000	182.119.221.73	192.168.2.16
05/06/24-04:57:51.149121	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	55731	8000	117.217.35.101	192.168.2.16
05/06/24-04:56:59.194846	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6881	8000	117.204.200.187	192.168.2.16
05/06/24-04:57:26.179429	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	11256	8000	112.248.110.81	192.168.2.16
05/06/24-04:57:33.312386	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	11290	8000	59.184.56.155	192.168.2.16
05/06/24-04:57:12.034640	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5060	8000	117.204.206.129	192.168.2.16
05/06/24-04:57:53.203452	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	29605	8000	117.193.91.27	192.168.2.16
05/06/24-04:56:56.730016	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5353	8000	117.254.177.36	192.168.2.16
05/06/24-04:57:13.170555	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8082	8000	117.204.207.102	192.168.2.16
05/06/24-04:57:14.360671	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5060	8000	182.113.25.95	192.168.2.16
05/06/24-04:57:46.406749	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	49987	8000	222.140.90.32	192.168.2.16
05/06/24-04:57:15.033840	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4000	8000	125.44.35.142	192.168.2.16
05/06/24-04:56:46.657877	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8081	8000	117.235.112.77	192.168.2.16
05/06/24-04:56:50.256768	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	19048	8000	115.55.240.86	192.168.2.16
05/06/24-04:57:44.247808	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6736	8000	137.175.46.64	192.168.2.16
05/06/24-04:56:58.742678	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6881	8000	42.228.222.130	192.168.2.16
05/06/24-04:57:22.260359	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	36160	8000	42.227.3.250	192.168.2.16
05/06/24-04:57:31.517210	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5060	8000	178.141.162.151	192.168.2.16
05/06/24-04:57:47.938276	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8000	8000	117.204.204.118	192.168.2.16
05/06/24-04:57:18.332664	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	11211	8000	117.220.150.181	192.168.2.16
05/06/24-04:57:48.168725	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	18577	8000	117.253.219.183	192.168.2.16
05/06/24-04:57:20.089407	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	47307	8000	222.141.82.27	192.168.2.16
05/06/24-04:57:53.337233	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	3078	8000	42.231.96.176	192.168.2.16
05/06/24-04:57:21.417623	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	25134	8000	61.53.133.187	192.168.2.16
05/06/24-04:57:37.026668	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	28634	8000	117.213.94.237	192.168.2.16
05/06/24-04:57:35.632421	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	64503	8000	221.14.37.81	192.168.2.16
05/06/24-04:57:19.081206	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	9926	8000	182.117.90.225	192.168.2.16
05/06/24-04:57:39.670144	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8081	8000	117.207.67.98	192.168.2.16
05/06/24-04:57:22.661312	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	28409	8000	42.224.178.47	192.168.2.16
05/06/24-04:57:18.771480	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	20766	8000	117.196.39.46	192.168.2.16
05/06/24-04:57:19.805702	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	38223	8000	42.86.123.101	192.168.2.16
05/06/24-04:57:19.240508	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30301	8000	1.62.131.76	192.168.2.16
05/06/24-04:56:46.632858	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	49521	8000	178.141.129.252	192.168.2.16
05/06/24-04:57:53.200461	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5353	8000	42.227.129.175	192.168.2.16
05/06/24-04:57:50.972855	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5353	8000	42.232.59.36	192.168.2.16
05/06/24-04:57:35.191079	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	48026	8000	160.238.93.44	192.168.2.16
05/06/24-04:57:00.194015	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	23377	8000	117.50.73.154	192.168.2.16
05/06/24-04:57:10.569760	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	41757	8000	78.168.196.128	192.168.2.16
05/06/24-04:57:04.098843	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1434	8000	109.108.218.34	192.168.2.16
05/06/24-04:57:49.322436	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30922	8000	61.3.3.158	192.168.2.16
05/06/24-04:57:50.411844	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	17885	8000	117.221.97.24	192.168.2.16
05/06/24-04:57:53.571256	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4000	8000	59.89.0.106	192.168.2.16
05/06/24-04:57:12.140730	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	11211	8000	117.220.108.113	192.168.2.16
05/06/24-04:57:28.810706	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6881	8000	117.204.195.238	192.168.2.16
05/06/24-04:57:22.078109	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	19478	8000	42.227.205.32	192.168.2.16
05/06/24-04:56:52.205956	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	17607	8000	188.149.142.208	192.168.2.16
05/06/24-04:57:52.978731	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	34827	8000	1.10.212.33	192.168.2.16
05/06/24-04:56:56.807665	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30301	8000	119.183.40.71	192.168.2.16
05/06/24-04:57:03.553442	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	20102	8000	117.235.120.55	192.168.2.16
05/06/24-04:57:53.594774	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4000	8000	59.99.130.52	192.168.2.16
05/06/24-04:57:39.159715	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	7791	8000	117.201.3.204	192.168.2.16
05/06/24-04:57:30.321534	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	59170	8000	117.235.101.142	192.168.2.16
05/06/24-04:57:17.924904	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1334	8000	42.59.84.143	192.168.2.16
05/06/24-04:57:12.159616	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	22523	8000	117.199.2.18	192.168.2.16
05/06/24-04:57:50.089066	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8083	8000	117.204.192.36	192.168.2.16
05/06/24-04:57:23.067246	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	32312	8000	112.248.110.58	192.168.2.16
05/06/24-04:56:55.271874	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6990	8000	115.49.65.154	192.168.2.16
05/06/24-04:57:00.863687	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	44365	8000	222.142.241.123	192.168.2.16
05/06/24-04:57:28.059552	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	13000	8000	117.206.165.113	192.168.2.16
05/06/24-04:57:27.990405	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8081	8000	117.204.206.85	192.168.2.16
05/06/24-04:56:52.255576	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30301	8000	117.204.77.54	192.168.2.16
05/06/24-04:56:46.730572	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8080	8000	49.84.159.171	192.168.2.16
05/06/24-04:56:57.906490	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	47135	8000	117.204.204.26	192.168.2.16
05/06/24-04:57:53.416666	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	21168	8000	49.234.57.41	192.168.2.16
05/06/24-04:57:52.378318	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4000	8000	117.204.205.188	192.168.2.16
05/06/24-04:57:28.203549	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8082	8000	117.204.192.149	192.168.2.16
05/06/24-04:56:45.536987	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	36130	8000	186.148.245.119	192.168.2.16
05/06/24-04:57:52.405364	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	25070	8000	186.148.245.183	192.168.2.16
05/06/24-04:57:49.330656	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	31750	8000	222.140.140.198	192.168.2.16
05/06/24-04:57:02.488872	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5060	8000	117.204.203.91	192.168.2.16
05/06/24-04:57:26.244428	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6340	8000	80.53.153.185	192.168.2.16
05/06/24-04:57:48.742604	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8080	8000	117.248.129.208	192.168.2.16
05/06/24-04:57:52.084932	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	46311	8000	1.10.212.34	192.168.2.16
05/06/24-04:56:57.853283	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	61591	8000	59.89.6.216	192.168.2.16
05/06/24-04:57:39.494776	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	60982	8000	61.3.179.228	192.168.2.16
05/06/24-04:57:53.440513	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1281	8000	37.79.0.6	192.168.2.16
05/06/24-04:57:46.376221	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8000	8000	42.231.92.106	192.168.2.16
05/06/24-04:57:44.174450	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1434	8000	178.141.158.194	192.168.2.16
05/06/24-04:56:53.349488	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	2801	8000	117.243.173.110	192.168.2.16
05/06/24-04:57:09.517924	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	11211	8000	105.96.25.193	192.168.2.16
05/06/24-04:57:50.741682	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30301	8000	117.248.44.170	192.168.2.16
05/06/24-04:56:51.752936	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8083	8000	42.239.246.52	192.168.2.16
05/06/24-04:57:26.777156	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	17077	8000	219.155.172.111	192.168.2.16
05/06/24-04:57:12.058075	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	27297	8000	117.204.205.77	192.168.2.16
05/06/24-04:57:24.559751	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5060	8000	58.17.125.118	192.168.2.16
05/06/24-04:57:08.010191	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1558	8000	117.199.0.37	192.168.2.16
05/06/24-04:57:37.370219	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	15525	8000	120.85.113.16	192.168.2.16
05/06/24-04:57:53.244495	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	7715	8000	1.10.212.35	192.168.2.16
05/06/24-04:57:50.572361	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8080	8000	117.199.14.73	192.168.2.16
05/06/24-04:57:46.692899	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8000	8000	61.53.95.218	192.168.2.16
05/06/24-04:57:53.567470	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30301	8000	59.99.131.251	192.168.2.16
05/06/24-04:56:56.725451	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	59136	8000	117.213.93.120	192.168.2.16
05/06/24-04:57:32.890286	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8081	8000	123.130.35.72	192.168.2.16
05/06/24-04:57:34.168490	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	11614	8000	117.200.176.205	192.168.2.16
05/06/24-04:56:45.529825	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5060	8000	115.61.18.2	192.168.2.16
05/06/24-04:57:04.270520	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	63836	8000	117.206.187.184	192.168.2.16
05/06/24-04:57:32.645681	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	50847	8000	117.255.84.52	192.168.2.16
05/06/24-04:57:47.526965	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5857	8000	117.204.202.50	192.168.2.16
05/06/24-04:57:08.823125	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8082	8000	182.113.18.92	192.168.2.16
05/06/24-04:57:06.173820	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8083	8000	14.223.26.33	192.168.2.16
05/06/24-04:57:24.058345	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	7724	8000	78.188.112.42	192.168.2.16
05/06/24-04:57:12.141090	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	17833	8000	101.22.184.177	192.168.2.16
05/06/24-04:57:12.157882	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	41705	8000	123.175.92.230	192.168.2.16
05/06/24-04:57:51.483031	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	31524	8000	171.36.88.43	192.168.2.16
05/06/24-04:57:50.937983	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	59351	8000	1.10.212.35	192.168.2.16
05/06/24-04:57:47.004203	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	65391	8000	27.6.206.186	192.168.2.16
05/06/24-04:57:04.655403	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	27474	8000	220.198.240.185	192.168.2.16
05/06/24-04:56:49.803518	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	60648	8000	119.179.238.174	192.168.2.16
05/06/24-04:57:48.368015	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	44377	8000	42.235.64.33	192.168.2.16
05/06/24-04:57:09.903155	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5353	8000	182.122.234.142	192.168.2.16
05/06/24-04:57:47.809457	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30301	8000	123.14.35.188	192.168.2.16
05/06/24-04:57:52.207327	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	26929	8000	221.202.181.253	192.168.2.16
05/06/24-04:57:49.923676	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8082	8000	124.131.156.1	192.168.2.16
05/06/24-04:56:53.371882	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	63764	8000	113.228.150.105	192.168.2.16
05/06/24-04:57:44.365305	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	17872	8000	120.85.112.221	192.168.2.16
05/06/24-04:57:36.957420	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1027	8000	123.129.129.98	192.168.2.16
05/06/24-04:57:01.950208	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30872	8000	115.57.109.53	192.168.2.16
05/06/24-04:57:17.946810	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8080	8000	61.53.105.50	192.168.2.16
05/06/24-04:57:18.086005	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4375	8000	175.175.188.249	192.168.2.16
05/06/24-04:57:53.425624	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8083	8000	120.56.5.224	192.168.2.16
05/06/24-04:57:46.669517	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	56840	8000	177.245.155.184	192.168.2.16
05/06/24-04:56:46.525437	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8083	8000	47.107.92.35	192.168.2.16
05/06/24-04:57:14.079247	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	25800	8000	59.89.71.117	192.168.2.16
05/06/24-04:56:59.001235	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	24247	8000	123.190.31.146	192.168.2.16
05/06/24-04:57:05.639744	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8082	8000	42.239.255.233	192.168.2.16
05/06/24-04:57:48.716133	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	13621	8000	59.93.183.173	192.168.2.16
05/06/24-04:56:48.106276	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8080	8000	113.225.115.233	192.168.2.16
05/06/24-04:57:33.473080	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	3277	8000	59.96.135.13	192.168.2.16
05/06/24-04:57:37.664423	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8080	8000	123.14.99.249	192.168.2.16
05/06/24-04:57:40.456327	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	3600	8000	182.114.228.16	192.168.2.16
05/06/24-04:56:55.670915	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	56461	8000	117.204.194.29	192.168.2.16
05/06/24-04:57:40.657388	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8080	8000	182.117.33.62	192.168.2.16
05/06/24-04:57:16.702254	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6881	8000	120.63.221.76	192.168.2.16
05/06/24-04:57:51.726108	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	13010	8000	125.42.230.168	192.168.2.16
05/06/24-04:56:49.477492	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	15006	8000	117.235.45.72	192.168.2.16
05/06/24-04:57:30.065356	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	49027	8000	177.245.153.99	192.168.2.16
05/06/24-04:57:34.494148	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30301	8000	117.213.88.166	192.168.2.16
05/06/24-04:57:48.462093	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5060	8000	117.204.197.119	192.168.2.16
05/06/24-04:57:28.402905	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8083	8000	182.117.78.148	192.168.2.16
05/06/24-04:57:35.525508	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	50561	8000	117.217.37.194	192.168.2.16
05/06/24-04:57:35.585084	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8652	8000	59.99.190.136	192.168.2.16
05/06/24-04:57:02.384168	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	10044	8000	117.204.203.18	192.168.2.16
05/06/24-04:56:48.871438	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	57985	8000	49.75.64.215	192.168.2.16
05/06/24-04:57:19.347046	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30301	8000	59.93.188.112	192.168.2.16
05/06/24-04:57:27.561147	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	18530	8000	61.137.199.152	192.168.2.16
05/06/24-04:57:52.236087	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5353	8000	5.188.64.229	192.168.2.16
05/06/24-04:56:55.049763	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	56641	8000	27.202.116.74	192.168.2.16
05/06/24-04:56:58.988530	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	63249	8000	117.200.181.176	192.168.2.16
05/06/24-04:57:19.147168	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1900	8000	178.141.142.251	192.168.2.16
05/06/24-04:57:08.001312	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8080	8000	117.205.131.100	192.168.2.16
05/06/24-04:57:20.546834	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8081	8000	114.226.245.81	192.168.2.16
05/06/24-04:57:32.917019	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	7235	8000	182.127.143.19	192.168.2.16
05/06/24-04:56:45.554583	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	12787	8000	42.5.65.154	192.168.2.16
05/06/24-04:57:11.887905	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	15323	8000	1.10.212.37	192.168.2.16
05/06/24-04:57:18.591356	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8000	8000	117.204.203.90	192.168.2.16
05/06/24-04:57:53.364218	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	15777	8000	115.48.31.1	192.168.2.16
05/06/24-04:57:27.941743	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	44328	8000	117.213.92.159	192.168.2.16
05/06/24-04:57:28.416947	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	33080	8000	117.213.85.239	192.168.2.16
05/06/24-04:57:36.682482	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30301	8000	219.155.168.215	192.168.2.16
05/06/24-04:57:42.299424	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	62780	8000	117.204.78.135	192.168.2.16
05/06/24-04:56:54.532242	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30617	8000	59.89.71.168	192.168.2.16
05/06/24-04:57:52.288687	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6881	8000	182.116.55.134	192.168.2.16
05/06/24-04:56:48.888646	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	25226	8000	117.253.215.73	192.168.2.16
05/06/24-04:56:52.145408	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6881	8000	85.215.242.168	192.168.2.16
05/06/24-04:57:45.050984	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1027	8000	117.204.201.7	192.168.2.16
05/06/24-04:57:00.219443	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8082	8000	117.253.221.191	192.168.2.16
05/06/24-04:56:47.407574	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	33088	8000	117.208.96.81	192.168.2.16
05/06/24-04:57:48.270945	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	11396	8000	182.113.235.204	192.168.2.16
05/06/24-04:57:01.767115	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8000	8000	61.53.97.55	192.168.2.16
05/06/24-04:56:46.632358	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8081	8000	125.44.21.50	192.168.2.16
05/06/24-04:57:10.462420	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5060	8000	221.13.243.13	192.168.2.16
05/06/24-04:57:19.211545	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6610	8000	117.215.214.178	192.168.2.16
05/06/24-04:56:46.651475	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8000	8000	27.210.218.119	192.168.2.16
05/06/24-04:57:42.352219	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	3285	8000	178.72.78.170	192.168.2.16
05/06/24-04:56:45.598500	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30301	8000	39.171.253.87	192.168.2.16
05/06/24-04:57:02.448395	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8080	8000	222.241.210.81	192.168.2.16
05/06/24-04:56:58.378654	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8081	8000	182.127.154.100	192.168.2.16
05/06/24-04:57:35.646961	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	61480	8000	117.204.202.152	192.168.2.16
05/06/24-04:57:51.606483	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8974	8000	120.86.252.160	192.168.2.16
05/06/24-04:56:54.822906	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4000	8000	182.124.122.251	192.168.2.16
05/06/24-04:57:09.157673	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	29739	8000	117.204.204.80	192.168.2.16
05/06/24-04:57:48.607766	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5045	8000	120.85.118.198	192.168.2.16
05/06/24-04:57:49.773788	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	25535	8000	27.215.180.200	192.168.2.16
05/06/24-04:57:50.043740	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5353	8000	117.204.207.136	192.168.2.16
05/06/24-04:57:48.618333	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	2087	8000	95.32.69.32	192.168.2.16
05/06/24-04:57:46.249926	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30301	8000	115.55.199.44	192.168.2.16
05/06/24-04:57:49.255592	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8081	8000	117.206.187.150	192.168.2.16
05/06/24-04:57:52.179710	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	43183	8000	117.248.53.145	192.168.2.16
05/06/24-04:56:57.776741	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	45756	8000	178.141.226.116	192.168.2.16
05/06/24-04:56:47.772234	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	49006	8000	59.89.193.177	192.168.2.16
05/06/24-04:56:55.962662	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1185	8000	115.61.148.148	192.168.2.16
05/06/24-04:57:51.443072	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	64609	8000	117.204.197.242	192.168.2.16
05/06/24-04:56:57.545474	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	20781	8000	39.90.160.121	192.168.2.16
05/06/24-04:57:17.511381	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	2574	8000	117.222.192.193	192.168.2.16
05/06/24-04:57:18.143156	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	41346	8000	106.112.179.121	192.168.2.16
05/06/24-04:56:52.293838	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1027	8000	117.204.193.227	192.168.2.16
05/06/24-04:57:53.459676	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	46401	8000	1.10.212.34	192.168.2.16
05/06/24-04:57:46.813869	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30040	8000	117.213.82.138	192.168.2.16
05/06/24-04:57:11.000020	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1027	8000	117.242.239.85	192.168.2.16
05/06/24-04:57:53.507736	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8081	8000	221.215.247.125	192.168.2.16
05/06/24-04:57:52.991021	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	29918	8000	117.204.198.43	192.168.2.16
05/06/24-04:57:45.052040	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1434	8000	117.204.202.54	192.168.2.16
05/06/24-04:57:51.025851	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5060	8000	119.187.201.64	192.168.2.16
05/06/24-04:57:04.711744	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5060	8000	117.204.203.117	192.168.2.16
05/06/24-04:56:48.968046	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	45724	8000	117.204.207.60	192.168.2.16
05/06/24-04:57:50.621864	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8080	8000	113.230.80.68	192.168.2.16
05/06/24-04:57:25.580221	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	24240	8000	112.248.112.76	192.168.2.16
05/06/24-04:57:08.035706	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	19378	8000	117.204.194.129	192.168.2.16
05/06/24-04:56:53.247679	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8083	8000	115.56.155.143	192.168.2.16
05/06/24-04:57:40.038146	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	10984	8000	117.204.199.3	192.168.2.16
05/06/24-04:57:53.448881	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30301	8000	117.204.195.124	192.168.2.16
05/06/24-04:57:24.586566	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	19307	8000	182.117.30.233	192.168.2.16
05/06/24-04:57:37.940926	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	45689	8000	117.252.160.59	192.168.2.16
05/06/24-04:57:13.114775	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	48283	8000	117.194.171.174	192.168.2.16
05/06/24-04:57:53.104039	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	41238	8000	1.10.212.37	192.168.2.16
05/06/24-04:57:29.003557	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30301	8000	61.3.95.14	192.168.2.16
05/06/24-04:57:12.157403	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	65413	8000	182.121.173.58	192.168.2.16
05/06/24-04:57:13.103216	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5353	8000	115.55.245.232	192.168.2.16
05/06/24-04:57:15.015281	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8000	8000	117.222.252.98	192.168.2.16
05/06/24-04:57:46.124262	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	18538	8000	117.204.200.147	192.168.2.16
05/06/24-04:57:30.044469	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	63831	8000	178.141.161.72	192.168.2.16
05/06/24-04:57:37.410570	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5353	8000	117.204.203.214	192.168.2.16
05/06/24-04:57:38.685266	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	63317	8000	117.204.207.77	192.168.2.16
05/06/24-04:57:47.508922	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8000	8000	117.194.210.76	192.168.2.16
05/06/24-04:57:27.447674	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	61656	8000	59.182.240.126	192.168.2.16
05/06/24-04:57:40.945740	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	16589	8000	59.99.133.192	192.168.2.16
05/06/24-04:57:45.361204	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8083	8000	115.49.203.227	192.168.2.16
05/06/24-04:57:08.965624	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	21125	8000	42.228.35.248	192.168.2.16
05/06/24-04:57:48.224706	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8081	8000	117.206.187.0	192.168.2.16
05/06/24-04:57:21.386153	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8000	8000	123.14.214.241	192.168.2.16
05/06/24-04:57:31.444146	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	41451	8000	125.47.235.12	192.168.2.16
05/06/24-04:56:43.361076	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	64230	8000	117.204.193.170	192.168.2.16
05/06/24-04:57:00.193434	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30301	8000	42.5.245.210	192.168.2.16
05/06/24-04:57:18.892700	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5060	8000	120.211.137.176	192.168.2.16
05/06/24-04:57:42.542205	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8083	8000	117.204.195.255	192.168.2.16
05/06/24-04:57:03.593163	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8081	8000	222.137.57.27	192.168.2.16
05/06/24-04:57:26.053410	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1027	8000	59.89.202.101	192.168.2.16
05/06/24-04:57:04.326737	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5060	8000	112.248.63.217	192.168.2.16
05/06/24-04:57:08.326139	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	9134	8000	27.215.82.209	192.168.2.16
05/06/24-04:57:21.480120	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6881	8000	61.3.188.193	192.168.2.16
05/06/24-04:57:12.051042	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	25286	8000	186.148.245.86	192.168.2.16
05/06/24-04:57:09.208033	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8000	8000	221.235.45.4	192.168.2.16
05/06/24-04:57:52.219980	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8080	8000	117.204.207.253	192.168.2.16
05/06/24-04:57:30.602158	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8080	8000	219.155.195.79	192.168.2.16
05/06/24-04:56:48.071160	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	25973	8000	171.36.157.2	192.168.2.16
05/06/24-04:57:00.676563	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	18900	8000	1.10.212.37	192.168.2.16
05/06/24-04:57:02.395769	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	15403	8000	178.72.76.88	192.168.2.16
05/06/24-04:57:52.931571	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	53465	8000	1.10.212.38	192.168.2.16
05/06/24-04:57:32.972617	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1372	8000	182.120.51.224	192.168.2.16
05/06/24-04:57:12.145495	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30301	8000	117.220.108.129	192.168.2.16
05/06/24-04:57:39.674790	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	61659	8000	1.10.212.35	192.168.2.16
05/06/24-04:57:03.596988	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	18790	8000	117.199.77.27	192.168.2.16
05/06/24-04:57:06.231909	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5060	8000	61.52.27.104	192.168.2.16
05/06/24-04:57:08.737606	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	54564	8000	42.234.244.67	192.168.2.16
05/06/24-04:57:34.654922	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	28409	8000	39.89.165.53	192.168.2.16
05/06/24-04:57:22.578426	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	60706	8000	119.109.147.116	192.168.2.16
05/06/24-04:57:53.414689	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5137	8000	42.58.121.236	192.168.2.16
05/06/24-04:57:24.623483	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	29646	8000	117.204.196.5	192.168.2.16
05/06/24-04:56:55.448769	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	11211	8000	45.229.174.144	192.168.2.16
05/06/24-04:57:27.962807	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	16630	8000	1.10.212.37	192.168.2.16
05/06/24-04:57:48.993048	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	53575	8000	117.194.166.98	192.168.2.16
05/06/24-04:56:52.289416	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30301	8000	117.204.203.119	192.168.2.16
05/06/24-04:57:00.011258	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	46037	8000	116.68.162.186	192.168.2.16
05/06/24-04:57:22.233497	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8083	8000	45.189.207.241	192.168.2.16
05/06/24-04:57:25.880633	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30301	8000	106.3.130.252	192.168.2.16
05/06/24-04:56:48.885489	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	32763	8000	117.50.73.202	192.168.2.16
05/06/24-04:57:22.114426	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	45675	8000	117.204.202.151	192.168.2.16
05/06/24-04:57:27.664156	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8083	8000	61.53.140.32	192.168.2.16
05/06/24-04:57:46.093432	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5060	8000	178.141.227.103	192.168.2.16
05/06/24-04:57:42.282608	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	18096	8000	125.25.93.161	192.168.2.16
05/06/24-04:56:58.911172	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	13297	8000	46.153.236.32	192.168.2.16
05/06/24-04:57:06.437774	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	17017	8000	117.204.204.226	192.168.2.16
05/06/24-04:57:21.658530	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	24216	8000	120.85.114.169	192.168.2.16
05/06/24-04:57:16.115356	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	55291	8000	39.87.73.210	192.168.2.16
05/06/24-04:57:35.670339	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	32860	8000	61.52.109.1	192.168.2.16
05/06/24-04:57:14.421187	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	45193	8000	182.125.120.85	192.168.2.16
05/06/24-04:56:56.962998	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	40563	8000	117.213.95.10	192.168.2.16
05/06/24-04:57:38.404958	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	24980	8000	87.255.200.247	192.168.2.16
05/06/24-04:57:37.346396	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	18652	8000	117.248.44.129	192.168.2.16
05/06/24-04:57:17.525446	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1900	8000	112.31.180.128	192.168.2.16
05/06/24-04:57:18.331861	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5274	8000	117.213.95.216	192.168.2.16
05/06/24-04:57:44.030773	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	14781	8000	120.86.252.180	192.168.2.16
05/06/24-04:56:47.777287	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	11211	8000	175.30.112.140	192.168.2.16
05/06/24-04:57:48.866115	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	32623	8000	189.165.201.254	192.168.2.16
05/06/24-04:57:40.646721	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8081	8000	61.3.179.115	192.168.2.16
05/06/24-04:57:45.450518	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	17433	8000	1.215.138.43	192.168.2.16
05/06/24-04:56:51.146356	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5964	8000	112.239.102.121	192.168.2.16
05/06/24-04:57:48.498687	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	39378	8000	117.221.61.2	192.168.2.16
05/06/24-04:57:00.285847	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	37497	8000	115.58.42.240	192.168.2.16
05/06/24-04:57:53.212682	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	59147	8000	117.194.168.91	192.168.2.16
05/06/24-04:57:35.832276	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	16054	8000	81.68.153.169	192.168.2.16
05/06/24-04:57:15.957051	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	3540	8000	117.204.207.130	192.168.2.16
05/06/24-04:57:25.219388	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8083	8000	121.61.149.209	192.168.2.16
05/06/24-04:57:28.455613	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	29478	8000	117.204.195.155	192.168.2.16
05/06/24-04:57:20.959434	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4000	8000	219.157.151.133	192.168.2.16
05/06/24-04:57:35.459976	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8080	8000	117.248.22.205	192.168.2.16
05/06/24-04:57:51.758260	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1796	8000	31.162.4.120	192.168.2.16
05/06/24-04:57:22.662318	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4000	8000	123.185.49.90	192.168.2.16
05/06/24-04:57:09.148592	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8080	8000	117.204.205.157	192.168.2.16
05/06/24-04:56:52.236258	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	61479	8000	121.231.121.39	192.168.2.16
05/06/24-04:56:40.334518	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5060	8000	14.155.205.75	192.168.2.16
05/06/24-04:57:00.246540	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6881	8000	117.204.200.69	192.168.2.16
05/06/24-04:56:51.126533	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	57674	8000	209.59.113.249	192.168.2.16
05/06/24-04:57:16.706801	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	2003	8000	112.237.23.220	192.168.2.16
05/06/24-04:57:51.745847	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6881	8000	117.204.205.14	192.168.2.16
05/06/24-04:57:32.231995	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8082	8000	117.213.86.46	192.168.2.16
05/06/24-04:56:56.782035	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	33749	8000	116.74.19.124	192.168.2.16
05/06/24-04:56:55.608726	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	60648	8000	182.124.40.132	192.168.2.16
05/06/24-04:56:40.004597	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8082	8000	117.204.194.135	192.168.2.16
05/06/24-04:57:11.500044	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6881	8000	222.139.39.163	192.168.2.16
05/06/24-04:56:57.856263	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4945	8000	117.197.189.217	192.168.2.16
05/06/24-04:57:28.323848	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8081	8000	59.93.21.122	192.168.2.16
05/06/24-04:57:12.129345	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	62851	8000	60.246.138.175	192.168.2.16
05/06/24-04:57:34.479076	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8082	8000	59.184.58.208	192.168.2.16
05/06/24-04:57:38.971076	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5353	8000	117.211.215.190	192.168.2.16
05/06/24-04:56:56.754279	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4000	8000	42.5.53.19	192.168.2.16
05/06/24-04:57:05.782465	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	26401	8000	222.140.87.236	192.168.2.16
05/06/24-04:57:53.351707	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	23975	8000	220.124.130.79	192.168.2.16
05/06/24-04:57:00.264663	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8000	8000	27.216.35.127	192.168.2.16
05/06/24-04:57:53.115395	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4770	8000	59.178.249.186	192.168.2.16
05/06/24-04:56:46.669808	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	18557	8000	27.6.3.211	192.168.2.16
05/06/24-04:57:35.364468	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	22520	8000	182.56.69.246	192.168.2.16
05/06/24-04:56:59.541989	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	3755	8000	112.248.100.146	192.168.2.16
05/06/24-04:57:20.682803	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4000	8000	117.242.233.228	192.168.2.16
05/06/24-04:57:27.344993	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6881	8000	202.110.15.176	192.168.2.16
05/06/24-04:57:31.817942	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1027	8000	151.177.251.42	192.168.2.16
05/06/24-04:57:04.649420	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	24420	8000	112.248.107.205	192.168.2.16
05/06/24-04:57:21.471602	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	58924	8000	117.214.8.218	192.168.2.16
05/06/24-04:56:55.550248	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	3870	8000	120.85.119.218	192.168.2.16
05/06/24-04:56:47.849657	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5353	8000	42.239.240.169	192.168.2.16
05/06/24-04:57:53.204186	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	22281	8000	117.192.127.79	192.168.2.16
05/06/24-04:57:20.649855	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1027	8000	117.204.205.251	192.168.2.16
05/06/24-04:57:29.890337	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	34928	8000	117.204.193.70	192.168.2.16
05/06/24-04:57:50.432420	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	62650	8000	1.10.212.36	192.168.2.16
05/06/24-04:57:46.617809	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	15949	8000	117.215.222.16	192.168.2.16
05/06/24-04:57:43.675612	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6649	8000	1.10.212.38	192.168.2.16
05/06/24-04:56:58.041787	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	37662	8000	115.55.252.99	192.168.2.16
05/06/24-04:56:43.504565	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	11211	8000	124.7.139.186	192.168.2.16
05/06/24-04:57:31.266848	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	12447	8000	178.72.78.59	192.168.2.16
05/06/24-04:56:47.788313	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	33917	8000	117.248.24.210	192.168.2.16
05/06/24-04:57:42.271584	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	21908	8000	120.56.5.31	192.168.2.16
05/06/24-04:57:31.262046	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	47762	8000	59.89.185.186	192.168.2.16
05/06/24-04:57:51.361471	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	11211	8000	117.206.189.163	192.168.2.16
05/06/24-04:57:25.232465	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	60936	8000	59.89.183.154	192.168.2.16
05/06/24-04:57:38.300426	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4000	8000	59.89.5.128	192.168.2.16
05/06/24-04:57:19.115527	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	57617	8000	112.242.100.32	192.168.2.16
05/06/24-04:57:27.789156	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4000	8000	122.159.62.209	192.168.2.16
05/06/24-04:57:22.016732	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	45886	8000	153.34.81.58	192.168.2.16
05/06/24-04:57:52.223621	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4234	8000	117.204.202.167	192.168.2.16
05/06/24-04:56:44.426840	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	12460	8000	117.248.25.83	192.168.2.16
05/06/24-04:57:31.277822	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	3026	8000	222.246.41.12	192.168.2.16
05/06/24-04:57:19.572311	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	41547	8000	117.213.86.33	192.168.2.16
05/06/24-04:57:27.944887	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30526	8000	117.248.18.124	192.168.2.16
05/06/24-04:57:20.743465	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	54607	8000	117.204.199.81	192.168.2.16
05/06/24-04:57:46.399511	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6463	8000	178.72.81.202	192.168.2.16
05/06/24-04:56:52.238748	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8000	8000	117.206.186.128	192.168.2.16
05/06/24-04:57:38.046829	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8083	8000	117.204.198.88	192.168.2.16
05/06/24-04:57:24.420393	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4000	8000	117.220.106.143	192.168.2.16
05/06/24-04:57:52.117834	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	24465	8000	123.4.46.248	192.168.2.16
05/06/24-04:57:52.739611	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1319	8000	1.10.212.37	192.168.2.16
05/06/24-04:57:05.831915	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	22738	8000	117.204.198.155	192.168.2.16
05/06/24-04:57:02.827074	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8080	8000	115.55.247.210	192.168.2.16
05/06/24-04:56:54.536432	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	21688	8000	117.209.1.159	192.168.2.16
05/06/24-04:57:40.464232	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	18778	8000	120.86.253.225	192.168.2.16
05/06/24-04:57:53.445339	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	14400	8000	27.47.2.116	192.168.2.16
05/06/24-04:57:53.224659	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8651	8000	61.0.9.201	192.168.2.16
05/06/24-04:57:23.191044	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	40772	8000	190.109.229.181	192.168.2.16
05/06/24-04:57:53.095777	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8000	8000	117.204.194.169	192.168.2.16
05/06/24-04:57:53.333057	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	47233	8000	221.14.188.19	192.168.2.16
05/06/24-04:57:48.398705	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4000	8000	117.204.196.193	192.168.2.16
05/06/24-04:57:53.391529	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6621	8000	117.222.251.146	192.168.2.16
05/06/24-04:56:57.951587	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8505	8000	178.72.88.93	192.168.2.16
05/06/24-04:57:09.936571	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5060	8000	182.119.188.84	192.168.2.16
05/06/24-04:57:29.406786	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8080	8000	117.204.192.6	192.168.2.16
05/06/24-04:57:44.856859	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	61653	8000	117.215.255.17	192.168.2.16
05/06/24-04:57:18.315700	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30301	8000	117.248.41.238	192.168.2.16
05/06/24-04:57:21.423104	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	25759	8000	117.201.3.242	192.168.2.16
05/06/24-04:57:16.720952	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	50279	8000	117.194.166.233	192.168.2.16
05/06/24-04:57:48.092528	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8083	8000	42.225.218.4	192.168.2.16
05/06/24-04:57:29.154895	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4000	8000	117.248.17.169	192.168.2.16
05/06/24-04:57:42.463594	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6881	8000	218.61.110.165	192.168.2.16
05/06/24-04:57:41.597542	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30301	8000	124.235.243.25	192.168.2.16
05/06/24-04:57:07.987059	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8080	8000	157.211.1.243	192.168.2.16
05/06/24-04:57:40.493012	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	53286	8000	117.204.196.25	192.168.2.16
05/06/24-04:57:31.154904	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	9007	8000	188.150.231.39	192.168.2.16
05/06/24-04:57:52.715539	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	58141	8000	1.10.212.37	192.168.2.16
05/06/24-04:57:16.828449	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	32424	8000	117.204.205.89	192.168.2.16
05/06/24-04:57:11.197720	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8083	8000	27.207.162.152	192.168.2.16
05/06/24-04:56:43.406321	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	22715	8000	120.211.183.3	192.168.2.16
05/06/24-04:57:53.531962	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30034	8000	211.150.84.20	192.168.2.16
05/06/24-04:57:16.709333	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	21078	8000	59.89.207.109	192.168.2.16
05/06/24-04:57:09.714252	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	9825	8000	120.86.255.150	192.168.2.16
05/06/24-04:57:13.839679	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	11211	8000	117.222.253.43	192.168.2.16
05/06/24-04:57:34.174908	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5060	8000	112.242.43.175	192.168.2.16
05/06/24-04:57:06.940326	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	11396	8000	115.49.26.188	192.168.2.16
05/06/24-04:57:26.689048	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5353	8000	123.129.133.153	192.168.2.16
05/06/24-04:57:52.504459	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	40234	8000	112.248.69.209	192.168.2.16
05/06/24-04:57:38.000244	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	12938	8000	182.119.183.8	192.168.2.16
05/06/24-04:57:38.701463	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5060	8000	123.12.25.187	192.168.2.16
05/06/24-04:57:43.223381	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	56700	8000	59.93.25.165	192.168.2.16
05/06/24-04:57:52.410342	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30301	8000	115.56.57.254	192.168.2.16
05/06/24-04:57:42.411952	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	16873	8000	219.155.42.190	192.168.2.16
05/06/24-04:57:20.747091	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8081	8000	117.204.192.112	192.168.2.16
05/06/24-04:57:05.345331	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6881	8000	123.10.3.172	192.168.2.16
05/06/24-04:57:35.182278	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	64523	8000	42.224.1.160	192.168.2.16
05/06/24-04:57:24.420200	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30872	8000	115.52.151.248	192.168.2.16
05/06/24-04:57:53.243224	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	41606	8000	117.194.200.94	192.168.2.16
05/06/24-04:57:31.156331	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	2356	8000	178.72.71.230	192.168.2.16
05/06/24-04:57:10.314543	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	31891	8000	117.221.74.43	192.168.2.16
05/06/24-04:57:32.281724	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30301	8000	117.222.226.188	192.168.2.16
05/06/24-04:57:53.591487	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4000	8000	42.224.5.140	192.168.2.16
05/06/24-04:57:36.233147	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	57154	8000	1.10.212.37	192.168.2.16
05/06/24-04:57:30.304760	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	52259	8000	27.215.82.59	192.168.2.16
05/06/24-04:57:36.799502	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	49781	8000	117.215.246.197	192.168.2.16
05/06/24-04:57:52.050913	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	20131	8000	117.204.194.55	192.168.2.16
05/06/24-04:57:28.910580	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8080	8000	39.81.137.240	192.168.2.16
05/06/24-04:57:50.044942	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30301	8000	117.252.163.184	192.168.2.16
05/06/24-04:57:04.664389	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5060	8000	42.237.116.219	192.168.2.16
05/06/24-04:57:14.123801	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	44608	8000	117.201.108.93	192.168.2.16
05/06/24-04:57:33.873437	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5191	8000	117.248.19.118	192.168.2.16
05/06/24-04:57:33.900655	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	10933	8000	222.137.113.60	192.168.2.16
05/06/24-04:57:14.078792	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8083	8000	59.99.131.143	192.168.2.16
05/06/24-04:57:19.527248	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	48974	8000	112.239.96.126	192.168.2.16
05/06/24-04:57:52.496725	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	27409	8000	222.138.163.153	192.168.2.16
05/06/24-04:57:18.336350	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	15421	8000	59.93.23.92	192.168.2.16
05/06/24-04:57:07.442712	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	64355	8000	113.238.67.29	192.168.2.16
05/06/24-04:57:51.291817	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8080	8000	116.68.162.158	192.168.2.16
05/06/24-04:57:48.072487	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	15591	8000	115.52.250.211	192.168.2.16
05/06/24-04:57:28.034019	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	28879	8000	223.13.61.70	192.168.2.16
05/06/24-04:57:50.819917	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1076	8000	120.85.113.189	192.168.2.16
05/06/24-04:57:44.286362	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	47806	8000	117.204.204.248	192.168.2.16
05/06/24-04:57:36.461724	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8083	8000	115.54.79.176	192.168.2.16
05/06/24-04:57:47.144684	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	57674	8000	113.228.133.250	192.168.2.16
05/06/24-04:57:52.589340	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	53815	8000	117.204.207.188	192.168.2.16
05/06/24-04:57:36.294461	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8082	8000	178.141.211.40	192.168.2.16
05/06/24-04:57:52.881953	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	25629	8000	123.11.105.66	192.168.2.16
05/06/24-04:57:41.656853	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	32280	8000	115.60.202.57	192.168.2.16
05/06/24-04:57:03.704144	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6881	8000	117.206.176.227	192.168.2.16
05/06/24-04:57:12.535574	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	45745	8000	117.204.204.6	192.168.2.16
05/06/24-04:57:40.827544	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	31753	8000	117.204.203.72	192.168.2.16
05/06/24-04:56:55.702709	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	31173	8000	190.109.227.211	192.168.2.16
05/06/24-04:57:50.068240	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	64979	8000	81.232.48.63	192.168.2.16
05/06/24-04:57:19.287670	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	24616	8000	115.55.194.3	192.168.2.16
05/06/24-04:57:51.089623	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	19240	8000	120.86.255.57	192.168.2.16
05/06/24-04:57:48.520629	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4000	8000	120.56.3.131	192.168.2.16
05/06/24-04:57:37.064496	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	22795	8000	120.85.114.157	192.168.2.16
05/06/24-04:57:12.167291	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8081	8000	42.177.198.181	192.168.2.16
05/06/24-04:56:46.835320	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	55940	8000	39.74.4.17	192.168.2.16
05/06/24-04:57:53.670267	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	19242	8000	1.10.212.33	192.168.2.16
05/06/24-04:56:48.891932	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8082	8000	120.56.0.237	192.168.2.16
05/06/24-04:57:45.676579	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30301	8000	115.56.179.134	192.168.2.16
05/06/24-04:56:43.354577	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	39703	8000	117.204.202.8	192.168.2.16
05/06/24-04:57:41.462032	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	16714	8000	120.85.118.247	192.168.2.16
05/06/24-04:57:19.040009	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	40330	8000	175.148.210.248	192.168.2.16
05/06/24-04:57:00.934127	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	32865	8000	175.166.5.244	192.168.2.16
05/06/24-04:57:16.724456	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	55318	8000	117.200.184.210	192.168.2.16
05/06/24-04:57:34.493537	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1961	8000	120.85.116.216	192.168.2.16
05/06/24-04:57:24.754457	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8000	8000	178.141.153.125	192.168.2.16
05/06/24-04:57:39.341317	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5353	8000	117.215.217.182	192.168.2.16
05/06/24-04:57:41.183928	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	46064	8000	123.5.150.117	192.168.2.16
05/06/24-04:57:31.252793	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8082	8000	59.182.250.191	192.168.2.16
05/06/24-04:57:33.122750	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	10721	8000	2.55.98.253	192.168.2.16
05/06/24-04:57:52.490983	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30301	8000	24.155.118.58	192.168.2.16
05/06/24-04:57:52.221055	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6881	8000	117.204.199.157	192.168.2.16
05/06/24-04:57:14.432418	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	33932	8000	27.157.170.56	192.168.2.16
05/06/24-04:57:35.281395	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	63336	8000	222.137.158.244	192.168.2.16
05/06/24-04:57:52.590947	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	14931	8000	120.85.114.63	192.168.2.16
05/06/24-04:57:24.416132	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5060	8000	222.134.173.76	192.168.2.16
05/06/24-04:57:13.134535	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	28164	8000	117.201.7.216	192.168.2.16
05/06/24-04:57:19.905556	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5353	8000	117.243.247.195	192.168.2.16
05/06/24-04:56:56.752817	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5353	8000	117.215.212.4	192.168.2.16
05/06/24-04:57:06.833431	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	53618	8000	117.255.83.178	192.168.2.16
05/06/24-04:57:45.273309	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	18739	8000	110.42.235.42	192.168.2.16
05/06/24-04:57:21.415694	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	7850	8000	222.132.104.176	192.168.2.16
05/06/24-04:57:14.030875	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	44913	8000	1.10.212.35	192.168.2.16
05/06/24-04:57:43.225490	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8081	8000	59.182.247.182	192.168.2.16
05/06/24-04:57:52.829660	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5576	8000	1.10.212.36	192.168.2.16
05/06/24-04:57:01.372918	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	54241	8000	117.204.203.236	192.168.2.16
05/06/24-04:57:11.143549	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30301	8000	123.8.81.152	192.168.2.16
05/06/24-04:57:35.660370	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	56923	8000	117.204.201.88	192.168.2.16
05/06/24-04:57:17.256904	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8081	8000	117.205.58.18	192.168.2.16
05/06/24-04:57:17.288235	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	34907	8000	113.231.249.196	192.168.2.16
05/06/24-04:57:19.130065	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	20046	8000	1.10.212.36	192.168.2.16
05/06/24-04:57:27.880928	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	7459	8000	178.72.81.231	192.168.2.16
05/06/24-04:57:10.454704	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8082	8000	182.112.156.39	192.168.2.16
05/06/24-04:57:19.723595	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8080	8000	59.92.189.86	192.168.2.16
05/06/24-04:56:47.778868	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	62741	8000	59.89.70.39	192.168.2.16
05/06/24-04:56:53.027094	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30003	8000	112.242.87.123	192.168.2.16
05/06/24-04:57:52.220783	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	44715	8000	117.204.194.125	192.168.2.16
05/06/24-04:57:35.639782	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	13472	8000	178.72.76.39	192.168.2.16
05/06/24-04:57:15.099018	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	2192	8000	117.248.17.148	192.168.2.16
05/06/24-04:57:12.151850	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	11211	8000	117.215.222.219	192.168.2.16
05/06/24-04:57:00.146481	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8083	8000	182.117.117.236	192.168.2.16
05/06/24-04:57:50.500561	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8080	8000	24.242.46.78	192.168.2.16
05/06/24-04:57:27.057300	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6881	8000	182.113.213.176	192.168.2.16
05/06/24-04:57:15.554492	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30244	8000	117.251.165.169	192.168.2.16
05/06/24-04:57:21.294849	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	18235	8000	81.182.189.101	192.168.2.16
05/06/24-04:57:19.462190	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8081	8000	59.89.198.233	192.168.2.16
05/06/24-04:56:55.623620	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	21205	8000	117.201.11.4	192.168.2.16
05/06/24-04:57:15.048732	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6587	8000	117.208.232.40	192.168.2.16
05/06/24-04:57:28.423527	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	12086	8000	59.91.190.128	192.168.2.16
05/06/24-04:57:06.905771	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	3109	8000	222.140.171.151	192.168.2.16
05/06/24-04:57:52.135324	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8082	8000	117.196.39.51	192.168.2.16
05/06/24-04:56:42.213210	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30301	8000	42.59.206.141	192.168.2.16
05/06/24-04:56:46.748871	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8083	8000	120.211.137.182	192.168.2.16
05/06/24-04:57:07.166762	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	11211	8000	95.169.197.246	192.168.2.16
05/06/24-04:57:03.932326	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8081	8000	115.50.216.157	192.168.2.16
05/06/24-04:57:18.326845	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30301	8000	59.88.179.47	192.168.2.16
05/06/24-04:57:18.330388	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	46363	8000	222.247.8.15	192.168.2.16
05/06/24-04:56:58.035737	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	47086	8000	114.218.141.66	192.168.2.16
05/06/24-04:57:25.919710	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	22710	8000	178.141.154.132	192.168.2.16
05/06/24-04:57:36.486602	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6881	8000	60.216.254.16	192.168.2.16
05/06/24-04:57:14.375941	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	47083	8000	117.206.185.199	192.168.2.16
05/06/24-04:56:53.332060	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4000	8000	111.70.31.106	192.168.2.16
05/06/24-04:57:20.948219	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8081	8000	117.248.31.179	192.168.2.16
05/06/24-04:57:28.283770	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1027	8000	182.124.35.104	192.168.2.16
05/06/24-04:57:10.155596	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	15388	8000	178.72.71.66	192.168.2.16
05/06/24-04:57:22.579028	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5353	8000	117.204.198.180	192.168.2.16
05/06/24-04:57:23.302456	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8082	8000	117.207.77.22	192.168.2.16
05/06/24-04:57:51.673404	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5060	8000	222.142.222.207	192.168.2.16
05/06/24-04:57:46.533664	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8082	8000	117.204.197.76	192.168.2.16
05/06/24-04:57:17.510567	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	60210	8000	27.37.87.197	192.168.2.16
05/06/24-04:57:46.162395	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8000	8000	219.156.175.192	192.168.2.16
05/06/24-04:57:28.229328	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	41512	8000	42.239.240.239	192.168.2.16
05/06/24-04:57:01.320985	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30301	8000	117.248.51.122	192.168.2.16
05/06/24-04:57:28.414101	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5060	8000	117.241.42.226	192.168.2.16
05/06/24-04:57:50.844837	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5353	8000	182.124.119.225	192.168.2.16
05/06/24-04:56:47.785611	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5060	8000	14.155.221.46	192.168.2.16
05/06/24-04:57:48.951870	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8081	8000	115.51.120.251	192.168.2.16
05/06/24-04:57:39.179336	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	7045	8000	113.231.217.163	192.168.2.16
05/06/24-04:57:22.034135	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8083	8000	59.93.19.249	192.168.2.16
05/06/24-04:57:13.116932	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8083	8000	117.215.208.106	192.168.2.16
05/06/24-04:57:03.557523	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5060	8000	42.239.188.170	192.168.2.16
05/06/24-04:57:16.846268	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5353	8000	112.248.190.83	192.168.2.16
05/06/24-04:57:39.817709	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	56396	8000	117.201.1.45	192.168.2.16
05/06/24-04:57:53.401114	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4390	8000	120.86.252.142	192.168.2.16
05/06/24-04:57:28.925134	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4000	8000	117.204.200.191	192.168.2.16
05/06/24-04:57:40.309117	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5786	8000	115.50.44.165	192.168.2.16
05/06/24-04:57:35.897526	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8080	8000	117.247.104.212	192.168.2.16
05/06/24-04:57:15.852998	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8082	8000	123.8.161.46	192.168.2.16
05/06/24-04:57:24.854948	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	47145	8000	178.141.160.235	192.168.2.16
05/06/24-04:57:14.154671	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	54480	8000	221.15.7.234	192.168.2.16
05/06/24-04:57:03.598551	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	9482	8000	117.204.193.137	192.168.2.16
05/06/24-04:57:10.794984	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	29452	8000	27.215.209.34	192.168.2.16
05/06/24-04:56:56.281918	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	23027	8000	117.213.119.47	192.168.2.16
05/06/24-04:57:49.924231	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8080	8000	103.40.255.245	192.168.2.16
05/06/24-04:57:34.476851	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6881	8000	117.222.254.246	192.168.2.16
05/06/24-04:57:08.595387	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1057	8000	182.127.10.178	192.168.2.16
05/06/24-04:56:41.200429	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	54831	8000	123.9.195.230	192.168.2.16
05/06/24-04:56:52.099482	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8000	8000	221.15.189.62	192.168.2.16
05/06/24-04:57:03.910081	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	60508	8000	39.91.82.241	192.168.2.16
05/06/24-04:57:33.229733	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	9050	8000	182.120.249.219	192.168.2.16
05/06/24-04:57:20.668354	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	2530	8000	178.72.75.250	192.168.2.16
05/06/24-04:57:44.227514	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6881	8000	117.204.204.150	192.168.2.16
05/06/24-04:56:42.860979	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4148	8000	117.202.72.16	192.168.2.16
05/06/24-04:57:43.652477	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6881	8000	113.236.105.239	192.168.2.16
05/06/24-04:57:30.368164	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5060	8000	117.204.206.14	192.168.2.16
05/06/24-04:57:16.222604	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	15465	8000	119.189.215.205	192.168.2.16
05/06/24-04:56:58.842302	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8080	8000	182.124.168.209	192.168.2.16
05/06/24-04:57:42.304811	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5353	8000	117.202.76.122	192.168.2.16
05/06/24-04:57:24.547285	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5353	8000	221.230.38.202	192.168.2.16
05/06/24-04:57:43.850237	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	25918	8000	117.254.58.40	192.168.2.16
05/06/24-04:57:33.610290	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	3588	8000	196.191.231.12	192.168.2.16
05/06/24-04:57:35.693977	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1536	8000	95.32.198.228	192.168.2.16
05/06/24-04:57:27.046702	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6881	8000	117.204.200.240	192.168.2.16
05/06/24-04:57:33.022280	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8083	8000	117.204.194.151	192.168.2.16
05/06/24-04:57:11.020991	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	65175	8000	112.242.167.52	192.168.2.16
05/06/24-04:57:02.698814	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8000	8000	117.204.192.203	192.168.2.16
05/06/24-04:57:18.093840	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8080	8000	117.215.210.66	192.168.2.16
05/06/24-04:56:51.134136	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	11054	8000	222.138.119.36	192.168.2.16
05/06/24-04:57:48.169281	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6881	8000	1.70.87.160	192.168.2.16
05/06/24-04:57:36.484332	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5972	8000	115.49.25.205	192.168.2.16
05/06/24-04:57:42.426824	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30734	8000	83.97.73.228	192.168.2.16
05/06/24-04:57:49.401877	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	55764	8000	1.10.212.33	192.168.2.16
05/06/24-04:56:57.761908	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	46287	8000	117.252.192.87	192.168.2.16
05/06/24-04:57:01.053242	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8000	8000	27.210.156.182	192.168.2.16
05/06/24-04:57:01.401671	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6881	8000	182.243.157.74	192.168.2.16
05/06/24-04:57:14.046070	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1900	8000	123.194.35.224	192.168.2.16
05/06/24-04:57:43.562281	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1027	8000	117.248.47.91	192.168.2.16
05/06/24-04:57:41.729393	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	31068	8000	117.208.233.222	192.168.2.16
05/06/24-04:57:16.731804	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	55499	8000	117.202.65.104	192.168.2.16
05/06/24-04:57:53.286342	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8000	8000	123.130.4.251	192.168.2.16
05/06/24-04:57:25.251064	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	2476	8000	178.72.76.102	192.168.2.16
05/06/24-04:56:52.418543	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8000	8000	114.104.155.242	192.168.2.16
05/06/24-04:57:34.933716	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	23451	8000	160.153.235.195	192.168.2.16
05/06/24-04:57:53.609605	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	26176	8000	123.132.181.53	192.168.2.16
05/06/24-04:57:53.306650	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	44230	8000	1.10.212.37	192.168.2.16
05/06/24-04:56:51.980458	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	34281	8000	117.63.114.20	192.168.2.16
05/06/24-04:57:46.842087	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30301	8000	182.120.61.120	192.168.2.16
05/06/24-04:57:25.659128	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4000	8000	182.127.177.158	192.168.2.16
05/06/24-04:57:50.917685	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30301	8000	45.229.174.165	192.168.2.16
05/06/24-04:56:44.439267	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4000	8000	156.155.112.139	192.168.2.16
05/06/24-04:57:36.414770	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8000	8000	117.192.120.105	192.168.2.16
05/06/24-04:57:52.441360	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	43302	8000	59.93.190.104	192.168.2.16
05/06/24-04:56:38.410483	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	40901	8000	125.41.208.128	192.168.2.16
05/06/24-04:56:52.727851	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	41856	8000	111.61.93.5	192.168.2.16
05/06/24-04:57:13.669881	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	3442	8000	112.83.1.68	192.168.2.16
05/06/24-04:57:15.026653	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8081	8000	117.235.103.30	192.168.2.16
05/06/24-04:57:45.157118	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	57668	8000	117.222.255.43	192.168.2.16
05/06/24-04:57:47.367519	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	24582	8000	120.85.112.192	192.168.2.16
05/06/24-04:57:13.137950	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	22671	8000	115.55.181.56	192.168.2.16
05/06/24-04:57:50.631896	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5060	8000	45.119.84.144	192.168.2.16
05/06/24-04:57:13.123734	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	10816	8000	120.35.47.102	192.168.2.16
05/06/24-04:57:50.388436	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	51109	8000	117.220.56.180	192.168.2.16
05/06/24-04:57:18.519064	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5353	8000	42.227.2.139	192.168.2.16
05/06/24-04:57:15.818948	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	25110	8000	91.219.171.20	192.168.2.16
05/06/24-04:57:26.134786	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	47390	8000	117.204.203.185	192.168.2.16
05/06/24-04:57:15.024824	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6881	8000	42.230.41.246	192.168.2.16
05/06/24-04:57:36.717810	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	54428	8000	115.49.75.234	192.168.2.16
05/06/24-04:57:06.870276	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	14627	8000	120.85.183.45	192.168.2.16
05/06/24-04:57:27.178838	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	30301	8000	219.157.198.116	192.168.2.16
05/06/24-04:56:50.605561	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	61120	8000	80.202.217.118	192.168.2.16
05/06/24-04:57:50.881816	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	17738	8000	178.72.77.222	192.168.2.16
05/06/24-04:57:53.335341	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6301	8000	178.72.88.114	192.168.2.16
05/06/24-04:57:07.152177	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	46072	8000	182.126.78.17	192.168.2.16
05/06/24-04:57:05.786975	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	11211	8000	117.212.62.54	192.168.2.16
05/06/24-04:57:23.829308	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	11673	8000	193.234.64.121	192.168.2.16
05/06/24-04:56:42.214211	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	22502	8000	175.173.94.100	192.168.2.16
05/06/24-04:57:47.059654	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	51090	8000	189.174.100.153	192.168.2.16
05/06/24-04:56:52.290171	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	53127	8000	117.204.201.245	192.168.2.16
05/06/24-04:57:15.867486	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	17543	8000	115.61.177.9	192.168.2.16
05/06/24-04:57:22.709623	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	18836	8000	27.202.31.103	192.168.2.16
05/06/24-04:57:33.761569	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	20520	8000	47.222.117.185	192.168.2.16
05/06/24-04:57:53.295886	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	21223	8000	59.89.67.254	192.168.2.16
05/06/24-04:57:25.752903	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	28820	8000	91.239.77.159	192.168.2.16
05/06/24-04:57:12.162678	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	20514	8000	117.220.150.108	192.168.2.16
05/06/24-04:57:28.892409	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	46181	8000	1.10.212.38	192.168.2.16
05/06/24-04:57:08.057624	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4000	8000	117.204.201.129	192.168.2.16
05/06/24-04:57:16.231941	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	27017	8000	182.60.1.148	192.168.2.16
05/06/24-04:57:32.638334	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	37725	8000	117.204.201.252	192.168.2.16
05/06/24-04:57:44.725182	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6881	8000	59.93.185.25	192.168.2.16
05/06/24-04:57:37.992491	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1027	8000	117.199.14.219	192.168.2.16
05/06/24-04:56:53.945291	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	36160	8000	222.138.100.11	192.168.2.16
05/06/24-04:57:39.919155	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8083	8000	112.248.80.118	192.168.2.16
05/06/24-04:56:47.778656	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	11211	8000	124.234.158.191	192.168.2.16
05/06/24-04:57:23.980473	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	23167	8000	117.204.203.123	192.168.2.16
05/06/24-04:57:27.025152	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	36160	8000	27.202.212.226	192.168.2.16
05/06/24-04:57:47.346029	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	43453	8000	117.204.201.232	192.168.2.16
05/06/24-04:57:07.549919	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	26860	8000	42.4.96.111	192.168.2.16
05/06/24-04:57:17.179853	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5060	8000	61.53.88.225	192.168.2.16
05/06/24-04:57:03.667363	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4845	8000	61.3.95.214	192.168.2.16
05/06/24-04:57:16.723719	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8082	8000	117.248.30.127	192.168.2.16
05/06/24-04:57:36.103684	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	19456	8000	123.4.58.219	192.168.2.16
05/06/24-04:57:22.663108	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1027	8000	117.215.216.182	192.168.2.16
05/06/24-04:57:36.210606	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	17931	8000	120.85.182.220	192.168.2.16
05/06/24-04:57:47.704815	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	3341	8000	178.72.81.119	192.168.2.16
05/06/24-04:57:48.579714	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8082	8000	117.220.148.104	192.168.2.16
05/06/24-04:57:37.354088	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	16508	8000	1.241.172.105	192.168.2.16
05/06/24-04:57:16.902383	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	26449	8000	222.139.74.112	192.168.2.16
05/06/24-04:57:52.378619	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	34483	8000	117.204.193.71	192.168.2.16
05/06/24-04:57:52.490726	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	2049	8000	95.32.95.235	192.168.2.16
05/06/24-04:57:52.852751	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8080	8000	182.121.241.3	192.168.2.16
05/06/24-04:57:01.767892	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	34685	8000	88.234.130.44	192.168.2.16
05/06/24-04:57:46.528229	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4000	8000	27.207.227.15	192.168.2.16
05/06/24-04:57:19.462844	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	10615	8000	61.53.111.77	192.168.2.16
05/06/24-04:57:50.234661	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6881	8000	222.134.174.86	192.168.2.16
05/06/24-04:57:15.622868	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8080	8000	42.239.238.40	192.168.2.16
05/06/24-04:57:13.561523	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	11211	8000	117.204.195.186	192.168.2.16
05/06/24-04:57:13.196924	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	46103	8000	117.204.193.171	192.168.2.16
05/06/24-04:57:05.828743	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8081	8000	117.204.204.13	192.168.2.16
05/06/24-04:57:03.405735	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6881	8000	182.120.51.148	192.168.2.16
05/06/24-04:57:33.172697	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4000	8000	59.96.134.239	192.168.2.16
05/06/24-04:57:52.493459	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	17932	8000	123.13.56.150	192.168.2.16
05/06/24-04:57:33.407216	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	19603	8000	117.202.67.157	192.168.2.16
05/06/24-04:57:11.559695	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	5698	8000	182.127.183.40	192.168.2.16
05/06/24-04:57:42.467995	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	18145	8000	90.159.4.179	192.168.2.16
05/06/24-04:56:56.726731	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8083	8000	123.5.186.112	192.168.2.16
05/06/24-04:57:27.309148	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6881	8000	219.157.219.131	192.168.2.16
05/06/24-04:57:21.467567	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	23221	8000	117.235.34.245	192.168.2.16
05/06/24-04:56:44.646858	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	20455	8000	117.215.215.202	192.168.2.16
05/06/24-04:57:52.174189	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	11792	8000	125.24.157.223	192.168.2.16
05/06/24-04:57:53.396000	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	53151	8000	59.89.68.132	192.168.2.16
05/06/24-04:57:39.418648	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	58178	8000	123.5.126.66	192.168.2.16
05/06/24-04:56:48.728430	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	4486	8000	117.194.167.124	192.168.2.16
05/06/24-04:57:27.447775	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	56572	8000	210.22.177.142	192.168.2.16
05/06/24-04:57:31.267451	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	38528	8000	103.239.175.169	192.168.2.16
05/06/24-04:57:27.640592	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	11395	8000	117.201.15.246	192.168.2.16
05/06/24-04:57:16.309742	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8758	8000	120.86.255.218	192.168.2.16
05/06/24-04:57:27.655684	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	61830	8000	1.10.212.33	192.168.2.16
05/06/24-04:57:32.216748	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	3468	8000	59.89.5.154	192.168.2.16
05/06/24-04:56:57.854486	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	35335	8000	120.37.237.66	192.168.2.16
05/06/24-04:56:48.833860	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1574	8000	178.72.77.243	192.168.2.16
05/06/24-04:57:46.286459	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8081	8000	27.7.206.74	192.168.2.16
05/06/24-04:57:19.230061	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	39153	8000	125.47.241.124	192.168.2.16
05/06/24-04:56:57.889045	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8080	8000	27.6.206.197	192.168.2.16
05/06/24-04:57:53.563526	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	25305	8000	117.248.22.38	192.168.2.16
05/06/24-04:57:42.182873	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	42389	8000	111.70.25.62	192.168.2.16
05/06/24-04:57:46.747277	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6774	8000	59.93.28.47	192.168.2.16
05/06/24-04:57:35.430722	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	9253	8000	24.50.234.61	192.168.2.16
05/06/24-04:57:17.522912	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	28942	8000	117.200.177.161	192.168.2.16
05/06/24-04:57:49.521388	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	12704	8000	120.85.113.20	192.168.2.16
05/06/24-04:57:38.045768	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	1027	8000	117.204.194.90	192.168.2.16
05/06/24-04:57:24.579349	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	47317	8000	95.134.34.192	192.168.2.16
05/06/24-04:57:23.311215	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	50104	8000	59.92.189.210	192.168.2.16
05/06/24-04:57:11.621638	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	6881	8000	115.55.231.16	192.168.2.16
05/06/24-04:57:51.809645	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8080	8000	83.219.1.198	192.168.2.16
05/06/24-04:57:42.777756	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8080	8000	117.204.197.52	192.168.2.16
05/06/24-04:57:52.750781	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	52051	8000	1.10.212.33	192.168.2.16
05/06/24-04:56:55.788847	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	16787	8000	182.121.23.170	192.168.2.16
05/06/24-04:57:47.827968	UDP	2030919	ET TROJAN Mozi Botnet DHT Config Sent	8080	8000	59.93.182.219	192.168.2.16

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 6, 2024 04:56:37.960405111 CEST	49709	21	192.168.2.16	166.148.200.249
May 6, 2024 04:56:37.960494041 CEST	49710	2121	192.168.2.16	166.148.200.249
May 6, 2024 04:56:37.960516930 CEST	49711	21	192.168.2.16	35.137.203.142
May 6, 2024 04:56:37.961570024 CEST	49712	21	192.168.2.16	140.190.24.113
May 6, 2024 04:56:37.961658955 CEST	49713	2121	192.168.2.16	35.137.203.142
May 6, 2024 04:56:37.961743116 CEST	49714	2121	192.168.2.16	140.190.24.113
May 6, 2024 04:56:37.962460995 CEST	49715	21	192.168.2.16	213.249.245.75
May 6, 2024 04:56:37.963043928 CEST	49716	2121	192.168.2.16	213.249.245.75
May 6, 2024 04:56:37.963151932 CEST	49717	21	192.168.2.16	164.70.186.78
May 6, 2024 04:56:37.963572025 CEST	49718	2121	192.168.2.16	164.70.186.78
May 6, 2024 04:56:37.964031935 CEST	49719	21	192.168.2.16	100.15.75.145
May 6, 2024 04:56:37.964936018 CEST	49720	2121	192.168.2.16	100.15.75.145
May 6, 2024 04:56:37.964970112 CEST	49721	21	192.168.2.16	70.124.10.255
May 6, 2024 04:56:37.966218948 CEST	49722	2121	192.168.2.16	70.124.10.255
May 6, 2024 04:56:37.966538906 CEST	49723	21	192.168.2.16	104.67.188.105
May 6, 2024 04:56:37.966851950 CEST	49724	2121	192.168.2.16	104.67.188.105
May 6, 2024 04:56:37.967402935 CEST	49725	21	192.168.2.16	88.142.184.208
May 6, 2024 04:56:37.967495918 CEST	49726	2121	192.168.2.16	88.142.184.208
May 6, 2024 04:56:37.968456984 CEST	49727	2121	192.168.2.16	92.15.231.140
May 6, 2024 04:56:37.968529940 CEST	49728	21	192.168.2.16	92.15.231.140
May 6, 2024 04:56:37.969090939 CEST	49729	21	192.168.2.16	75.174.68.132
May 6, 2024 04:56:37.969229937 CEST	49730	2121	192.168.2.16	75.174.68.132
May 6, 2024 04:56:37.969599962 CEST	49731	21	192.168.2.16	201.113.164.51
May 6, 2024 04:56:37.970055103 CEST	49732	2121	192.168.2.16	201.113.164.51
May 6, 2024 04:56:37.971039057 CEST	49733	21	192.168.2.16	36.84.169.30
May 6, 2024 04:56:37.971493006 CEST	49734	2121	192.168.2.16	36.84.169.30
May 6, 2024 04:56:37.971579075 CEST	49735	21	192.168.2.16	73.35.188.189
May 6, 2024 04:56:37.972060919 CEST	49736	2121	192.168.2.16	73.35.188.189
May 6, 2024 04:56:37.972691059 CEST	49737	21	192.168.2.16	105.68.254.0
May 6, 2024 04:56:37.972912073 CEST	49738	2121	192.168.2.16	105.68.254.0
May 6, 2024 04:56:37.973279953 CEST	49739	21	192.168.2.16	90.215.132.151
May 6, 2024 04:56:37.973678112 CEST	49740	2121	192.168.2.16	90.215.132.151
May 6, 2024 04:56:37.974102974 CEST	49741	21	192.168.2.16	100.36.47.116
May 6, 2024 04:56:37.974344969 CEST	49742	2121	192.168.2.16	100.36.47.116
May 6, 2024 04:56:37.975081921 CEST	49743	21	192.168.2.16	115.74.91.137
May 6, 2024 04:56:37.975438118 CEST	49744	2121	192.168.2.16	115.74.91.137
May 6, 2024 04:56:37.976080894 CEST	49745	21	192.168.2.16	86.124.13.69
May 6, 2024 04:56:37.976583004 CEST	49746	2121	192.168.2.16	86.124.13.69
May 6, 2024 04:56:37.976797104 CEST	49747	21	192.168.2.16	20.75.38.29
May 6, 2024 04:56:37.977008104 CEST	49748	2121	192.168.2.16	20.75.38.29
May 6, 2024 04:56:37.977341890 CEST	49749	21	192.168.2.16	24.130.57.109
May 6, 2024 04:56:37.978075027 CEST	49750	2121	192.168.2.16	24.130.57.109
May 6, 2024 04:56:37.978467941 CEST	49751	21	192.168.2.16	187.200.140.177
May 6, 2024 04:56:37.978977919 CEST	49752	2121	192.168.2.16	187.200.140.177
May 6, 2024 04:56:37.979104996 CEST	49753	21	192.168.2.16	90.193.156.199
May 6, 2024 04:56:37.979805946 CEST	49754	2121	192.168.2.16	90.193.156.199
May 6, 2024 04:56:37.980494022 CEST	49755	21	192.168.2.16	150.220.125.58
May 6, 2024 04:56:37.980539083 CEST	49756	2121	192.168.2.16	150.220.125.58
May 6, 2024 04:56:37.981031895 CEST	49757	21	192.168.2.16	20.222.8.129
May 6, 2024 04:56:37.981713057 CEST	49758	2121	192.168.2.16	20.222.8.129
May 6, 2024 04:56:37.981805086 CEST	49759	21	192.168.2.16	103.162.154.23
May 6, 2024 04:56:37.982181072 CEST	49760	2121	192.168.2.16	103.162.154.23
May 6, 2024 04:56:37.982742071 CEST	49761	21	192.168.2.16	187.159.2.51
May 6, 2024 04:56:37.983262062 CEST	49762	2121	192.168.2.16	187.159.2.51
May 6, 2024 04:56:37.983722925 CEST	49763	21	192.168.2.16	73.63.91.71
May 6, 2024 04:56:37.984152079 CEST	49764	2121	192.168.2.16	73.63.91.71
May 6, 2024 04:56:37.984424114 CEST	49765	21	192.168.2.16	213.166.90.11
May 6, 2024 04:56:37.985099077 CEST	49766	2121	192.168.2.16	213.166.90.11
May 6, 2024 04:56:37.985554934 CEST	49767	2121	192.168.2.16	82.39.124.216
May 6, 2024 04:56:37.985966921 CEST	49768	21	192.168.2.16	82.39.124.216
May 6, 2024 04:56:37.986140013 CEST	49769	21	192.168.2.16	84.217.90.112
May 6, 2024 04:56:37.986486912 CEST	49770	2121	192.168.2.16	84.217.90.112
May 6, 2024 04:56:37.986706018 CEST	49771	21	192.168.2.16	178.234.143.20
May 6, 2024 04:56:37.987303019 CEST	49772	2121	192.168.2.16	178.234.143.20
May 6, 2024 04:56:37.987937927 CEST	49773	21	192.168.2.16	196.84.198.19
May 6, 2024 04:56:37.988365889 CEST	49774	2121	192.168.2.16	196.84.198.19
May 6, 2024 04:56:37.988715887 CEST	49775	21	192.168.2.16	174.118.107.167
May 6, 2024 04:56:37.989206076 CEST	49776	2121	192.168.2.16	174.118.107.167
May 6, 2024 04:56:37.989269018 CEST	49777	21	192.168.2.16	111.226.215.4
May 6, 2024 04:56:37.990243912 CEST	49778	2121	192.168.2.16	111.226.215.4
May 6, 2024 04:56:37.990586042 CEST	49779	21	192.168.2.16	5.142.219.193
May 6, 2024 04:56:37.991185904 CEST	49780	21	192.168.2.16	173.178.93.163
May 6, 2024 04:56:37.991477013 CEST	49781	2121	192.168.2.16	5.142.219.193
May 6, 2024 04:56:37.991839886 CEST	49782	2121	192.168.2.16	173.178.93.163
May 6, 2024 04:56:37.991954088 CEST	49783	21	192.168.2.16	73.189.43.14
May 6, 2024 04:56:37.992634058 CEST	49784	2121	192.168.2.16	73.189.43.14
May 6, 2024 04:56:37.993017912 CEST	49785	21	192.168.2.16	108.183.105.128
May 6, 2024 04:56:37.993530035 CEST	49786	2121	192.168.2.16	108.183.105.128
May 6, 2024 04:56:37.993895054 CEST	49787	21	192.168.2.16	69.141.22.219
May 6, 2024 04:56:37.994179964 CEST	49788	2121	192.168.2.16	69.141.22.219
May 6, 2024 04:56:37.995429039 CEST	49789	21	192.168.2.16	142.252.53.106
May 6, 2024 04:56:37.995484114 CEST	49790	2121	192.168.2.16	142.252.53.106
May 6, 2024 04:56:37.995707035 CEST	49791	21	192.168.2.16	174.79.2.219
May 6, 2024 04:56:37.996248960 CEST	49792	21	192.168.2.16	211.219.206.145
May 6, 2024 04:56:37.996695042 CEST	49793	2121	192.168.2.16	174.79.2.219
May 6, 2024 04:56:37.997020960 CEST	49794	2121	192.168.2.16	211.219.206.145
May 6, 2024 04:56:37.997888088 CEST	49795	21	192.168.2.16	79.196.95.8
May 6, 2024 04:56:37.997973919 CEST	49796	2121	192.168.2.16	79.196.95.8
May 6, 2024 04:56:37.998334885 CEST	49797	21	192.168.2.16	70.172.40.136
May 6, 2024 04:56:37.998660088 CEST	49798	2121	192.168.2.16	70.172.40.136
May 6, 2024 04:56:37.999351978 CEST	49799	21	192.168.2.16	87.166.1.99
May 6, 2024 04:56:37.999763012 CEST	49800	2121	192.168.2.16	87.166.1.99
May 6, 2024 04:56:38.000070095 CEST	49801	21	192.168.2.16	78.21.74.104
May 6, 2024 04:56:38.000569105 CEST	49802	2121	192.168.2.16	78.21.74.104
May 6, 2024 04:56:38.000827074 CEST	49803	21	192.168.2.16	189.253.72.130
May 6, 2024 04:56:38.001594067 CEST	49804	2121	192.168.2.16	189.253.72.130
May 6, 2024 04:56:38.001739979 CEST	49805	21	192.168.2.16	123.130.44.98
May 6, 2024 04:56:38.003174067 CEST	49806	2121	192.168.2.16	123.130.44.98
May 6, 2024 04:56:38.003232002 CEST	49807	21	192.168.2.16	182.109.58.235
May 6, 2024 04:56:38.003329039 CEST	49808	2121	192.168.2.16	182.109.58.235
May 6, 2024 04:56:38.004338980 CEST	49809	21	192.168.2.16	74.129.206.76
May 6, 2024 04:56:38.004832029 CEST	49810	2121	192.168.2.16	74.129.206.76
May 6, 2024 04:56:38.005660057 CEST	49811	21	192.168.2.16	108.2.68.15
May 6, 2024 04:56:38.005681038 CEST	49812	2121	192.168.2.16	108.2.68.15
May 6, 2024 04:56:38.005858898 CEST	49813	21	192.168.2.16	72.253.247.220
May 6, 2024 04:56:38.006599903 CEST	49814	2121	192.168.2.16	72.253.247.220
May 6, 2024 04:56:38.006941080 CEST	49815	21	192.168.2.16	123.10.24.255
May 6, 2024 04:56:38.007318974 CEST	49816	2121	192.168.2.16	123.10.24.255
May 6, 2024 04:56:38.007844925 CEST	49817	21	192.168.2.16	202.190.106.215
May 6, 2024 04:56:38.008306026 CEST	49818	2121	192.168.2.16	202.190.106.215
May 6, 2024 04:56:38.008563042 CEST	49819	21	192.168.2.16	2.126.55.74
May 6, 2024 04:56:38.009305000 CEST	49820	21	192.168.2.16	71.221.146.72
May 6, 2024 04:56:38.009428024 CEST	49821	2121	192.168.2.16	2.126.55.74
May 6, 2024 04:56:38.009696960 CEST	49822	2121	192.168.2.16	71.221.146.72
May 6, 2024 04:56:38.010333061 CEST	49823	2121	192.168.2.16	14.153.184.124
May 6, 2024 04:56:38.010509014 CEST	49824	21	192.168.2.16	14.153.184.124
May 6, 2024 04:56:38.011018991 CEST	49825	21	192.168.2.16	175.250.21.18
May 6, 2024 04:56:38.011075974 CEST	49826	2121	192.168.2.16	175.250.21.18
May 6, 2024 04:56:38.011588097 CEST	49827	21	192.168.2.16	88.70.37.48
May 6, 2024 04:56:38.012747049 CEST	49828	2121	192.168.2.16	88.70.37.48
May 6, 2024 04:56:38.012763023 CEST	49829	21	192.168.2.16	190.31.92.93
May 6, 2024 04:56:38.012902975 CEST	49830	2121	192.168.2.16	190.31.92.93
May 6, 2024 04:56:38.013659000 CEST	49831	21	192.168.2.16	187.139.173.210
May 6, 2024 04:56:38.013977051 CEST	49832	2121	192.168.2.16	187.139.173.210
May 6, 2024 04:56:38.014602900 CEST	49833	21	192.168.2.16	79.157.98.21
May 6, 2024 04:56:38.015077114 CEST	49834	2121	192.168.2.16	79.157.98.21
May 6, 2024 04:56:38.015142918 CEST	49835	21	192.168.2.16	172.116.204.173
May 6, 2024 04:56:38.015867949 CEST	49837	21	192.168.2.16	149.11.204.146
May 6, 2024 04:56:38.015928984 CEST	49836	2121	192.168.2.16	172.116.204.173
May 6, 2024 04:56:38.016271114 CEST	49838	2121	192.168.2.16	149.11.204.146
May 6, 2024 04:56:38.016995907 CEST	49839	21	192.168.2.16	100.4.98.205
May 6, 2024 04:56:38.017074108 CEST	49840	2121	192.168.2.16	85.66.80.209
May 6, 2024 04:56:38.017476082 CEST	49841	2121	192.168.2.16	100.4.98.205
May 6, 2024 04:56:38.017581940 CEST	49842	21	192.168.2.16	86.8.247.4
May 6, 2024 04:56:38.017627954 CEST	49843	21	192.168.2.16	85.66.80.209
May 6, 2024 04:56:38.017858982 CEST	49844	2121	192.168.2.16	86.8.247.4
May 6, 2024 04:56:38.018244982 CEST	49845	21	192.168.2.16	49.22.166.94
May 6, 2024 04:56:38.018569946 CEST	49846	2121	192.168.2.16	49.22.166.94
May 6, 2024 04:56:38.018969059 CEST	49847	21	192.168.2.16	18.172.155.195
May 6, 2024 04:56:38.019294024 CEST	49848	2121	192.168.2.16	18.172.155.195
May 6, 2024 04:56:38.019804001 CEST	49849	21	192.168.2.16	217.103.67.136
May 6, 2024 04:56:38.020021915 CEST	49850	2121	192.168.2.16	217.103.67.136
May 6, 2024 04:56:38.020481110 CEST	49851	21	192.168.2.16	184.168.238.60
May 6, 2024 04:56:38.020713091 CEST	49852	2121	192.168.2.16	184.168.238.60
May 6, 2024 04:56:38.021199942 CEST	49853	21	192.168.2.16	88.88.34.254
May 6, 2024 04:56:38.021497011 CEST	49854	2121	192.168.2.16	88.88.34.254
May 6, 2024 04:56:38.022022963 CEST	49855	21	192.168.2.16	201.25.34.80
May 6, 2024 04:56:38.022334099 CEST	49856	2121	192.168.2.16	201.25.34.80
May 6, 2024 04:56:38.022670984 CEST	49857	21	192.168.2.16	98.11.196.125
May 6, 2024 04:56:38.023046970 CEST	49858	2121	192.168.2.16	98.11.196.125
May 6, 2024 04:56:38.023545980 CEST	49859	21	192.168.2.16	115.86.174.81
May 6, 2024 04:56:38.023849010 CEST	49860	2121	192.168.2.16	115.86.174.81
May 6, 2024 04:56:38.024269104 CEST	49861	21	192.168.2.16	163.47.81.9
May 6, 2024 04:56:38.024631977 CEST	49862	2121	192.168.2.16	163.47.81.9
May 6, 2024 04:56:38.025135040 CEST	49863	21	192.168.2.16	45.38.130.234
May 6, 2024 04:56:38.025541067 CEST	49864	2121	192.168.2.16	45.38.130.234
May 6, 2024 04:56:38.025760889 CEST	49865	21	192.168.2.16	71.62.131.219
May 6, 2024 04:56:38.026500940 CEST	49866	2121	192.168.2.16	71.62.131.219
May 6, 2024 04:56:38.026913881 CEST	49867	21	192.168.2.16	211.80.156.157
May 6, 2024 04:56:38.027188063 CEST	49868	2121	192.168.2.16	211.80.156.157
May 6, 2024 04:56:38.027761936 CEST	49869	21	192.168.2.16	69.255.144.143
May 6, 2024 04:56:38.028115988 CEST	49870	2121	192.168.2.16	69.255.144.143
May 6, 2024 04:56:38.028448105 CEST	49871	21	192.168.2.16	68.170.77.226
May 6, 2024 04:56:38.028816938 CEST	49872	2121	192.168.2.16	68.170.77.226
May 6, 2024 04:56:38.029135942 CEST	49873	21	192.168.2.16	51.137.203.141
May 6, 2024 04:56:38.029752016 CEST	49874	2121	192.168.2.16	51.137.203.141
May 6, 2024 04:56:38.030209064 CEST	49875	21	192.168.2.16	14.75.234.10
May 6, 2024 04:56:38.030597925 CEST	49876	2121	192.168.2.16	14.75.234.10
May 6, 2024 04:56:38.030889988 CEST	49877	21	192.168.2.16	90.204.82.70
May 6, 2024 04:56:38.031115055 CEST	49878	2121	192.168.2.16	90.204.82.70
May 6, 2024 04:56:38.031538010 CEST	49879	21	192.168.2.16	76.23.3.9
May 6, 2024 04:56:38.031840086 CEST	49880	2121	192.168.2.16	76.23.3.9
May 6, 2024 04:56:38.032254934 CEST	49881	21	192.168.2.16	80.197.137.196
May 6, 2024 04:56:38.032536030 CEST	49882	2121	192.168.2.16	80.197.137.196
May 6, 2024 04:56:38.032917976 CEST	49883	21	192.168.2.16	84.106.198.128
May 6, 2024 04:56:38.033282042 CEST	49884	2121	192.168.2.16	84.106.198.128
May 6, 2024 04:56:38.033809900 CEST	49885	21	192.168.2.16	38.44.1.45
May 6, 2024 04:56:38.034111023 CEST	49886	2121	192.168.2.16	38.44.1.45
May 6, 2024 04:56:38.034529924 CEST	49887	21	192.168.2.16	119.192.251.99
May 6, 2024 04:56:38.034918070 CEST	49888	2121	192.168.2.16	119.192.251.99
May 6, 2024 04:56:38.035100937 CEST	49889	21	192.168.2.16	123.144.34.49
May 6, 2024 04:56:38.035619020 CEST	49890	2121	192.168.2.16	123.144.34.49
May 6, 2024 04:56:38.035837889 CEST	49891	21	192.168.2.16	222.237.147.227
May 6, 2024 04:56:38.036247015 CEST	49892	2121	192.168.2.16	222.237.147.227
May 6, 2024 04:56:38.036734104 CEST	49893	21	192.168.2.16	112.230.77.155
May 6, 2024 04:56:38.037034988 CEST	49894	2121	192.168.2.16	112.230.77.155
May 6, 2024 04:56:38.037441015 CEST	49895	21	192.168.2.16	203.206.143.107
May 6, 2024 04:56:38.037811041 CEST	49896	2121	192.168.2.16	203.206.143.107
May 6, 2024 04:56:38.038130045 CEST	49897	21	192.168.2.16	89.46.255.178
May 6, 2024 04:56:38.038450956 CEST	49898	2121	192.168.2.16	89.46.255.178
May 6, 2024 04:56:38.038749933 CEST	49899	21	192.168.2.16	216.117.162.236
May 6, 2024 04:56:38.039129019 CEST	49900	2121	192.168.2.16	216.117.162.236
May 6, 2024 04:56:38.039503098 CEST	49901	21	192.168.2.16	2.152.179.32
May 6, 2024 04:56:38.039884090 CEST	49902	2121	192.168.2.16	2.152.179.32
May 6, 2024 04:56:38.040262938 CEST	49903	21	192.168.2.16	35.204.211.43
May 6, 2024 04:56:38.040497065 CEST	49904	2121	192.168.2.16	35.204.211.43
May 6, 2024 04:56:38.040791988 CEST	49905	21	192.168.2.16	49.170.40.102
May 6, 2024 04:56:38.041132927 CEST	49906	2121	192.168.2.16	49.170.40.102
May 6, 2024 04:56:38.041523933 CEST	49907	21	192.168.2.16	49.160.49.242
May 6, 2024 04:56:38.041678905 CEST	49908	2121	192.168.2.16	49.160.49.242
May 6, 2024 04:56:38.172338009 CEST	21	49899	216.117.162.236	192.168.2.16
May 6, 2024 04:56:38.172406912 CEST	49899	21	192.168.2.16	216.117.162.236
May 6, 2024 04:56:38.225234985 CEST	21	49737	105.68.254.0	192.168.2.16
May 6, 2024 04:56:38.227488995 CEST	2121	49738	105.68.254.0	192.168.2.16
May 6, 2024 04:56:38.238711119 CEST	21	49765	213.166.90.11	192.168.2.16
May 6, 2024 04:56:38.240494013 CEST	2121	49766	213.166.90.11	192.168.2.16
May 6, 2024 04:56:38.252190113 CEST	21	49863	45.38.130.234	192.168.2.16
May 6, 2024 04:56:38.252695084 CEST	2121	49864	45.38.130.234	192.168.2.16
May 6, 2024 04:56:38.260831118 CEST	2121	49718	164.70.186.78	192.168.2.16
May 6, 2024 04:56:38.323111057 CEST	21	49825	175.250.21.18	192.168.2.16
May 6, 2024 04:56:38.325618029 CEST	2121	49826	175.250.21.18	192.168.2.16
May 6, 2024 04:56:38.339672089 CEST	2121	49908	49.160.49.242	192.168.2.16
May 6, 2024 04:56:38.339797974 CEST	21	49875	14.75.234.10	192.168.2.16
May 6, 2024 04:56:38.341224909 CEST	2121	49876	14.75.234.10	192.168.2.16
May 6, 2024 04:56:38.351063967 CEST	2121	49744	115.74.91.137	192.168.2.16
May 6, 2024 04:56:38.352010012 CEST	2121	49710	166.148.200.249	192.168.2.16
May 6, 2024 04:56:38.352020979 CEST	21	49709	166.148.200.249	192.168.2.16
May 6, 2024 04:56:38.367805958 CEST	21	49815	123.10.24.255	192.168.2.16
May 6, 2024 04:56:38.367877007 CEST	2121	49816	123.10.24.255	192.168.2.16
May 6, 2024 04:56:38.369820118 CEST	2121	49823	14.153.184.124	192.168.2.16
May 6, 2024 04:56:38.407121897 CEST	21	49773	196.84.198.19	192.168.2.16
May 6, 2024 04:56:38.407641888 CEST	2121	49774	196.84.198.19	192.168.2.16
May 6, 2024 04:56:38.418343067 CEST	21	49861	163.47.81.9	192.168.2.16
May 6, 2024 04:56:38.424840927 CEST	2121	49862	163.47.81.9	192.168.2.16
May 6, 2024 04:56:38.729967117 CEST	49737	21	192.168.2.16	105.68.254.0
May 6, 2024 04:56:38.729980946 CEST	49738	2121	192.168.2.16	105.68.254.0
May 6, 2024 04:56:38.744956970 CEST	49766	2121	192.168.2.16	213.166.90.11
May 6, 2024 04:56:38.744985104 CEST	49765	21	192.168.2.16	213.166.90.11
May 6, 2024 04:56:38.760957956 CEST	49863	21	192.168.2.16	45.38.130.234
May 6, 2024 04:56:38.760962009 CEST	49718	2121	192.168.2.16	164.70.186.78
May 6, 2024 04:56:38.760966063 CEST	49864	2121	192.168.2.16	45.38.130.234
May 6, 2024 04:56:38.831942081 CEST	49825	21	192.168.2.16	175.250.21.18
May 6, 2024 04:56:38.839942932 CEST	49826	2121	192.168.2.16	175.250.21.18
May 6, 2024 04:56:38.847934961 CEST	49908	2121	192.168.2.16	49.160.49.242
May 6, 2024 04:56:38.847939968 CEST	49876	2121	192.168.2.16	14.75.234.10
May 6, 2024 04:56:38.854976892 CEST	49875	21	192.168.2.16	14.75.234.10
May 6, 2024 04:56:38.854985952 CEST	49709	21	192.168.2.16	166.148.200.249
May 6, 2024 04:56:38.870955944 CEST	49815	21	192.168.2.16	123.10.24.255
May 6, 2024 04:56:38.871918917 CEST	49744	2121	192.168.2.16	115.74.91.137
May 6, 2024 04:56:38.871932030 CEST	49710	2121	192.168.2.16	166.148.200.249
May 6, 2024 04:56:38.871932983 CEST	49816	2121	192.168.2.16	123.10.24.255
May 6, 2024 04:56:38.871961117 CEST	49823	2121	192.168.2.16	14.153.184.124
May 6, 2024 04:56:38.918963909 CEST	49774	2121	192.168.2.16	196.84.198.19
May 6, 2024 04:56:38.918966055 CEST	49773	21	192.168.2.16	196.84.198.19
May 6, 2024 04:56:38.934945107 CEST	49861	21	192.168.2.16	163.47.81.9
May 6, 2024 04:56:38.934958935 CEST	49862	2121	192.168.2.16	163.47.81.9
May 6, 2024 04:56:38.966964006 CEST	49711	21	192.168.2.16	35.137.203.142
May 6, 2024 04:56:38.966979980 CEST	49714	2121	192.168.2.16	140.190.24.113
May 6, 2024 04:56:38.966981888 CEST	49717	21	192.168.2.16	164.70.186.78
May 6, 2024 04:56:38.966981888 CEST	49713	2121	192.168.2.16	35.137.203.142
May 6, 2024 04:56:38.966988087 CEST	49712	21	192.168.2.16	140.190.24.113
May 6, 2024 04:56:38.966989040 CEST	49716	2121	192.168.2.16	213.249.245.75
May 6, 2024 04:56:38.966989994 CEST	49720	2121	192.168.2.16	100.15.75.145
May 6, 2024 04:56:38.967009068 CEST	49715	21	192.168.2.16	213.249.245.75
May 6, 2024 04:56:38.967009068 CEST	49719	21	192.168.2.16	100.15.75.145
May 6, 2024 04:56:38.967010021 CEST	49722	2121	192.168.2.16	70.124.10.255
May 6, 2024 04:56:38.967009068 CEST	49724	2121	192.168.2.16	104.67.188.105
May 6, 2024 04:56:38.967010021 CEST	49723	21	192.168.2.16	104.67.188.105
May 6, 2024 04:56:38.967011929 CEST	49721	21	192.168.2.16	70.124.10.255
May 6, 2024 04:56:38.967010021 CEST	49725	21	192.168.2.16	88.142.184.208
May 6, 2024 04:56:38.981235027 CEST	21	49737	105.68.254.0	192.168.2.16
May 6, 2024 04:56:38.982944965 CEST	49727	2121	192.168.2.16	92.15.231.140
May 6, 2024 04:56:38.982960939 CEST	49730	2121	192.168.2.16	75.174.68.132
May 6, 2024 04:56:38.982969999 CEST	49732	2121	192.168.2.16	201.113.164.51
May 6, 2024 04:56:38.982990026 CEST	49726	2121	192.168.2.16	88.142.184.208
May 6, 2024 04:56:38.982990026 CEST	49731	21	192.168.2.16	201.113.164.51
May 6, 2024 04:56:38.982991934 CEST	49750	2121	192.168.2.16	24.130.57.109
May 6, 2024 04:56:38.982994080 CEST	49733	21	192.168.2.16	36.84.169.30
May 6, 2024 04:56:38.982994080 CEST	49742	2121	192.168.2.16	100.36.47.116
May 6, 2024 04:56:38.982994080 CEST	49748	2121	192.168.2.16	20.75.38.29
May 6, 2024 04:56:38.982997894 CEST	49729	21	192.168.2.16	75.174.68.132
May 6, 2024 04:56:38.982999086 CEST	49728	21	192.168.2.16	92.15.231.140
May 6, 2024 04:56:38.982997894 CEST	49735	21	192.168.2.16	73.35.188.189
May 6, 2024 04:56:38.983000040 CEST	49736	2121	192.168.2.16	73.35.188.189
May 6, 2024 04:56:38.983000040 CEST	49756	2121	192.168.2.16	150.220.125.58
May 6, 2024 04:56:38.983000040 CEST	49739	21	192.168.2.16	90.215.132.151
May 6, 2024 04:56:38.983000040 CEST	49741	21	192.168.2.16	100.36.47.116
May 6, 2024 04:56:38.983000040 CEST	49746	2121	192.168.2.16	86.124.13.69
May 6, 2024 04:56:38.983000040 CEST	49734	2121	192.168.2.16	36.84.169.30
May 6, 2024 04:56:38.983015060 CEST	49751	21	192.168.2.16	187.200.140.177
May 6, 2024 04:56:38.983015060 CEST	49740	2121	192.168.2.16	90.215.132.151
May 6, 2024 04:56:38.983016968 CEST	49760	2121	192.168.2.16	103.162.154.23
May 6, 2024 04:56:38.983021975 CEST	49743	21	192.168.2.16	115.74.91.137
May 6, 2024 04:56:38.983021975 CEST	49752	2121	192.168.2.16	187.200.140.177
May 6, 2024 04:56:38.983021975 CEST	49749	21	192.168.2.16	24.130.57.109
May 6, 2024 04:56:38.983021975 CEST	49747	21	192.168.2.16	20.75.38.29
May 6, 2024 04:56:38.983021975 CEST	49757	21	192.168.2.16	20.222.8.129
May 6, 2024 04:56:38.983021975 CEST	49759	21	192.168.2.16	103.162.154.23
May 6, 2024 04:56:38.983027935 CEST	49753	21	192.168.2.16	90.193.156.199
May 6, 2024 04:56:38.983027935 CEST	49762	2121	192.168.2.16	187.159.2.51
May 6, 2024 04:56:38.983048916 CEST	49761	21	192.168.2.16	187.159.2.51
May 6, 2024 04:56:38.983048916 CEST	49745	21	192.168.2.16	86.124.13.69
May 6, 2024 04:56:38.983048916 CEST	49754	2121	192.168.2.16	90.193.156.199
May 6, 2024 04:56:38.983079910 CEST	49755	21	192.168.2.16	150.220.125.58
May 6, 2024 04:56:38.983079910 CEST	49758	2121	192.168.2.16	20.222.8.129
May 6, 2024 04:56:38.984483957 CEST	2121	49738	105.68.254.0	192.168.2.16
May 6, 2024 04:56:38.988145113 CEST	21	49863	45.38.130.234	192.168.2.16
May 6, 2024 04:56:38.988162041 CEST	2121	49864	45.38.130.234	192.168.2.16
May 6, 2024 04:56:38.998948097 CEST	49767	2121	192.168.2.16	82.39.124.216
May 6, 2024 04:56:38.998949051 CEST	49763	21	192.168.2.16	73.63.91.71
May 6, 2024 04:56:38.998964071 CEST	49771	21	192.168.2.16	178.234.143.20
May 6, 2024 04:56:38.998965025 CEST	49768	21	192.168.2.16	82.39.124.216
May 6, 2024 04:56:38.998965025 CEST	49770	2121	192.168.2.16	84.217.90.112
May 6, 2024 04:56:38.998965025 CEST	49772	2121	192.168.2.16	178.234.143.20
May 6, 2024 04:56:38.998965979 CEST	49778	2121	192.168.2.16	111.226.215.4
May 6, 2024 04:56:38.998965979 CEST	49780	21	192.168.2.16	173.178.93.163
May 6, 2024 04:56:38.998980999 CEST	49789	21	192.168.2.16	142.252.53.106
May 6, 2024 04:56:38.998980999 CEST	49777	21	192.168.2.16	111.226.215.4
May 6, 2024 04:56:38.998980999 CEST	49794	2121	192.168.2.16	211.219.206.145
May 6, 2024 04:56:38.998984098 CEST	49764	2121	192.168.2.16	73.63.91.71
May 6, 2024 04:56:38.998984098 CEST	49785	21	192.168.2.16	108.183.105.128
May 6, 2024 04:56:38.998986006 CEST	49786	2121	192.168.2.16	108.183.105.128
May 6, 2024 04:56:38.998986006 CEST	49776	2121	192.168.2.16	174.118.107.167
May 6, 2024 04:56:38.998986959 CEST	49782	2121	192.168.2.16	173.178.93.163
May 6, 2024 04:56:38.998986959 CEST	49769	21	192.168.2.16	84.217.90.112
May 6, 2024 04:56:38.998986959 CEST	49783	21	192.168.2.16	73.189.43.14
May 6, 2024 04:56:38.998989105 CEST	49787	21	192.168.2.16	69.141.22.219
May 6, 2024 04:56:38.998989105 CEST	49775	21	192.168.2.16	174.118.107.167
May 6, 2024 04:56:38.999000072 CEST	49791	21	192.168.2.16	174.79.2.219
May 6, 2024 04:56:38.999017000 CEST	49790	2121	192.168.2.16	142.252.53.106
May 6, 2024 04:56:38.999017954 CEST	49793	2121	192.168.2.16	174.79.2.219
May 6, 2024 04:56:38.999017954 CEST	49784	2121	192.168.2.16	73.189.43.14
May 6, 2024 04:56:38.999021053 CEST	49795	21	192.168.2.16	79.196.95.8
May 6, 2024 04:56:38.999022007 CEST	49798	2121	192.168.2.16	70.172.40.136
May 6, 2024 04:56:38.999022007 CEST	49788	2121	192.168.2.16	69.141.22.219
May 6, 2024 04:56:38.999022961 CEST	49792	21	192.168.2.16	211.219.206.145
May 6, 2024 04:56:38.999022961 CEST	49779	21	192.168.2.16	5.142.219.193
May 6, 2024 04:56:38.999022961 CEST	49796	2121	192.168.2.16	79.196.95.8
May 6, 2024 04:56:38.999028921 CEST	49781	2121	192.168.2.16	5.142.219.193
May 6, 2024 04:56:38.999090910 CEST	49797	21	192.168.2.16	70.172.40.136
May 6, 2024 04:56:38.999097109 CEST	49799	21	192.168.2.16	87.166.1.99
May 6, 2024 04:56:38.999341965 CEST	21	49765	213.166.90.11	192.168.2.16
May 6, 2024 04:56:39.000442028 CEST	2121	49766	213.166.90.11	192.168.2.16
May 6, 2024 04:56:39.014966965 CEST	49802	2121	192.168.2.16	78.21.74.104
May 6, 2024 04:56:39.014970064 CEST	49800	2121	192.168.2.16	87.166.1.99
May 6, 2024 04:56:39.014988899 CEST	49803	21	192.168.2.16	189.253.72.130
May 6, 2024 04:56:39.014987946 CEST	49809	21	192.168.2.16	74.129.206.76
May 6, 2024 04:56:39.014987946 CEST	49806	2121	192.168.2.16	123.130.44.98
May 6, 2024 04:56:39.014995098 CEST	49812	2121	192.168.2.16	108.2.68.15
May 6, 2024 04:56:39.014995098 CEST	49810	2121	192.168.2.16	74.129.206.76
May 6, 2024 04:56:39.014995098 CEST	49801	21	192.168.2.16	78.21.74.104
May 6, 2024 04:56:39.014995098 CEST	49804	2121	192.168.2.16	189.253.72.130
May 6, 2024 04:56:39.015019894 CEST	49805	21	192.168.2.16	123.130.44.98
May 6, 2024 04:56:39.015021086 CEST	49813	21	192.168.2.16	72.253.247.220
May 6, 2024 04:56:39.015021086 CEST	49821	2121	192.168.2.16	2.126.55.74
May 6, 2024 04:56:39.015022039 CEST	49819	21	192.168.2.16	2.126.55.74
May 6, 2024 04:56:39.015022039 CEST	49830	2121	192.168.2.16	190.31.92.93
May 6, 2024 04:56:39.015022993 CEST	49822	2121	192.168.2.16	71.221.146.72
May 6, 2024 04:56:39.015026093 CEST	49811	21	192.168.2.16	108.2.68.15
May 6, 2024 04:56:39.015026093 CEST	49808	2121	192.168.2.16	182.109.58.235
May 6, 2024 04:56:39.015027046 CEST	49807	21	192.168.2.16	182.109.58.235
May 6, 2024 04:56:39.015026093 CEST	49832	2121	192.168.2.16	187.139.173.210
May 6, 2024 04:56:39.015027046 CEST	49814	2121	192.168.2.16	72.253.247.220
May 6, 2024 04:56:39.015027046 CEST	49817	21	192.168.2.16	202.190.106.215
May 6, 2024 04:56:39.015027046 CEST	49834	2121	192.168.2.16	79.157.98.21
May 6, 2024 04:56:39.015178919 CEST	49824	21	192.168.2.16	14.153.184.124
May 6, 2024 04:56:39.015178919 CEST	49837	21	192.168.2.16	149.11.204.146
May 6, 2024 04:56:39.015178919 CEST	49827	21	192.168.2.16	88.70.37.48
May 6, 2024 04:56:39.015180111 CEST	49831	21	192.168.2.16	187.139.173.210
May 6, 2024 04:56:39.015178919 CEST	49835	21	192.168.2.16	172.116.204.173
May 6, 2024 04:56:39.015180111 CEST	49818	2121	192.168.2.16	202.190.106.215
May 6, 2024 04:56:39.015180111 CEST	49833	21	192.168.2.16	79.157.98.21
May 6, 2024 04:56:39.015180111 CEST	49820	21	192.168.2.16	71.221.146.72
May 6, 2024 04:56:39.015181065 CEST	49828	2121	192.168.2.16	88.70.37.48
May 6, 2024 04:56:39.015182972 CEST	49829	21	192.168.2.16	190.31.92.93
May 6, 2024 04:56:39.031002045 CEST	49841	2121	192.168.2.16	100.4.98.205
May 6, 2024 04:56:39.031016111 CEST	49838	2121	192.168.2.16	149.11.204.146
May 6, 2024 04:56:39.031017065 CEST	49849	21	192.168.2.16	217.103.67.136
May 6, 2024 04:56:39.031017065 CEST	49854	2121	192.168.2.16	88.88.34.254
May 6, 2024 04:56:39.031042099 CEST	49855	21	192.168.2.16	201.25.34.80
May 6, 2024 04:56:39.031043053 CEST	49853	21	192.168.2.16	88.88.34.254
May 6, 2024 04:56:39.031042099 CEST	49860	2121	192.168.2.16	115.86.174.81
May 6, 2024 04:56:39.031043053 CEST	49840	2121	192.168.2.16	85.66.80.209
May 6, 2024 04:56:39.031042099 CEST	49865	21	192.168.2.16	71.62.131.219
May 6, 2024 04:56:39.031044006 CEST	49850	2121	192.168.2.16	217.103.67.136
May 6, 2024 04:56:39.031043053 CEST	49836	2121	192.168.2.16	172.116.204.173
May 6, 2024 04:56:39.031043053 CEST	49845	21	192.168.2.16	49.22.166.94
May 6, 2024 04:56:39.031043053 CEST	49839	21	192.168.2.16	100.4.98.205
May 6, 2024 04:56:39.031044006 CEST	49843	21	192.168.2.16	85.66.80.209
May 6, 2024 04:56:39.031043053 CEST	49842	21	192.168.2.16	86.8.247.4
May 6, 2024 04:56:39.031044960 CEST	49846	2121	192.168.2.16	49.22.166.94
May 6, 2024 04:56:39.031043053 CEST	49852	2121	192.168.2.16	184.168.238.60
May 6, 2024 04:56:39.031044960 CEST	49857	21	192.168.2.16	98.11.196.125
May 6, 2024 04:56:39.031060934 CEST	49848	2121	192.168.2.16	18.172.155.195
May 6, 2024 04:56:39.031061888 CEST	49844	2121	192.168.2.16	86.8.247.4
May 6, 2024 04:56:39.031061888 CEST	49872	2121	192.168.2.16	68.170.77.226
May 6, 2024 04:56:39.031063080 CEST	49856	2121	192.168.2.16	201.25.34.80
May 6, 2024 04:56:39.031063080 CEST	49847	21	192.168.2.16	18.172.155.195
May 6, 2024 04:56:39.031064987 CEST	49869	21	192.168.2.16	69.255.144.143
May 6, 2024 04:56:39.031064034 CEST	49866	2121	192.168.2.16	71.62.131.219
May 6, 2024 04:56:39.031064987 CEST	49859	21	192.168.2.16	115.86.174.81
May 6, 2024 04:56:39.031064034 CEST	49851	21	192.168.2.16	184.168.238.60
May 6, 2024 04:56:39.031064034 CEST	49868	2121	192.168.2.16	211.80.156.157
May 6, 2024 04:56:39.031086922 CEST	49858	2121	192.168.2.16	98.11.196.125
May 6, 2024 04:56:39.031086922 CEST	49867	21	192.168.2.16	211.80.156.157
May 6, 2024 04:56:39.031086922 CEST	49870	2121	192.168.2.16	69.255.144.143
May 6, 2024 04:56:39.031086922 CEST	49871	21	192.168.2.16	68.170.77.226
May 6, 2024 04:56:39.031862974 CEST	49878	2121	192.168.2.16	90.204.82.70
May 6, 2024 04:56:39.031863928 CEST	49873	21	192.168.2.16	51.137.203.141
May 6, 2024 04:56:39.031863928 CEST	49874	2121	192.168.2.16	51.137.203.141
May 6, 2024 04:56:39.031864882 CEST	49877	21	192.168.2.16	90.204.82.70
May 6, 2024 04:56:39.046968937 CEST	49880	2121	192.168.2.16	76.23.3.9
May 6, 2024 04:56:39.046973944 CEST	49881	21	192.168.2.16	80.197.137.196
May 6, 2024 04:56:39.046984911 CEST	49886	2121	192.168.2.16	38.44.1.45
May 6, 2024 04:56:39.046988964 CEST	49885	21	192.168.2.16	38.44.1.45
May 6, 2024 04:56:39.046988964 CEST	49879	21	192.168.2.16	76.23.3.9
May 6, 2024 04:56:39.046988964 CEST	49884	2121	192.168.2.16	84.106.198.128
May 6, 2024 04:56:39.046988964 CEST	49883	21	192.168.2.16	84.106.198.128
May 6, 2024 04:56:39.046994925 CEST	49890	2121	192.168.2.16	123.144.34.49
May 6, 2024 04:56:39.047009945 CEST	49895	21	192.168.2.16	203.206.143.107
May 6, 2024 04:56:39.047009945 CEST	49888	2121	192.168.2.16	119.192.251.99
May 6, 2024 04:56:39.047009945 CEST	49897	21	192.168.2.16	89.46.255.178
May 6, 2024 04:56:39.047012091 CEST	49901	21	192.168.2.16	2.152.179.32
May 6, 2024 04:56:39.047013044 CEST	49887	21	192.168.2.16	119.192.251.99
May 6, 2024 04:56:39.047013044 CEST	49903	21	192.168.2.16	35.204.211.43
May 6, 2024 04:56:39.047013998 CEST	49894	2121	192.168.2.16	112.230.77.155
May 6, 2024 04:56:39.047015905 CEST	49882	2121	192.168.2.16	80.197.137.196
May 6, 2024 04:56:39.047014952 CEST	49902	2121	192.168.2.16	2.152.179.32
May 6, 2024 04:56:39.047015905 CEST	49891	21	192.168.2.16	222.237.147.227
May 6, 2024 04:56:39.047015905 CEST	49905	21	192.168.2.16	49.170.40.102
May 6, 2024 04:56:39.047034025 CEST	49900	2121	192.168.2.16	216.117.162.236
May 6, 2024 04:56:39.047035933 CEST	49889	21	192.168.2.16	123.144.34.49
May 6, 2024 04:56:39.047035933 CEST	49896	2121	192.168.2.16	203.206.143.107
May 6, 2024 04:56:39.047035933 CEST	49906	2121	192.168.2.16	49.170.40.102
May 6, 2024 04:56:39.047036886 CEST	49904	2121	192.168.2.16	35.204.211.43
May 6, 2024 04:56:39.047038078 CEST	49898	2121	192.168.2.16	89.46.255.178
May 6, 2024 04:56:39.047036886 CEST	49892	2121	192.168.2.16	222.237.147.227
May 6, 2024 04:56:39.047036886 CEST	49893	21	192.168.2.16	112.230.77.155
May 6, 2024 04:56:39.047327995 CEST	49907	21	192.168.2.16	49.160.49.242
May 6, 2024 04:56:39.058247089 CEST	2121	49718	164.70.186.78	192.168.2.16
May 6, 2024 04:56:39.144427061 CEST	21	49825	175.250.21.18	192.168.2.16
May 6, 2024 04:56:39.146027088 CEST	2121	49908	49.160.49.242	192.168.2.16
May 6, 2024 04:56:39.153862953 CEST	2121	49826	175.250.21.18	192.168.2.16
May 6, 2024 04:56:39.158791065 CEST	2121	49876	14.75.234.10	192.168.2.16
May 6, 2024 04:56:39.165137053 CEST	21	49875	14.75.234.10	192.168.2.16
May 6, 2024 04:56:39.231492996 CEST	2121	49823	14.153.184.124	192.168.2.16
May 6, 2024 04:56:39.231767893 CEST	21	49815	123.10.24.255	192.168.2.16
May 6, 2024 04:56:39.232909918 CEST	2121	49816	123.10.24.255	192.168.2.16
May 6, 2024 04:56:39.247343063 CEST	2121	49744	115.74.91.137	192.168.2.16
May 6, 2024 04:56:39.294843912 CEST	21	49709	166.148.200.249	192.168.2.16
May 6, 2024 04:56:39.294871092 CEST	2121	49710	166.148.200.249	192.168.2.16
May 6, 2024 04:56:39.329065084 CEST	21	49861	163.47.81.9	192.168.2.16
May 6, 2024 04:56:39.335180044 CEST	2121	49862	163.47.81.9	192.168.2.16
May 6, 2024 04:56:39.365302086 CEST	21	49773	196.84.198.19	192.168.2.16
May 6, 2024 04:56:39.367052078 CEST	2121	49774	196.84.198.19	192.168.2.16
May 6, 2024 04:56:39.494970083 CEST	49863	21	192.168.2.16	45.38.130.234
May 6, 2024 04:56:39.494985104 CEST	49737	21	192.168.2.16	105.68.254.0
May 6, 2024 04:56:39.494986057 CEST	49738	2121	192.168.2.16	105.68.254.0
May 6, 2024 04:56:39.494988918 CEST	49864	2121	192.168.2.16	45.38.130.234
May 6, 2024 04:56:39.510962009 CEST	49766	2121	192.168.2.16	213.166.90.11
May 6, 2024 04:56:39.510966063 CEST	49765	21	192.168.2.16	213.166.90.11
May 6, 2024 04:56:39.573035955 CEST	49718	2121	192.168.2.16	164.70.186.78
May 6, 2024 04:56:39.651953936 CEST	49825	21	192.168.2.16	175.250.21.18
May 6, 2024 04:56:39.652007103 CEST	49908	2121	192.168.2.16	49.160.49.242
May 6, 2024 04:56:39.667942047 CEST	49876	2121	192.168.2.16	14.75.234.10
May 6, 2024 04:56:39.667956114 CEST	49826	2121	192.168.2.16	175.250.21.18
May 6, 2024 04:56:39.667973995 CEST	49875	21	192.168.2.16	14.75.234.10
May 6, 2024 04:56:39.722085953 CEST	21	49863	45.38.130.234	192.168.2.16
May 6, 2024 04:56:39.722166061 CEST	2121	49864	45.38.130.234	192.168.2.16
May 6, 2024 04:56:39.746946096 CEST	49823	2121	192.168.2.16	14.153.184.124
May 6, 2024 04:56:39.746947050 CEST	49815	21	192.168.2.16	123.10.24.255
May 6, 2024 04:56:39.746968031 CEST	49816	2121	192.168.2.16	123.10.24.255
May 6, 2024 04:56:39.747783899 CEST	21	49737	105.68.254.0	192.168.2.16
May 6, 2024 04:56:39.750092030 CEST	2121	49738	105.68.254.0	192.168.2.16
May 6, 2024 04:56:39.762939930 CEST	49744	2121	192.168.2.16	115.74.91.137
May 6, 2024 04:56:39.765717030 CEST	21	49765	213.166.90.11	192.168.2.16
May 6, 2024 04:56:39.766381979 CEST	2121	49766	213.166.90.11	192.168.2.16
May 6, 2024 04:56:39.794965029 CEST	49710	2121	192.168.2.16	166.148.200.249
May 6, 2024 04:56:39.794966936 CEST	49709	21	192.168.2.16	166.148.200.249
May 6, 2024 04:56:39.842941999 CEST	49861	21	192.168.2.16	163.47.81.9
May 6, 2024 04:56:39.842946053 CEST	49862	2121	192.168.2.16	163.47.81.9
May 6, 2024 04:56:39.870414019 CEST	2121	49718	164.70.186.78	192.168.2.16
May 6, 2024 04:56:39.874984980 CEST	49773	21	192.168.2.16	196.84.198.19
May 6, 2024 04:56:39.874984980 CEST	49774	2121	192.168.2.16	196.84.198.19
May 6, 2024 04:56:39.949894905 CEST	2121	49908	49.160.49.242	192.168.2.16
May 6, 2024 04:56:39.964509964 CEST	21	49825	175.250.21.18	192.168.2.16
May 6, 2024 04:56:39.978203058 CEST	21	49875	14.75.234.10	192.168.2.16
May 6, 2024 04:56:39.978807926 CEST	2121	49876	14.75.234.10	192.168.2.16
May 6, 2024 04:56:39.980117083 CEST	21	49709	166.148.200.249	192.168.2.16
May 6, 2024 04:56:39.980139017 CEST	2121	49710	166.148.200.249	192.168.2.16
May 6, 2024 04:56:39.982716084 CEST	2121	49826	175.250.21.18	192.168.2.16
May 6, 2024 04:56:40.106450081 CEST	2121	49823	14.153.184.124	192.168.2.16
May 6, 2024 04:56:40.107847929 CEST	21	49815	123.10.24.255	192.168.2.16
May 6, 2024 04:56:40.107860088 CEST	2121	49816	123.10.24.255	192.168.2.16
May 6, 2024 04:56:40.138633013 CEST	2121	49744	115.74.91.137	192.168.2.16
May 6, 2024 04:56:40.140208006 CEST	21	49899	216.117.162.236	192.168.2.16
May 6, 2024 04:56:40.140316010 CEST	49899	21	192.168.2.16	216.117.162.236
May 6, 2024 04:56:40.140948057 CEST	49909	21	192.168.2.16	39.27.13.134
May 6, 2024 04:56:40.165091038 CEST	21	49773	196.84.198.19	192.168.2.16
May 6, 2024 04:56:40.166951895 CEST	2121	49774	196.84.198.19	192.168.2.16
May 6, 2024 04:56:40.226070881 CEST	49863	21	192.168.2.16	45.38.130.234
May 6, 2024 04:56:40.226164103 CEST	49864	2121	192.168.2.16	45.38.130.234
May 6, 2024 04:56:40.237034082 CEST	21	49861	163.47.81.9	192.168.2.16
May 6, 2024 04:56:40.243285894 CEST	2121	49862	163.47.81.9	192.168.2.16
May 6, 2024 04:56:40.257951975 CEST	49737	21	192.168.2.16	105.68.254.0
May 6, 2024 04:56:40.257957935 CEST	49738	2121	192.168.2.16	105.68.254.0
May 6, 2024 04:56:40.275145054 CEST	49766	2121	192.168.2.16	213.166.90.11
May 6, 2024 04:56:40.275146961 CEST	49765	21	192.168.2.16	213.166.90.11
May 6, 2024 04:56:40.275541067 CEST	21	49899	216.117.162.236	192.168.2.16
May 6, 2024 04:56:40.275616884 CEST	49899	21	192.168.2.16	216.117.162.236
May 6, 2024 04:56:40.276011944 CEST	21	49899	216.117.162.236	192.168.2.16
May 6, 2024 04:56:40.276060104 CEST	49899	21	192.168.2.16	216.117.162.236
May 6, 2024 04:56:40.276196003 CEST	21	49899	216.117.162.236	192.168.2.16
May 6, 2024 04:56:40.276238918 CEST	49899	21	192.168.2.16	216.117.162.236
May 6, 2024 04:56:40.276923895 CEST	21	49899	216.117.162.236	192.168.2.16
May 6, 2024 04:56:40.276968002 CEST	49899	21	192.168.2.16	216.117.162.236
May 6, 2024 04:56:40.386044979 CEST	49718	2121	192.168.2.16	164.70.186.78
May 6, 2024 04:56:40.438016891 CEST	21	49909	39.27.13.134	192.168.2.16
May 6, 2024 04:56:40.453198910 CEST	21	49863	45.38.130.234	192.168.2.16
May 6, 2024 04:56:40.453288078 CEST	2121	49864	45.38.130.234	192.168.2.16
May 6, 2024 04:56:40.464946032 CEST	49908	2121	192.168.2.16	49.160.49.242
May 6, 2024 04:56:40.464982986 CEST	49825	21	192.168.2.16	175.250.21.18
May 6, 2024 04:56:40.480967045 CEST	49876	2121	192.168.2.16	14.75.234.10
May 6, 2024 04:56:40.480967999 CEST	49875	21	192.168.2.16	14.75.234.10
May 6, 2024 04:56:40.481128931 CEST	49710	2121	192.168.2.16	166.148.200.249
May 6, 2024 04:56:40.481261015 CEST	49709	21	192.168.2.16	166.148.200.249
May 6, 2024 04:56:40.495944977 CEST	49826	2121	192.168.2.16	175.250.21.18
May 6, 2024 04:56:40.510534048 CEST	21	49737	105.68.254.0	192.168.2.16
May 6, 2024 04:56:40.512783051 CEST	2121	49738	105.68.254.0	192.168.2.16
May 6, 2024 04:56:40.529644966 CEST	21	49765	213.166.90.11	192.168.2.16
May 6, 2024 04:56:40.530630112 CEST	2121	49766	213.166.90.11	192.168.2.16
May 6, 2024 04:56:40.607975006 CEST	49823	2121	192.168.2.16	14.153.184.124
May 6, 2024 04:56:40.607975006 CEST	49816	2121	192.168.2.16	123.10.24.255
May 6, 2024 04:56:40.622957945 CEST	49815	21	192.168.2.16	123.10.24.255
May 6, 2024 04:56:40.645035028 CEST	49744	2121	192.168.2.16	115.74.91.137
May 6, 2024 04:56:40.670964003 CEST	49773	21	192.168.2.16	196.84.198.19
May 6, 2024 04:56:40.670974970 CEST	49774	2121	192.168.2.16	196.84.198.19
May 6, 2024 04:56:40.683374882 CEST	2121	49718	164.70.186.78	192.168.2.16
May 6, 2024 04:56:40.751054049 CEST	49861	21	192.168.2.16	163.47.81.9
May 6, 2024 04:56:40.751055002 CEST	49862	2121	192.168.2.16	163.47.81.9
May 6, 2024 04:56:40.763166904 CEST	2121	49908	49.160.49.242	192.168.2.16
May 6, 2024 04:56:40.777426958 CEST	21	49825	175.250.21.18	192.168.2.16
May 6, 2024 04:56:40.791043043 CEST	21	49875	14.75.234.10	192.168.2.16
May 6, 2024 04:56:40.792457104 CEST	2121	49876	14.75.234.10	192.168.2.16
May 6, 2024 04:56:40.810034990 CEST	2121	49826	175.250.21.18	192.168.2.16
May 6, 2024 04:56:40.894825935 CEST	21	49709	166.148.200.249	192.168.2.16
May 6, 2024 04:56:40.894936085 CEST	2121	49710	166.148.200.249	192.168.2.16
May 6, 2024 04:56:40.942975998 CEST	49909	21	192.168.2.16	39.27.13.134
May 6, 2024 04:56:40.958981037 CEST	49863	21	192.168.2.16	45.38.130.234
May 6, 2024 04:56:40.965536118 CEST	21	49773	196.84.198.19	192.168.2.16
May 6, 2024 04:56:40.965954065 CEST	49864	2121	192.168.2.16	45.38.130.234
May 6, 2024 04:56:40.967401028 CEST	2121	49774	196.84.198.19	192.168.2.16
May 6, 2024 04:56:40.967454910 CEST	2121	49823	14.153.184.124	192.168.2.16
May 6, 2024 04:56:40.968844891 CEST	2121	49816	123.10.24.255	192.168.2.16
May 6, 2024 04:56:40.974950075 CEST	49712	21	192.168.2.16	140.190.24.113
May 6, 2024 04:56:40.974950075 CEST	49720	2121	192.168.2.16	100.15.75.145
May 6, 2024 04:56:40.974951029 CEST	49713	2121	192.168.2.16	35.137.203.142
May 6, 2024 04:56:40.974961996 CEST	49719	21	192.168.2.16	100.15.75.145
May 6, 2024 04:56:40.974965096 CEST	49725	21	192.168.2.16	88.142.184.208
May 6, 2024 04:56:40.974965096 CEST	49716	2121	192.168.2.16	213.249.245.75
May 6, 2024 04:56:40.974967003 CEST	49717	21	192.168.2.16	164.70.186.78
May 6, 2024 04:56:40.974967003 CEST	49721	21	192.168.2.16	70.124.10.255
May 6, 2024 04:56:40.974988937 CEST	49715	21	192.168.2.16	213.249.245.75
May 6, 2024 04:56:40.974988937 CEST	49724	2121	192.168.2.16	104.67.188.105
May 6, 2024 04:56:40.974991083 CEST	49714	2121	192.168.2.16	140.190.24.113
May 6, 2024 04:56:40.974992037 CEST	49711	21	192.168.2.16	35.137.203.142
May 6, 2024 04:56:40.974996090 CEST	49722	2121	192.168.2.16	70.124.10.255
May 6, 2024 04:56:40.974996090 CEST	49723	21	192.168.2.16	104.67.188.105
May 6, 2024 04:56:40.983751059 CEST	21	49815	123.10.24.255	192.168.2.16
May 6, 2024 04:56:40.990964890 CEST	49734	2121	192.168.2.16	36.84.169.30
May 6, 2024 04:56:40.990964890 CEST	49733	21	192.168.2.16	36.84.169.30
May 6, 2024 04:56:40.990967989 CEST	49726	2121	192.168.2.16	88.142.184.208
May 6, 2024 04:56:40.990967989 CEST	49731	21	192.168.2.16	201.113.164.51
May 6, 2024 04:56:40.990988016 CEST	49747	21	192.168.2.16	20.75.38.29
May 6, 2024 04:56:40.990991116 CEST	49728	21	192.168.2.16	92.15.231.140
May 6, 2024 04:56:40.990991116 CEST	49730	2121	192.168.2.16	75.174.68.132
May 6, 2024 04:56:40.990993023 CEST	49740	2121	192.168.2.16	90.215.132.151
May 6, 2024 04:56:40.990993977 CEST	49735	21	192.168.2.16	73.35.188.189
May 6, 2024 04:56:40.990995884 CEST	49742	2121	192.168.2.16	100.36.47.116
May 6, 2024 04:56:40.990995884 CEST	49736	2121	192.168.2.16	73.35.188.189
May 6, 2024 04:56:40.990995884 CEST	49756	2121	192.168.2.16	150.220.125.58
May 6, 2024 04:56:40.990997076 CEST	49729	21	192.168.2.16	75.174.68.132
May 6, 2024 04:56:40.990997076 CEST	49727	2121	192.168.2.16	92.15.231.140
May 6, 2024 04:56:40.990997076 CEST	49732	2121	192.168.2.16	201.113.164.51
May 6, 2024 04:56:40.991020918 CEST	49761	21	192.168.2.16	187.159.2.51
May 6, 2024 04:56:40.991022110 CEST	49760	2121	192.168.2.16	103.162.154.23
May 6, 2024 04:56:40.991022110 CEST	49743	21	192.168.2.16	115.74.91.137
May 6, 2024 04:56:40.991023064 CEST	49762	2121	192.168.2.16	187.159.2.51
May 6, 2024 04:56:40.991023064 CEST	49739	21	192.168.2.16	90.215.132.151
May 6, 2024 04:56:40.991038084 CEST	49749	21	192.168.2.16	24.130.57.109
May 6, 2024 04:56:40.991039038 CEST	49745	21	192.168.2.16	86.124.13.69
May 6, 2024 04:56:40.991039038 CEST	49748	2121	192.168.2.16	20.75.38.29
May 6, 2024 04:56:40.991040945 CEST	49741	21	192.168.2.16	100.36.47.116
May 6, 2024 04:56:40.991040945 CEST	49746	2121	192.168.2.16	86.124.13.69
May 6, 2024 04:56:40.991043091 CEST	49752	2121	192.168.2.16	187.200.140.177
May 6, 2024 04:56:40.991054058 CEST	49753	21	192.168.2.16	90.193.156.199
May 6, 2024 04:56:40.991059065 CEST	49755	21	192.168.2.16	150.220.125.58
May 6, 2024 04:56:40.991059065 CEST	49750	2121	192.168.2.16	24.130.57.109
May 6, 2024 04:56:40.991059065 CEST	49751	21	192.168.2.16	187.200.140.177
May 6, 2024 04:56:40.991070986 CEST	49758	2121	192.168.2.16	20.222.8.129
May 6, 2024 04:56:40.991072893 CEST	49757	21	192.168.2.16	20.222.8.129
May 6, 2024 04:56:40.991074085 CEST	49754	2121	192.168.2.16	90.193.156.199
May 6, 2024 04:56:40.991107941 CEST	49759	21	192.168.2.16	103.162.154.23
May 6, 2024 04:56:41.007117987 CEST	49764	2121	192.168.2.16	73.63.91.71
May 6, 2024 04:56:41.007117987 CEST	49785	21	192.168.2.16	108.183.105.128
May 6, 2024 04:56:41.007117987 CEST	49793	2121	192.168.2.16	174.79.2.219
May 6, 2024 04:56:41.007117987 CEST	49784	2121	192.168.2.16	73.189.43.14
May 6, 2024 04:56:41.007119894 CEST	49789	21	192.168.2.16	142.252.53.106
May 6, 2024 04:56:41.007122040 CEST	49786	2121	192.168.2.16	108.183.105.128
May 6, 2024 04:56:41.007121086 CEST	49778	2121	192.168.2.16	111.226.215.4
May 6, 2024 04:56:41.007122040 CEST	49767	2121	192.168.2.16	82.39.124.216
May 6, 2024 04:56:41.007121086 CEST	49791	21	192.168.2.16	174.79.2.219
May 6, 2024 04:56:41.007122040 CEST	49776	2121	192.168.2.16	174.118.107.167
May 6, 2024 04:56:41.007128000 CEST	49782	2121	192.168.2.16	173.178.93.163
May 6, 2024 04:56:41.007121086 CEST	49798	2121	192.168.2.16	70.172.40.136
May 6, 2024 04:56:41.007121086 CEST	49780	21	192.168.2.16	173.178.93.163
May 6, 2024 04:56:41.007128954 CEST	49763	21	192.168.2.16	73.63.91.71
May 6, 2024 04:56:41.007121086 CEST	49771	21	192.168.2.16	178.234.143.20
May 6, 2024 04:56:41.007122040 CEST	49795	21	192.168.2.16	79.196.95.8
May 6, 2024 04:56:41.007124901 CEST	49783	21	192.168.2.16	73.189.43.14
May 6, 2024 04:56:41.007129908 CEST	49768	21	192.168.2.16	82.39.124.216
May 6, 2024 04:56:41.007128954 CEST	49792	21	192.168.2.16	211.219.206.145
May 6, 2024 04:56:41.007121086 CEST	49790	2121	192.168.2.16	142.252.53.106
May 6, 2024 04:56:41.007124901 CEST	49769	21	192.168.2.16	84.217.90.112
May 6, 2024 04:56:41.007129908 CEST	49770	2121	192.168.2.16	84.217.90.112
May 6, 2024 04:56:41.007128954 CEST	49775	21	192.168.2.16	174.118.107.167
May 6, 2024 04:56:41.007129908 CEST	49787	21	192.168.2.16	69.141.22.219
May 6, 2024 04:56:41.007121086 CEST	49797	21	192.168.2.16	70.172.40.136
May 6, 2024 04:56:41.007128000 CEST	49796	2121	192.168.2.16	79.196.95.8
May 6, 2024 04:56:41.007121086 CEST	49794	2121	192.168.2.16	211.219.206.145
May 6, 2024 04:56:41.007129908 CEST	49772	2121	192.168.2.16	178.234.143.20
May 6, 2024 04:56:41.007121086 CEST	49777	21	192.168.2.16	111.226.215.4
May 6, 2024 04:56:41.007129908 CEST	49781	2121	192.168.2.16	5.142.219.193
May 6, 2024 04:56:41.007121086 CEST	49788	2121	192.168.2.16	69.141.22.219
May 6, 2024 04:56:41.007128000 CEST	49779	21	192.168.2.16	5.142.219.193
May 6, 2024 04:56:41.007128000 CEST	49799	21	192.168.2.16	87.166.1.99
May 6, 2024 04:56:41.020745039 CEST	2121	49744	115.74.91.137	192.168.2.16
May 6, 2024 04:56:41.022944927 CEST	49802	2121	192.168.2.16	78.21.74.104
May 6, 2024 04:56:41.022958040 CEST	49803	21	192.168.2.16	189.253.72.130
May 6, 2024 04:56:41.022958040 CEST	49737	21	192.168.2.16	105.68.254.0
May 6, 2024 04:56:41.022968054 CEST	49814	2121	192.168.2.16	72.253.247.220
May 6, 2024 04:56:41.022969961 CEST	49800	2121	192.168.2.16	87.166.1.99
May 6, 2024 04:56:41.022969961 CEST	49810	2121	192.168.2.16	74.129.206.76
May 6, 2024 04:56:41.022970915 CEST	49804	2121	192.168.2.16	189.253.72.130
May 6, 2024 04:56:41.022989988 CEST	49738	2121	192.168.2.16	105.68.254.0
May 6, 2024 04:56:41.022989988 CEST	49832	2121	192.168.2.16	187.139.173.210
May 6, 2024 04:56:41.022993088 CEST	49809	21	192.168.2.16	74.129.206.76
May 6, 2024 04:56:41.022993088 CEST	49806	2121	192.168.2.16	123.130.44.98
May 6, 2024 04:56:41.022993088 CEST	49817	21	192.168.2.16	202.190.106.215
May 6, 2024 04:56:41.022993088 CEST	49807	21	192.168.2.16	182.109.58.235
May 6, 2024 04:56:41.022996902 CEST	49801	21	192.168.2.16	78.21.74.104
May 6, 2024 04:56:41.022996902 CEST	49830	2121	192.168.2.16	190.31.92.93
May 6, 2024 04:56:41.022996902 CEST	49808	2121	192.168.2.16	182.109.58.235
May 6, 2024 04:56:41.023014069 CEST	49834	2121	192.168.2.16	79.157.98.21
May 6, 2024 04:56:41.023014069 CEST	49837	21	192.168.2.16	149.11.204.146
May 6, 2024 04:56:41.023015976 CEST	49835	21	192.168.2.16	172.116.204.173
May 6, 2024 04:56:41.023015976 CEST	49805	21	192.168.2.16	123.130.44.98
May 6, 2024 04:56:41.023015976 CEST	49812	2121	192.168.2.16	108.2.68.15
May 6, 2024 04:56:41.023016930 CEST	49819	21	192.168.2.16	2.126.55.74
May 6, 2024 04:56:41.023015976 CEST	49813	21	192.168.2.16	72.253.247.220
May 6, 2024 04:56:41.023016930 CEST	49820	21	192.168.2.16	71.221.146.72
May 6, 2024 04:56:41.023026943 CEST	49822	2121	192.168.2.16	71.221.146.72
May 6, 2024 04:56:41.023027897 CEST	49811	21	192.168.2.16	108.2.68.15
May 6, 2024 04:56:41.023045063 CEST	49827	21	192.168.2.16	88.70.37.48
May 6, 2024 04:56:41.023045063 CEST	49821	2121	192.168.2.16	2.126.55.74
May 6, 2024 04:56:41.023045063 CEST	49828	2121	192.168.2.16	88.70.37.48
May 6, 2024 04:56:41.023045063 CEST	49818	2121	192.168.2.16	202.190.106.215
May 6, 2024 04:56:41.023046970 CEST	49824	21	192.168.2.16	14.153.184.124
May 6, 2024 04:56:41.023046970 CEST	49829	21	192.168.2.16	190.31.92.93
May 6, 2024 04:56:41.023092031 CEST	49831	21	192.168.2.16	187.139.173.210
May 6, 2024 04:56:41.023092031 CEST	49833	21	192.168.2.16	79.157.98.21
May 6, 2024 04:56:41.038948059 CEST	49765	21	192.168.2.16	213.166.90.11
May 6, 2024 04:56:41.038964033 CEST	49841	2121	192.168.2.16	100.4.98.205
May 6, 2024 04:56:41.038969040 CEST	49855	21	192.168.2.16	201.25.34.80
May 6, 2024 04:56:41.038974047 CEST	49836	2121	192.168.2.16	172.116.204.173
May 6, 2024 04:56:41.038975000 CEST	49849	21	192.168.2.16	217.103.67.136
May 6, 2024 04:56:41.038975954 CEST	49854	2121	192.168.2.16	88.88.34.254
May 6, 2024 04:56:41.038975954 CEST	49845	21	192.168.2.16	49.22.166.94
May 6, 2024 04:56:41.038991928 CEST	49860	2121	192.168.2.16	115.86.174.81
May 6, 2024 04:56:41.038991928 CEST	49865	21	192.168.2.16	71.62.131.219
May 6, 2024 04:56:41.038992882 CEST	49840	2121	192.168.2.16	85.66.80.209
May 6, 2024 04:56:41.038992882 CEST	49847	21	192.168.2.16	18.172.155.195
May 6, 2024 04:56:41.038994074 CEST	49843	21	192.168.2.16	85.66.80.209
May 6, 2024 04:56:41.038995981 CEST	49839	21	192.168.2.16	100.4.98.205
May 6, 2024 04:56:41.038995981 CEST	49842	21	192.168.2.16	86.8.247.4
May 6, 2024 04:56:41.038996935 CEST	49870	2121	192.168.2.16	69.255.144.143
May 6, 2024 04:56:41.038999081 CEST	49857	21	192.168.2.16	98.11.196.125
May 6, 2024 04:56:41.039009094 CEST	49851	21	192.168.2.16	184.168.238.60
May 6, 2024 04:56:41.039015055 CEST	49844	2121	192.168.2.16	86.8.247.4
May 6, 2024 04:56:41.039015055 CEST	49873	21	192.168.2.16	51.137.203.141
May 6, 2024 04:56:41.039015055 CEST	49872	2121	192.168.2.16	68.170.77.226
May 6, 2024 04:56:41.039016008 CEST	49867	21	192.168.2.16	211.80.156.157
May 6, 2024 04:56:41.039016008 CEST	49871	21	192.168.2.16	68.170.77.226
May 6, 2024 04:56:41.039016962 CEST	49874	2121	192.168.2.16	51.137.203.141
May 6, 2024 04:56:41.039016962 CEST	49848	2121	192.168.2.16	18.172.155.195
May 6, 2024 04:56:41.039017916 CEST	49859	21	192.168.2.16	115.86.174.81
May 6, 2024 04:56:41.039062023 CEST	49878	2121	192.168.2.16	90.204.82.70
May 6, 2024 04:56:41.039062023 CEST	49838	2121	192.168.2.16	149.11.204.146
May 6, 2024 04:56:41.039063931 CEST	49877	21	192.168.2.16	90.204.82.70
May 6, 2024 04:56:41.039068937 CEST	49852	2121	192.168.2.16	184.168.238.60
May 6, 2024 04:56:41.039069891 CEST	49850	2121	192.168.2.16	217.103.67.136
May 6, 2024 04:56:41.039071083 CEST	49846	2121	192.168.2.16	49.22.166.94
May 6, 2024 04:56:41.039076090 CEST	49856	2121	192.168.2.16	201.25.34.80
May 6, 2024 04:56:41.039078951 CEST	49853	21	192.168.2.16	88.88.34.254
May 6, 2024 04:56:41.039091110 CEST	49866	2121	192.168.2.16	71.62.131.219
May 6, 2024 04:56:41.039093018 CEST	49858	2121	192.168.2.16	98.11.196.125
May 6, 2024 04:56:41.039102077 CEST	49868	2121	192.168.2.16	211.80.156.157
May 6, 2024 04:56:41.039107084 CEST	49869	21	192.168.2.16	69.255.144.143
May 6, 2024 04:56:41.039107084 CEST	49766	2121	192.168.2.16	213.166.90.11
May 6, 2024 04:56:41.054968119 CEST	49881	21	192.168.2.16	80.197.137.196
May 6, 2024 04:56:41.054972887 CEST	49879	21	192.168.2.16	76.23.3.9
May 6, 2024 04:56:41.054985046 CEST	49887	21	192.168.2.16	119.192.251.99
May 6, 2024 04:56:41.054985046 CEST	49890	2121	192.168.2.16	123.144.34.49
May 6, 2024 04:56:41.054989100 CEST	49891	21	192.168.2.16	222.237.147.227
May 6, 2024 04:56:41.054989100 CEST	49883	21	192.168.2.16	84.106.198.128
May 6, 2024 04:56:41.054989100 CEST	49880	2121	192.168.2.16	76.23.3.9
May 6, 2024 04:56:41.054990053 CEST	49886	2121	192.168.2.16	38.44.1.45
May 6, 2024 04:56:41.055006027 CEST	49882	2121	192.168.2.16	80.197.137.196
May 6, 2024 04:56:41.055006027 CEST	49889	21	192.168.2.16	123.144.34.49
May 6, 2024 04:56:41.055007935 CEST	49895	21	192.168.2.16	203.206.143.107
May 6, 2024 04:56:41.055007935 CEST	49884	2121	192.168.2.16	84.106.198.128
May 6, 2024 04:56:41.055008888 CEST	49894	2121	192.168.2.16	112.230.77.155
May 6, 2024 04:56:41.055012941 CEST	49888	2121	192.168.2.16	119.192.251.99
May 6, 2024 04:56:41.055012941 CEST	49897	21	192.168.2.16	89.46.255.178
May 6, 2024 04:56:41.055027008 CEST	49892	2121	192.168.2.16	222.237.147.227
May 6, 2024 04:56:41.055027008 CEST	49893	21	192.168.2.16	112.230.77.155
May 6, 2024 04:56:41.055028915 CEST	49905	21	192.168.2.16	49.170.40.102
May 6, 2024 04:56:41.055032015 CEST	49885	21	192.168.2.16	38.44.1.45
May 6, 2024 04:56:41.055032969 CEST	49902	2121	192.168.2.16	2.152.179.32
May 6, 2024 04:56:41.055036068 CEST	49901	21	192.168.2.16	2.152.179.32
May 6, 2024 04:56:41.055046082 CEST	49904	2121	192.168.2.16	35.204.211.43
May 6, 2024 04:56:41.055048943 CEST	49898	2121	192.168.2.16	89.46.255.178
May 6, 2024 04:56:41.055048943 CEST	49900	2121	192.168.2.16	216.117.162.236
May 6, 2024 04:56:41.055049896 CEST	49903	21	192.168.2.16	35.204.211.43
May 6, 2024 04:56:41.055052996 CEST	49896	2121	192.168.2.16	203.206.143.107
May 6, 2024 04:56:41.055270910 CEST	49906	2121	192.168.2.16	49.170.40.102
May 6, 2024 04:56:41.055273056 CEST	49907	21	192.168.2.16	49.160.49.242
May 6, 2024 04:56:41.147264957 CEST	21	49861	163.47.81.9	192.168.2.16
May 6, 2024 04:56:41.153351068 CEST	2121	49862	163.47.81.9	192.168.2.16
May 6, 2024 04:56:41.188146114 CEST	21	49863	45.38.130.234	192.168.2.16
May 6, 2024 04:56:41.189554930 CEST	49910	2121	192.168.2.16	39.27.13.134
May 6, 2024 04:56:41.193146944 CEST	2121	49864	45.38.130.234	192.168.2.16
May 6, 2024 04:56:41.193593025 CEST	49911	21	192.168.2.16	217.71.254.134
May 6, 2024 04:56:41.198965073 CEST	49718	2121	192.168.2.16	164.70.186.78
May 6, 2024 04:56:41.239804983 CEST	21	49909	39.27.13.134	192.168.2.16
May 6, 2024 04:56:41.262973070 CEST	49908	2121	192.168.2.16	49.160.49.242
May 6, 2024 04:56:41.275763035 CEST	21	49737	105.68.254.0	192.168.2.16
May 6, 2024 04:56:41.278072119 CEST	2121	49738	105.68.254.0	192.168.2.16
May 6, 2024 04:56:41.281130075 CEST	49825	21	192.168.2.16	175.250.21.18
May 6, 2024 04:56:41.294661999 CEST	21	49765	213.166.90.11	192.168.2.16
May 6, 2024 04:56:41.294967890 CEST	49876	2121	192.168.2.16	14.75.234.10
May 6, 2024 04:56:41.294985056 CEST	49875	21	192.168.2.16	14.75.234.10
May 6, 2024 04:56:41.295536995 CEST	49912	21	192.168.2.16	92.207.138.140
May 6, 2024 04:56:41.295562983 CEST	49913	2121	192.168.2.16	217.71.254.134
May 6, 2024 04:56:41.295744896 CEST	2121	49766	213.166.90.11	192.168.2.16
May 6, 2024 04:56:41.296183109 CEST	49914	2121	192.168.2.16	92.207.138.140
May 6, 2024 04:56:41.310985088 CEST	49826	2121	192.168.2.16	175.250.21.18
May 6, 2024 04:56:41.311175108 CEST	49915	21	192.168.2.16	121.239.148.97
May 6, 2024 04:56:41.407041073 CEST	49709	21	192.168.2.16	166.148.200.249
May 6, 2024 04:56:41.407042027 CEST	49710	2121	192.168.2.16	166.148.200.249
May 6, 2024 04:56:41.436312914 CEST	21	49911	217.71.254.134	192.168.2.16
May 6, 2024 04:56:41.470973015 CEST	49774	2121	192.168.2.16	196.84.198.19
May 6, 2024 04:56:41.470976114 CEST	49823	2121	192.168.2.16	14.153.184.124
May 6, 2024 04:56:41.471033096 CEST	49816	2121	192.168.2.16	123.10.24.255
May 6, 2024 04:56:41.471050024 CEST	49773	21	192.168.2.16	196.84.198.19
May 6, 2024 04:56:41.486984015 CEST	49815	21	192.168.2.16	123.10.24.255
May 6, 2024 04:56:41.493623018 CEST	2121	49910	39.27.13.134	192.168.2.16
May 6, 2024 04:56:41.498322010 CEST	2121	49718	164.70.186.78	192.168.2.16
May 6, 2024 04:56:41.498708010 CEST	49916	2121	192.168.2.16	121.239.148.97
May 6, 2024 04:56:41.527154922 CEST	2121	49913	217.71.254.134	192.168.2.16
May 6, 2024 04:56:41.534040928 CEST	49744	2121	192.168.2.16	115.74.91.137
May 6, 2024 04:56:41.561439037 CEST	2121	49908	49.160.49.242	192.168.2.16
May 6, 2024 04:56:41.582191944 CEST	49917	21	192.168.2.16	75.69.181.185
May 6, 2024 04:56:41.593748093 CEST	21	49825	175.250.21.18	192.168.2.16
May 6, 2024 04:56:41.604623079 CEST	21	49875	14.75.234.10	192.168.2.16
May 6, 2024 04:56:41.606214046 CEST	2121	49876	14.75.234.10	192.168.2.16
May 6, 2024 04:56:41.614301920 CEST	49918	2121	192.168.2.16	75.69.181.185
May 6, 2024 04:56:41.625859022 CEST	2121	49826	175.250.21.18	192.168.2.16
May 6, 2024 04:56:41.629348993 CEST	49919	21	192.168.2.16	70.64.135.84
May 6, 2024 04:56:41.629400015 CEST	49920	2121	192.168.2.16	70.64.135.84
May 6, 2024 04:56:41.645236015 CEST	49921	21	192.168.2.16	124.104.19.175
May 6, 2024 04:56:41.661041021 CEST	49862	2121	192.168.2.16	163.47.81.9
May 6, 2024 04:56:41.661076069 CEST	49861	21	192.168.2.16	163.47.81.9
May 6, 2024 04:56:41.741074085 CEST	49909	21	192.168.2.16	39.27.13.134
May 6, 2024 04:56:41.765141964 CEST	21	49773	196.84.198.19	192.168.2.16
May 6, 2024 04:56:41.766887903 CEST	2121	49774	196.84.198.19	192.168.2.16
May 6, 2024 04:56:41.789395094 CEST	49922	2121	192.168.2.16	124.104.19.175
May 6, 2024 04:56:41.789423943 CEST	49923	21	192.168.2.16	50.50.245.60
May 6, 2024 04:56:41.830590010 CEST	2121	49823	14.153.184.124	192.168.2.16
May 6, 2024 04:56:41.831883907 CEST	2121	49816	123.10.24.255	192.168.2.16
May 6, 2024 04:56:41.843648911 CEST	2121	49916	121.239.148.97	192.168.2.16
May 6, 2024 04:56:41.847795010 CEST	21	49815	123.10.24.255	192.168.2.16
May 6, 2024 04:56:41.848200083 CEST	49924	2121	192.168.2.16	50.50.245.60
May 6, 2024 04:56:41.853470087 CEST	49925	21	192.168.2.16	95.233.231.144
May 6, 2024 04:56:41.853471041 CEST	49926	2121	192.168.2.16	95.233.231.144
May 6, 2024 04:56:41.869666100 CEST	2121	49710	166.148.200.249	192.168.2.16
May 6, 2024 04:56:41.870676041 CEST	21	49709	166.148.200.249	192.168.2.16
May 6, 2024 04:56:41.885334015 CEST	49927	21	192.168.2.16	91.23.96.94
May 6, 2024 04:56:41.885416985 CEST	49928	2121	192.168.2.16	91.23.96.94
May 6, 2024 04:56:41.909238100 CEST	2121	49744	115.74.91.137	192.168.2.16
May 6, 2024 04:56:41.933345079 CEST	49929	21	192.168.2.16	180.225.207.195
May 6, 2024 04:56:41.950227976 CEST	49911	21	192.168.2.16	217.71.254.134
May 6, 2024 04:56:41.953381062 CEST	21	49923	50.50.245.60	192.168.2.16
May 6, 2024 04:56:41.996969938 CEST	49910	2121	192.168.2.16	39.27.13.134
May 6, 2024 04:56:42.028980970 CEST	49913	2121	192.168.2.16	217.71.254.134
May 6, 2024 04:56:42.038742065 CEST	21	49909	39.27.13.134	192.168.2.16
May 6, 2024 04:56:42.055181026 CEST	21	49861	163.47.81.9	192.168.2.16
May 6, 2024 04:56:42.061238050 CEST	2121	49862	163.47.81.9	192.168.2.16
May 6, 2024 04:56:42.077493906 CEST	49930	21	192.168.2.16	39.57.192.254
May 6, 2024 04:56:42.077512026 CEST	49931	2121	192.168.2.16	180.225.207.195
May 6, 2024 04:56:42.193901062 CEST	21	49911	217.71.254.134	192.168.2.16
May 6, 2024 04:56:42.261311054 CEST	2121	49913	217.71.254.134	192.168.2.16
May 6, 2024 04:56:42.300750017 CEST	2121	49910	39.27.13.134	192.168.2.16
May 6, 2024 04:56:42.300987005 CEST	49912	21	192.168.2.16	92.207.138.140
May 6, 2024 04:56:42.300987959 CEST	49914	2121	192.168.2.16	92.207.138.140
May 6, 2024 04:56:42.316977024 CEST	49915	21	192.168.2.16	121.239.148.97
May 6, 2024 04:56:42.348968029 CEST	49916	2121	192.168.2.16	121.239.148.97
May 6, 2024 04:56:42.392657995 CEST	2121	49931	180.225.207.195	192.168.2.16
May 6, 2024 04:56:42.460956097 CEST	49923	21	192.168.2.16	50.50.245.60
May 6, 2024 04:56:42.540981054 CEST	49909	21	192.168.2.16	39.27.13.134
May 6, 2024 04:56:42.588958979 CEST	49917	21	192.168.2.16	75.69.181.185
May 6, 2024 04:56:42.621064901 CEST	49918	2121	192.168.2.16	75.69.181.185
May 6, 2024 04:56:42.625128984 CEST	21	49923	50.50.245.60	192.168.2.16
May 6, 2024 04:56:42.636972904 CEST	49920	2121	192.168.2.16	70.64.135.84
May 6, 2024 04:56:42.636975050 CEST	49919	21	192.168.2.16	70.64.135.84
May 6, 2024 04:56:42.652945995 CEST	49921	21	192.168.2.16	124.104.19.175
May 6, 2024 04:56:42.694475889 CEST	2121	49916	121.239.148.97	192.168.2.16
May 6, 2024 04:56:42.700974941 CEST	49911	21	192.168.2.16	217.71.254.134
May 6, 2024 04:56:42.764981985 CEST	49913	2121	192.168.2.16	217.71.254.134
May 6, 2024 04:56:42.796979904 CEST	49922	2121	192.168.2.16	124.104.19.175
May 6, 2024 04:56:42.812953949 CEST	49910	2121	192.168.2.16	39.27.13.134
May 6, 2024 04:56:42.837965012 CEST	21	49909	39.27.13.134	192.168.2.16
May 6, 2024 04:56:42.860950947 CEST	49924	2121	192.168.2.16	50.50.245.60
May 6, 2024 04:56:42.860989094 CEST	49926	2121	192.168.2.16	95.233.231.144
May 6, 2024 04:56:42.860996008 CEST	49925	21	192.168.2.16	95.233.231.144
May 6, 2024 04:56:42.892977953 CEST	49927	21	192.168.2.16	91.23.96.94
May 6, 2024 04:56:42.892982006 CEST	49928	2121	192.168.2.16	91.23.96.94
May 6, 2024 04:56:42.894943953 CEST	49931	2121	192.168.2.16	180.225.207.195
May 6, 2024 04:56:42.940972090 CEST	49929	21	192.168.2.16	180.225.207.195
May 6, 2024 04:56:42.944731951 CEST	21	49911	217.71.254.134	192.168.2.16
May 6, 2024 04:56:42.975084066 CEST	49932	2121	192.168.2.16	39.57.192.254
May 6, 2024 04:56:42.975192070 CEST	49933	21	192.168.2.16	46.89.232.180
May 6, 2024 04:56:42.975274086 CEST	49934	2121	192.168.2.16	46.89.232.180
May 6, 2024 04:56:42.975313902 CEST	49935	21	192.168.2.16	73.118.128.95
May 6, 2024 04:56:42.975367069 CEST	49936	2121	192.168.2.16	73.118.128.95
May 6, 2024 04:56:42.975506067 CEST	49938	21	192.168.2.16	188.214.213.151
May 6, 2024 04:56:42.975507975 CEST	49937	2121	192.168.2.16	64.234.71.164
May 6, 2024 04:56:42.975605965 CEST	49939	2121	192.168.2.16	188.214.213.151
May 6, 2024 04:56:42.975697041 CEST	49941	21	192.168.2.16	101.93.183.130
May 6, 2024 04:56:42.975759029 CEST	49942	2121	192.168.2.16	101.93.183.130
May 6, 2024 04:56:42.975817919 CEST	49940	21	192.168.2.16	64.234.71.164
May 6, 2024 04:56:42.975867033 CEST	49943	21	192.168.2.16	73.87.131.239
May 6, 2024 04:56:42.975938082 CEST	49944	2121	192.168.2.16	73.87.131.239
May 6, 2024 04:56:42.976007938 CEST	49946	21	192.168.2.16	204.141.177.155
May 6, 2024 04:56:42.976022005 CEST	49945	2121	192.168.2.16	204.141.177.155
May 6, 2024 04:56:42.976129055 CEST	49947	2121	192.168.2.16	177.135.211.33
May 6, 2024 04:56:42.976164103 CEST	49948	21	192.168.2.16	73.159.106.21
May 6, 2024 04:56:42.976239920 CEST	49949	21	192.168.2.16	20.116.64.231
May 6, 2024 04:56:42.976294041 CEST	49950	21	192.168.2.16	36.14.21.3
May 6, 2024 04:56:42.976346970 CEST	49951	2121	192.168.2.16	36.14.21.3
May 6, 2024 04:56:42.976361990 CEST	49952	21	192.168.2.16	71.94.100.217
May 6, 2024 04:56:42.976449013 CEST	49953	2121	192.168.2.16	20.116.64.231
May 6, 2024 04:56:42.976469994 CEST	49954	21	192.168.2.16	177.135.211.33
May 6, 2024 04:56:42.976492882 CEST	49955	2121	192.168.2.16	73.159.106.21
May 6, 2024 04:56:42.976536036 CEST	49956	2121	192.168.2.16	71.94.100.217
May 6, 2024 04:56:42.990274906 CEST	49957	21	192.168.2.16	156.239.231.220
May 6, 2024 04:56:42.990474939 CEST	49958	2121	192.168.2.16	156.239.231.220
May 6, 2024 04:56:42.990477085 CEST	49959	21	192.168.2.16	49.76.33.233
May 6, 2024 04:56:42.990526915 CEST	49960	2121	192.168.2.16	49.76.33.233
May 6, 2024 04:56:42.990530014 CEST	49961	21	192.168.2.16	123.28.163.82
May 6, 2024 04:56:42.990673065 CEST	49962	21	192.168.2.16	46.109.137.149
May 6, 2024 04:56:42.990736008 CEST	49963	2121	192.168.2.16	46.109.137.149
May 6, 2024 04:56:42.990833044 CEST	49965	21	192.168.2.16	83.53.51.42
May 6, 2024 04:56:42.990860939 CEST	49964	2121	192.168.2.16	123.28.163.82
May 6, 2024 04:56:42.990906000 CEST	49966	2121	192.168.2.16	83.53.51.42
May 6, 2024 04:56:42.990932941 CEST	49967	21	192.168.2.16	125.246.254.11
May 6, 2024 04:56:42.990969896 CEST	49968	2121	192.168.2.16	125.246.254.11
May 6, 2024 04:56:42.991054058 CEST	49969	21	192.168.2.16	66.108.100.134
May 6, 2024 04:56:42.991125107 CEST	49970	2121	192.168.2.16	66.108.100.134
May 6, 2024 04:56:42.991241932 CEST	49971	21	192.168.2.16	43.201.47.213
May 6, 2024 04:56:42.991295099 CEST	49972	2121	192.168.2.16	43.201.47.213
May 6, 2024 04:56:42.991372108 CEST	49973	21	192.168.2.16	98.122.116.210
May 6, 2024 04:56:42.991435051 CEST	49974	2121	192.168.2.16	98.122.116.210
May 6, 2024 04:56:42.991467953 CEST	49975	21	192.168.2.16	24.132.104.243
May 6, 2024 04:56:42.991614103 CEST	49976	21	192.168.2.16	73.183.154.173
May 6, 2024 04:56:42.991652012 CEST	49977	2121	192.168.2.16	73.183.154.173
May 6, 2024 04:56:42.991699934 CEST	49978	2121	192.168.2.16	173.18.4.227
May 6, 2024 04:56:42.991785049 CEST	49979	21	192.168.2.16	73.184.119.203
May 6, 2024 04:56:42.991920948 CEST	49980	2121	192.168.2.16	73.184.119.203
May 6, 2024 04:56:42.991978884 CEST	49981	21	192.168.2.16	119.223.221.121
May 6, 2024 04:56:42.992024899 CEST	49983	2121	192.168.2.16	119.223.221.121
May 6, 2024 04:56:42.992055893 CEST	49982	21	192.168.2.16	1.49.252.112
May 6, 2024 04:56:42.992085934 CEST	49984	2121	192.168.2.16	1.49.252.112
May 6, 2024 04:56:42.992116928 CEST	49985	2121	192.168.2.16	24.132.104.243
May 6, 2024 04:56:42.992116928 CEST	49986	21	192.168.2.16	105.72.6.198
May 6, 2024 04:56:42.992192984 CEST	49987	21	192.168.2.16	173.18.4.227
May 6, 2024 04:56:42.996705055 CEST	2121	49913	217.71.254.134	192.168.2.16
May 6, 2024 04:56:43.004992962 CEST	49988	2121	192.168.2.16	105.72.6.198
May 6, 2024 04:56:43.005311966 CEST	49989	21	192.168.2.16	60.76.76.108
May 6, 2024 04:56:43.005392075 CEST	49990	2121	192.168.2.16	60.76.76.108
May 6, 2024 04:56:43.005425930 CEST	49991	21	192.168.2.16	82.78.235.56
May 6, 2024 04:56:43.005513906 CEST	49992	2121	192.168.2.16	82.78.235.56
May 6, 2024 04:56:43.005594015 CEST	49993	21	192.168.2.16	98.184.230.194
May 6, 2024 04:56:43.005647898 CEST	49994	2121	192.168.2.16	98.184.230.194
May 6, 2024 04:56:43.005716085 CEST	49995	21	192.168.2.16	86.126.81.230
May 6, 2024 04:56:43.005799055 CEST	49996	21	192.168.2.16	179.54.202.127
May 6, 2024 04:56:43.005861044 CEST	49997	2121	192.168.2.16	86.126.81.230
May 6, 2024 04:56:43.005947113 CEST	49998	2121	192.168.2.16	179.54.202.127
May 6, 2024 04:56:43.006078005 CEST	49999	21	192.168.2.16	153.205.240.87
May 6, 2024 04:56:43.006165028 CEST	50000	2121	192.168.2.16	153.205.240.87
May 6, 2024 04:56:43.006257057 CEST	50001	21	192.168.2.16	221.3.28.190
May 6, 2024 04:56:43.006350994 CEST	50002	2121	192.168.2.16	221.3.28.190
May 6, 2024 04:56:43.006406069 CEST	50003	21	192.168.2.16	83.36.215.37
May 6, 2024 04:56:43.006462097 CEST	50004	2121	192.168.2.16	83.36.215.37
May 6, 2024 04:56:43.006536007 CEST	50005	21	192.168.2.16	119.165.35.137
May 6, 2024 04:56:43.006592035 CEST	50006	2121	192.168.2.16	119.165.35.137
May 6, 2024 04:56:43.006678104 CEST	50007	21	192.168.2.16	62.115.189.118
May 6, 2024 04:56:43.006742954 CEST	50008	2121	192.168.2.16	62.115.189.118
May 6, 2024 04:56:43.006763935 CEST	50009	21	192.168.2.16	111.59.245.235
May 6, 2024 04:56:43.006922960 CEST	50010	21	192.168.2.16	40.113.144.129
May 6, 2024 04:56:43.006978035 CEST	50011	2121	192.168.2.16	40.113.144.129
May 6, 2024 04:56:43.007028103 CEST	50012	2121	192.168.2.16	111.59.245.235
May 6, 2024 04:56:43.007142067 CEST	50013	2121	192.168.2.16	116.172.87.75
May 6, 2024 04:56:43.007168055 CEST	50014	21	192.168.2.16	58.153.229.5
May 6, 2024 04:56:43.007313967 CEST	50016	2121	192.168.2.16	58.153.229.5
May 6, 2024 04:56:43.007314920 CEST	50015	21	192.168.2.16	116.172.87.75
May 6, 2024 04:56:43.007352114 CEST	50017	21	192.168.2.16	154.125.106.175
May 6, 2024 04:56:43.007374048 CEST	50018	2121	192.168.2.16	154.125.106.175
May 6, 2024 04:56:43.020212889 CEST	50019	21	192.168.2.16	82.151.55.252
May 6, 2024 04:56:43.020602942 CEST	50020	2121	192.168.2.16	82.151.55.252
May 6, 2024 04:56:43.020725965 CEST	50021	21	192.168.2.16	124.54.188.17
May 6, 2024 04:56:43.020800114 CEST	50022	2121	192.168.2.16	124.54.188.17
May 6, 2024 04:56:43.020854950 CEST	50023	21	192.168.2.16	91.196.221.70
May 6, 2024 04:56:43.020960093 CEST	50024	2121	192.168.2.16	91.196.221.70
May 6, 2024 04:56:43.021070004 CEST	50025	21	192.168.2.16	1.225.194.212
May 6, 2024 04:56:43.021142960 CEST	50026	2121	192.168.2.16	1.225.194.212
May 6, 2024 04:56:43.021203041 CEST	50027	21	192.168.2.16	189.232.134.22
May 6, 2024 04:56:43.021240950 CEST	50028	2121	192.168.2.16	189.232.134.22
May 6, 2024 04:56:43.021290064 CEST	50029	21	192.168.2.16	188.127.174.192
May 6, 2024 04:56:43.021352053 CEST	50030	2121	192.168.2.16	188.127.174.192
May 6, 2024 04:56:43.021379948 CEST	50031	21	192.168.2.16	118.37.227.7
May 6, 2024 04:56:43.021457911 CEST	50032	21	192.168.2.16	5.56.64.87
May 6, 2024 04:56:43.021529913 CEST	50033	2121	192.168.2.16	5.56.64.87
May 6, 2024 04:56:43.021662951 CEST	50034	2121	192.168.2.16	118.37.227.7
May 6, 2024 04:56:43.021733999 CEST	50035	21	192.168.2.16	51.116.138.204
May 6, 2024 04:56:43.021796942 CEST	50036	21	192.168.2.16	187.94.222.6
May 6, 2024 04:56:43.021816015 CEST	50037	2121	192.168.2.16	51.116.138.204
May 6, 2024 04:56:43.021862984 CEST	50038	2121	192.168.2.16	187.94.222.6
May 6, 2024 04:56:43.021917105 CEST	50039	21	192.168.2.16	47.37.113.171
May 6, 2024 04:56:43.021975040 CEST	50040	2121	192.168.2.16	47.37.113.171
May 6, 2024 04:56:43.022034883 CEST	50041	21	192.168.2.16	183.162.166.97
May 6, 2024 04:56:43.022104025 CEST	50042	21	192.168.2.16	125.165.86.247
May 6, 2024 04:56:43.022161961 CEST	50043	2121	192.168.2.16	125.165.86.247
May 6, 2024 04:56:43.022270918 CEST	50044	2121	192.168.2.16	183.162.166.97
May 6, 2024 04:56:43.022320032 CEST	50045	21	192.168.2.16	20.197.33.115
May 6, 2024 04:56:43.022346973 CEST	50046	2121	192.168.2.16	20.197.33.115
May 6, 2024 04:56:43.022433996 CEST	50047	21	192.168.2.16	171.225.13.244
May 6, 2024 04:56:43.022548914 CEST	50048	2121	192.168.2.16	171.225.13.244
May 6, 2024 04:56:43.022666931 CEST	50049	21	192.168.2.16	71.53.157.218
May 6, 2024 04:56:43.022733927 CEST	50050	2121	192.168.2.16	71.53.157.218
May 6, 2024 04:56:43.022811890 CEST	50051	21	192.168.2.16	86.21.54.149
May 6, 2024 04:56:43.022844076 CEST	50052	2121	192.168.2.16	86.21.54.149
May 6, 2024 04:56:43.035295010 CEST	50053	2121	192.168.2.16	189.146.178.160
May 6, 2024 04:56:43.035391092 CEST	50055	21	192.168.2.16	189.146.178.160
May 6, 2024 04:56:43.035393953 CEST	50054	21	192.168.2.16	47.96.78.154
May 6, 2024 04:56:43.035418034 CEST	50056	2121	192.168.2.16	47.96.78.154
May 6, 2024 04:56:43.035598040 CEST	50057	2121	192.168.2.16	90.218.5.59
May 6, 2024 04:56:43.035630941 CEST	50058	21	192.168.2.16	90.218.5.59
May 6, 2024 04:56:43.035676956 CEST	50059	21	192.168.2.16	109.205.180.149
May 6, 2024 04:56:43.035737038 CEST	50061	21	192.168.2.16	116.126.49.212
May 6, 2024 04:56:43.035737038 CEST	50060	2121	192.168.2.16	109.205.180.149
May 6, 2024 04:56:43.035809040 CEST	50062	2121	192.168.2.16	116.126.49.212
May 6, 2024 04:56:43.035934925 CEST	50063	21	192.168.2.16	187.153.144.97
May 6, 2024 04:56:43.036026001 CEST	50064	21	192.168.2.16	79.154.68.52
May 6, 2024 04:56:43.036043882 CEST	50065	2121	192.168.2.16	187.153.144.97
May 6, 2024 04:56:43.036073923 CEST	50066	2121	192.168.2.16	79.154.68.52
May 6, 2024 04:56:43.036201954 CEST	50067	21	192.168.2.16	184.174.107.146
May 6, 2024 04:56:43.036295891 CEST	50068	2121	192.168.2.16	184.174.107.146
May 6, 2024 04:56:43.036324978 CEST	50069	21	192.168.2.16	220.71.129.47
May 6, 2024 04:56:43.036371946 CEST	50070	2121	192.168.2.16	220.71.129.47
May 6, 2024 04:56:43.036493063 CEST	50071	21	192.168.2.16	208.87.22.137
May 6, 2024 04:56:43.036572933 CEST	50072	21	192.168.2.16	182.111.5.233
May 6, 2024 04:56:43.036592007 CEST	50073	2121	192.168.2.16	208.87.22.137
May 6, 2024 04:56:43.036643982 CEST	50074	2121	192.168.2.16	182.111.5.233
May 6, 2024 04:56:43.036814928 CEST	50075	2121	192.168.2.16	103.109.6.215
May 6, 2024 04:56:43.036889076 CEST	50076	21	192.168.2.16	103.109.6.215
May 6, 2024 04:56:43.036910057 CEST	50077	2121	192.168.2.16	43.156.44.194
May 6, 2024 04:56:43.036998034 CEST	50078	21	192.168.2.16	43.156.44.194
May 6, 2024 04:56:43.037019968 CEST	50079	21	192.168.2.16	66.103.220.9
May 6, 2024 04:56:43.037091017 CEST	50080	2121	192.168.2.16	66.103.220.9
May 6, 2024 04:56:43.037182093 CEST	50081	21	192.168.2.16	8.139.2.255
May 6, 2024 04:56:43.037261963 CEST	50082	2121	192.168.2.16	8.139.2.255
May 6, 2024 04:56:43.037292004 CEST	50083	21	192.168.2.16	75.182.234.146
May 6, 2024 04:56:43.037307024 CEST	50084	2121	192.168.2.16	75.182.234.146
May 6, 2024 04:56:43.049806118 CEST	50085	21	192.168.2.16	49.169.39.43
May 6, 2024 04:56:43.049999952 CEST	50086	2121	192.168.2.16	49.169.39.43
May 6, 2024 04:56:43.050097942 CEST	50087	21	192.168.2.16	20.232.59.48
May 6, 2024 04:56:43.050209045 CEST	50088	2121	192.168.2.16	20.232.59.48
May 6, 2024 04:56:43.050234079 CEST	50089	21	192.168.2.16	16.162.180.123
May 6, 2024 04:56:43.050451040 CEST	50090	21	192.168.2.16	207.66.112.94
May 6, 2024 04:56:43.050472021 CEST	50091	2121	192.168.2.16	16.162.180.123
May 6, 2024 04:56:43.050527096 CEST	50092	2121	192.168.2.16	207.66.112.94
May 6, 2024 04:56:43.050597906 CEST	50093	21	192.168.2.16	190.160.27.247
May 6, 2024 04:56:43.050724030 CEST	50094	2121	192.168.2.16	190.160.27.247
May 6, 2024 04:56:43.050786018 CEST	50095	21	192.168.2.16	115.141.248.1
May 6, 2024 04:56:43.050880909 CEST	50096	2121	192.168.2.16	115.141.248.1
May 6, 2024 04:56:43.050971985 CEST	50097	21	192.168.2.16	68.34.99.131
May 6, 2024 04:56:43.051033974 CEST	50098	2121	192.168.2.16	68.34.99.131
May 6, 2024 04:56:43.051140070 CEST	50099	21	192.168.2.16	93.229.32.114
May 6, 2024 04:56:43.051222086 CEST	50100	2121	192.168.2.16	93.229.32.114
May 6, 2024 04:56:43.051282883 CEST	50101	21	192.168.2.16	38.18.122.147
May 6, 2024 04:56:43.051356077 CEST	50102	2121	192.168.2.16	38.18.122.147
May 6, 2024 04:56:43.051476955 CEST	50103	21	192.168.2.16	118.35.206.150
May 6, 2024 04:56:43.051570892 CEST	50104	2121	192.168.2.16	118.35.206.150
May 6, 2024 04:56:43.051671982 CEST	50105	21	192.168.2.16	92.253.68.186
May 6, 2024 04:56:43.051772118 CEST	50106	2121	192.168.2.16	92.253.68.186
May 6, 2024 04:56:43.051834106 CEST	50107	21	192.168.2.16	84.133.30.105
May 6, 2024 04:56:43.051877022 CEST	50108	2121	192.168.2.16	84.133.30.105
May 6, 2024 04:56:43.079952955 CEST	49930	21	192.168.2.16	39.57.192.254
May 6, 2024 04:56:43.117427111 CEST	2121	49910	39.27.13.134	192.168.2.16
May 6, 2024 04:56:43.127074003 CEST	49923	21	192.168.2.16	50.50.245.60
May 6, 2024 04:56:43.162781000 CEST	21	49957	156.239.231.220	192.168.2.16
May 6, 2024 04:56:43.162822008 CEST	2121	49958	156.239.231.220	192.168.2.16
May 6, 2024 04:56:43.166773081 CEST	2121	49978	173.18.4.227	192.168.2.16
May 6, 2024 04:56:43.172115088 CEST	21	49954	177.135.211.33	192.168.2.16
May 6, 2024 04:56:43.174662113 CEST	2121	49947	177.135.211.33	192.168.2.16
May 6, 2024 04:56:43.191252947 CEST	21	50071	208.87.22.137	192.168.2.16
May 6, 2024 04:56:43.191423893 CEST	2121	50073	208.87.22.137	192.168.2.16
May 6, 2024 04:56:43.206983089 CEST	49916	2121	192.168.2.16	121.239.148.97
May 6, 2024 04:56:43.209431887 CEST	21	50079	66.103.220.9	192.168.2.16
May 6, 2024 04:56:43.209445953 CEST	2121	50080	66.103.220.9	192.168.2.16
May 6, 2024 04:56:43.209997892 CEST	2121	49931	180.225.207.195	192.168.2.16
May 6, 2024 04:56:43.238656998 CEST	2121	49998	179.54.202.127	192.168.2.16
May 6, 2024 04:56:43.251998901 CEST	21	50036	187.94.222.6	192.168.2.16
May 6, 2024 04:56:43.253966093 CEST	2121	49951	36.14.21.3	192.168.2.16
May 6, 2024 04:56:43.253988981 CEST	21	49950	36.14.21.3	192.168.2.16
May 6, 2024 04:56:43.254882097 CEST	2121	50038	187.94.222.6	192.168.2.16
May 6, 2024 04:56:43.260293961 CEST	2121	49992	82.78.235.56	192.168.2.16
May 6, 2024 04:56:43.264461994 CEST	2121	50060	109.205.180.149	192.168.2.16
May 6, 2024 04:56:43.268991947 CEST	21	50059	109.205.180.149	192.168.2.16
May 6, 2024 04:56:43.269056082 CEST	50059	21	192.168.2.16	109.205.180.149
May 6, 2024 04:56:43.271018982 CEST	21	50093	190.160.27.247	192.168.2.16
May 6, 2024 04:56:43.276240110 CEST	2121	50094	190.160.27.247	192.168.2.16
May 6, 2024 04:56:43.285303116 CEST	21	49989	60.76.76.108	192.168.2.16
May 6, 2024 04:56:43.290580988 CEST	21	49923	50.50.245.60	192.168.2.16
May 6, 2024 04:56:43.301490068 CEST	2121	49990	60.76.76.108	192.168.2.16
May 6, 2024 04:56:43.314529896 CEST	21	49971	43.201.47.213	192.168.2.16
May 6, 2024 04:56:43.314542055 CEST	2121	49972	43.201.47.213	192.168.2.16
May 6, 2024 04:56:43.317783117 CEST	21	49999	153.205.240.87	192.168.2.16
May 6, 2024 04:56:43.333827972 CEST	2121	50062	116.126.49.212	192.168.2.16
May 6, 2024 04:56:43.346998930 CEST	2121	50026	1.225.194.212	192.168.2.16
May 6, 2024 04:56:43.348107100 CEST	21	50014	58.153.229.5	192.168.2.16
May 6, 2024 04:56:43.350950003 CEST	49909	21	192.168.2.16	39.27.13.134
May 6, 2024 04:56:43.351210117 CEST	21	50103	118.35.206.150	192.168.2.16
May 6, 2024 04:56:43.351669073 CEST	2121	50104	118.35.206.150	192.168.2.16
May 6, 2024 04:56:43.355293989 CEST	2121	49984	1.49.252.112	192.168.2.16
May 6, 2024 04:56:43.357845068 CEST	2121	50016	58.153.229.5	192.168.2.16
May 6, 2024 04:56:43.360371113 CEST	21	50061	116.126.49.212	192.168.2.16
May 6, 2024 04:56:43.360995054 CEST	21	50025	1.225.194.212	192.168.2.16
May 6, 2024 04:56:43.370076895 CEST	2121	50096	115.141.248.1	192.168.2.16
May 6, 2024 04:56:43.385796070 CEST	21	50076	103.109.6.215	192.168.2.16
May 6, 2024 04:56:43.385863066 CEST	50076	21	192.168.2.16	103.109.6.215
May 6, 2024 04:56:43.397387981 CEST	21	50042	125.165.86.247	192.168.2.16
May 6, 2024 04:56:43.404670000 CEST	2121	50043	125.165.86.247	192.168.2.16
May 6, 2024 04:56:43.444825888 CEST	2121	50012	111.59.245.235	192.168.2.16
May 6, 2024 04:56:43.446969986 CEST	49911	21	192.168.2.16	217.71.254.134
May 6, 2024 04:56:43.462095022 CEST	21	50009	111.59.245.235	192.168.2.16
May 6, 2024 04:56:43.504369020 CEST	21	50059	109.205.180.149	192.168.2.16
May 6, 2024 04:56:43.504462004 CEST	50059	21	192.168.2.16	109.205.180.149
May 6, 2024 04:56:43.504688978 CEST	50109	21	192.168.2.16	61.55.18.14
May 6, 2024 04:56:43.510972977 CEST	49913	2121	192.168.2.16	217.71.254.134
May 6, 2024 04:56:43.552186012 CEST	2121	49916	121.239.148.97	192.168.2.16
May 6, 2024 04:56:43.622982025 CEST	49910	2121	192.168.2.16	39.27.13.134
May 6, 2024 04:56:43.647605896 CEST	21	49909	39.27.13.134	192.168.2.16
May 6, 2024 04:56:43.670978069 CEST	49957	21	192.168.2.16	156.239.231.220
May 6, 2024 04:56:43.670979977 CEST	49978	2121	192.168.2.16	173.18.4.227
May 6, 2024 04:56:43.671216011 CEST	50110	2121	192.168.2.16	61.55.18.14
May 6, 2024 04:56:43.671246052 CEST	49958	2121	192.168.2.16	156.239.231.220
May 6, 2024 04:56:43.686959028 CEST	49947	2121	192.168.2.16	177.135.211.33
May 6, 2024 04:56:43.686963081 CEST	49954	21	192.168.2.16	177.135.211.33
May 6, 2024 04:56:43.689764977 CEST	21	49911	217.71.254.134	192.168.2.16
May 6, 2024 04:56:43.702965975 CEST	50073	2121	192.168.2.16	208.87.22.137
May 6, 2024 04:56:43.702965975 CEST	50071	21	192.168.2.16	208.87.22.137
May 6, 2024 04:56:43.718950033 CEST	50080	2121	192.168.2.16	66.103.220.9
May 6, 2024 04:56:43.718981028 CEST	49931	2121	192.168.2.16	180.225.207.195
May 6, 2024 04:56:43.718981028 CEST	50079	21	192.168.2.16	66.103.220.9
May 6, 2024 04:56:43.735404968 CEST	21	50076	103.109.6.215	192.168.2.16
May 6, 2024 04:56:43.735512018 CEST	50076	21	192.168.2.16	103.109.6.215
May 6, 2024 04:56:43.735745907 CEST	50111	21	192.168.2.16	45.87.1.166
May 6, 2024 04:56:43.737689972 CEST	21	50059	109.205.180.149	192.168.2.16
May 6, 2024 04:56:43.737747908 CEST	50059	21	192.168.2.16	109.205.180.149
May 6, 2024 04:56:43.741266012 CEST	21	50059	109.205.180.149	192.168.2.16
May 6, 2024 04:56:43.741319895 CEST	50059	21	192.168.2.16	109.205.180.149
May 6, 2024 04:56:43.743820906 CEST	2121	49913	217.71.254.134	192.168.2.16
May 6, 2024 04:56:43.750952005 CEST	49998	2121	192.168.2.16	179.54.202.127
May 6, 2024 04:56:43.766957045 CEST	49951	2121	192.168.2.16	36.14.21.3
May 6, 2024 04:56:43.766957998 CEST	50036	21	192.168.2.16	187.94.222.6
May 6, 2024 04:56:43.766980886 CEST	50038	2121	192.168.2.16	187.94.222.6
May 6, 2024 04:56:43.766982079 CEST	49992	2121	192.168.2.16	82.78.235.56
May 6, 2024 04:56:43.766984940 CEST	49950	21	192.168.2.16	36.14.21.3
May 6, 2024 04:56:43.766985893 CEST	50060	2121	192.168.2.16	109.205.180.149
May 6, 2024 04:56:43.782963991 CEST	50093	21	192.168.2.16	190.160.27.247
May 6, 2024 04:56:43.782965899 CEST	50094	2121	192.168.2.16	190.160.27.247
May 6, 2024 04:56:43.798948050 CEST	49989	21	192.168.2.16	60.76.76.108
May 6, 2024 04:56:43.798974991 CEST	49923	21	192.168.2.16	50.50.245.60
May 6, 2024 04:56:43.814961910 CEST	49972	2121	192.168.2.16	43.201.47.213
May 6, 2024 04:56:43.814963102 CEST	49990	2121	192.168.2.16	60.76.76.108
May 6, 2024 04:56:43.814964056 CEST	49971	21	192.168.2.16	43.201.47.213
May 6, 2024 04:56:43.830950975 CEST	49999	21	192.168.2.16	153.205.240.87
May 6, 2024 04:56:43.843440056 CEST	21	49957	156.239.231.220	192.168.2.16
May 6, 2024 04:56:43.843619108 CEST	2121	49958	156.239.231.220	192.168.2.16
May 6, 2024 04:56:43.846947908 CEST	50062	2121	192.168.2.16	116.126.49.212
May 6, 2024 04:56:43.846961975 CEST	50026	2121	192.168.2.16	1.225.194.212
May 6, 2024 04:56:43.847424030 CEST	2121	49978	173.18.4.227	192.168.2.16
May 6, 2024 04:56:43.857350111 CEST	2121	50073	208.87.22.137	192.168.2.16
May 6, 2024 04:56:43.857608080 CEST	21	50071	208.87.22.137	192.168.2.16
May 6, 2024 04:56:43.862946987 CEST	50103	21	192.168.2.16	118.35.206.150
May 6, 2024 04:56:43.862958908 CEST	50104	2121	192.168.2.16	118.35.206.150
May 6, 2024 04:56:43.862966061 CEST	49984	2121	192.168.2.16	1.49.252.112
May 6, 2024 04:56:43.863945961 CEST	50025	21	192.168.2.16	1.225.194.212
May 6, 2024 04:56:43.863946915 CEST	50014	21	192.168.2.16	58.153.229.5
May 6, 2024 04:56:43.865134954 CEST	50016	2121	192.168.2.16	58.153.229.5
May 6, 2024 04:56:43.865134954 CEST	50061	21	192.168.2.16	116.126.49.212
May 6, 2024 04:56:43.878950119 CEST	50096	2121	192.168.2.16	115.141.248.1
May 6, 2024 04:56:43.882446051 CEST	21	49954	177.135.211.33	192.168.2.16
May 6, 2024 04:56:43.885445118 CEST	2121	49947	177.135.211.33	192.168.2.16
May 6, 2024 04:56:43.891674042 CEST	2121	50080	66.103.220.9	192.168.2.16
May 6, 2024 04:56:43.891686916 CEST	21	50079	66.103.220.9	192.168.2.16
May 6, 2024 04:56:43.910949945 CEST	50042	21	192.168.2.16	125.165.86.247
May 6, 2024 04:56:43.910969973 CEST	50043	2121	192.168.2.16	125.165.86.247
May 6, 2024 04:56:43.928349972 CEST	2121	49910	39.27.13.134	192.168.2.16
May 6, 2024 04:56:43.958962917 CEST	50012	2121	192.168.2.16	111.59.245.235
May 6, 2024 04:56:43.961500883 CEST	21	50111	45.87.1.166	192.168.2.16
May 6, 2024 04:56:43.961576939 CEST	50111	21	192.168.2.16	45.87.1.166
May 6, 2024 04:56:43.962214947 CEST	21	49923	50.50.245.60	192.168.2.16
May 6, 2024 04:56:43.974982977 CEST	49934	2121	192.168.2.16	46.89.232.180
May 6, 2024 04:56:43.974984884 CEST	50009	21	192.168.2.16	111.59.245.235
May 6, 2024 04:56:43.974986076 CEST	49940	21	192.168.2.16	64.234.71.164
May 6, 2024 04:56:43.974998951 CEST	49943	21	192.168.2.16	73.87.131.239
May 6, 2024 04:56:43.974998951 CEST	49937	2121	192.168.2.16	64.234.71.164
May 6, 2024 04:56:43.974998951 CEST	49935	21	192.168.2.16	73.118.128.95
May 6, 2024 04:56:43.974998951 CEST	49939	2121	192.168.2.16	188.214.213.151
May 6, 2024 04:56:43.974998951 CEST	49936	2121	192.168.2.16	73.118.128.95
May 6, 2024 04:56:43.975868940 CEST	49932	2121	192.168.2.16	39.57.192.254
May 6, 2024 04:56:43.975874901 CEST	49941	21	192.168.2.16	101.93.183.130
May 6, 2024 04:56:43.975878000 CEST	49938	21	192.168.2.16	188.214.213.151
May 6, 2024 04:56:43.975878000 CEST	49933	21	192.168.2.16	46.89.232.180
May 6, 2024 04:56:43.975888014 CEST	49942	2121	192.168.2.16	101.93.183.130
May 6, 2024 04:56:43.975891113 CEST	49955	2121	192.168.2.16	73.159.106.21
May 6, 2024 04:56:43.975893021 CEST	49952	21	192.168.2.16	71.94.100.217
May 6, 2024 04:56:43.983649015 CEST	2121	49998	179.54.202.127	192.168.2.16
May 6, 2024 04:56:43.990958929 CEST	49948	21	192.168.2.16	73.159.106.21
May 6, 2024 04:56:43.990959883 CEST	49953	2121	192.168.2.16	20.116.64.231
May 6, 2024 04:56:43.990961075 CEST	49946	21	192.168.2.16	204.141.177.155
May 6, 2024 04:56:43.990977049 CEST	49966	2121	192.168.2.16	83.53.51.42
May 6, 2024 04:56:43.990978003 CEST	49961	21	192.168.2.16	123.28.163.82
May 6, 2024 04:56:43.990981102 CEST	49959	21	192.168.2.16	49.76.33.233
May 6, 2024 04:56:43.990983009 CEST	49973	21	192.168.2.16	98.122.116.210
May 6, 2024 04:56:43.990988016 CEST	49963	2121	192.168.2.16	46.109.137.149
May 6, 2024 04:56:43.990988016 CEST	49949	21	192.168.2.16	20.116.64.231
May 6, 2024 04:56:43.991000891 CEST	49960	2121	192.168.2.16	49.76.33.233
May 6, 2024 04:56:43.991003036 CEST	49944	2121	192.168.2.16	73.87.131.239
May 6, 2024 04:56:43.991003036 CEST	49968	2121	192.168.2.16	125.246.254.11
May 6, 2024 04:56:43.991007090 CEST	49945	2121	192.168.2.16	204.141.177.155
May 6, 2024 04:56:43.991007090 CEST	49967	21	192.168.2.16	125.246.254.11
May 6, 2024 04:56:43.991007090 CEST	49976	21	192.168.2.16	73.183.154.173
May 6, 2024 04:56:43.991007090 CEST	49974	2121	192.168.2.16	98.122.116.210
May 6, 2024 04:56:43.991009951 CEST	49956	2121	192.168.2.16	71.94.100.217
May 6, 2024 04:56:43.991009951 CEST	49969	21	192.168.2.16	66.108.100.134
May 6, 2024 04:56:43.991067886 CEST	49964	2121	192.168.2.16	123.28.163.82
May 6, 2024 04:56:43.991067886 CEST	49962	21	192.168.2.16	46.109.137.149
May 6, 2024 04:56:43.991067886 CEST	49979	21	192.168.2.16	73.184.119.203
May 6, 2024 04:56:43.991115093 CEST	49965	21	192.168.2.16	83.53.51.42
May 6, 2024 04:56:43.991116047 CEST	49975	21	192.168.2.16	24.132.104.243
May 6, 2024 04:56:43.991118908 CEST	49970	2121	192.168.2.16	66.108.100.134
May 6, 2024 04:56:43.991118908 CEST	49977	2121	192.168.2.16	73.183.154.173
May 6, 2024 04:56:43.995733976 CEST	2121	50060	109.205.180.149	192.168.2.16
May 6, 2024 04:56:43.996726990 CEST	21	50036	187.94.222.6	192.168.2.16
May 6, 2024 04:56:43.998403072 CEST	2121	50038	187.94.222.6	192.168.2.16
May 6, 2024 04:56:44.005368948 CEST	21	50093	190.160.27.247	192.168.2.16
May 6, 2024 04:56:44.006956100 CEST	49980	2121	192.168.2.16	73.184.119.203
May 6, 2024 04:56:44.006957054 CEST	49982	21	192.168.2.16	1.49.252.112
May 6, 2024 04:56:44.006966114 CEST	49981	21	192.168.2.16	119.223.221.121
May 6, 2024 04:56:44.006966114 CEST	49987	21	192.168.2.16	173.18.4.227
May 6, 2024 04:56:44.006969929 CEST	49991	21	192.168.2.16	82.78.235.56
May 6, 2024 04:56:44.006969929 CEST	50001	21	192.168.2.16	221.3.28.190
May 6, 2024 04:56:44.006970882 CEST	49986	21	192.168.2.16	105.72.6.198
May 6, 2024 04:56:44.006969929 CEST	50000	2121	192.168.2.16	153.205.240.87
May 6, 2024 04:56:44.006970882 CEST	50002	2121	192.168.2.16	221.3.28.190
May 6, 2024 04:56:44.006988049 CEST	50005	21	192.168.2.16	119.165.35.137
May 6, 2024 04:56:44.006989956 CEST	49985	2121	192.168.2.16	24.132.104.243
May 6, 2024 04:56:44.006989956 CEST	49993	21	192.168.2.16	98.184.230.194
May 6, 2024 04:56:44.006990910 CEST	50008	2121	192.168.2.16	62.115.189.118
May 6, 2024 04:56:44.006990910 CEST	49988	2121	192.168.2.16	105.72.6.198
May 6, 2024 04:56:44.006990910 CEST	50006	2121	192.168.2.16	119.165.35.137
May 6, 2024 04:56:44.006993055 CEST	50007	21	192.168.2.16	62.115.189.118
May 6, 2024 04:56:44.006994009 CEST	49996	21	192.168.2.16	179.54.202.127
May 6, 2024 04:56:44.006994963 CEST	49983	2121	192.168.2.16	119.223.221.121
May 6, 2024 04:56:44.006994963 CEST	49997	2121	192.168.2.16	86.126.81.230
May 6, 2024 04:56:44.006994963 CEST	49994	2121	192.168.2.16	98.184.230.194
May 6, 2024 04:56:44.007025957 CEST	50015	21	192.168.2.16	116.172.87.75
May 6, 2024 04:56:44.007025957 CEST	50011	2121	192.168.2.16	40.113.144.129
May 6, 2024 04:56:44.007034063 CEST	50004	2121	192.168.2.16	83.36.215.37
May 6, 2024 04:56:44.007035017 CEST	50018	2121	192.168.2.16	154.125.106.175
May 6, 2024 04:56:44.007038116 CEST	49995	21	192.168.2.16	86.126.81.230
May 6, 2024 04:56:44.007038116 CEST	50003	21	192.168.2.16	83.36.215.37
May 6, 2024 04:56:44.007038116 CEST	50010	21	192.168.2.16	40.113.144.129
May 6, 2024 04:56:44.007072926 CEST	50017	21	192.168.2.16	154.125.106.175
May 6, 2024 04:56:44.007074118 CEST	50013	2121	192.168.2.16	116.172.87.75
May 6, 2024 04:56:44.010596991 CEST	2121	50094	190.160.27.247	192.168.2.16
May 6, 2024 04:56:44.021773100 CEST	2121	49992	82.78.235.56	192.168.2.16
May 6, 2024 04:56:44.022969007 CEST	50020	2121	192.168.2.16	82.151.55.252
May 6, 2024 04:56:44.022984982 CEST	50022	2121	192.168.2.16	124.54.188.17
May 6, 2024 04:56:44.022989988 CEST	50044	2121	192.168.2.16	183.162.166.97
May 6, 2024 04:56:44.022989988 CEST	50023	21	192.168.2.16	91.196.221.70
May 6, 2024 04:56:44.022989988 CEST	50027	21	192.168.2.16	189.232.134.22
May 6, 2024 04:56:44.022994995 CEST	50032	21	192.168.2.16	5.56.64.87
May 6, 2024 04:56:44.022994995 CEST	50021	21	192.168.2.16	124.54.188.17
May 6, 2024 04:56:44.022999048 CEST	50019	21	192.168.2.16	82.151.55.252
May 6, 2024 04:56:44.022999048 CEST	50024	2121	192.168.2.16	91.196.221.70
May 6, 2024 04:56:44.023000002 CEST	50034	2121	192.168.2.16	118.37.227.7
May 6, 2024 04:56:44.023030996 CEST	50029	21	192.168.2.16	188.127.174.192
May 6, 2024 04:56:44.023030996 CEST	50050	2121	192.168.2.16	71.53.157.218
May 6, 2024 04:56:44.023031950 CEST	50048	2121	192.168.2.16	171.225.13.244
May 6, 2024 04:56:44.023031950 CEST	50046	2121	192.168.2.16	20.197.33.115
May 6, 2024 04:56:44.023036957 CEST	50045	21	192.168.2.16	20.197.33.115
May 6, 2024 04:56:44.023036957 CEST	50033	2121	192.168.2.16	5.56.64.87
May 6, 2024 04:56:44.023036957 CEST	50031	21	192.168.2.16	118.37.227.7
May 6, 2024 04:56:44.023036957 CEST	50049	21	192.168.2.16	71.53.157.218
May 6, 2024 04:56:44.023036957 CEST	50030	2121	192.168.2.16	188.127.174.192
May 6, 2024 04:56:44.023036957 CEST	50039	21	192.168.2.16	47.37.113.171
May 6, 2024 04:56:44.023041010 CEST	50037	2121	192.168.2.16	51.116.138.204
May 6, 2024 04:56:44.023044109 CEST	50041	21	192.168.2.16	183.162.166.97
May 6, 2024 04:56:44.023044109 CEST	50047	21	192.168.2.16	171.225.13.244
May 6, 2024 04:56:44.023045063 CEST	50040	2121	192.168.2.16	47.37.113.171
May 6, 2024 04:56:44.023045063 CEST	50035	21	192.168.2.16	51.116.138.204
May 6, 2024 04:56:44.023045063 CEST	50052	2121	192.168.2.16	86.21.54.149
May 6, 2024 04:56:44.023046970 CEST	50028	2121	192.168.2.16	189.232.134.22
May 6, 2024 04:56:44.023128986 CEST	50051	21	192.168.2.16	86.21.54.149
May 6, 2024 04:56:44.034590960 CEST	2121	49931	180.225.207.195	192.168.2.16
May 6, 2024 04:56:44.038960934 CEST	50056	2121	192.168.2.16	47.96.78.154
May 6, 2024 04:56:44.038975000 CEST	50053	2121	192.168.2.16	189.146.178.160
May 6, 2024 04:56:44.038976908 CEST	50057	2121	192.168.2.16	90.218.5.59
May 6, 2024 04:56:44.038976908 CEST	50055	21	192.168.2.16	189.146.178.160
May 6, 2024 04:56:44.038976908 CEST	50058	21	192.168.2.16	90.218.5.59
May 6, 2024 04:56:44.038978100 CEST	50066	2121	192.168.2.16	79.154.68.52
May 6, 2024 04:56:44.038978100 CEST	50054	21	192.168.2.16	47.96.78.154
May 6, 2024 04:56:44.038979053 CEST	50063	21	192.168.2.16	187.153.144.97
May 6, 2024 04:56:44.038990021 CEST	50072	21	192.168.2.16	182.111.5.233
May 6, 2024 04:56:44.038992882 CEST	50070	2121	192.168.2.16	220.71.129.47
May 6, 2024 04:56:44.038992882 CEST	50065	2121	192.168.2.16	187.153.144.97
May 6, 2024 04:56:44.038995981 CEST	50082	2121	192.168.2.16	8.139.2.255
May 6, 2024 04:56:44.038995981 CEST	50064	21	192.168.2.16	79.154.68.52
May 6, 2024 04:56:44.038995981 CEST	50067	21	192.168.2.16	184.174.107.146
May 6, 2024 04:56:44.038995981 CEST	50068	2121	192.168.2.16	184.174.107.146
May 6, 2024 04:56:44.038997889 CEST	50084	2121	192.168.2.16	75.182.234.146
May 6, 2024 04:56:44.038999081 CEST	50074	2121	192.168.2.16	182.111.5.233
May 6, 2024 04:56:44.039000034 CEST	50077	2121	192.168.2.16	43.156.44.194
May 6, 2024 04:56:44.039000034 CEST	50069	21	192.168.2.16	220.71.129.47
May 6, 2024 04:56:44.039068937 CEST	50078	21	192.168.2.16	43.156.44.194
May 6, 2024 04:56:44.039072037 CEST	50081	21	192.168.2.16	8.139.2.255
May 6, 2024 04:56:44.039078951 CEST	50075	2121	192.168.2.16	103.109.6.215
May 6, 2024 04:56:44.039083004 CEST	50083	21	192.168.2.16	75.182.234.146
May 6, 2024 04:56:44.054946899 CEST	50085	21	192.168.2.16	49.169.39.43
May 6, 2024 04:56:44.054955959 CEST	50089	21	192.168.2.16	16.162.180.123
May 6, 2024 04:56:44.054958105 CEST	50101	21	192.168.2.16	38.18.122.147
May 6, 2024 04:56:44.054960012 CEST	50097	21	192.168.2.16	68.34.99.131
May 6, 2024 04:56:44.054975986 CEST	50087	21	192.168.2.16	20.232.59.48
May 6, 2024 04:56:44.054977894 CEST	50086	2121	192.168.2.16	49.169.39.43
May 6, 2024 04:56:44.054980040 CEST	50090	21	192.168.2.16	207.66.112.94
May 6, 2024 04:56:44.054980993 CEST	50088	2121	192.168.2.16	20.232.59.48
May 6, 2024 04:56:44.054981947 CEST	50098	2121	192.168.2.16	68.34.99.131
May 6, 2024 04:56:44.054985046 CEST	50091	2121	192.168.2.16	16.162.180.123
May 6, 2024 04:56:44.054985046 CEST	50100	2121	192.168.2.16	93.229.32.114
May 6, 2024 04:56:44.054985046 CEST	50095	21	192.168.2.16	115.141.248.1
May 6, 2024 04:56:44.055397034 CEST	50102	2121	192.168.2.16	38.18.122.147
May 6, 2024 04:56:44.055397034 CEST	49916	2121	192.168.2.16	121.239.148.97
May 6, 2024 04:56:44.055397987 CEST	50099	21	192.168.2.16	93.229.32.114
May 6, 2024 04:56:44.055397034 CEST	50092	2121	192.168.2.16	207.66.112.94
May 6, 2024 04:56:44.055399895 CEST	50106	2121	192.168.2.16	92.253.68.186
May 6, 2024 04:56:44.055399895 CEST	50107	21	192.168.2.16	84.133.30.105
May 6, 2024 04:56:44.055401087 CEST	50108	2121	192.168.2.16	84.133.30.105
May 6, 2024 04:56:44.055401087 CEST	50105	21	192.168.2.16	92.253.68.186
May 6, 2024 04:56:44.079087019 CEST	21	49989	60.76.76.108	192.168.2.16
May 6, 2024 04:56:44.084903955 CEST	21	50076	103.109.6.215	192.168.2.16
May 6, 2024 04:56:44.084924936 CEST	21	50076	103.109.6.215	192.168.2.16
May 6, 2024 04:56:44.084986925 CEST	50076	21	192.168.2.16	103.109.6.215
May 6, 2024 04:56:44.111040115 CEST	2121	49990	60.76.76.108	192.168.2.16
May 6, 2024 04:56:44.138010025 CEST	2121	49972	43.201.47.213	192.168.2.16
May 6, 2024 04:56:44.138022900 CEST	21	49971	43.201.47.213	192.168.2.16
May 6, 2024 04:56:44.144032955 CEST	2121	50062	116.126.49.212	192.168.2.16
May 6, 2024 04:56:44.145181894 CEST	21	49999	153.205.240.87	192.168.2.16
May 6, 2024 04:56:44.162651062 CEST	21	50103	118.35.206.150	192.168.2.16
May 6, 2024 04:56:44.163007975 CEST	2121	50104	118.35.206.150	192.168.2.16
May 6, 2024 04:56:44.168951988 CEST	2121	50026	1.225.194.212	192.168.2.16
May 6, 2024 04:56:44.189711094 CEST	21	50061	116.126.49.212	192.168.2.16
May 6, 2024 04:56:44.193012953 CEST	21	50111	45.87.1.166	192.168.2.16
May 6, 2024 04:56:44.193135977 CEST	50111	21	192.168.2.16	45.87.1.166
May 6, 2024 04:56:44.193387032 CEST	50112	2121	192.168.2.16	45.87.1.166
May 6, 2024 04:56:44.197535992 CEST	2121	50096	115.141.248.1	192.168.2.16
May 6, 2024 04:56:44.198961973 CEST	49911	21	192.168.2.16	217.71.254.134
May 6, 2024 04:56:44.198977947 CEST	21	50025	1.225.194.212	192.168.2.16
May 6, 2024 04:56:44.206077099 CEST	21	50014	58.153.229.5	192.168.2.16
May 6, 2024 04:56:44.216609001 CEST	2121	50016	58.153.229.5	192.168.2.16
May 6, 2024 04:56:44.225802898 CEST	2121	49984	1.49.252.112	192.168.2.16
May 6, 2024 04:56:44.246984959 CEST	49913	2121	192.168.2.16	217.71.254.134
May 6, 2024 04:56:44.285748959 CEST	21	50042	125.165.86.247	192.168.2.16
May 6, 2024 04:56:44.295057058 CEST	2121	50043	125.165.86.247	192.168.2.16
May 6, 2024 04:56:44.310983896 CEST	49914	2121	192.168.2.16	92.207.138.140
May 6, 2024 04:56:44.312215090 CEST	49912	21	192.168.2.16	92.207.138.140
May 6, 2024 04:56:44.326984882 CEST	49915	21	192.168.2.16	121.239.148.97
May 6, 2024 04:56:44.358959913 CEST	49978	2121	192.168.2.16	173.18.4.227
May 6, 2024 04:56:44.358959913 CEST	49958	2121	192.168.2.16	156.239.231.220
May 6, 2024 04:56:44.359081030 CEST	50073	2121	192.168.2.16	208.87.22.137
May 6, 2024 04:56:44.359081030 CEST	50071	21	192.168.2.16	208.87.22.137
May 6, 2024 04:56:44.359102011 CEST	49957	21	192.168.2.16	156.239.231.220
May 6, 2024 04:56:44.390960932 CEST	49954	21	192.168.2.16	177.135.211.33
May 6, 2024 04:56:44.391000986 CEST	49947	2121	192.168.2.16	177.135.211.33
May 6, 2024 04:56:44.397402048 CEST	2121	50012	111.59.245.235	192.168.2.16
May 6, 2024 04:56:44.400418043 CEST	2121	49916	121.239.148.97	192.168.2.16
May 6, 2024 04:56:44.406963110 CEST	50080	2121	192.168.2.16	66.103.220.9
May 6, 2024 04:56:44.406979084 CEST	50079	21	192.168.2.16	66.103.220.9
May 6, 2024 04:56:44.418643951 CEST	21	50111	45.87.1.166	192.168.2.16
May 6, 2024 04:56:44.418704987 CEST	50111	21	192.168.2.16	45.87.1.166
May 6, 2024 04:56:44.430748940 CEST	21	50009	111.59.245.235	192.168.2.16
May 6, 2024 04:56:44.438963890 CEST	49910	2121	192.168.2.16	39.27.13.134
May 6, 2024 04:56:44.441695929 CEST	21	49911	217.71.254.134	192.168.2.16
May 6, 2024 04:56:44.442347050 CEST	50113	21	192.168.2.16	173.240.190.237
May 6, 2024 04:56:44.470972061 CEST	49923	21	192.168.2.16	50.50.245.60
May 6, 2024 04:56:44.478709936 CEST	2121	49913	217.71.254.134	192.168.2.16
May 6, 2024 04:56:44.479188919 CEST	50114	2121	192.168.2.16	173.240.190.237
May 6, 2024 04:56:44.486968040 CEST	49998	2121	192.168.2.16	179.54.202.127
May 6, 2024 04:56:44.502955914 CEST	50060	2121	192.168.2.16	109.205.180.149
May 6, 2024 04:56:44.502969980 CEST	50038	2121	192.168.2.16	187.94.222.6
May 6, 2024 04:56:44.502974987 CEST	50036	21	192.168.2.16	187.94.222.6
May 6, 2024 04:56:44.513602018 CEST	2121	50073	208.87.22.137	192.168.2.16
May 6, 2024 04:56:44.513834953 CEST	21	50071	208.87.22.137	192.168.2.16
May 6, 2024 04:56:44.518959999 CEST	50093	21	192.168.2.16	190.160.27.247
May 6, 2024 04:56:44.518971920 CEST	50109	21	192.168.2.16	61.55.18.14
May 6, 2024 04:56:44.519138098 CEST	50094	2121	192.168.2.16	190.160.27.247
May 6, 2024 04:56:44.531415939 CEST	21	49957	156.239.231.220	192.168.2.16
May 6, 2024 04:56:44.531429052 CEST	2121	49958	156.239.231.220	192.168.2.16
May 6, 2024 04:56:44.532901049 CEST	2121	49978	173.18.4.227	192.168.2.16
May 6, 2024 04:56:44.535959005 CEST	49992	2121	192.168.2.16	82.78.235.56
May 6, 2024 04:56:44.549957037 CEST	49931	2121	192.168.2.16	180.225.207.195
May 6, 2024 04:56:44.579014063 CEST	2121	50080	66.103.220.9	192.168.2.16
May 6, 2024 04:56:44.579025030 CEST	21	50079	66.103.220.9	192.168.2.16
May 6, 2024 04:56:44.582114935 CEST	49989	21	192.168.2.16	60.76.76.108
May 6, 2024 04:56:44.586411953 CEST	21	49954	177.135.211.33	192.168.2.16
May 6, 2024 04:56:44.589226961 CEST	2121	49947	177.135.211.33	192.168.2.16
May 6, 2024 04:56:44.597982883 CEST	49917	21	192.168.2.16	75.69.181.185
May 6, 2024 04:56:44.613976955 CEST	49990	2121	192.168.2.16	60.76.76.108
May 6, 2024 04:56:44.625200033 CEST	21	50113	173.240.190.237	192.168.2.16
May 6, 2024 04:56:44.632988930 CEST	49918	2121	192.168.2.16	75.69.181.185
May 6, 2024 04:56:44.634308100 CEST	21	49923	50.50.245.60	192.168.2.16
May 6, 2024 04:56:44.645987034 CEST	49920	2121	192.168.2.16	70.64.135.84
May 6, 2024 04:56:44.645987034 CEST	49972	2121	192.168.2.16	43.201.47.213
May 6, 2024 04:56:44.645987988 CEST	49999	21	192.168.2.16	153.205.240.87
May 6, 2024 04:56:44.645988941 CEST	49919	21	192.168.2.16	70.64.135.84
May 6, 2024 04:56:44.646888971 CEST	50062	2121	192.168.2.16	116.126.49.212
May 6, 2024 04:56:44.646891117 CEST	49971	21	192.168.2.16	43.201.47.213
May 6, 2024 04:56:44.660634041 CEST	2121	50114	173.240.190.237	192.168.2.16
May 6, 2024 04:56:44.660957098 CEST	49921	21	192.168.2.16	124.104.19.175
May 6, 2024 04:56:44.661379099 CEST	50115	21	192.168.2.16	179.255.165.104
May 6, 2024 04:56:44.676963091 CEST	50103	21	192.168.2.16	118.35.206.150
May 6, 2024 04:56:44.676976919 CEST	50104	2121	192.168.2.16	118.35.206.150
May 6, 2024 04:56:44.676980019 CEST	50026	2121	192.168.2.16	1.225.194.212
May 6, 2024 04:56:44.676985979 CEST	50110	2121	192.168.2.16	61.55.18.14
May 6, 2024 04:56:44.692971945 CEST	50061	21	192.168.2.16	116.126.49.212
May 6, 2024 04:56:44.708969116 CEST	50025	21	192.168.2.16	1.225.194.212
May 6, 2024 04:56:44.708969116 CEST	50096	2121	192.168.2.16	115.141.248.1
May 6, 2024 04:56:44.708971024 CEST	50014	21	192.168.2.16	58.153.229.5
May 6, 2024 04:56:44.719657898 CEST	2121	49998	179.54.202.127	192.168.2.16
May 6, 2024 04:56:44.724950075 CEST	50016	2121	192.168.2.16	58.153.229.5
May 6, 2024 04:56:44.731751919 CEST	2121	50060	109.205.180.149	192.168.2.16
May 6, 2024 04:56:44.732817888 CEST	21	50036	187.94.222.6	192.168.2.16
May 6, 2024 04:56:44.734422922 CEST	2121	50038	187.94.222.6	192.168.2.16
May 6, 2024 04:56:44.740952969 CEST	49984	2121	192.168.2.16	1.49.252.112
May 6, 2024 04:56:44.743220091 CEST	2121	49910	39.27.13.134	192.168.2.16
May 6, 2024 04:56:44.743588924 CEST	50116	2121	192.168.2.16	179.255.165.104
May 6, 2024 04:56:44.745551109 CEST	21	50093	190.160.27.247	192.168.2.16
May 6, 2024 04:56:44.745563984 CEST	2121	50094	190.160.27.247	192.168.2.16
May 6, 2024 04:56:44.788971901 CEST	50042	21	192.168.2.16	125.165.86.247
May 6, 2024 04:56:44.791518927 CEST	2121	49992	82.78.235.56	192.168.2.16
May 6, 2024 04:56:44.804977894 CEST	50043	2121	192.168.2.16	125.165.86.247
May 6, 2024 04:56:44.805064917 CEST	49922	2121	192.168.2.16	124.104.19.175
May 6, 2024 04:56:44.861820936 CEST	21	49989	60.76.76.108	192.168.2.16
May 6, 2024 04:56:44.865027905 CEST	2121	49931	180.225.207.195	192.168.2.16
May 6, 2024 04:56:44.868962049 CEST	49924	2121	192.168.2.16	50.50.245.60
May 6, 2024 04:56:44.869062901 CEST	49926	2121	192.168.2.16	95.233.231.144
May 6, 2024 04:56:44.869064093 CEST	49925	21	192.168.2.16	95.233.231.144
May 6, 2024 04:56:44.900949955 CEST	49928	2121	192.168.2.16	91.23.96.94
May 6, 2024 04:56:44.900954962 CEST	49916	2121	192.168.2.16	121.239.148.97
May 6, 2024 04:56:44.900969028 CEST	49927	21	192.168.2.16	91.23.96.94
May 6, 2024 04:56:44.900969982 CEST	50012	2121	192.168.2.16	111.59.245.235
May 6, 2024 04:56:44.909961939 CEST	2121	49990	60.76.76.108	192.168.2.16
May 6, 2024 04:56:44.932971954 CEST	50009	21	192.168.2.16	111.59.245.235
May 6, 2024 04:56:44.944413900 CEST	2121	50062	116.126.49.212	192.168.2.16
May 6, 2024 04:56:44.948982000 CEST	49929	21	192.168.2.16	180.225.207.195
May 6, 2024 04:56:44.958178997 CEST	21	49999	153.205.240.87	192.168.2.16
May 6, 2024 04:56:44.969793081 CEST	2121	49972	43.201.47.213	192.168.2.16
May 6, 2024 04:56:44.970201015 CEST	21	49971	43.201.47.213	192.168.2.16
May 6, 2024 04:56:44.976440907 CEST	2121	50104	118.35.206.150	192.168.2.16
May 6, 2024 04:56:44.976914883 CEST	21	50103	118.35.206.150	192.168.2.16
May 6, 2024 04:56:44.998951912 CEST	2121	50026	1.225.194.212	192.168.2.16
May 6, 2024 04:56:45.015961885 CEST	50073	2121	192.168.2.16	208.87.22.137
May 6, 2024 04:56:45.017508984 CEST	21	50061	116.126.49.212	192.168.2.16
May 6, 2024 04:56:45.027412891 CEST	2121	50096	115.141.248.1	192.168.2.16
May 6, 2024 04:56:45.029059887 CEST	50071	21	192.168.2.16	208.87.22.137
May 6, 2024 04:56:45.044950008 CEST	49958	2121	192.168.2.16	156.239.231.220
May 6, 2024 04:56:45.044964075 CEST	49957	21	192.168.2.16	156.239.231.220
May 6, 2024 04:56:45.045028925 CEST	21	50025	1.225.194.212	192.168.2.16
May 6, 2024 04:56:45.045952082 CEST	49978	2121	192.168.2.16	173.18.4.227
May 6, 2024 04:56:45.050015926 CEST	21	50014	58.153.229.5	192.168.2.16
May 6, 2024 04:56:45.075381994 CEST	2121	50016	58.153.229.5	192.168.2.16
May 6, 2024 04:56:45.081949949 CEST	50080	2121	192.168.2.16	66.103.220.9
May 6, 2024 04:56:45.092978001 CEST	49930	21	192.168.2.16	39.57.192.254
May 6, 2024 04:56:45.092978001 CEST	49947	2121	192.168.2.16	177.135.211.33
May 6, 2024 04:56:45.092978954 CEST	50079	21	192.168.2.16	66.103.220.9
May 6, 2024 04:56:45.092993021 CEST	49954	21	192.168.2.16	177.135.211.33
May 6, 2024 04:56:45.103871107 CEST	2121	49984	1.49.252.112	192.168.2.16
May 6, 2024 04:56:45.140989065 CEST	50113	21	192.168.2.16	173.240.190.237
May 6, 2024 04:56:45.163786888 CEST	21	50042	125.165.86.247	192.168.2.16
May 6, 2024 04:56:45.170380116 CEST	2121	50073	208.87.22.137	192.168.2.16
May 6, 2024 04:56:45.172976017 CEST	50114	2121	192.168.2.16	173.240.190.237
May 6, 2024 04:56:45.183581114 CEST	21	50071	208.87.22.137	192.168.2.16
May 6, 2024 04:56:45.186996937 CEST	2121	50043	125.165.86.247	192.168.2.16
May 6, 2024 04:56:45.204950094 CEST	50112	2121	192.168.2.16	45.87.1.166
May 6, 2024 04:56:45.217396975 CEST	21	49957	156.239.231.220	192.168.2.16
May 6, 2024 04:56:45.217427969 CEST	2121	49958	156.239.231.220	192.168.2.16
May 6, 2024 04:56:45.220968008 CEST	49998	2121	192.168.2.16	179.54.202.127
May 6, 2024 04:56:45.223360062 CEST	2121	49978	173.18.4.227	192.168.2.16
May 6, 2024 04:56:45.236948967 CEST	50060	2121	192.168.2.16	109.205.180.149
May 6, 2024 04:56:45.236979961 CEST	50038	2121	192.168.2.16	187.94.222.6
May 6, 2024 04:56:45.236983061 CEST	50036	21	192.168.2.16	187.94.222.6
May 6, 2024 04:56:45.245704889 CEST	2121	49916	121.239.148.97	192.168.2.16
May 6, 2024 04:56:45.252959013 CEST	50093	21	192.168.2.16	190.160.27.247
May 6, 2024 04:56:45.252973080 CEST	50094	2121	192.168.2.16	190.160.27.247
May 6, 2024 04:56:45.253963947 CEST	2121	50080	66.103.220.9	192.168.2.16
May 6, 2024 04:56:45.265110970 CEST	21	50079	66.103.220.9	192.168.2.16
May 6, 2024 04:56:45.269361973 CEST	50117	21	192.168.2.16	173.186.63.246
May 6, 2024 04:56:45.288543940 CEST	21	49954	177.135.211.33	192.168.2.16
May 6, 2024 04:56:45.291762114 CEST	2121	49947	177.135.211.33	192.168.2.16
May 6, 2024 04:56:45.300973892 CEST	49992	2121	192.168.2.16	82.78.235.56
May 6, 2024 04:56:45.323477030 CEST	21	50113	173.240.190.237	192.168.2.16
May 6, 2024 04:56:45.338697910 CEST	2121	50012	111.59.245.235	192.168.2.16
May 6, 2024 04:56:45.355742931 CEST	2121	50114	173.240.190.237	192.168.2.16
May 6, 2024 04:56:45.364969969 CEST	49931	2121	192.168.2.16	180.225.207.195
May 6, 2024 04:56:45.364983082 CEST	49989	21	192.168.2.16	60.76.76.108
May 6, 2024 04:56:45.388273954 CEST	21	50009	111.59.245.235	192.168.2.16
May 6, 2024 04:56:45.412971020 CEST	49990	2121	192.168.2.16	60.76.76.108
May 6, 2024 04:56:45.444986105 CEST	50062	2121	192.168.2.16	116.126.49.212
May 6, 2024 04:56:45.454416037 CEST	2121	49998	179.54.202.127	192.168.2.16
May 6, 2024 04:56:45.460968018 CEST	49999	21	192.168.2.16	153.205.240.87
May 6, 2024 04:56:45.465675116 CEST	2121	50060	109.205.180.149	192.168.2.16
May 6, 2024 04:56:45.466742992 CEST	21	50036	187.94.222.6	192.168.2.16
May 6, 2024 04:56:45.468439102 CEST	2121	50038	187.94.222.6	192.168.2.16
May 6, 2024 04:56:45.474245071 CEST	21	50093	190.160.27.247	192.168.2.16
May 6, 2024 04:56:45.476950884 CEST	49972	2121	192.168.2.16	43.201.47.213
May 6, 2024 04:56:45.476979017 CEST	50104	2121	192.168.2.16	118.35.206.150
May 6, 2024 04:56:45.476985931 CEST	49971	21	192.168.2.16	43.201.47.213
May 6, 2024 04:56:45.476989031 CEST	50103	21	192.168.2.16	118.35.206.150
May 6, 2024 04:56:45.479684114 CEST	2121	50094	190.160.27.247	192.168.2.16
May 6, 2024 04:56:45.508964062 CEST	50026	2121	192.168.2.16	1.225.194.212
May 6, 2024 04:56:45.528620958 CEST	50061	21	192.168.2.16	116.126.49.212
May 6, 2024 04:56:45.540961981 CEST	50096	2121	192.168.2.16	115.141.248.1
May 6, 2024 04:56:45.556822062 CEST	2121	49992	82.78.235.56	192.168.2.16
May 6, 2024 04:56:45.556968927 CEST	50025	21	192.168.2.16	1.225.194.212
May 6, 2024 04:56:45.566945076 CEST	50014	21	192.168.2.16	58.153.229.5
May 6, 2024 04:56:45.588951111 CEST	50016	2121	192.168.2.16	58.153.229.5
May 6, 2024 04:56:45.604975939 CEST	49984	2121	192.168.2.16	1.49.252.112
May 6, 2024 04:56:45.645067930 CEST	21	49989	60.76.76.108	192.168.2.16
May 6, 2024 04:56:45.668962955 CEST	50042	21	192.168.2.16	125.165.86.247
May 6, 2024 04:56:45.668979883 CEST	50115	21	192.168.2.16	179.255.165.104
May 6, 2024 04:56:45.680030107 CEST	2121	49931	180.225.207.195	192.168.2.16
May 6, 2024 04:56:45.684957981 CEST	50073	2121	192.168.2.16	208.87.22.137
May 6, 2024 04:56:45.684973001 CEST	50071	21	192.168.2.16	208.87.22.137
May 6, 2024 04:56:45.700086117 CEST	50043	2121	192.168.2.16	125.165.86.247
May 6, 2024 04:56:45.700252056 CEST	50118	2121	192.168.2.16	173.186.63.246
May 6, 2024 04:56:45.709358931 CEST	2121	49990	60.76.76.108	192.168.2.16
May 6, 2024 04:56:45.730962038 CEST	49978	2121	192.168.2.16	173.18.4.227
May 6, 2024 04:56:45.730977058 CEST	49957	21	192.168.2.16	156.239.231.220
May 6, 2024 04:56:45.730978966 CEST	49958	2121	192.168.2.16	156.239.231.220
May 6, 2024 04:56:45.742208958 CEST	2121	50062	116.126.49.212	192.168.2.16
May 6, 2024 04:56:45.746985912 CEST	50116	2121	192.168.2.16	179.255.165.104
May 6, 2024 04:56:45.762959003 CEST	50080	2121	192.168.2.16	66.103.220.9
May 6, 2024 04:56:45.774032116 CEST	21	49999	153.205.240.87	192.168.2.16
May 6, 2024 04:56:45.776137114 CEST	2121	50104	118.35.206.150	192.168.2.16
May 6, 2024 04:56:45.776691914 CEST	21	50103	118.35.206.150	192.168.2.16
May 6, 2024 04:56:45.779001951 CEST	49950	21	192.168.2.16	36.14.21.3
May 6, 2024 04:56:45.779004097 CEST	49951	2121	192.168.2.16	36.14.21.3
May 6, 2024 04:56:45.779004097 CEST	50079	21	192.168.2.16	66.103.220.9
May 6, 2024 04:56:45.794955015 CEST	49954	21	192.168.2.16	177.135.211.33
May 6, 2024 04:56:45.794969082 CEST	49947	2121	192.168.2.16	177.135.211.33
May 6, 2024 04:56:45.799987078 CEST	21	49971	43.201.47.213	192.168.2.16
May 6, 2024 04:56:45.799998999 CEST	2121	49972	43.201.47.213	192.168.2.16
May 6, 2024 04:56:45.826981068 CEST	50113	21	192.168.2.16	173.240.190.237
May 6, 2024 04:56:45.832974911 CEST	2121	50026	1.225.194.212	192.168.2.16
May 6, 2024 04:56:45.839615107 CEST	2121	50073	208.87.22.137	192.168.2.16
May 6, 2024 04:56:45.839865923 CEST	21	50071	208.87.22.137	192.168.2.16
May 6, 2024 04:56:45.842972040 CEST	50012	2121	192.168.2.16	111.59.245.235
May 6, 2024 04:56:45.854785919 CEST	21	50061	116.126.49.212	192.168.2.16
May 6, 2024 04:56:45.858988047 CEST	50114	2121	192.168.2.16	173.240.190.237
May 6, 2024 04:56:45.859390020 CEST	50119	21	192.168.2.16	73.112.120.219
May 6, 2024 04:56:45.859394073 CEST	50120	2121	192.168.2.16	73.112.120.219
May 6, 2024 04:56:45.859608889 CEST	2121	50096	115.141.248.1	192.168.2.16
May 6, 2024 04:56:45.890985966 CEST	50009	21	192.168.2.16	111.59.245.235
May 6, 2024 04:56:45.895016909 CEST	21	50025	1.225.194.212	192.168.2.16
May 6, 2024 04:56:45.903511047 CEST	2121	49958	156.239.231.220	192.168.2.16
May 6, 2024 04:56:45.903523922 CEST	21	49957	156.239.231.220	192.168.2.16
May 6, 2024 04:56:45.907918930 CEST	21	50014	58.153.229.5	192.168.2.16
May 6, 2024 04:56:45.913525105 CEST	2121	49978	173.18.4.227	192.168.2.16
May 6, 2024 04:56:45.923547029 CEST	50121	2121	192.168.2.16	27.207.39.138
May 6, 2024 04:56:45.923614979 CEST	50122	21	192.168.2.16	27.207.39.138
May 6, 2024 04:56:45.923615932 CEST	50123	21	192.168.2.16	71.31.151.54
May 6, 2024 04:56:45.936988115 CEST	2121	50080	66.103.220.9	192.168.2.16
May 6, 2024 04:56:45.942887068 CEST	2121	50016	58.153.229.5	192.168.2.16
May 6, 2024 04:56:45.953239918 CEST	21	50079	66.103.220.9	192.168.2.16
May 6, 2024 04:56:45.954958916 CEST	49998	2121	192.168.2.16	179.54.202.127
May 6, 2024 04:56:45.955180883 CEST	50124	2121	192.168.2.16	71.31.151.54
May 6, 2024 04:56:45.967802048 CEST	2121	49984	1.49.252.112	192.168.2.16
May 6, 2024 04:56:45.970957041 CEST	50060	2121	192.168.2.16	109.205.180.149
May 6, 2024 04:56:45.970982075 CEST	50036	21	192.168.2.16	187.94.222.6
May 6, 2024 04:56:45.970990896 CEST	50038	2121	192.168.2.16	187.94.222.6
May 6, 2024 04:56:45.971194029 CEST	50125	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:45.986967087 CEST	49934	2121	192.168.2.16	46.89.232.180
May 6, 2024 04:56:45.986967087 CEST	49932	2121	192.168.2.16	39.57.192.254
May 6, 2024 04:56:45.986968994 CEST	49933	21	192.168.2.16	46.89.232.180
May 6, 2024 04:56:45.986980915 CEST	49941	21	192.168.2.16	101.93.183.130
May 6, 2024 04:56:45.986983061 CEST	49938	21	192.168.2.16	188.214.213.151
May 6, 2024 04:56:45.986983061 CEST	49955	2121	192.168.2.16	73.159.106.21
May 6, 2024 04:56:45.986985922 CEST	49936	2121	192.168.2.16	73.118.128.95
May 6, 2024 04:56:45.986985922 CEST	49937	2121	192.168.2.16	64.234.71.164
May 6, 2024 04:56:45.986985922 CEST	49942	2121	192.168.2.16	101.93.183.130
May 6, 2024 04:56:45.986987114 CEST	49952	21	192.168.2.16	71.94.100.217
May 6, 2024 04:56:45.986991882 CEST	49935	21	192.168.2.16	73.118.128.95
May 6, 2024 04:56:45.987008095 CEST	49939	2121	192.168.2.16	188.214.213.151
May 6, 2024 04:56:45.987008095 CEST	50093	21	192.168.2.16	190.160.27.247
May 6, 2024 04:56:45.987008095 CEST	49940	21	192.168.2.16	64.234.71.164
May 6, 2024 04:56:45.987009048 CEST	50094	2121	192.168.2.16	190.160.27.247
May 6, 2024 04:56:45.987016916 CEST	49943	21	192.168.2.16	73.87.131.239
May 6, 2024 04:56:45.992799997 CEST	21	49954	177.135.211.33	192.168.2.16
May 6, 2024 04:56:45.993267059 CEST	50126	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:45.995444059 CEST	2121	49947	177.135.211.33	192.168.2.16
May 6, 2024 04:56:46.002960920 CEST	49948	21	192.168.2.16	73.159.106.21
May 6, 2024 04:56:46.002963066 CEST	49953	2121	192.168.2.16	20.116.64.231
May 6, 2024 04:56:46.002964020 CEST	49946	21	192.168.2.16	204.141.177.155
May 6, 2024 04:56:46.002973080 CEST	49963	2121	192.168.2.16	46.109.137.149
May 6, 2024 04:56:46.002974033 CEST	49973	21	192.168.2.16	98.122.116.210
May 6, 2024 04:56:46.002973080 CEST	49949	21	192.168.2.16	20.116.64.231
May 6, 2024 04:56:46.002973080 CEST	49966	2121	192.168.2.16	83.53.51.42
May 6, 2024 04:56:46.002976894 CEST	49964	2121	192.168.2.16	123.28.163.82
May 6, 2024 04:56:46.002988100 CEST	49944	2121	192.168.2.16	73.87.131.239
May 6, 2024 04:56:46.002990007 CEST	49956	2121	192.168.2.16	71.94.100.217
May 6, 2024 04:56:46.002990007 CEST	49959	21	192.168.2.16	49.76.33.233
May 6, 2024 04:56:46.002990007 CEST	49969	21	192.168.2.16	66.108.100.134
May 6, 2024 04:56:46.003000975 CEST	49945	2121	192.168.2.16	204.141.177.155
May 6, 2024 04:56:46.003000975 CEST	49976	21	192.168.2.16	73.183.154.173
May 6, 2024 04:56:46.003001928 CEST	49960	2121	192.168.2.16	49.76.33.233
May 6, 2024 04:56:46.003004074 CEST	49965	21	192.168.2.16	83.53.51.42
May 6, 2024 04:56:46.003005981 CEST	49962	21	192.168.2.16	46.109.137.149
May 6, 2024 04:56:46.003005981 CEST	49979	21	192.168.2.16	73.184.119.203
May 6, 2024 04:56:46.003030062 CEST	49967	21	192.168.2.16	125.246.254.11
May 6, 2024 04:56:46.003031969 CEST	49961	21	192.168.2.16	123.28.163.82
May 6, 2024 04:56:46.003034115 CEST	49970	2121	192.168.2.16	66.108.100.134
May 6, 2024 04:56:46.003035069 CEST	49975	21	192.168.2.16	24.132.104.243
May 6, 2024 04:56:46.003040075 CEST	49968	2121	192.168.2.16	125.246.254.11
May 6, 2024 04:56:46.003040075 CEST	49977	2121	192.168.2.16	73.183.154.173
May 6, 2024 04:56:46.003041029 CEST	49974	2121	192.168.2.16	98.122.116.210
May 6, 2024 04:56:46.011564016 CEST	21	50113	173.240.190.237	192.168.2.16
May 6, 2024 04:56:46.018965960 CEST	49980	2121	192.168.2.16	73.184.119.203
May 6, 2024 04:56:46.018966913 CEST	49982	21	192.168.2.16	1.49.252.112
May 6, 2024 04:56:46.018985033 CEST	49983	2121	192.168.2.16	119.223.221.121
May 6, 2024 04:56:46.018985033 CEST	49986	21	192.168.2.16	105.72.6.198
May 6, 2024 04:56:46.018987894 CEST	49981	21	192.168.2.16	119.223.221.121
May 6, 2024 04:56:46.018987894 CEST	49987	21	192.168.2.16	173.18.4.227
May 6, 2024 04:56:46.018989086 CEST	50001	21	192.168.2.16	221.3.28.190
May 6, 2024 04:56:46.018991947 CEST	49991	21	192.168.2.16	82.78.235.56
May 6, 2024 04:56:46.018991947 CEST	50000	2121	192.168.2.16	153.205.240.87
May 6, 2024 04:56:46.018991947 CEST	50002	2121	192.168.2.16	221.3.28.190
May 6, 2024 04:56:46.018991947 CEST	50007	21	192.168.2.16	62.115.189.118
May 6, 2024 04:56:46.019013882 CEST	49997	2121	192.168.2.16	86.126.81.230
May 6, 2024 04:56:46.019013882 CEST	50018	2121	192.168.2.16	154.125.106.175
May 6, 2024 04:56:46.019012928 CEST	50005	21	192.168.2.16	119.165.35.137
May 6, 2024 04:56:46.019013882 CEST	49994	2121	192.168.2.16	98.184.230.194
May 6, 2024 04:56:46.019016981 CEST	50004	2121	192.168.2.16	83.36.215.37
May 6, 2024 04:56:46.019016981 CEST	50013	2121	192.168.2.16	116.172.87.75
May 6, 2024 04:56:46.019016981 CEST	50008	2121	192.168.2.16	62.115.189.118
May 6, 2024 04:56:46.019016981 CEST	49996	21	192.168.2.16	179.54.202.127
May 6, 2024 04:56:46.019016981 CEST	49995	21	192.168.2.16	86.126.81.230
May 6, 2024 04:56:46.019016981 CEST	49988	2121	192.168.2.16	105.72.6.198
May 6, 2024 04:56:46.019017935 CEST	50006	2121	192.168.2.16	119.165.35.137
May 6, 2024 04:56:46.019017935 CEST	49985	2121	192.168.2.16	24.132.104.243
May 6, 2024 04:56:46.019017935 CEST	50010	21	192.168.2.16	40.113.144.129
May 6, 2024 04:56:46.019017935 CEST	49993	21	192.168.2.16	98.184.230.194
May 6, 2024 04:56:46.019017935 CEST	50011	2121	192.168.2.16	40.113.144.129
May 6, 2024 04:56:46.019017935 CEST	50015	21	192.168.2.16	116.172.87.75
May 6, 2024 04:56:46.019351006 CEST	50127	21	192.168.2.16	221.3.49.159
May 6, 2024 04:56:46.019355059 CEST	50017	21	192.168.2.16	154.125.106.175
May 6, 2024 04:56:46.019355059 CEST	50003	21	192.168.2.16	83.36.215.37
May 6, 2024 04:56:46.034967899 CEST	50032	21	192.168.2.16	5.56.64.87
May 6, 2024 04:56:46.034987926 CEST	50044	2121	192.168.2.16	183.162.166.97
May 6, 2024 04:56:46.034989119 CEST	50021	21	192.168.2.16	124.54.188.17
May 6, 2024 04:56:46.034990072 CEST	50020	2121	192.168.2.16	82.151.55.252
May 6, 2024 04:56:46.034991026 CEST	50019	21	192.168.2.16	82.151.55.252
May 6, 2024 04:56:46.034991980 CEST	50034	2121	192.168.2.16	118.37.227.7
May 6, 2024 04:56:46.035015106 CEST	50022	2121	192.168.2.16	124.54.188.17
May 6, 2024 04:56:46.035015106 CEST	50031	21	192.168.2.16	118.37.227.7
May 6, 2024 04:56:46.035016060 CEST	50023	21	192.168.2.16	91.196.221.70
May 6, 2024 04:56:46.035016060 CEST	50029	21	192.168.2.16	188.127.174.192
May 6, 2024 04:56:46.035017014 CEST	50048	2121	192.168.2.16	171.225.13.244
May 6, 2024 04:56:46.035016060 CEST	50027	21	192.168.2.16	189.232.134.22
May 6, 2024 04:56:46.035017014 CEST	50033	2121	192.168.2.16	5.56.64.87
May 6, 2024 04:56:46.035017967 CEST	50024	2121	192.168.2.16	91.196.221.70
May 6, 2024 04:56:46.035017967 CEST	50041	21	192.168.2.16	183.162.166.97
May 6, 2024 04:56:46.035018921 CEST	50028	2121	192.168.2.16	189.232.134.22
May 6, 2024 04:56:46.035017014 CEST	50030	2121	192.168.2.16	188.127.174.192
May 6, 2024 04:56:46.035021067 CEST	50040	2121	192.168.2.16	47.37.113.171
May 6, 2024 04:56:46.035021067 CEST	50035	21	192.168.2.16	51.116.138.204
May 6, 2024 04:56:46.035021067 CEST	50052	2121	192.168.2.16	86.21.54.149
May 6, 2024 04:56:46.035022020 CEST	50037	2121	192.168.2.16	51.116.138.204
May 6, 2024 04:56:46.035037994 CEST	50045	21	192.168.2.16	20.197.33.115
May 6, 2024 04:56:46.035037994 CEST	50051	21	192.168.2.16	86.21.54.149
May 6, 2024 04:56:46.035043001 CEST	50046	2121	192.168.2.16	20.197.33.115
May 6, 2024 04:56:46.035043955 CEST	50047	21	192.168.2.16	171.225.13.244
May 6, 2024 04:56:46.035051107 CEST	50049	21	192.168.2.16	71.53.157.218
May 6, 2024 04:56:46.035051107 CEST	50039	21	192.168.2.16	47.37.113.171
May 6, 2024 04:56:46.035058022 CEST	50050	2121	192.168.2.16	71.53.157.218
May 6, 2024 04:56:46.041274071 CEST	2121	50114	173.240.190.237	192.168.2.16
May 6, 2024 04:56:46.043915987 CEST	21	50042	125.165.86.247	192.168.2.16
May 6, 2024 04:56:46.050959110 CEST	50056	2121	192.168.2.16	47.96.78.154
May 6, 2024 04:56:46.050960064 CEST	50055	21	192.168.2.16	189.146.178.160
May 6, 2024 04:56:46.050975084 CEST	50066	2121	192.168.2.16	79.154.68.52
May 6, 2024 04:56:46.050975084 CEST	50054	21	192.168.2.16	47.96.78.154
May 6, 2024 04:56:46.050976038 CEST	50053	2121	192.168.2.16	189.146.178.160
May 6, 2024 04:56:46.050976038 CEST	50065	2121	192.168.2.16	187.153.144.97
May 6, 2024 04:56:46.050977945 CEST	50082	2121	192.168.2.16	8.139.2.255
May 6, 2024 04:56:46.050977945 CEST	50067	21	192.168.2.16	184.174.107.146
May 6, 2024 04:56:46.050978899 CEST	50057	2121	192.168.2.16	90.218.5.59
May 6, 2024 04:56:46.050980091 CEST	50058	21	192.168.2.16	90.218.5.59
May 6, 2024 04:56:46.051000118 CEST	50070	2121	192.168.2.16	220.71.129.47
May 6, 2024 04:56:46.051001072 CEST	50078	21	192.168.2.16	43.156.44.194
May 6, 2024 04:56:46.051002026 CEST	50072	21	192.168.2.16	182.111.5.233
May 6, 2024 04:56:46.051002026 CEST	50063	21	192.168.2.16	187.153.144.97
May 6, 2024 04:56:46.051002026 CEST	50081	21	192.168.2.16	8.139.2.255
May 6, 2024 04:56:46.051006079 CEST	50077	2121	192.168.2.16	43.156.44.194
May 6, 2024 04:56:46.051006079 CEST	50083	21	192.168.2.16	75.182.234.146
May 6, 2024 04:56:46.051006079 CEST	50069	21	192.168.2.16	220.71.129.47
May 6, 2024 04:56:46.051007032 CEST	50084	2121	192.168.2.16	75.182.234.146
May 6, 2024 04:56:46.051009893 CEST	50064	21	192.168.2.16	79.154.68.52
May 6, 2024 04:56:46.051009893 CEST	50074	2121	192.168.2.16	182.111.5.233
May 6, 2024 04:56:46.051009893 CEST	50068	2121	192.168.2.16	184.174.107.146
May 6, 2024 04:56:46.051013947 CEST	50075	2121	192.168.2.16	103.109.6.215
May 6, 2024 04:56:46.066958904 CEST	50089	21	192.168.2.16	16.162.180.123
May 6, 2024 04:56:46.066958904 CEST	50087	21	192.168.2.16	20.232.59.48
May 6, 2024 04:56:46.066961050 CEST	50085	21	192.168.2.16	49.169.39.43
May 6, 2024 04:56:46.066962004 CEST	50088	2121	192.168.2.16	20.232.59.48
May 6, 2024 04:56:46.066986084 CEST	50086	2121	192.168.2.16	49.169.39.43
May 6, 2024 04:56:46.066986084 CEST	50092	2121	192.168.2.16	207.66.112.94
May 6, 2024 04:56:46.066987038 CEST	50107	21	192.168.2.16	84.133.30.105
May 6, 2024 04:56:46.066987038 CEST	50090	21	192.168.2.16	207.66.112.94
May 6, 2024 04:56:46.066988945 CEST	50101	21	192.168.2.16	38.18.122.147
May 6, 2024 04:56:46.066988945 CEST	49992	2121	192.168.2.16	82.78.235.56
May 6, 2024 04:56:46.066989899 CEST	50098	2121	192.168.2.16	68.34.99.131
May 6, 2024 04:56:46.066989899 CEST	50097	21	192.168.2.16	68.34.99.131
May 6, 2024 04:56:46.066991091 CEST	50105	21	192.168.2.16	92.253.68.186
May 6, 2024 04:56:46.066993952 CEST	50091	2121	192.168.2.16	16.162.180.123
May 6, 2024 04:56:46.066993952 CEST	50100	2121	192.168.2.16	93.229.32.114
May 6, 2024 04:56:46.066993952 CEST	50106	2121	192.168.2.16	92.253.68.186
May 6, 2024 04:56:46.066993952 CEST	50095	21	192.168.2.16	115.141.248.1
May 6, 2024 04:56:46.067409992 CEST	50102	2121	192.168.2.16	38.18.122.147
May 6, 2024 04:56:46.067411900 CEST	50108	2121	192.168.2.16	84.133.30.105
May 6, 2024 04:56:46.067411900 CEST	50099	21	192.168.2.16	93.229.32.114
May 6, 2024 04:56:46.080826044 CEST	21	50125	34.128.145.40	192.168.2.16
May 6, 2024 04:56:46.080897093 CEST	50125	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:46.081794977 CEST	2121	50043	125.165.86.247	192.168.2.16
May 6, 2024 04:56:46.102781057 CEST	2121	50126	34.128.145.40	192.168.2.16
May 6, 2024 04:56:46.102852106 CEST	50126	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:46.147001982 CEST	49989	21	192.168.2.16	60.76.76.108
May 6, 2024 04:56:46.187634945 CEST	2121	49998	179.54.202.127	192.168.2.16
May 6, 2024 04:56:46.188071012 CEST	50128	2121	192.168.2.16	221.3.49.159
May 6, 2024 04:56:46.190697908 CEST	21	50125	34.128.145.40	192.168.2.16
May 6, 2024 04:56:46.190758944 CEST	50125	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:46.190834999 CEST	50125	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:46.190877914 CEST	50125	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:46.191123962 CEST	50129	21	192.168.2.16	196.196.68.7
May 6, 2024 04:56:46.199810982 CEST	2121	50060	109.205.180.149	192.168.2.16
May 6, 2024 04:56:46.200753927 CEST	21	50036	187.94.222.6	192.168.2.16
May 6, 2024 04:56:46.202430010 CEST	2121	50038	187.94.222.6	192.168.2.16
May 6, 2024 04:56:46.210386992 CEST	21	50093	190.160.27.247	192.168.2.16
May 6, 2024 04:56:46.210984945 CEST	49990	2121	192.168.2.16	60.76.76.108
May 6, 2024 04:56:46.211302996 CEST	50130	2121	192.168.2.16	196.196.68.7
May 6, 2024 04:56:46.211366892 CEST	50131	21	192.168.2.16	113.226.113.123
May 6, 2024 04:56:46.212757111 CEST	2121	50126	34.128.145.40	192.168.2.16
May 6, 2024 04:56:46.212824106 CEST	50126	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:46.212869883 CEST	50126	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:46.212937117 CEST	50126	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:46.213165045 CEST	50132	2121	192.168.2.16	113.226.113.123
May 6, 2024 04:56:46.214339972 CEST	2121	50094	190.160.27.247	192.168.2.16
May 6, 2024 04:56:46.214593887 CEST	50133	21	192.168.2.16	186.202.7.41
May 6, 2024 04:56:46.227235079 CEST	50134	21	192.168.2.16	40.134.86.153
May 6, 2024 04:56:46.227313042 CEST	50135	2121	192.168.2.16	186.202.7.41
May 6, 2024 04:56:46.242986917 CEST	50062	2121	192.168.2.16	116.126.49.212
May 6, 2024 04:56:46.274957895 CEST	50117	21	192.168.2.16	173.186.63.246
May 6, 2024 04:56:46.274970055 CEST	49999	21	192.168.2.16	153.205.240.87
May 6, 2024 04:56:46.281299114 CEST	2121	50012	111.59.245.235	192.168.2.16
May 6, 2024 04:56:46.290976048 CEST	50103	21	192.168.2.16	118.35.206.150
May 6, 2024 04:56:46.290997982 CEST	50104	2121	192.168.2.16	118.35.206.150
May 6, 2024 04:56:46.301393986 CEST	21	50125	34.128.145.40	192.168.2.16
May 6, 2024 04:56:46.301404953 CEST	21	50125	34.128.145.40	192.168.2.16
May 6, 2024 04:56:46.306957960 CEST	49971	21	192.168.2.16	43.201.47.213
May 6, 2024 04:56:46.307219982 CEST	49972	2121	192.168.2.16	43.201.47.213
May 6, 2024 04:56:46.307379007 CEST	50136	2121	192.168.2.16	40.134.86.153
May 6, 2024 04:56:46.307432890 CEST	50137	21	192.168.2.16	122.194.22.137
May 6, 2024 04:56:46.321824074 CEST	2121	49992	82.78.235.56	192.168.2.16
May 6, 2024 04:56:46.322231054 CEST	50138	2121	192.168.2.16	122.194.22.137
May 6, 2024 04:56:46.322386980 CEST	2121	50126	34.128.145.40	192.168.2.16
May 6, 2024 04:56:46.322398901 CEST	2121	50126	34.128.145.40	192.168.2.16
May 6, 2024 04:56:46.323321104 CEST	50139	21	192.168.2.16	74.77.49.187
May 6, 2024 04:56:46.339299917 CEST	50026	2121	192.168.2.16	1.225.194.212
May 6, 2024 04:56:46.347156048 CEST	21	50009	111.59.245.235	192.168.2.16
May 6, 2024 04:56:46.354981899 CEST	50061	21	192.168.2.16	116.126.49.212
May 6, 2024 04:56:46.370995045 CEST	50096	2121	192.168.2.16	115.141.248.1
May 6, 2024 04:56:46.402980089 CEST	50025	21	192.168.2.16	1.225.194.212
May 6, 2024 04:56:46.418962955 CEST	50014	21	192.168.2.16	58.153.229.5
May 6, 2024 04:56:46.426424980 CEST	21	49989	60.76.76.108	192.168.2.16
May 6, 2024 04:56:46.439208984 CEST	21	50129	196.196.68.7	192.168.2.16
May 6, 2024 04:56:46.451383114 CEST	50140	2121	192.168.2.16	74.77.49.187
May 6, 2024 04:56:46.455177069 CEST	50016	2121	192.168.2.16	58.153.229.5
May 6, 2024 04:56:46.463582993 CEST	2121	50130	196.196.68.7	192.168.2.16
May 6, 2024 04:56:46.482981920 CEST	49984	2121	192.168.2.16	1.49.252.112
May 6, 2024 04:56:46.507096052 CEST	2121	49990	60.76.76.108	192.168.2.16
May 6, 2024 04:56:46.507577896 CEST	50141	21	192.168.2.16	113.242.203.213
May 6, 2024 04:56:46.514988899 CEST	50113	21	192.168.2.16	173.240.190.237
May 6, 2024 04:56:46.530983925 CEST	50109	21	192.168.2.16	61.55.18.14
May 6, 2024 04:56:46.540292978 CEST	2121	50062	116.126.49.212	192.168.2.16
May 6, 2024 04:56:46.546952009 CEST	50042	21	192.168.2.16	125.165.86.247
May 6, 2024 04:56:46.546977997 CEST	50114	2121	192.168.2.16	173.240.190.237
May 6, 2024 04:56:46.563177109 CEST	50142	2121	192.168.2.16	113.242.203.213
May 6, 2024 04:56:46.586285114 CEST	21	49999	153.205.240.87	192.168.2.16
May 6, 2024 04:56:46.590296984 CEST	21	50103	118.35.206.150	192.168.2.16
May 6, 2024 04:56:46.590717077 CEST	2121	50104	118.35.206.150	192.168.2.16
May 6, 2024 04:56:46.591029882 CEST	50143	21	192.168.2.16	98.109.18.153
May 6, 2024 04:56:46.595001936 CEST	50043	2121	192.168.2.16	125.165.86.247
May 6, 2024 04:56:46.595191002 CEST	50144	2121	192.168.2.16	98.109.18.153
May 6, 2024 04:56:46.611284018 CEST	50145	2121	192.168.2.16	125.78.110.175
May 6, 2024 04:56:46.611350060 CEST	50146	21	192.168.2.16	125.78.110.175
May 6, 2024 04:56:46.627265930 CEST	50147	21	192.168.2.16	112.163.192.212
May 6, 2024 04:56:46.630320072 CEST	2121	49972	43.201.47.213	192.168.2.16
May 6, 2024 04:56:46.630898952 CEST	21	49971	43.201.47.213	192.168.2.16
May 6, 2024 04:56:46.643485069 CEST	50148	2121	192.168.2.16	112.163.192.212
May 6, 2024 04:56:46.643548012 CEST	50149	21	192.168.2.16	59.103.222.239
May 6, 2024 04:56:46.643584013 CEST	50150	21	192.168.2.16	116.40.189.189
May 6, 2024 04:56:46.643680096 CEST	50151	2121	192.168.2.16	116.40.189.189
May 6, 2024 04:56:46.659295082 CEST	50152	2121	192.168.2.16	59.103.222.239
May 6, 2024 04:56:46.661072016 CEST	2121	50026	1.225.194.212	192.168.2.16
May 6, 2024 04:56:46.662698984 CEST	50153	21	192.168.2.16	60.248.246.121
May 6, 2024 04:56:46.679661989 CEST	21	50061	116.126.49.212	192.168.2.16
May 6, 2024 04:56:46.690200090 CEST	2121	50096	115.141.248.1	192.168.2.16
May 6, 2024 04:56:46.690951109 CEST	50110	2121	192.168.2.16	61.55.18.14
May 6, 2024 04:56:46.691188097 CEST	50154	2121	192.168.2.16	60.248.246.121
May 6, 2024 04:56:46.697037935 CEST	21	50113	173.240.190.237	192.168.2.16
May 6, 2024 04:56:46.707051039 CEST	50118	2121	192.168.2.16	173.186.63.246
May 6, 2024 04:56:46.707201958 CEST	50155	21	192.168.2.16	85.193.93.60
May 6, 2024 04:56:46.730329037 CEST	2121	50114	173.240.190.237	192.168.2.16
May 6, 2024 04:56:46.739130974 CEST	21	50025	1.225.194.212	192.168.2.16
May 6, 2024 04:56:46.739694118 CEST	50156	2121	192.168.2.16	85.193.93.60
May 6, 2024 04:56:46.759799957 CEST	21	50014	58.153.229.5	192.168.2.16
May 6, 2024 04:56:46.771239996 CEST	50157	21	192.168.2.16	187.48.185.76
May 6, 2024 04:56:46.787100077 CEST	50012	2121	192.168.2.16	111.59.245.235
May 6, 2024 04:56:46.803174019 CEST	50158	2121	192.168.2.16	187.48.185.76
May 6, 2024 04:56:46.805548906 CEST	2121	50016	58.153.229.5	192.168.2.16
May 6, 2024 04:56:46.819288969 CEST	50159	21	192.168.2.16	213.18.112.155
May 6, 2024 04:56:46.845999002 CEST	2121	49984	1.49.252.112	192.168.2.16
May 6, 2024 04:56:46.850987911 CEST	50009	21	192.168.2.16	111.59.245.235
May 6, 2024 04:56:46.851509094 CEST	50160	2121	192.168.2.16	213.18.112.155
May 6, 2024 04:56:46.867011070 CEST	50119	21	192.168.2.16	73.112.120.219
May 6, 2024 04:56:46.867069960 CEST	50120	2121	192.168.2.16	73.112.120.219
May 6, 2024 04:56:46.867394924 CEST	50161	21	192.168.2.16	179.66.129.72
May 6, 2024 04:56:46.867414951 CEST	50162	2121	192.168.2.16	179.66.129.72
May 6, 2024 04:56:46.867525101 CEST	50163	21	192.168.2.16	163.255.185.34
May 6, 2024 04:56:46.899377108 CEST	50164	2121	192.168.2.16	163.255.185.34
May 6, 2024 04:56:46.899377108 CEST	50165	21	192.168.2.16	98.212.21.110
May 6, 2024 04:56:46.921935081 CEST	21	50042	125.165.86.247	192.168.2.16
May 6, 2024 04:56:46.928472042 CEST	21	50147	112.163.192.212	192.168.2.16
May 6, 2024 04:56:46.930984974 CEST	50122	21	192.168.2.16	27.207.39.138
May 6, 2024 04:56:46.935960054 CEST	50123	21	192.168.2.16	71.31.151.54
May 6, 2024 04:56:46.937133074 CEST	50121	2121	192.168.2.16	27.207.39.138
May 6, 2024 04:56:46.946974993 CEST	50129	21	192.168.2.16	196.196.68.7
May 6, 2024 04:56:46.947357893 CEST	50166	2121	192.168.2.16	98.212.21.110
May 6, 2024 04:56:46.947412968 CEST	50167	21	192.168.2.16	60.21.229.138
May 6, 2024 04:56:46.950098038 CEST	2121	50148	112.163.192.212	192.168.2.16
May 6, 2024 04:56:46.962982893 CEST	50124	2121	192.168.2.16	71.31.151.54
May 6, 2024 04:56:46.966463089 CEST	21	50155	85.193.93.60	192.168.2.16
May 6, 2024 04:56:46.976639032 CEST	2121	50043	125.165.86.247	192.168.2.16
May 6, 2024 04:56:46.979026079 CEST	50130	2121	192.168.2.16	196.196.68.7
May 6, 2024 04:56:46.995260000 CEST	50168	2121	192.168.2.16	60.21.229.138
May 6, 2024 04:56:46.997605085 CEST	21	50149	59.103.222.239	192.168.2.16
May 6, 2024 04:56:47.004268885 CEST	2121	50156	85.193.93.60	192.168.2.16
May 6, 2024 04:56:47.016350985 CEST	2121	50152	59.103.222.239	192.168.2.16
May 6, 2024 04:56:47.027004957 CEST	50127	21	192.168.2.16	221.3.49.159
May 6, 2024 04:56:47.091169119 CEST	50169	21	192.168.2.16	154.148.45.69
May 6, 2024 04:56:47.196105003 CEST	21	50129	196.196.68.7	192.168.2.16
May 6, 2024 04:56:47.202967882 CEST	50113	21	192.168.2.16	173.240.190.237
May 6, 2024 04:56:47.202971935 CEST	50128	2121	192.168.2.16	221.3.49.159
May 6, 2024 04:56:47.206260920 CEST	50112	2121	192.168.2.16	45.87.1.166
May 6, 2024 04:56:47.218975067 CEST	50132	2121	192.168.2.16	113.226.113.123
May 6, 2024 04:56:47.218975067 CEST	50133	21	192.168.2.16	186.202.7.41
May 6, 2024 04:56:47.221472979 CEST	50131	21	192.168.2.16	113.226.113.123
May 6, 2024 04:56:47.225158930 CEST	2121	50012	111.59.245.235	192.168.2.16
May 6, 2024 04:56:47.231268883 CEST	2121	50130	196.196.68.7	192.168.2.16
May 6, 2024 04:56:47.234958887 CEST	50134	21	192.168.2.16	40.134.86.153
May 6, 2024 04:56:47.234958887 CEST	50114	2121	192.168.2.16	173.240.190.237
May 6, 2024 04:56:47.234961033 CEST	50135	2121	192.168.2.16	186.202.7.41
May 6, 2024 04:56:47.235268116 CEST	50170	2121	192.168.2.16	154.148.45.69
May 6, 2024 04:56:47.305860043 CEST	21	50009	111.59.245.235	192.168.2.16
May 6, 2024 04:56:47.314990997 CEST	50136	2121	192.168.2.16	40.134.86.153
May 6, 2024 04:56:47.314990997 CEST	50137	21	192.168.2.16	122.194.22.137
May 6, 2024 04:56:47.331001043 CEST	50138	2121	192.168.2.16	122.194.22.137
May 6, 2024 04:56:47.331063032 CEST	50139	21	192.168.2.16	74.77.49.187
May 6, 2024 04:56:47.331381083 CEST	50171	21	192.168.2.16	189.153.186.34
May 6, 2024 04:56:47.384427071 CEST	21	50113	173.240.190.237	192.168.2.16
May 6, 2024 04:56:47.395205975 CEST	50172	2121	192.168.2.16	189.153.186.34
May 6, 2024 04:56:47.416264057 CEST	2121	50114	173.240.190.237	192.168.2.16
May 6, 2024 04:56:47.416614056 CEST	50173	21	192.168.2.16	70.80.238.19
May 6, 2024 04:56:47.441966057 CEST	50147	21	192.168.2.16	112.163.192.212
May 6, 2024 04:56:47.472629070 CEST	50148	2121	192.168.2.16	112.163.192.212
May 6, 2024 04:56:47.472640038 CEST	50140	2121	192.168.2.16	74.77.49.187
May 6, 2024 04:56:47.473957062 CEST	50155	21	192.168.2.16	85.193.93.60
May 6, 2024 04:56:47.505975008 CEST	50149	21	192.168.2.16	59.103.222.239
May 6, 2024 04:56:47.505976915 CEST	50156	2121	192.168.2.16	85.193.93.60
May 6, 2024 04:56:47.521953106 CEST	50141	21	192.168.2.16	113.242.203.213
May 6, 2024 04:56:47.521953106 CEST	50152	2121	192.168.2.16	59.103.222.239
May 6, 2024 04:56:47.530253887 CEST	2121	50170	154.148.45.69	192.168.2.16
May 6, 2024 04:56:47.530433893 CEST	21	50169	154.148.45.69	192.168.2.16
May 6, 2024 04:56:47.569977999 CEST	50142	2121	192.168.2.16	113.242.203.213
May 6, 2024 04:56:47.601974010 CEST	50144	2121	192.168.2.16	98.109.18.153
May 6, 2024 04:56:47.602052927 CEST	50143	21	192.168.2.16	98.109.18.153
May 6, 2024 04:56:47.617959976 CEST	50146	21	192.168.2.16	125.78.110.175
May 6, 2024 04:56:47.617961884 CEST	50145	2121	192.168.2.16	125.78.110.175
May 6, 2024 04:56:47.649971008 CEST	50151	2121	192.168.2.16	116.40.189.189
May 6, 2024 04:56:47.650652885 CEST	50150	21	192.168.2.16	116.40.189.189
May 6, 2024 04:56:47.665977955 CEST	50153	21	192.168.2.16	60.248.246.121
May 6, 2024 04:56:47.681984901 CEST	50115	21	192.168.2.16	179.255.165.104
May 6, 2024 04:56:47.697989941 CEST	50129	21	192.168.2.16	196.196.68.7
May 6, 2024 04:56:47.697992086 CEST	50154	2121	192.168.2.16	60.248.246.121
May 6, 2024 04:56:47.734334946 CEST	21	50155	85.193.93.60	192.168.2.16
May 6, 2024 04:56:47.743163109 CEST	21	50147	112.163.192.212	192.168.2.16
May 6, 2024 04:56:47.745995998 CEST	50130	2121	192.168.2.16	196.196.68.7
May 6, 2024 04:56:47.761962891 CEST	50116	2121	192.168.2.16	179.255.165.104
May 6, 2024 04:56:47.770704031 CEST	2121	50156	85.193.93.60	192.168.2.16
May 6, 2024 04:56:47.778832912 CEST	2121	50148	112.163.192.212	192.168.2.16
May 6, 2024 04:56:47.784951925 CEST	50157	21	192.168.2.16	187.48.185.76
May 6, 2024 04:56:47.810000896 CEST	50158	2121	192.168.2.16	187.48.185.76
May 6, 2024 04:56:47.825958014 CEST	50159	21	192.168.2.16	213.18.112.155
May 6, 2024 04:56:47.857975006 CEST	50160	2121	192.168.2.16	213.18.112.155
May 6, 2024 04:56:47.860064983 CEST	21	50149	59.103.222.239	192.168.2.16
May 6, 2024 04:56:47.874074936 CEST	50161	21	192.168.2.16	179.66.129.72
May 6, 2024 04:56:47.874074936 CEST	50163	21	192.168.2.16	163.255.185.34
May 6, 2024 04:56:47.874075890 CEST	50162	2121	192.168.2.16	179.66.129.72
May 6, 2024 04:56:47.878942966 CEST	2121	50152	59.103.222.239	192.168.2.16
May 6, 2024 04:56:47.905993938 CEST	50165	21	192.168.2.16	98.212.21.110
May 6, 2024 04:56:47.905994892 CEST	50164	2121	192.168.2.16	163.255.185.34
May 6, 2024 04:56:47.946293116 CEST	21	50129	196.196.68.7	192.168.2.16
May 6, 2024 04:56:47.953979969 CEST	50167	21	192.168.2.16	60.21.229.138
May 6, 2024 04:56:47.957134962 CEST	50166	2121	192.168.2.16	98.212.21.110
May 6, 2024 04:56:47.990520954 CEST	50174	2121	192.168.2.16	70.80.238.19
May 6, 2024 04:56:47.990771055 CEST	50176	2121	192.168.2.16	104.93.124.254
May 6, 2024 04:56:47.990772963 CEST	50175	21	192.168.2.16	79.144.99.44
May 6, 2024 04:56:47.990833044 CEST	50177	21	192.168.2.16	104.93.124.254
May 6, 2024 04:56:47.990931034 CEST	50178	2121	192.168.2.16	79.144.99.44
May 6, 2024 04:56:47.991065025 CEST	50179	21	192.168.2.16	93.144.107.191
May 6, 2024 04:56:47.991233110 CEST	50181	2121	192.168.2.16	47.122.51.65
May 6, 2024 04:56:47.991265059 CEST	50182	21	192.168.2.16	78.23.133.140
May 6, 2024 04:56:47.991269112 CEST	50180	21	192.168.2.16	47.122.51.65
May 6, 2024 04:56:47.991393089 CEST	50183	2121	192.168.2.16	104.174.143.71
May 6, 2024 04:56:47.991466045 CEST	50184	21	192.168.2.16	80.119.223.253
May 6, 2024 04:56:47.991581917 CEST	50185	2121	192.168.2.16	80.119.223.253
May 6, 2024 04:56:47.991676092 CEST	50186	2121	192.168.2.16	112.103.252.249
May 6, 2024 04:56:47.991709948 CEST	50187	21	192.168.2.16	112.103.252.249
May 6, 2024 04:56:47.991764069 CEST	50188	21	192.168.2.16	112.238.43.125
May 6, 2024 04:56:47.991902113 CEST	50190	2121	192.168.2.16	112.238.43.125
May 6, 2024 04:56:47.991955042 CEST	50189	21	192.168.2.16	104.174.143.71
May 6, 2024 04:56:47.992002010 CEST	50192	21	192.168.2.16	47.244.119.251
May 6, 2024 04:56:47.992038012 CEST	50193	2121	192.168.2.16	47.244.119.251
May 6, 2024 04:56:47.992104053 CEST	50194	2121	192.168.2.16	93.144.107.191
May 6, 2024 04:56:47.992167950 CEST	50191	21	192.168.2.16	73.133.2.57
May 6, 2024 04:56:47.992167950 CEST	50196	2121	192.168.2.16	78.23.133.140
May 6, 2024 04:56:47.992259026 CEST	50195	2121	192.168.2.16	73.133.2.57
May 6, 2024 04:56:47.998157024 CEST	50168	2121	192.168.2.16	60.21.229.138
May 6, 2024 04:56:48.002290010 CEST	2121	50130	196.196.68.7	192.168.2.16
May 6, 2024 04:56:48.003979921 CEST	50197	21	192.168.2.16	150.255.30.207
May 6, 2024 04:56:48.004122972 CEST	50198	2121	192.168.2.16	150.255.30.207
May 6, 2024 04:56:48.004184961 CEST	50199	21	192.168.2.16	71.235.56.180
May 6, 2024 04:56:48.004267931 CEST	50200	2121	192.168.2.16	71.235.56.180
May 6, 2024 04:56:48.004385948 CEST	50201	2121	192.168.2.16	182.233.214.56
May 6, 2024 04:56:48.004576921 CEST	50203	21	192.168.2.16	210.5.190.214
May 6, 2024 04:56:48.004576921 CEST	50204	2121	192.168.2.16	210.5.190.214
May 6, 2024 04:56:48.004599094 CEST	50202	21	192.168.2.16	182.233.214.56
May 6, 2024 04:56:48.004627943 CEST	50205	21	192.168.2.16	49.48.43.254
May 6, 2024 04:56:48.004848957 CEST	50206	2121	192.168.2.16	49.48.43.254
May 6, 2024 04:56:48.004961014 CEST	50207	2121	192.168.2.16	221.160.246.44
May 6, 2024 04:56:48.004975080 CEST	50208	21	192.168.2.16	221.160.246.44
May 6, 2024 04:56:48.005059958 CEST	50210	21	192.168.2.16	104.222.45.222
May 6, 2024 04:56:48.005139112 CEST	50209	2121	192.168.2.16	104.222.45.222
May 6, 2024 04:56:48.005383015 CEST	50211	2121	192.168.2.16	201.102.186.151
May 6, 2024 04:56:48.005548000 CEST	50212	21	192.168.2.16	110.138.153.93
May 6, 2024 04:56:48.005577087 CEST	50213	2121	192.168.2.16	92.104.140.43
May 6, 2024 04:56:48.005645037 CEST	50214	21	192.168.2.16	120.196.4.149
May 6, 2024 04:56:48.005698919 CEST	50215	21	192.168.2.16	217.217.194.14
May 6, 2024 04:56:48.005794048 CEST	50217	21	192.168.2.16	92.104.140.43
May 6, 2024 04:56:48.005815983 CEST	50219	2121	192.168.2.16	120.196.4.149
May 6, 2024 04:56:48.005844116 CEST	50216	2121	192.168.2.16	217.217.194.14
May 6, 2024 04:56:48.005896091 CEST	50218	21	192.168.2.16	71.58.210.134
May 6, 2024 04:56:48.006028891 CEST	50220	2121	192.168.2.16	110.138.153.93
May 6, 2024 04:56:48.006072998 CEST	50221	21	192.168.2.16	201.102.186.151
May 6, 2024 04:56:48.018640995 CEST	50222	2121	192.168.2.16	71.58.210.134
May 6, 2024 04:56:48.018686056 CEST	50223	21	192.168.2.16	111.26.192.63
May 6, 2024 04:56:48.018753052 CEST	50224	2121	192.168.2.16	111.26.192.63
May 6, 2024 04:56:48.018773079 CEST	50225	21	192.168.2.16	78.115.218.214
May 6, 2024 04:56:48.018872023 CEST	50226	21	192.168.2.16	188.72.123.137
May 6, 2024 04:56:48.018907070 CEST	50227	2121	192.168.2.16	78.115.218.214
May 6, 2024 04:56:48.018924952 CEST	50228	2121	192.168.2.16	188.72.123.137
May 6, 2024 04:56:48.019120932 CEST	50229	21	192.168.2.16	61.161.28.125
May 6, 2024 04:56:48.019171953 CEST	50230	21	192.168.2.16	72.208.6.163
May 6, 2024 04:56:48.019243956 CEST	50231	2121	192.168.2.16	72.208.6.163
May 6, 2024 04:56:48.019275904 CEST	50232	21	192.168.2.16	183.233.93.130
May 6, 2024 04:56:48.019438028 CEST	50234	2121	192.168.2.16	190.30.122.126
May 6, 2024 04:56:48.019512892 CEST	50235	2121	192.168.2.16	27.58.41.241
May 6, 2024 04:56:48.019539118 CEST	50236	21	192.168.2.16	27.58.41.241
May 6, 2024 04:56:48.019575119 CEST	50233	21	192.168.2.16	190.30.122.126
May 6, 2024 04:56:48.019642115 CEST	50237	21	192.168.2.16	14.160.134.158
May 6, 2024 04:56:48.019695044 CEST	50238	2121	192.168.2.16	14.160.134.158
May 6, 2024 04:56:48.019699097 CEST	50239	21	192.168.2.16	108.34.21.249
May 6, 2024 04:56:48.019764900 CEST	50240	2121	192.168.2.16	108.34.21.249
May 6, 2024 04:56:48.019850016 CEST	50241	21	192.168.2.16	27.213.157.225
May 6, 2024 04:56:48.019851923 CEST	50242	2121	192.168.2.16	183.233.93.130
May 6, 2024 04:56:48.019851923 CEST	50243	2121	192.168.2.16	61.161.28.125
May 6, 2024 04:56:48.032979965 CEST	50170	2121	192.168.2.16	154.148.45.69
May 6, 2024 04:56:48.032980919 CEST	50169	21	192.168.2.16	154.148.45.69
May 6, 2024 04:56:48.035013914 CEST	50244	2121	192.168.2.16	27.213.157.225
May 6, 2024 04:56:48.035054922 CEST	50245	21	192.168.2.16	46.0.171.21
May 6, 2024 04:56:48.035111904 CEST	50246	2121	192.168.2.16	46.0.171.21
May 6, 2024 04:56:48.035183907 CEST	50247	21	192.168.2.16	187.138.31.196
May 6, 2024 04:56:48.035274982 CEST	50248	2121	192.168.2.16	187.138.31.196
May 6, 2024 04:56:48.035352945 CEST	50249	21	192.168.2.16	74.51.225.184
May 6, 2024 04:56:48.035378933 CEST	50250	2121	192.168.2.16	74.51.225.184
May 6, 2024 04:56:48.035424948 CEST	50251	21	192.168.2.16	168.220.94.137
May 6, 2024 04:56:48.035501003 CEST	50252	2121	192.168.2.16	168.220.94.137
May 6, 2024 04:56:48.035542965 CEST	50253	21	192.168.2.16	222.163.7.242
May 6, 2024 04:56:48.035631895 CEST	50254	2121	192.168.2.16	222.163.7.242
May 6, 2024 04:56:48.035706997 CEST	50255	21	192.168.2.16	177.34.196.1
May 6, 2024 04:56:48.035809040 CEST	50256	21	192.168.2.16	113.78.184.237
May 6, 2024 04:56:48.035826921 CEST	50257	2121	192.168.2.16	177.34.196.1
May 6, 2024 04:56:48.035849094 CEST	50258	2121	192.168.2.16	113.78.184.237
May 6, 2024 04:56:48.036005020 CEST	50259	21	192.168.2.16	71.186.189.60
May 6, 2024 04:56:48.036067963 CEST	50261	2121	192.168.2.16	105.130.167.223
May 6, 2024 04:56:48.036149979 CEST	50263	21	192.168.2.16	20.45.74.140
May 6, 2024 04:56:48.036176920 CEST	50262	21	192.168.2.16	105.130.167.223
May 6, 2024 04:56:48.036312103 CEST	50265	2121	192.168.2.16	153.99.157.36
May 6, 2024 04:56:48.036360025 CEST	50264	2121	192.168.2.16	20.45.74.140
May 6, 2024 04:56:48.036370993 CEST	50266	21	192.168.2.16	18.165.91.73
May 6, 2024 04:56:48.036448956 CEST	50268	2121	192.168.2.16	18.165.91.73
May 6, 2024 04:56:48.036478043 CEST	50269	21	192.168.2.16	190.11.40.87
May 6, 2024 04:56:48.036525965 CEST	50270	2121	192.168.2.16	190.11.40.87
May 6, 2024 04:56:48.036562920 CEST	50267	21	192.168.2.16	153.99.157.36
May 6, 2024 04:56:48.036602974 CEST	50271	21	192.168.2.16	36.85.153.27
May 6, 2024 04:56:48.036603928 CEST	50260	2121	192.168.2.16	71.186.189.60
May 6, 2024 04:56:48.050755978 CEST	50272	2121	192.168.2.16	36.85.153.27
May 6, 2024 04:56:48.050827026 CEST	50273	2121	192.168.2.16	18.172.251.146
May 6, 2024 04:56:48.050860882 CEST	50274	21	192.168.2.16	18.172.251.146
May 6, 2024 04:56:48.050950050 CEST	50275	21	192.168.2.16	113.232.167.50
May 6, 2024 04:56:48.050964117 CEST	50276	2121	192.168.2.16	113.232.167.50
May 6, 2024 04:56:48.051037073 CEST	50277	21	192.168.2.16	94.8.106.34
May 6, 2024 04:56:48.051153898 CEST	50278	2121	192.168.2.16	94.8.106.34
May 6, 2024 04:56:48.051222086 CEST	50279	21	192.168.2.16	194.42.89.141
May 6, 2024 04:56:48.051286936 CEST	50280	2121	192.168.2.16	194.42.89.141
May 6, 2024 04:56:48.051374912 CEST	50281	21	192.168.2.16	117.89.16.57
May 6, 2024 04:56:48.051412106 CEST	50282	2121	192.168.2.16	117.89.16.57
May 6, 2024 04:56:48.051505089 CEST	50283	21	192.168.2.16	126.78.66.219
May 6, 2024 04:56:48.051559925 CEST	50284	2121	192.168.2.16	126.78.66.219
May 6, 2024 04:56:48.051609993 CEST	50285	21	192.168.2.16	27.207.21.16
May 6, 2024 04:56:48.051687956 CEST	50286	2121	192.168.2.16	27.207.21.16
May 6, 2024 04:56:48.051769018 CEST	50287	21	192.168.2.16	119.155.11.243
May 6, 2024 04:56:48.051856995 CEST	50288	2121	192.168.2.16	119.155.11.243
May 6, 2024 04:56:48.051950932 CEST	50289	21	192.168.2.16	104.34.24.209
May 6, 2024 04:56:48.052021027 CEST	50290	2121	192.168.2.16	104.34.24.209
May 6, 2024 04:56:48.052057028 CEST	50291	21	192.168.2.16	76.104.43.21
May 6, 2024 04:56:48.052251101 CEST	50292	21	192.168.2.16	185.107.27.184
May 6, 2024 04:56:48.052308083 CEST	50293	2121	192.168.2.16	76.104.43.21
May 6, 2024 04:56:48.052326918 CEST	50294	2121	192.168.2.16	185.107.27.184
May 6, 2024 04:56:48.052447081 CEST	50295	21	192.168.2.16	216.117.162.236
May 6, 2024 04:56:48.066164970 CEST	50296	21	192.168.2.16	109.205.180.149
May 6, 2024 04:56:48.066433907 CEST	50297	21	192.168.2.16	103.109.6.215
May 6, 2024 04:56:48.066601038 CEST	50298	21	192.168.2.16	45.87.1.166
May 6, 2024 04:56:48.066684961 CEST	50299	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:48.066761971 CEST	50300	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:48.066812992 CEST	50301	21	192.168.2.16	195.240.238.212
May 6, 2024 04:56:48.066884041 CEST	50302	2121	192.168.2.16	195.240.238.212
May 6, 2024 04:56:48.066956043 CEST	50303	21	192.168.2.16	193.124.183.222
May 6, 2024 04:56:48.067008018 CEST	50304	2121	192.168.2.16	193.124.183.222
May 6, 2024 04:56:48.067120075 CEST	50305	21	192.168.2.16	113.26.215.31
May 6, 2024 04:56:48.067197084 CEST	50306	2121	192.168.2.16	113.26.215.31
May 6, 2024 04:56:48.067255020 CEST	50307	21	192.168.2.16	124.64.6.45
May 6, 2024 04:56:48.067327976 CEST	50308	2121	192.168.2.16	124.64.6.45
May 6, 2024 04:56:48.067430973 CEST	50309	21	192.168.2.16	93.41.237.60
May 6, 2024 04:56:48.067543030 CEST	50310	2121	192.168.2.16	93.41.237.60
May 6, 2024 04:56:48.067594051 CEST	50311	21	192.168.2.16	91.203.165.183
May 6, 2024 04:56:48.067637920 CEST	50312	2121	192.168.2.16	91.203.165.183
May 6, 2024 04:56:48.067651987 CEST	50313	21	192.168.2.16	223.221.178.206
May 6, 2024 04:56:48.144957066 CEST	21	50251	168.220.94.137	192.168.2.16
May 6, 2024 04:56:48.145046949 CEST	50251	21	192.168.2.16	168.220.94.137
May 6, 2024 04:56:48.145148039 CEST	2121	50252	168.220.94.137	192.168.2.16
May 6, 2024 04:56:48.145207882 CEST	50252	2121	192.168.2.16	168.220.94.137
May 6, 2024 04:56:48.152070045 CEST	21	50249	74.51.225.184	192.168.2.16
May 6, 2024 04:56:48.152344942 CEST	2121	50250	74.51.225.184	192.168.2.16
May 6, 2024 04:56:48.176398993 CEST	2121	50300	34.128.145.40	192.168.2.16
May 6, 2024 04:56:48.176470041 CEST	50300	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:48.177059889 CEST	21	50299	34.128.145.40	192.168.2.16
May 6, 2024 04:56:48.177114964 CEST	50299	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:48.186060905 CEST	21	50295	216.117.162.236	192.168.2.16
May 6, 2024 04:56:48.186117887 CEST	50295	21	192.168.2.16	216.117.162.236
May 6, 2024 04:56:48.240988016 CEST	50155	21	192.168.2.16	85.193.93.60
May 6, 2024 04:56:48.256979942 CEST	50147	21	192.168.2.16	112.163.192.212
May 6, 2024 04:56:48.272991896 CEST	50156	2121	192.168.2.16	85.193.93.60
May 6, 2024 04:56:48.286118984 CEST	2121	50300	34.128.145.40	192.168.2.16
May 6, 2024 04:56:48.286174059 CEST	50300	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:48.286293983 CEST	50300	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:48.286550045 CEST	50314	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:48.287632942 CEST	21	50299	34.128.145.40	192.168.2.16
May 6, 2024 04:56:48.287688971 CEST	50299	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:48.287769079 CEST	50299	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:48.288017988 CEST	50315	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:48.288957119 CEST	50117	21	192.168.2.16	173.186.63.246
May 6, 2024 04:56:48.288971901 CEST	50148	2121	192.168.2.16	112.163.192.212
May 6, 2024 04:56:48.291239977 CEST	21	50277	94.8.106.34	192.168.2.16
May 6, 2024 04:56:48.292151928 CEST	21	50298	45.87.1.166	192.168.2.16
May 6, 2024 04:56:48.292223930 CEST	50298	21	192.168.2.16	45.87.1.166
May 6, 2024 04:56:48.295166016 CEST	2121	50278	94.8.106.34	192.168.2.16
May 6, 2024 04:56:48.299668074 CEST	21	50296	109.205.180.149	192.168.2.16
May 6, 2024 04:56:48.299727917 CEST	50296	21	192.168.2.16	109.205.180.149
May 6, 2024 04:56:48.307166100 CEST	21	50208	221.160.246.44	192.168.2.16
May 6, 2024 04:56:48.312469006 CEST	2121	50257	177.34.196.1	192.168.2.16
May 6, 2024 04:56:48.312571049 CEST	2121	50207	221.160.246.44	192.168.2.16
May 6, 2024 04:56:48.312725067 CEST	21	50255	177.34.196.1	192.168.2.16
May 6, 2024 04:56:48.325464010 CEST	21	50262	105.130.167.223	192.168.2.16
May 6, 2024 04:56:48.325550079 CEST	2121	50261	105.130.167.223	192.168.2.16
May 6, 2024 04:56:48.328046083 CEST	21	50295	216.117.162.236	192.168.2.16
May 6, 2024 04:56:48.328182936 CEST	50295	21	192.168.2.16	216.117.162.236
May 6, 2024 04:56:48.330023050 CEST	2121	50312	91.203.165.183	192.168.2.16
May 6, 2024 04:56:48.330550909 CEST	21	50311	91.203.165.183	192.168.2.16
May 6, 2024 04:56:48.336992025 CEST	50171	21	192.168.2.16	189.153.186.34
May 6, 2024 04:56:48.338460922 CEST	2121	50284	126.78.66.219	192.168.2.16
May 6, 2024 04:56:48.338747978 CEST	2121	50304	193.124.183.222	192.168.2.16
May 6, 2024 04:56:48.341021061 CEST	2121	50204	210.5.190.214	192.168.2.16
May 6, 2024 04:56:48.344314098 CEST	21	50203	210.5.190.214	192.168.2.16
May 6, 2024 04:56:48.344979048 CEST	21	50303	193.124.183.222	192.168.2.16
May 6, 2024 04:56:48.345052004 CEST	50303	21	192.168.2.16	193.124.183.222
May 6, 2024 04:56:48.367623091 CEST	21	50283	126.78.66.219	192.168.2.16
May 6, 2024 04:56:48.368978024 CEST	50149	21	192.168.2.16	59.103.222.239
May 6, 2024 04:56:48.371591091 CEST	2121	50206	49.48.43.254	192.168.2.16
May 6, 2024 04:56:48.373425007 CEST	21	50205	49.48.43.254	192.168.2.16
May 6, 2024 04:56:48.374299049 CEST	21	50256	113.78.184.237	192.168.2.16
May 6, 2024 04:56:48.384999990 CEST	50152	2121	192.168.2.16	59.103.222.239
May 6, 2024 04:56:48.390357971 CEST	2121	50258	113.78.184.237	192.168.2.16
May 6, 2024 04:56:48.395850897 CEST	2121	50300	34.128.145.40	192.168.2.16
May 6, 2024 04:56:48.397075891 CEST	2121	50314	34.128.145.40	192.168.2.16
May 6, 2024 04:56:48.397140026 CEST	50314	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:48.398154974 CEST	21	50299	34.128.145.40	192.168.2.16
May 6, 2024 04:56:48.398380041 CEST	21	50315	34.128.145.40	192.168.2.16
May 6, 2024 04:56:48.398441076 CEST	50315	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:48.400548935 CEST	21	50197	150.255.30.207	192.168.2.16
May 6, 2024 04:56:48.400959969 CEST	50172	2121	192.168.2.16	189.153.186.34
May 6, 2024 04:56:48.413415909 CEST	2121	50198	150.255.30.207	192.168.2.16
May 6, 2024 04:56:48.416979074 CEST	50173	21	192.168.2.16	70.80.238.19
May 6, 2024 04:56:48.441407919 CEST	21	50297	103.109.6.215	192.168.2.16
May 6, 2024 04:56:48.441467047 CEST	50297	21	192.168.2.16	103.109.6.215
May 6, 2024 04:56:48.442116022 CEST	21	50313	223.221.178.206	192.168.2.16
May 6, 2024 04:56:48.445611954 CEST	2121	50224	111.26.192.63	192.168.2.16
May 6, 2024 04:56:48.446274996 CEST	21	50223	111.26.192.63	192.168.2.16
May 6, 2024 04:56:48.448985100 CEST	50129	21	192.168.2.16	196.196.68.7
May 6, 2024 04:56:48.462241888 CEST	21	50295	216.117.162.236	192.168.2.16
May 6, 2024 04:56:48.466423035 CEST	21	50295	216.117.162.236	192.168.2.16
May 6, 2024 04:56:48.466543913 CEST	50295	21	192.168.2.16	216.117.162.236
May 6, 2024 04:56:48.490021944 CEST	21	50169	154.148.45.69	192.168.2.16
May 6, 2024 04:56:48.490032911 CEST	2121	50170	154.148.45.69	192.168.2.16
May 6, 2024 04:56:48.500130892 CEST	21	50155	85.193.93.60	192.168.2.16
May 6, 2024 04:56:48.507565975 CEST	2121	50314	34.128.145.40	192.168.2.16
May 6, 2024 04:56:48.507616997 CEST	50314	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:48.507694006 CEST	50314	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:48.507901907 CEST	50316	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:48.508857012 CEST	21	50315	34.128.145.40	192.168.2.16
May 6, 2024 04:56:48.508915901 CEST	50315	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:48.508965015 CEST	50315	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:48.509171963 CEST	50317	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:48.512959003 CEST	50130	2121	192.168.2.16	196.196.68.7
May 6, 2024 04:56:48.513189077 CEST	50318	2121	192.168.2.16	223.221.178.206
May 6, 2024 04:56:48.521836996 CEST	21	50298	45.87.1.166	192.168.2.16
May 6, 2024 04:56:48.521954060 CEST	50298	21	192.168.2.16	45.87.1.166
May 6, 2024 04:56:48.535453081 CEST	21	50296	109.205.180.149	192.168.2.16
May 6, 2024 04:56:48.535605907 CEST	50296	21	192.168.2.16	109.205.180.149
May 6, 2024 04:56:48.537663937 CEST	2121	50156	85.193.93.60	192.168.2.16
May 6, 2024 04:56:48.558121920 CEST	21	50147	112.163.192.212	192.168.2.16
May 6, 2024 04:56:48.594877005 CEST	2121	50148	112.163.192.212	192.168.2.16
May 6, 2024 04:56:48.617213964 CEST	2121	50314	34.128.145.40	192.168.2.16
May 6, 2024 04:56:48.618385077 CEST	2121	50316	34.128.145.40	192.168.2.16
May 6, 2024 04:56:48.618437052 CEST	50316	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:48.618773937 CEST	21	50317	34.128.145.40	192.168.2.16
May 6, 2024 04:56:48.618832111 CEST	50317	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:48.619393110 CEST	21	50315	34.128.145.40	192.168.2.16
May 6, 2024 04:56:48.626878977 CEST	21	50303	193.124.183.222	192.168.2.16
May 6, 2024 04:56:48.626960993 CEST	50303	21	192.168.2.16	193.124.183.222
May 6, 2024 04:56:48.627135038 CEST	50319	21	192.168.2.16	61.99.64.185
May 6, 2024 04:56:48.640858889 CEST	21	50295	216.117.162.236	192.168.2.16
May 6, 2024 04:56:48.657131910 CEST	50250	2121	192.168.2.16	74.51.225.184
May 6, 2024 04:56:48.657135010 CEST	50249	21	192.168.2.16	74.51.225.184
May 6, 2024 04:56:48.673239946 CEST	50320	2121	192.168.2.16	61.99.64.185
May 6, 2024 04:56:48.697191954 CEST	21	50129	196.196.68.7	192.168.2.16
May 6, 2024 04:56:48.720995903 CEST	50118	2121	192.168.2.16	173.186.63.246
May 6, 2024 04:56:48.723128080 CEST	21	50149	59.103.222.239	192.168.2.16
May 6, 2024 04:56:48.728415966 CEST	21	50317	34.128.145.40	192.168.2.16
May 6, 2024 04:56:48.728471041 CEST	50317	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:48.728540897 CEST	50317	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:48.728720903 CEST	50321	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:48.728991032 CEST	2121	50316	34.128.145.40	192.168.2.16
May 6, 2024 04:56:48.729034901 CEST	50316	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:48.729123116 CEST	50316	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:48.729306936 CEST	50322	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:48.741990089 CEST	2121	50152	59.103.222.239	192.168.2.16
May 6, 2024 04:56:48.751164913 CEST	21	50298	45.87.1.166	192.168.2.16
May 6, 2024 04:56:48.751176119 CEST	21	50298	45.87.1.166	192.168.2.16
May 6, 2024 04:56:48.751300097 CEST	50298	21	192.168.2.16	45.87.1.166
May 6, 2024 04:56:48.766844988 CEST	2121	50130	196.196.68.7	192.168.2.16
May 6, 2024 04:56:48.770603895 CEST	21	50296	109.205.180.149	192.168.2.16
May 6, 2024 04:56:48.770749092 CEST	21	50296	109.205.180.149	192.168.2.16
May 6, 2024 04:56:48.770874023 CEST	50296	21	192.168.2.16	109.205.180.149
May 6, 2024 04:56:48.771045923 CEST	21	50249	74.51.225.184	192.168.2.16
May 6, 2024 04:56:48.771056890 CEST	2121	50250	74.51.225.184	192.168.2.16
May 6, 2024 04:56:48.800961971 CEST	50278	2121	192.168.2.16	94.8.106.34
May 6, 2024 04:56:48.800976992 CEST	50277	21	192.168.2.16	94.8.106.34
May 6, 2024 04:56:48.816972017 CEST	50257	2121	192.168.2.16	177.34.196.1
May 6, 2024 04:56:48.816984892 CEST	50207	2121	192.168.2.16	221.160.246.44
May 6, 2024 04:56:48.816988945 CEST	50208	21	192.168.2.16	221.160.246.44
May 6, 2024 04:56:48.817075968 CEST	50255	21	192.168.2.16	177.34.196.1
May 6, 2024 04:56:48.818152905 CEST	21	50297	103.109.6.215	192.168.2.16
May 6, 2024 04:56:48.818248987 CEST	50297	21	192.168.2.16	103.109.6.215
May 6, 2024 04:56:48.832956076 CEST	50261	2121	192.168.2.16	105.130.167.223
May 6, 2024 04:56:48.832968950 CEST	50311	21	192.168.2.16	91.203.165.183
May 6, 2024 04:56:48.832972050 CEST	50312	2121	192.168.2.16	91.203.165.183
May 6, 2024 04:56:48.833077908 CEST	50262	21	192.168.2.16	105.130.167.223
May 6, 2024 04:56:48.838793039 CEST	21	50321	34.128.145.40	192.168.2.16
May 6, 2024 04:56:48.838860035 CEST	50321	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:48.838881016 CEST	21	50317	34.128.145.40	192.168.2.16
May 6, 2024 04:56:48.839817047 CEST	2121	50316	34.128.145.40	192.168.2.16
May 6, 2024 04:56:48.839828014 CEST	2121	50322	34.128.145.40	192.168.2.16
May 6, 2024 04:56:48.839886904 CEST	50322	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:48.848968029 CEST	50204	2121	192.168.2.16	210.5.190.214
May 6, 2024 04:56:48.848968029 CEST	50284	2121	192.168.2.16	126.78.66.219
May 6, 2024 04:56:48.849138021 CEST	50304	2121	192.168.2.16	193.124.183.222
May 6, 2024 04:56:48.855962038 CEST	50203	21	192.168.2.16	210.5.190.214
May 6, 2024 04:56:48.880964041 CEST	50120	2121	192.168.2.16	73.112.120.219
May 6, 2024 04:56:48.880978107 CEST	50283	21	192.168.2.16	126.78.66.219
May 6, 2024 04:56:48.880980015 CEST	50206	2121	192.168.2.16	49.48.43.254
May 6, 2024 04:56:48.880983114 CEST	50205	21	192.168.2.16	49.48.43.254
May 6, 2024 04:56:48.881129980 CEST	50256	21	192.168.2.16	113.78.184.237
May 6, 2024 04:56:48.885957003 CEST	50119	21	192.168.2.16	73.112.120.219
May 6, 2024 04:56:48.896137953 CEST	2121	50318	223.221.178.206	192.168.2.16
May 6, 2024 04:56:48.896959066 CEST	50258	2121	192.168.2.16	113.78.184.237
May 6, 2024 04:56:48.904751062 CEST	21	50303	193.124.183.222	192.168.2.16
May 6, 2024 04:56:48.904803038 CEST	50303	21	192.168.2.16	193.124.183.222
May 6, 2024 04:56:48.912976027 CEST	50197	21	192.168.2.16	150.255.30.207
May 6, 2024 04:56:48.931951046 CEST	50198	2121	192.168.2.16	150.255.30.207
May 6, 2024 04:56:48.944967985 CEST	50122	21	192.168.2.16	27.207.39.138
May 6, 2024 04:56:48.944976091 CEST	50313	21	192.168.2.16	223.221.178.206
May 6, 2024 04:56:48.944977045 CEST	50123	21	192.168.2.16	71.31.151.54
May 6, 2024 04:56:48.945048094 CEST	50121	2121	192.168.2.16	27.207.39.138
May 6, 2024 04:56:48.950454950 CEST	21	50321	34.128.145.40	192.168.2.16
May 6, 2024 04:56:48.950505972 CEST	50321	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:48.950561047 CEST	50321	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:48.950754881 CEST	50323	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:48.951667070 CEST	2121	50322	34.128.145.40	192.168.2.16
May 6, 2024 04:56:48.951709032 CEST	50322	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:48.951780081 CEST	50322	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:48.951982975 CEST	50324	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:48.960959911 CEST	50224	2121	192.168.2.16	111.26.192.63
May 6, 2024 04:56:48.961229086 CEST	50223	21	192.168.2.16	111.26.192.63
May 6, 2024 04:56:48.976962090 CEST	50124	2121	192.168.2.16	71.31.151.54
May 6, 2024 04:56:48.992959023 CEST	50170	2121	192.168.2.16	154.148.45.69
May 6, 2024 04:56:48.992969036 CEST	50177	21	192.168.2.16	104.93.124.254
May 6, 2024 04:56:48.992980957 CEST	50182	21	192.168.2.16	78.23.133.140
May 6, 2024 04:56:48.992980957 CEST	50174	2121	192.168.2.16	70.80.238.19
May 6, 2024 04:56:48.992983103 CEST	50178	2121	192.168.2.16	79.144.99.44
May 6, 2024 04:56:48.992985010 CEST	50175	21	192.168.2.16	79.144.99.44
May 6, 2024 04:56:48.992985010 CEST	50180	21	192.168.2.16	47.122.51.65
May 6, 2024 04:56:48.993002892 CEST	50183	2121	192.168.2.16	104.174.143.71
May 6, 2024 04:56:48.993007898 CEST	50185	2121	192.168.2.16	80.119.223.253
May 6, 2024 04:56:48.993007898 CEST	50176	2121	192.168.2.16	104.93.124.254
May 6, 2024 04:56:48.993040085 CEST	50179	21	192.168.2.16	93.144.107.191
May 6, 2024 04:56:48.993042946 CEST	50181	2121	192.168.2.16	47.122.51.65
May 6, 2024 04:56:48.993042946 CEST	50195	2121	192.168.2.16	73.133.2.57
May 6, 2024 04:56:48.993045092 CEST	50191	21	192.168.2.16	73.133.2.57
May 6, 2024 04:56:48.993045092 CEST	50187	21	192.168.2.16	112.103.252.249
May 6, 2024 04:56:48.993045092 CEST	50196	2121	192.168.2.16	78.23.133.140
May 6, 2024 04:56:48.993097067 CEST	50186	2121	192.168.2.16	112.103.252.249
May 6, 2024 04:56:48.993098021 CEST	50189	21	192.168.2.16	104.174.143.71
May 6, 2024 04:56:48.993098021 CEST	50193	2121	192.168.2.16	47.244.119.251
May 6, 2024 04:56:48.993098021 CEST	50188	21	192.168.2.16	112.238.43.125
May 6, 2024 04:56:48.995814085 CEST	50169	21	192.168.2.16	154.148.45.69
May 6, 2024 04:56:48.995834112 CEST	50194	2121	192.168.2.16	93.144.107.191
May 6, 2024 04:56:48.995834112 CEST	50184	21	192.168.2.16	80.119.223.253
May 6, 2024 04:56:48.995834112 CEST	50190	2121	192.168.2.16	112.238.43.125
May 6, 2024 04:56:48.995835066 CEST	50192	21	192.168.2.16	47.244.119.251
May 6, 2024 04:56:49.008970022 CEST	50155	21	192.168.2.16	85.193.93.60
May 6, 2024 04:56:49.008986950 CEST	50200	2121	192.168.2.16	71.235.56.180
May 6, 2024 04:56:49.008991003 CEST	50209	2121	192.168.2.16	104.222.45.222
May 6, 2024 04:56:49.008991957 CEST	50210	21	192.168.2.16	104.222.45.222
May 6, 2024 04:56:49.008995056 CEST	50201	2121	192.168.2.16	182.233.214.56
May 6, 2024 04:56:49.008995056 CEST	50202	21	192.168.2.16	182.233.214.56
May 6, 2024 04:56:49.008995056 CEST	50211	2121	192.168.2.16	201.102.186.151
May 6, 2024 04:56:49.008996010 CEST	50220	2121	192.168.2.16	110.138.153.93
May 6, 2024 04:56:49.009022951 CEST	50212	21	192.168.2.16	110.138.153.93
May 6, 2024 04:56:49.009022951 CEST	50217	21	192.168.2.16	92.104.140.43
May 6, 2024 04:56:49.009023905 CEST	50214	21	192.168.2.16	120.196.4.149
May 6, 2024 04:56:49.009023905 CEST	50221	21	192.168.2.16	201.102.186.151
May 6, 2024 04:56:49.009023905 CEST	50218	21	192.168.2.16	71.58.210.134
May 6, 2024 04:56:49.009026051 CEST	50213	2121	192.168.2.16	92.104.140.43
May 6, 2024 04:56:49.009026051 CEST	50216	2121	192.168.2.16	217.217.194.14
May 6, 2024 04:56:49.009026051 CEST	50219	2121	192.168.2.16	120.196.4.149
May 6, 2024 04:56:49.009777069 CEST	50199	21	192.168.2.16	71.235.56.180
May 6, 2024 04:56:49.012454987 CEST	50215	21	192.168.2.16	217.217.194.14
May 6, 2024 04:56:49.018466949 CEST	21	50298	45.87.1.166	192.168.2.16
May 6, 2024 04:56:49.024966002 CEST	50222	2121	192.168.2.16	71.58.210.134
May 6, 2024 04:56:49.024966002 CEST	50225	21	192.168.2.16	78.115.218.214
May 6, 2024 04:56:49.024987936 CEST	50227	2121	192.168.2.16	78.115.218.214
May 6, 2024 04:56:49.024987936 CEST	50232	21	192.168.2.16	183.233.93.130
May 6, 2024 04:56:49.024991035 CEST	50230	21	192.168.2.16	72.208.6.163
May 6, 2024 04:56:49.024991035 CEST	50231	2121	192.168.2.16	72.208.6.163
May 6, 2024 04:56:49.024991989 CEST	50229	21	192.168.2.16	61.161.28.125
May 6, 2024 04:56:49.025007010 CEST	50240	2121	192.168.2.16	108.34.21.249
May 6, 2024 04:56:49.025007010 CEST	50228	2121	192.168.2.16	188.72.123.137
May 6, 2024 04:56:49.025007963 CEST	50234	2121	192.168.2.16	190.30.122.126
May 6, 2024 04:56:49.025007010 CEST	50242	2121	192.168.2.16	183.233.93.130
May 6, 2024 04:56:49.025007963 CEST	50226	21	192.168.2.16	188.72.123.137
May 6, 2024 04:56:49.025007010 CEST	50243	2121	192.168.2.16	61.161.28.125
May 6, 2024 04:56:49.025007963 CEST	50237	21	192.168.2.16	14.160.134.158
May 6, 2024 04:56:49.025007963 CEST	50236	21	192.168.2.16	27.58.41.241
May 6, 2024 04:56:49.030958891 CEST	50235	2121	192.168.2.16	27.58.41.241
May 6, 2024 04:56:49.030972004 CEST	50238	2121	192.168.2.16	14.160.134.158
May 6, 2024 04:56:49.030977011 CEST	50241	21	192.168.2.16	27.213.157.225
May 6, 2024 04:56:49.030976057 CEST	50233	21	192.168.2.16	190.30.122.126
May 6, 2024 04:56:49.030977964 CEST	50239	21	192.168.2.16	108.34.21.249
May 6, 2024 04:56:49.040960073 CEST	50127	21	192.168.2.16	221.3.49.159
May 6, 2024 04:56:49.040960073 CEST	50244	2121	192.168.2.16	27.213.157.225
May 6, 2024 04:56:49.040972948 CEST	50246	2121	192.168.2.16	46.0.171.21
May 6, 2024 04:56:49.040972948 CEST	50247	21	192.168.2.16	187.138.31.196
May 6, 2024 04:56:49.040973902 CEST	50248	2121	192.168.2.16	187.138.31.196
May 6, 2024 04:56:49.040973902 CEST	50245	21	192.168.2.16	46.0.171.21
May 6, 2024 04:56:49.040976048 CEST	50263	21	192.168.2.16	20.45.74.140
May 6, 2024 04:56:49.040987015 CEST	50270	2121	192.168.2.16	190.11.40.87
May 6, 2024 04:56:49.040997028 CEST	50267	21	192.168.2.16	153.99.157.36
May 6, 2024 04:56:49.041001081 CEST	50271	21	192.168.2.16	36.85.153.27
May 6, 2024 04:56:49.041001081 CEST	50156	2121	192.168.2.16	85.193.93.60
May 6, 2024 04:56:49.041001081 CEST	50253	21	192.168.2.16	222.163.7.242
May 6, 2024 04:56:49.041001081 CEST	50254	2121	192.168.2.16	222.163.7.242
May 6, 2024 04:56:49.041002989 CEST	50265	2121	192.168.2.16	153.99.157.36
May 6, 2024 04:56:49.041001081 CEST	50260	2121	192.168.2.16	71.186.189.60
May 6, 2024 04:56:49.041002989 CEST	50259	21	192.168.2.16	71.186.189.60
May 6, 2024 04:56:49.041220903 CEST	21	50277	94.8.106.34	192.168.2.16
May 6, 2024 04:56:49.043940067 CEST	21	50296	109.205.180.149	192.168.2.16
May 6, 2024 04:56:49.044395924 CEST	2121	50278	94.8.106.34	192.168.2.16
May 6, 2024 04:56:49.047477007 CEST	2121	50257	177.34.196.1	192.168.2.16
May 6, 2024 04:56:49.049639940 CEST	21	50255	177.34.196.1	192.168.2.16
May 6, 2024 04:56:49.050959110 CEST	50264	2121	192.168.2.16	20.45.74.140
May 6, 2024 04:56:49.050966978 CEST	50268	2121	192.168.2.16	18.165.91.73
May 6, 2024 04:56:49.050970078 CEST	50269	21	192.168.2.16	190.11.40.87
May 6, 2024 04:56:49.050970078 CEST	50273	2121	192.168.2.16	18.172.251.146
May 6, 2024 04:56:49.050972939 CEST	50266	21	192.168.2.16	18.165.91.73
May 6, 2024 04:56:49.051589966 CEST	50285	21	192.168.2.16	27.207.21.16
May 6, 2024 04:56:49.056960106 CEST	50290	2121	192.168.2.16	104.34.24.209
May 6, 2024 04:56:49.056972980 CEST	50272	2121	192.168.2.16	36.85.153.27
May 6, 2024 04:56:49.056976080 CEST	50294	2121	192.168.2.16	185.107.27.184
May 6, 2024 04:56:49.056977034 CEST	50276	2121	192.168.2.16	113.232.167.50
May 6, 2024 04:56:49.056977034 CEST	50274	21	192.168.2.16	18.172.251.146
May 6, 2024 04:56:49.056988001 CEST	50279	21	192.168.2.16	194.42.89.141
May 6, 2024 04:56:49.056991100 CEST	50275	21	192.168.2.16	113.232.167.50
May 6, 2024 04:56:49.056992054 CEST	50282	2121	192.168.2.16	117.89.16.57
May 6, 2024 04:56:49.056993008 CEST	50280	2121	192.168.2.16	194.42.89.141
May 6, 2024 04:56:49.057008028 CEST	50286	2121	192.168.2.16	27.207.21.16
May 6, 2024 04:56:49.057008982 CEST	50291	21	192.168.2.16	76.104.43.21
May 6, 2024 04:56:49.057008982 CEST	50292	21	192.168.2.16	185.107.27.184
May 6, 2024 04:56:49.057010889 CEST	50287	21	192.168.2.16	119.155.11.243
May 6, 2024 04:56:49.057012081 CEST	50281	21	192.168.2.16	117.89.16.57
May 6, 2024 04:56:49.057012081 CEST	50288	2121	192.168.2.16	119.155.11.243
May 6, 2024 04:56:49.057122946 CEST	50289	21	192.168.2.16	104.34.24.209
May 6, 2024 04:56:49.057126999 CEST	50293	2121	192.168.2.16	76.104.43.21
May 6, 2024 04:56:49.062010050 CEST	21	50321	34.128.145.40	192.168.2.16
May 6, 2024 04:56:49.062088013 CEST	21	50323	34.128.145.40	192.168.2.16
May 6, 2024 04:56:49.062150002 CEST	50323	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:49.062556982 CEST	2121	50322	34.128.145.40	192.168.2.16
May 6, 2024 04:56:49.062764883 CEST	2121	50324	34.128.145.40	192.168.2.16
May 6, 2024 04:56:49.062818050 CEST	50324	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:49.072963953 CEST	50306	2121	192.168.2.16	113.26.215.31
May 6, 2024 04:56:49.072982073 CEST	50147	21	192.168.2.16	112.163.192.212
May 6, 2024 04:56:49.072983980 CEST	50308	2121	192.168.2.16	124.64.6.45
May 6, 2024 04:56:49.072983980 CEST	50309	21	192.168.2.16	93.41.237.60
May 6, 2024 04:56:49.072984934 CEST	50301	21	192.168.2.16	195.240.238.212
May 6, 2024 04:56:49.073138952 CEST	50302	2121	192.168.2.16	195.240.238.212
May 6, 2024 04:56:49.073138952 CEST	50307	21	192.168.2.16	124.64.6.45
May 6, 2024 04:56:49.081952095 CEST	50305	21	192.168.2.16	113.26.215.31
May 6, 2024 04:56:49.085136890 CEST	50310	2121	192.168.2.16	93.41.237.60
May 6, 2024 04:56:49.097103119 CEST	2121	50312	91.203.165.183	192.168.2.16
May 6, 2024 04:56:49.098644018 CEST	21	50311	91.203.165.183	192.168.2.16
May 6, 2024 04:56:49.104979038 CEST	50148	2121	192.168.2.16	112.163.192.212
May 6, 2024 04:56:49.120347023 CEST	21	50208	221.160.246.44	192.168.2.16
May 6, 2024 04:56:49.122941971 CEST	2121	50304	193.124.183.222	192.168.2.16
May 6, 2024 04:56:49.124330997 CEST	2121	50207	221.160.246.44	192.168.2.16
May 6, 2024 04:56:49.125107050 CEST	21	50262	105.130.167.223	192.168.2.16
May 6, 2024 04:56:49.125145912 CEST	2121	50261	105.130.167.223	192.168.2.16
May 6, 2024 04:56:49.136742115 CEST	2121	50284	126.78.66.219	192.168.2.16
May 6, 2024 04:56:49.172744036 CEST	21	50323	34.128.145.40	192.168.2.16
May 6, 2024 04:56:49.172796011 CEST	50323	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:49.172861099 CEST	50323	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:49.173053980 CEST	50325	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:49.174861908 CEST	2121	50324	34.128.145.40	192.168.2.16
May 6, 2024 04:56:49.174909115 CEST	50324	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:49.174985886 CEST	50324	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:49.175230026 CEST	50326	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:49.186801910 CEST	2121	50204	210.5.190.214	192.168.2.16
May 6, 2024 04:56:49.194407940 CEST	21	50297	103.109.6.215	192.168.2.16
May 6, 2024 04:56:49.194545984 CEST	50297	21	192.168.2.16	103.109.6.215
May 6, 2024 04:56:49.197901011 CEST	21	50203	210.5.190.214	192.168.2.16
May 6, 2024 04:56:49.197913885 CEST	21	50283	126.78.66.219	192.168.2.16
May 6, 2024 04:56:49.200004101 CEST	50129	21	192.168.2.16	196.196.68.7
May 6, 2024 04:56:49.200428963 CEST	50327	21	192.168.2.16	68.189.69.171
May 6, 2024 04:56:49.215966940 CEST	50128	2121	192.168.2.16	221.3.49.159
May 6, 2024 04:56:49.220904112 CEST	21	50256	113.78.184.237	192.168.2.16
May 6, 2024 04:56:49.230971098 CEST	50131	21	192.168.2.16	113.226.113.123
May 6, 2024 04:56:49.230981112 CEST	50133	21	192.168.2.16	186.202.7.41
May 6, 2024 04:56:49.231004953 CEST	50149	21	192.168.2.16	59.103.222.239
May 6, 2024 04:56:49.231010914 CEST	50132	2121	192.168.2.16	113.226.113.123
May 6, 2024 04:56:49.246956110 CEST	50135	2121	192.168.2.16	186.202.7.41
May 6, 2024 04:56:49.246974945 CEST	50134	21	192.168.2.16	40.134.86.153
May 6, 2024 04:56:49.246984005 CEST	50152	2121	192.168.2.16	59.103.222.239
May 6, 2024 04:56:49.249300003 CEST	2121	50206	49.48.43.254	192.168.2.16
May 6, 2024 04:56:49.251251936 CEST	21	50205	49.48.43.254	192.168.2.16
May 6, 2024 04:56:49.252820969 CEST	2121	50258	113.78.184.237	192.168.2.16
May 6, 2024 04:56:49.270212889 CEST	21	50155	85.193.93.60	192.168.2.16
May 6, 2024 04:56:49.278959990 CEST	50130	2121	192.168.2.16	196.196.68.7
May 6, 2024 04:56:49.278987885 CEST	50249	21	192.168.2.16	74.51.225.184
May 6, 2024 04:56:49.279061079 CEST	50250	2121	192.168.2.16	74.51.225.184
May 6, 2024 04:56:49.284135103 CEST	21	50325	34.128.145.40	192.168.2.16
May 6, 2024 04:56:49.284200907 CEST	50325	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:49.286803007 CEST	2121	50326	34.128.145.40	192.168.2.16
May 6, 2024 04:56:49.286861897 CEST	50326	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:49.287354946 CEST	2121	50324	34.128.145.40	192.168.2.16
May 6, 2024 04:56:49.304802895 CEST	21	50197	150.255.30.207	192.168.2.16
May 6, 2024 04:56:49.305754900 CEST	2121	50156	85.193.93.60	192.168.2.16
May 6, 2024 04:56:49.320369959 CEST	2121	50198	150.255.30.207	192.168.2.16
May 6, 2024 04:56:49.321216106 CEST	21	50313	223.221.178.206	192.168.2.16
May 6, 2024 04:56:49.326968908 CEST	50136	2121	192.168.2.16	40.134.86.153
May 6, 2024 04:56:49.326997042 CEST	50137	21	192.168.2.16	122.194.22.137
May 6, 2024 04:56:49.342978954 CEST	50138	2121	192.168.2.16	122.194.22.137
May 6, 2024 04:56:49.345134020 CEST	50139	21	192.168.2.16	74.77.49.187
May 6, 2024 04:56:49.377362967 CEST	21	50147	112.163.192.212	192.168.2.16
May 6, 2024 04:56:49.391849995 CEST	2121	50250	74.51.225.184	192.168.2.16
May 6, 2024 04:56:49.391863108 CEST	21	50249	74.51.225.184	192.168.2.16
May 6, 2024 04:56:49.395615101 CEST	21	50325	34.128.145.40	192.168.2.16
May 6, 2024 04:56:49.395667076 CEST	50325	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:49.395756006 CEST	50325	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:49.395988941 CEST	50328	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:49.397042036 CEST	2121	50224	111.26.192.63	192.168.2.16
May 6, 2024 04:56:49.397592068 CEST	2121	50326	34.128.145.40	192.168.2.16
May 6, 2024 04:56:49.397639036 CEST	50326	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:49.397732019 CEST	50326	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:49.397973061 CEST	50329	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:49.399533987 CEST	21	50223	111.26.192.63	192.168.2.16
May 6, 2024 04:56:49.406964064 CEST	50318	2121	192.168.2.16	223.221.178.206
May 6, 2024 04:56:49.412961960 CEST	2121	50148	112.163.192.212	192.168.2.16
May 6, 2024 04:56:49.440037012 CEST	2121	50272	36.85.153.27	192.168.2.16
May 6, 2024 04:56:49.448113918 CEST	21	50129	196.196.68.7	192.168.2.16
May 6, 2024 04:56:49.450027943 CEST	2121	50170	154.148.45.69	192.168.2.16
May 6, 2024 04:56:49.450040102 CEST	21	50169	154.148.45.69	192.168.2.16
May 6, 2024 04:56:49.471200943 CEST	50330	2121	192.168.2.16	68.189.69.171
May 6, 2024 04:56:49.486965895 CEST	50140	2121	192.168.2.16	74.77.49.187
May 6, 2024 04:56:49.502957106 CEST	50323	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:49.506858110 CEST	21	50328	34.128.145.40	192.168.2.16
May 6, 2024 04:56:49.506915092 CEST	50328	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:49.508703947 CEST	2121	50326	34.128.145.40	192.168.2.16
May 6, 2024 04:56:49.508716106 CEST	21	50325	34.128.145.40	192.168.2.16
May 6, 2024 04:56:49.512922049 CEST	2121	50329	34.128.145.40	192.168.2.16
May 6, 2024 04:56:49.512975931 CEST	50329	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:49.531161070 CEST	2121	50130	196.196.68.7	192.168.2.16
May 6, 2024 04:56:49.534959078 CEST	50141	21	192.168.2.16	113.242.203.213
May 6, 2024 04:56:49.550978899 CEST	50278	2121	192.168.2.16	94.8.106.34
May 6, 2024 04:56:49.551390886 CEST	50331	21	192.168.2.16	110.136.96.12
May 6, 2024 04:56:49.551392078 CEST	50277	21	192.168.2.16	94.8.106.34
May 6, 2024 04:56:49.551393032 CEST	50257	2121	192.168.2.16	177.34.196.1
May 6, 2024 04:56:49.551393032 CEST	50255	21	192.168.2.16	177.34.196.1
May 6, 2024 04:56:49.572566032 CEST	21	50297	103.109.6.215	192.168.2.16
May 6, 2024 04:56:49.572702885 CEST	50297	21	192.168.2.16	103.109.6.215
May 6, 2024 04:56:49.572884083 CEST	50332	21	192.168.2.16	103.109.6.215
May 6, 2024 04:56:49.581984997 CEST	50142	2121	192.168.2.16	113.242.203.213
May 6, 2024 04:56:49.585161924 CEST	21	50149	59.103.222.239	192.168.2.16
May 6, 2024 04:56:49.596981049 CEST	50312	2121	192.168.2.16	91.203.165.183
May 6, 2024 04:56:49.604012012 CEST	2121	50152	59.103.222.239	192.168.2.16
May 6, 2024 04:56:49.612524033 CEST	21	50323	34.128.145.40	192.168.2.16
May 6, 2024 04:56:49.612962008 CEST	50143	21	192.168.2.16	98.109.18.153
May 6, 2024 04:56:49.612976074 CEST	50144	2121	192.168.2.16	98.109.18.153
May 6, 2024 04:56:49.612991095 CEST	50311	21	192.168.2.16	91.203.165.183
May 6, 2024 04:56:49.616641998 CEST	21	50328	34.128.145.40	192.168.2.16
May 6, 2024 04:56:49.616765976 CEST	50328	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:49.616784096 CEST	50328	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:49.616964102 CEST	50333	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:49.623430014 CEST	2121	50329	34.128.145.40	192.168.2.16
May 6, 2024 04:56:49.623503923 CEST	50329	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:49.623596907 CEST	50329	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:49.623832941 CEST	50334	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:49.628977060 CEST	50145	2121	192.168.2.16	125.78.110.175
May 6, 2024 04:56:49.628994942 CEST	50319	21	192.168.2.16	61.99.64.185
May 6, 2024 04:56:49.628994942 CEST	50207	2121	192.168.2.16	221.160.246.44
May 6, 2024 04:56:49.628995895 CEST	50262	21	192.168.2.16	105.130.167.223
May 6, 2024 04:56:49.628999949 CEST	50146	21	192.168.2.16	125.78.110.175
May 6, 2024 04:56:49.629133940 CEST	50261	2121	192.168.2.16	105.130.167.223
May 6, 2024 04:56:49.629137039 CEST	50208	21	192.168.2.16	221.160.246.44
May 6, 2024 04:56:49.629138947 CEST	50304	2121	192.168.2.16	193.124.183.222
May 6, 2024 04:56:49.644989967 CEST	50284	2121	192.168.2.16	126.78.66.219
May 6, 2024 04:56:49.660960913 CEST	50150	21	192.168.2.16	116.40.189.189
May 6, 2024 04:56:49.660995960 CEST	50151	2121	192.168.2.16	116.40.189.189
May 6, 2024 04:56:49.661436081 CEST	50335	2121	192.168.2.16	110.136.96.12
May 6, 2024 04:56:49.676976919 CEST	50153	21	192.168.2.16	60.248.246.121
May 6, 2024 04:56:49.677146912 CEST	50320	2121	192.168.2.16	61.99.64.185
May 6, 2024 04:56:49.692997932 CEST	50204	2121	192.168.2.16	210.5.190.214
May 6, 2024 04:56:49.703128099 CEST	50154	2121	192.168.2.16	60.248.246.121
May 6, 2024 04:56:49.703135967 CEST	50283	21	192.168.2.16	126.78.66.219
May 6, 2024 04:56:49.708986998 CEST	50203	21	192.168.2.16	210.5.190.214
May 6, 2024 04:56:49.723984003 CEST	50256	21	192.168.2.16	113.78.184.237
May 6, 2024 04:56:49.726530075 CEST	21	50333	34.128.145.40	192.168.2.16
May 6, 2024 04:56:49.726593018 CEST	50333	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:49.727329016 CEST	21	50328	34.128.145.40	192.168.2.16
May 6, 2024 04:56:49.733091116 CEST	2121	50329	34.128.145.40	192.168.2.16
May 6, 2024 04:56:49.733484030 CEST	2121	50334	34.128.145.40	192.168.2.16
May 6, 2024 04:56:49.733534098 CEST	50334	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:49.756001949 CEST	50205	21	192.168.2.16	49.48.43.254
May 6, 2024 04:56:49.756139040 CEST	50258	2121	192.168.2.16	113.78.184.237
May 6, 2024 04:56:49.756170988 CEST	50206	2121	192.168.2.16	49.48.43.254
May 6, 2024 04:56:49.756509066 CEST	50336	21	192.168.2.16	193.175.238.88
May 6, 2024 04:56:49.771976948 CEST	50155	21	192.168.2.16	85.193.93.60
May 6, 2024 04:56:49.777045965 CEST	2121	50257	177.34.196.1	192.168.2.16
May 6, 2024 04:56:49.783607006 CEST	21	50255	177.34.196.1	192.168.2.16
May 6, 2024 04:56:49.787972927 CEST	50157	21	192.168.2.16	187.48.185.76
May 6, 2024 04:56:49.789941072 CEST	2121	50318	223.221.178.206	192.168.2.16
May 6, 2024 04:56:49.791752100 CEST	21	50277	94.8.106.34	192.168.2.16
May 6, 2024 04:56:49.793673992 CEST	2121	50278	94.8.106.34	192.168.2.16
May 6, 2024 04:56:49.819962025 CEST	50197	21	192.168.2.16	150.255.30.207
May 6, 2024 04:56:49.819968939 CEST	50158	2121	192.168.2.16	187.48.185.76
May 6, 2024 04:56:49.819983959 CEST	50156	2121	192.168.2.16	85.193.93.60
May 6, 2024 04:56:49.835959911 CEST	50198	2121	192.168.2.16	150.255.30.207
May 6, 2024 04:56:49.835962057 CEST	50159	21	192.168.2.16	213.18.112.155
May 6, 2024 04:56:49.835983992 CEST	50313	21	192.168.2.16	223.221.178.206
May 6, 2024 04:56:49.836477041 CEST	21	50333	34.128.145.40	192.168.2.16
May 6, 2024 04:56:49.836530924 CEST	50333	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:49.836605072 CEST	50333	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:49.836800098 CEST	50337	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:49.843333006 CEST	2121	50334	34.128.145.40	192.168.2.16
May 6, 2024 04:56:49.843388081 CEST	50334	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:49.843467951 CEST	50334	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:49.843683004 CEST	50338	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:49.859024048 CEST	2121	50312	91.203.165.183	192.168.2.16
May 6, 2024 04:56:49.867974997 CEST	50160	2121	192.168.2.16	213.18.112.155
May 6, 2024 04:56:49.876832962 CEST	21	50311	91.203.165.183	192.168.2.16
May 6, 2024 04:56:49.883970976 CEST	50162	2121	192.168.2.16	179.66.129.72
May 6, 2024 04:56:49.883981943 CEST	50161	21	192.168.2.16	179.66.129.72
May 6, 2024 04:56:49.883981943 CEST	50163	21	192.168.2.16	163.255.185.34
May 6, 2024 04:56:49.883985043 CEST	50147	21	192.168.2.16	112.163.192.212
May 6, 2024 04:56:49.899960041 CEST	50249	21	192.168.2.16	74.51.225.184
May 6, 2024 04:56:49.899971008 CEST	50224	2121	192.168.2.16	111.26.192.63
May 6, 2024 04:56:49.899983883 CEST	50250	2121	192.168.2.16	74.51.225.184
May 6, 2024 04:56:49.899985075 CEST	50223	21	192.168.2.16	111.26.192.63
May 6, 2024 04:56:49.901741982 CEST	2121	50304	193.124.183.222	192.168.2.16
May 6, 2024 04:56:49.915975094 CEST	50164	2121	192.168.2.16	163.255.185.34
May 6, 2024 04:56:49.919439077 CEST	50148	2121	192.168.2.16	112.163.192.212
May 6, 2024 04:56:49.919442892 CEST	50165	21	192.168.2.16	98.212.21.110
May 6, 2024 04:56:49.926042080 CEST	21	50262	105.130.167.223	192.168.2.16
May 6, 2024 04:56:49.926213980 CEST	2121	50261	105.130.167.223	192.168.2.16
May 6, 2024 04:56:49.932524920 CEST	2121	50284	126.78.66.219	192.168.2.16
May 6, 2024 04:56:49.933022976 CEST	21	50208	221.160.246.44	192.168.2.16
May 6, 2024 04:56:49.937086105 CEST	2121	50207	221.160.246.44	192.168.2.16
May 6, 2024 04:56:49.944937944 CEST	21	50332	103.109.6.215	192.168.2.16
May 6, 2024 04:56:49.945019007 CEST	50332	21	192.168.2.16	103.109.6.215
May 6, 2024 04:56:49.947207928 CEST	21	50337	34.128.145.40	192.168.2.16
May 6, 2024 04:56:49.947269917 CEST	50337	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:49.947346926 CEST	21	50333	34.128.145.40	192.168.2.16
May 6, 2024 04:56:49.947983980 CEST	50272	2121	192.168.2.16	36.85.153.27
May 6, 2024 04:56:49.948666096 CEST	21	50297	103.109.6.215	192.168.2.16
May 6, 2024 04:56:49.948837996 CEST	21	50297	103.109.6.215	192.168.2.16
May 6, 2024 04:56:49.948884010 CEST	50297	21	192.168.2.16	103.109.6.215
May 6, 2024 04:56:49.953033924 CEST	2121	50334	34.128.145.40	192.168.2.16
May 6, 2024 04:56:49.954050064 CEST	2121	50338	34.128.145.40	192.168.2.16
May 6, 2024 04:56:49.954109907 CEST	50338	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:49.963964939 CEST	50167	21	192.168.2.16	60.21.229.138
May 6, 2024 04:56:49.963970900 CEST	50169	21	192.168.2.16	154.148.45.69
May 6, 2024 04:56:49.963992119 CEST	50170	2121	192.168.2.16	154.148.45.69
May 6, 2024 04:56:49.964257002 CEST	50166	2121	192.168.2.16	98.212.21.110
May 6, 2024 04:56:50.011986017 CEST	50168	2121	192.168.2.16	60.21.229.138
May 6, 2024 04:56:50.012212038 CEST	2121	50250	74.51.225.184	192.168.2.16
May 6, 2024 04:56:50.012223005 CEST	21	50249	74.51.225.184	192.168.2.16
May 6, 2024 04:56:50.018125057 CEST	21	50283	126.78.66.219	192.168.2.16
May 6, 2024 04:56:50.029079914 CEST	2121	50204	210.5.190.214	192.168.2.16
May 6, 2024 04:56:50.031150103 CEST	21	50155	85.193.93.60	192.168.2.16
May 6, 2024 04:56:50.031521082 CEST	50339	2121	192.168.2.16	193.175.238.88
May 6, 2024 04:56:50.034454107 CEST	2121	50335	110.136.96.12	192.168.2.16
May 6, 2024 04:56:50.048469067 CEST	21	50203	210.5.190.214	192.168.2.16
May 6, 2024 04:56:50.056699038 CEST	21	50337	34.128.145.40	192.168.2.16
May 6, 2024 04:56:50.056781054 CEST	50337	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:50.056886911 CEST	50337	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:50.057157040 CEST	50340	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:50.062604904 CEST	21	50256	113.78.184.237	192.168.2.16
May 6, 2024 04:56:50.064503908 CEST	2121	50338	34.128.145.40	192.168.2.16
May 6, 2024 04:56:50.064553022 CEST	50338	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:50.064613104 CEST	50338	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:50.064766884 CEST	50341	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:50.087260008 CEST	2121	50156	85.193.93.60	192.168.2.16
May 6, 2024 04:56:50.087666988 CEST	50342	21	192.168.2.16	189.172.31.228
May 6, 2024 04:56:50.091983080 CEST	50149	21	192.168.2.16	59.103.222.239
May 6, 2024 04:56:50.107990026 CEST	50152	2121	192.168.2.16	59.103.222.239
May 6, 2024 04:56:50.110688925 CEST	2121	50258	113.78.184.237	192.168.2.16
May 6, 2024 04:56:50.126034975 CEST	2121	50206	49.48.43.254	192.168.2.16
May 6, 2024 04:56:50.126997948 CEST	21	50205	49.48.43.254	192.168.2.16
May 6, 2024 04:56:50.168620110 CEST	21	50337	34.128.145.40	192.168.2.16
May 6, 2024 04:56:50.169425964 CEST	21	50340	34.128.145.40	192.168.2.16
May 6, 2024 04:56:50.169502974 CEST	50340	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:50.176800013 CEST	2121	50338	34.128.145.40	192.168.2.16
May 6, 2024 04:56:50.176939011 CEST	2121	50341	34.128.145.40	192.168.2.16
May 6, 2024 04:56:50.177009106 CEST	50341	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:50.187613964 CEST	21	50147	112.163.192.212	192.168.2.16
May 6, 2024 04:56:50.204029083 CEST	50327	21	192.168.2.16	68.189.69.171
May 6, 2024 04:56:50.204432011 CEST	50343	2121	192.168.2.16	189.172.31.228
May 6, 2024 04:56:50.211699963 CEST	21	50313	223.221.178.206	192.168.2.16
May 6, 2024 04:56:50.212389946 CEST	21	50197	150.255.30.207	192.168.2.16
May 6, 2024 04:56:50.224751949 CEST	2121	50198	150.255.30.207	192.168.2.16
May 6, 2024 04:56:50.228646994 CEST	2121	50148	112.163.192.212	192.168.2.16
May 6, 2024 04:56:50.252223015 CEST	50344	21	192.168.2.16	183.141.107.50
May 6, 2024 04:56:50.260051966 CEST	21	50251	168.220.94.137	192.168.2.16
May 6, 2024 04:56:50.260066032 CEST	2121	50252	168.220.94.137	192.168.2.16
May 6, 2024 04:56:50.260140896 CEST	50251	21	192.168.2.16	168.220.94.137
May 6, 2024 04:56:50.260140896 CEST	50252	2121	192.168.2.16	168.220.94.137
May 6, 2024 04:56:50.281994104 CEST	21	50340	34.128.145.40	192.168.2.16
May 6, 2024 04:56:50.282052040 CEST	50340	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:50.282131910 CEST	50340	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:50.282325983 CEST	50345	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:50.283965111 CEST	50257	2121	192.168.2.16	177.34.196.1
May 6, 2024 04:56:50.284296036 CEST	50346	2121	192.168.2.16	183.141.107.50
May 6, 2024 04:56:50.291356087 CEST	2121	50341	34.128.145.40	192.168.2.16
May 6, 2024 04:56:50.291409969 CEST	50341	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:50.291482925 CEST	50341	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:50.291662931 CEST	50347	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:50.298965931 CEST	50278	2121	192.168.2.16	94.8.106.34
May 6, 2024 04:56:50.298980951 CEST	50255	21	192.168.2.16	177.34.196.1
May 6, 2024 04:56:50.298985004 CEST	50277	21	192.168.2.16	94.8.106.34
May 6, 2024 04:56:50.299717903 CEST	50318	2121	192.168.2.16	223.221.178.206
May 6, 2024 04:56:50.316034079 CEST	21	50332	103.109.6.215	192.168.2.16
May 6, 2024 04:56:50.316188097 CEST	50332	21	192.168.2.16	103.109.6.215
May 6, 2024 04:56:50.330044031 CEST	2121	50272	36.85.153.27	192.168.2.16
May 6, 2024 04:56:50.347018003 CEST	50171	21	192.168.2.16	189.153.186.34
May 6, 2024 04:56:50.348917007 CEST	2121	50224	111.26.192.63	192.168.2.16
May 6, 2024 04:56:50.351392031 CEST	21	50223	111.26.192.63	192.168.2.16
May 6, 2024 04:56:50.363002062 CEST	50312	2121	192.168.2.16	91.203.165.183
May 6, 2024 04:56:50.370188951 CEST	2121	50170	154.148.45.69	192.168.2.16
May 6, 2024 04:56:50.370233059 CEST	21	50169	154.148.45.69	192.168.2.16
May 6, 2024 04:56:50.379134893 CEST	50311	21	192.168.2.16	91.203.165.183
May 6, 2024 04:56:50.392972946 CEST	21	50345	34.128.145.40	192.168.2.16
May 6, 2024 04:56:50.392985106 CEST	21	50340	34.128.145.40	192.168.2.16
May 6, 2024 04:56:50.393054962 CEST	50345	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:50.402331114 CEST	2121	50347	34.128.145.40	192.168.2.16
May 6, 2024 04:56:50.402395964 CEST	50347	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:50.410983086 CEST	50172	2121	192.168.2.16	189.153.186.34
May 6, 2024 04:56:50.410989046 CEST	50304	2121	192.168.2.16	193.124.183.222
May 6, 2024 04:56:50.426996946 CEST	50173	21	192.168.2.16	70.80.238.19
May 6, 2024 04:56:50.426997900 CEST	50262	21	192.168.2.16	105.130.167.223
May 6, 2024 04:56:50.427005053 CEST	50261	2121	192.168.2.16	105.130.167.223
May 6, 2024 04:56:50.441967964 CEST	50284	2121	192.168.2.16	126.78.66.219
May 6, 2024 04:56:50.441968918 CEST	50208	21	192.168.2.16	221.160.246.44
May 6, 2024 04:56:50.441986084 CEST	50207	2121	192.168.2.16	221.160.246.44
May 6, 2024 04:56:50.446772099 CEST	21	50149	59.103.222.239	192.168.2.16
May 6, 2024 04:56:50.458224058 CEST	50348	21	192.168.2.16	45.120.174.5
May 6, 2024 04:56:50.465023994 CEST	2121	50152	59.103.222.239	192.168.2.16
May 6, 2024 04:56:50.473980904 CEST	50330	2121	192.168.2.16	68.189.69.171
May 6, 2024 04:56:50.490252972 CEST	50349	2121	192.168.2.16	45.120.174.5
May 6, 2024 04:56:50.503686905 CEST	21	50345	34.128.145.40	192.168.2.16
May 6, 2024 04:56:50.503742933 CEST	50345	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:50.503803015 CEST	50345	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:50.503957033 CEST	50350	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:50.509537935 CEST	2121	50257	177.34.196.1	192.168.2.16
May 6, 2024 04:56:50.513181925 CEST	2121	50347	34.128.145.40	192.168.2.16
May 6, 2024 04:56:50.513233900 CEST	50347	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:50.513312101 CEST	50347	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:50.513511896 CEST	50351	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:50.521962881 CEST	50249	21	192.168.2.16	74.51.225.184
May 6, 2024 04:56:50.521979094 CEST	50250	2121	192.168.2.16	74.51.225.184
May 6, 2024 04:56:50.521986961 CEST	50283	21	192.168.2.16	126.78.66.219
May 6, 2024 04:56:50.531725883 CEST	21	50255	177.34.196.1	192.168.2.16
May 6, 2024 04:56:50.537966967 CEST	50335	2121	192.168.2.16	110.136.96.12
May 6, 2024 04:56:50.537981987 CEST	50204	2121	192.168.2.16	210.5.190.214
May 6, 2024 04:56:50.539912939 CEST	21	50277	94.8.106.34	192.168.2.16
May 6, 2024 04:56:50.542865038 CEST	2121	50278	94.8.106.34	192.168.2.16
May 6, 2024 04:56:50.553987980 CEST	50331	21	192.168.2.16	110.136.96.12
May 6, 2024 04:56:50.554157972 CEST	50203	21	192.168.2.16	210.5.190.214
May 6, 2024 04:56:50.569967031 CEST	50256	21	192.168.2.16	113.78.184.237
May 6, 2024 04:56:50.615642071 CEST	21	50350	34.128.145.40	192.168.2.16
May 6, 2024 04:56:50.615719080 CEST	50350	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:50.615735054 CEST	21	50345	34.128.145.40	192.168.2.16
May 6, 2024 04:56:50.617983103 CEST	50258	2121	192.168.2.16	113.78.184.237
May 6, 2024 04:56:50.623842955 CEST	2121	50347	34.128.145.40	192.168.2.16
May 6, 2024 04:56:50.624851942 CEST	2121	50312	91.203.165.183	192.168.2.16
May 6, 2024 04:56:50.624926090 CEST	2121	50351	34.128.145.40	192.168.2.16
May 6, 2024 04:56:50.624983072 CEST	50351	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:50.633959055 CEST	50205	21	192.168.2.16	49.48.43.254
May 6, 2024 04:56:50.633989096 CEST	50341	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:50.633989096 CEST	50206	2121	192.168.2.16	49.48.43.254
May 6, 2024 04:56:50.634291887 CEST	21	50249	74.51.225.184	192.168.2.16
May 6, 2024 04:56:50.634305000 CEST	2121	50250	74.51.225.184	192.168.2.16
May 6, 2024 04:56:50.634677887 CEST	50352	21	192.168.2.16	98.122.64.212
May 6, 2024 04:56:50.642671108 CEST	21	50311	91.203.165.183	192.168.2.16
May 6, 2024 04:56:50.650418997 CEST	50353	2121	192.168.2.16	98.122.64.212
May 6, 2024 04:56:50.682610989 CEST	2121	50304	193.124.183.222	192.168.2.16
May 6, 2024 04:56:50.684171915 CEST	2121	50318	223.221.178.206	192.168.2.16
May 6, 2024 04:56:50.686973095 CEST	21	50332	103.109.6.215	192.168.2.16
May 6, 2024 04:56:50.687119007 CEST	50332	21	192.168.2.16	103.109.6.215
May 6, 2024 04:56:50.714169979 CEST	50313	21	192.168.2.16	223.221.178.206
May 6, 2024 04:56:50.714174032 CEST	50197	21	192.168.2.16	150.255.30.207
May 6, 2024 04:56:50.714366913 CEST	50354	21	192.168.2.16	220.91.126.18
May 6, 2024 04:56:50.726113081 CEST	21	50262	105.130.167.223	192.168.2.16
May 6, 2024 04:56:50.726180077 CEST	2121	50261	105.130.167.223	192.168.2.16
May 6, 2024 04:56:50.726628065 CEST	21	50350	34.128.145.40	192.168.2.16
May 6, 2024 04:56:50.726687908 CEST	50350	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:50.726736069 CEST	50350	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:50.726867914 CEST	50355	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:50.728853941 CEST	2121	50284	126.78.66.219	192.168.2.16
May 6, 2024 04:56:50.729988098 CEST	50198	2121	192.168.2.16	150.255.30.207
May 6, 2024 04:56:50.735949039 CEST	2121	50351	34.128.145.40	192.168.2.16
May 6, 2024 04:56:50.735995054 CEST	50351	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:50.736079931 CEST	50351	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:50.736294985 CEST	50356	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:50.744422913 CEST	2121	50341	34.128.145.40	192.168.2.16
May 6, 2024 04:56:50.744721889 CEST	21	50208	221.160.246.44	192.168.2.16
May 6, 2024 04:56:50.748714924 CEST	2121	50207	221.160.246.44	192.168.2.16
May 6, 2024 04:56:50.760965109 CEST	50336	21	192.168.2.16	193.175.238.88
May 6, 2024 04:56:50.834938049 CEST	21	50283	126.78.66.219	192.168.2.16
May 6, 2024 04:56:50.837855101 CEST	21	50355	34.128.145.40	192.168.2.16
May 6, 2024 04:56:50.837919950 CEST	50355	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:50.840996981 CEST	50272	2121	192.168.2.16	36.85.153.27
May 6, 2024 04:56:50.847204924 CEST	2121	50356	34.128.145.40	192.168.2.16
May 6, 2024 04:56:50.847217083 CEST	2121	50351	34.128.145.40	192.168.2.16
May 6, 2024 04:56:50.847269058 CEST	50356	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:50.856986046 CEST	50223	21	192.168.2.16	111.26.192.63
May 6, 2024 04:56:50.856986046 CEST	50224	2121	192.168.2.16	111.26.192.63
May 6, 2024 04:56:50.871988058 CEST	50170	2121	192.168.2.16	154.148.45.69
May 6, 2024 04:56:50.872041941 CEST	50169	21	192.168.2.16	154.148.45.69
May 6, 2024 04:56:50.872313023 CEST	50357	2121	192.168.2.16	220.91.126.18
May 6, 2024 04:56:50.872334957 CEST	50358	21	192.168.2.16	130.61.85.191
May 6, 2024 04:56:50.874105930 CEST	2121	50204	210.5.190.214	192.168.2.16
May 6, 2024 04:56:50.893584967 CEST	21	50203	210.5.190.214	192.168.2.16
May 6, 2024 04:56:50.908420086 CEST	21	50256	113.78.184.237	192.168.2.16
May 6, 2024 04:56:50.911145926 CEST	2121	50335	110.136.96.12	192.168.2.16
May 6, 2024 04:56:50.936422110 CEST	50359	2121	192.168.2.16	130.61.85.191
May 6, 2024 04:56:50.936464071 CEST	50360	2121	192.168.2.16	41.97.219.244
May 6, 2024 04:56:50.936520100 CEST	50361	21	192.168.2.16	41.97.219.244
May 6, 2024 04:56:50.948761940 CEST	21	50355	34.128.145.40	192.168.2.16
May 6, 2024 04:56:50.948833942 CEST	50355	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:50.948867083 CEST	50355	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:50.948996067 CEST	50362	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:50.957046032 CEST	2121	50356	34.128.145.40	192.168.2.16
May 6, 2024 04:56:50.957103014 CEST	50356	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:50.957169056 CEST	50356	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:50.957336903 CEST	50363	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:50.968159914 CEST	50364	21	192.168.2.16	188.214.156.147
May 6, 2024 04:56:50.973136902 CEST	2121	50258	113.78.184.237	192.168.2.16
May 6, 2024 04:56:50.999969959 CEST	50174	2121	192.168.2.16	70.80.238.19
May 6, 2024 04:56:50.999969959 CEST	50184	21	192.168.2.16	80.119.223.253
May 6, 2024 04:56:50.999972105 CEST	50175	21	192.168.2.16	79.144.99.44
May 6, 2024 04:56:50.999994040 CEST	50182	21	192.168.2.16	78.23.133.140
May 6, 2024 04:56:50.999994040 CEST	50176	2121	192.168.2.16	104.93.124.254
May 6, 2024 04:56:50.999994040 CEST	50190	2121	192.168.2.16	112.238.43.125
May 6, 2024 04:56:50.999994040 CEST	50191	21	192.168.2.16	73.133.2.57
May 6, 2024 04:56:50.999999046 CEST	50177	21	192.168.2.16	104.93.124.254
May 6, 2024 04:56:51.000000000 CEST	50178	2121	192.168.2.16	79.144.99.44
May 6, 2024 04:56:50.999999046 CEST	50185	2121	192.168.2.16	80.119.223.253
May 6, 2024 04:56:51.000000000 CEST	50193	2121	192.168.2.16	47.244.119.251
May 6, 2024 04:56:51.000000000 CEST	50192	21	192.168.2.16	47.244.119.251
May 6, 2024 04:56:51.000000954 CEST	50194	2121	192.168.2.16	93.144.107.191
May 6, 2024 04:56:51.000575066 CEST	2121	50206	49.48.43.254	192.168.2.16
May 6, 2024 04:56:51.000616074 CEST	50186	2121	192.168.2.16	112.103.252.249
May 6, 2024 04:56:51.000616074 CEST	50189	21	192.168.2.16	104.174.143.71
May 6, 2024 04:56:51.000617027 CEST	50188	21	192.168.2.16	112.238.43.125
May 6, 2024 04:56:51.000617981 CEST	50181	2121	192.168.2.16	47.122.51.65
May 6, 2024 04:56:51.000617981 CEST	50187	21	192.168.2.16	112.103.252.249
May 6, 2024 04:56:51.000617981 CEST	50195	2121	192.168.2.16	73.133.2.57
May 6, 2024 04:56:51.000617981 CEST	50196	2121	192.168.2.16	78.23.133.140
May 6, 2024 04:56:51.000618935 CEST	50179	21	192.168.2.16	93.144.107.191
May 6, 2024 04:56:51.000623941 CEST	50180	21	192.168.2.16	47.122.51.65
May 6, 2024 04:56:51.000623941 CEST	50183	2121	192.168.2.16	104.174.143.71
May 6, 2024 04:56:51.002439022 CEST	21	50205	49.48.43.254	192.168.2.16
May 6, 2024 04:56:51.015985012 CEST	50201	2121	192.168.2.16	182.233.214.56
May 6, 2024 04:56:51.015985966 CEST	50200	2121	192.168.2.16	71.235.56.180
May 6, 2024 04:56:51.016000032 CEST	50199	21	192.168.2.16	71.235.56.180
May 6, 2024 04:56:51.016000032 CEST	50211	2121	192.168.2.16	201.102.186.151
May 6, 2024 04:56:51.016000986 CEST	50209	2121	192.168.2.16	104.222.45.222
May 6, 2024 04:56:51.016011000 CEST	50202	21	192.168.2.16	182.233.214.56
May 6, 2024 04:56:51.016011000 CEST	50221	21	192.168.2.16	201.102.186.151
May 6, 2024 04:56:51.016014099 CEST	50219	2121	192.168.2.16	120.196.4.149
May 6, 2024 04:56:51.016014099 CEST	50215	21	192.168.2.16	217.217.194.14
May 6, 2024 04:56:51.016014099 CEST	50210	21	192.168.2.16	104.222.45.222
May 6, 2024 04:56:51.016016960 CEST	50216	2121	192.168.2.16	217.217.194.14
May 6, 2024 04:56:51.016016960 CEST	50212	21	192.168.2.16	110.138.153.93
May 6, 2024 04:56:51.016016960 CEST	50220	2121	192.168.2.16	110.138.153.93
May 6, 2024 04:56:51.016016960 CEST	50257	2121	192.168.2.16	177.34.196.1
May 6, 2024 04:56:51.019154072 CEST	50213	2121	192.168.2.16	92.104.140.43
May 6, 2024 04:56:51.019155025 CEST	50218	21	192.168.2.16	71.58.210.134
May 6, 2024 04:56:51.019155025 CEST	50214	21	192.168.2.16	120.196.4.149
May 6, 2024 04:56:51.019156933 CEST	50217	21	192.168.2.16	92.104.140.43
May 6, 2024 04:56:51.023637056 CEST	21	50354	220.91.126.18	192.168.2.16
May 6, 2024 04:56:51.031963110 CEST	50222	2121	192.168.2.16	71.58.210.134
May 6, 2024 04:56:51.031970024 CEST	50225	21	192.168.2.16	78.115.218.214
May 6, 2024 04:56:51.031970024 CEST	50230	21	192.168.2.16	72.208.6.163
May 6, 2024 04:56:51.031975031 CEST	50229	21	192.168.2.16	61.161.28.125
May 6, 2024 04:56:51.031976938 CEST	50231	2121	192.168.2.16	72.208.6.163
May 6, 2024 04:56:51.031987906 CEST	50235	2121	192.168.2.16	27.58.41.241
May 6, 2024 04:56:51.031991005 CEST	50232	21	192.168.2.16	183.233.93.130
May 6, 2024 04:56:51.031992912 CEST	50237	21	192.168.2.16	14.160.134.158
May 6, 2024 04:56:51.031996012 CEST	50233	21	192.168.2.16	190.30.122.126
May 6, 2024 04:56:51.031997919 CEST	50234	2121	192.168.2.16	190.30.122.126
May 6, 2024 04:56:51.032023907 CEST	50227	2121	192.168.2.16	78.115.218.214
May 6, 2024 04:56:51.032025099 CEST	50239	21	192.168.2.16	108.34.21.249
May 6, 2024 04:56:51.032023907 CEST	50240	2121	192.168.2.16	108.34.21.249
May 6, 2024 04:56:51.032026052 CEST	50228	2121	192.168.2.16	188.72.123.137
May 6, 2024 04:56:51.032023907 CEST	50242	2121	192.168.2.16	183.233.93.130
May 6, 2024 04:56:51.032027006 CEST	50241	21	192.168.2.16	27.213.157.225
May 6, 2024 04:56:51.032023907 CEST	50243	2121	192.168.2.16	61.161.28.125
May 6, 2024 04:56:51.032026052 CEST	50339	2121	192.168.2.16	193.175.238.88
May 6, 2024 04:56:51.032027006 CEST	50255	21	192.168.2.16	177.34.196.1
May 6, 2024 04:56:51.032028913 CEST	50238	2121	192.168.2.16	14.160.134.158
May 6, 2024 04:56:51.032028913 CEST	50226	21	192.168.2.16	188.72.123.137
May 6, 2024 04:56:51.032028913 CEST	50236	21	192.168.2.16	27.58.41.241
May 6, 2024 04:56:51.032310009 CEST	50365	2121	192.168.2.16	188.214.156.147
May 6, 2024 04:56:51.047965050 CEST	50246	2121	192.168.2.16	46.0.171.21
May 6, 2024 04:56:51.047966003 CEST	50244	2121	192.168.2.16	27.213.157.225
May 6, 2024 04:56:51.047980070 CEST	50277	21	192.168.2.16	94.8.106.34
May 6, 2024 04:56:51.047980070 CEST	50270	2121	192.168.2.16	190.11.40.87
May 6, 2024 04:56:51.047980070 CEST	50247	21	192.168.2.16	187.138.31.196
May 6, 2024 04:56:51.047981977 CEST	50253	21	192.168.2.16	222.163.7.242
May 6, 2024 04:56:51.047981977 CEST	50263	21	192.168.2.16	20.45.74.140
May 6, 2024 04:56:51.047982931 CEST	50271	21	192.168.2.16	36.85.153.27
May 6, 2024 04:56:51.047995090 CEST	50260	2121	192.168.2.16	71.186.189.60
May 6, 2024 04:56:51.047996998 CEST	50245	21	192.168.2.16	46.0.171.21
May 6, 2024 04:56:51.047996998 CEST	50278	2121	192.168.2.16	94.8.106.34
May 6, 2024 04:56:51.047997952 CEST	50248	2121	192.168.2.16	187.138.31.196
May 6, 2024 04:56:51.048000097 CEST	50259	21	192.168.2.16	71.186.189.60
May 6, 2024 04:56:51.048005104 CEST	50267	21	192.168.2.16	153.99.157.36
May 6, 2024 04:56:51.048043013 CEST	50254	2121	192.168.2.16	222.163.7.242
May 6, 2024 04:56:51.048047066 CEST	50265	2121	192.168.2.16	153.99.157.36
May 6, 2024 04:56:51.058888912 CEST	21	50355	34.128.145.40	192.168.2.16
May 6, 2024 04:56:51.059148073 CEST	21	50332	103.109.6.215	192.168.2.16
May 6, 2024 04:56:51.059277058 CEST	50332	21	192.168.2.16	103.109.6.215
May 6, 2024 04:56:51.059417963 CEST	50366	21	192.168.2.16	103.109.6.215
May 6, 2024 04:56:51.059990883 CEST	21	50362	34.128.145.40	192.168.2.16
May 6, 2024 04:56:51.060056925 CEST	50362	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:51.063967943 CEST	50264	2121	192.168.2.16	20.45.74.140
May 6, 2024 04:56:51.063968897 CEST	50275	21	192.168.2.16	113.232.167.50
May 6, 2024 04:56:51.063971043 CEST	50274	21	192.168.2.16	18.172.251.146
May 6, 2024 04:56:51.063971043 CEST	50276	2121	192.168.2.16	113.232.167.50
May 6, 2024 04:56:51.063988924 CEST	50289	21	192.168.2.16	104.34.24.209
May 6, 2024 04:56:51.063992977 CEST	50279	21	192.168.2.16	194.42.89.141
May 6, 2024 04:56:51.063996077 CEST	50287	21	192.168.2.16	119.155.11.243
May 6, 2024 04:56:51.063997030 CEST	50286	2121	192.168.2.16	27.207.21.16
May 6, 2024 04:56:51.064002037 CEST	50266	21	192.168.2.16	18.165.91.73
May 6, 2024 04:56:51.064002991 CEST	50268	2121	192.168.2.16	18.165.91.73
May 6, 2024 04:56:51.064004898 CEST	50269	21	192.168.2.16	190.11.40.87
May 6, 2024 04:56:51.064004898 CEST	50273	2121	192.168.2.16	18.172.251.146
May 6, 2024 04:56:51.064004898 CEST	50282	2121	192.168.2.16	117.89.16.57
May 6, 2024 04:56:51.064004898 CEST	50288	2121	192.168.2.16	119.155.11.243
May 6, 2024 04:56:51.064141035 CEST	50291	21	192.168.2.16	76.104.43.21
May 6, 2024 04:56:51.064141035 CEST	50292	21	192.168.2.16	185.107.27.184
May 6, 2024 04:56:51.064141989 CEST	50290	2121	192.168.2.16	104.34.24.209
May 6, 2024 04:56:51.064142942 CEST	50293	2121	192.168.2.16	76.104.43.21
May 6, 2024 04:56:51.064143896 CEST	50280	2121	192.168.2.16	194.42.89.141
May 6, 2024 04:56:51.064145088 CEST	50350	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:51.064143896 CEST	50281	21	192.168.2.16	117.89.16.57
May 6, 2024 04:56:51.064145088 CEST	50285	21	192.168.2.16	27.207.21.16
May 6, 2024 04:56:51.064145088 CEST	50294	2121	192.168.2.16	185.107.27.184
May 6, 2024 04:56:51.067827940 CEST	2121	50356	34.128.145.40	192.168.2.16
May 6, 2024 04:56:51.067887068 CEST	2121	50363	34.128.145.40	192.168.2.16
May 6, 2024 04:56:51.067960024 CEST	50363	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:51.079982042 CEST	50306	2121	192.168.2.16	113.26.215.31
May 6, 2024 04:56:51.079986095 CEST	50301	21	192.168.2.16	195.240.238.212
May 6, 2024 04:56:51.080004930 CEST	50309	21	192.168.2.16	93.41.237.60
May 6, 2024 04:56:51.080007076 CEST	50302	2121	192.168.2.16	195.240.238.212
May 6, 2024 04:56:51.080007076 CEST	50307	21	192.168.2.16	124.64.6.45
May 6, 2024 04:56:51.080008984 CEST	50308	2121	192.168.2.16	124.64.6.45
May 6, 2024 04:56:51.092597961 CEST	21	50313	223.221.178.206	192.168.2.16
May 6, 2024 04:56:51.095964909 CEST	50305	21	192.168.2.16	113.26.215.31
May 6, 2024 04:56:51.097771883 CEST	50310	2121	192.168.2.16	93.41.237.60
May 6, 2024 04:56:51.097773075 CEST	50342	21	192.168.2.16	189.172.31.228
May 6, 2024 04:56:51.101820946 CEST	21	50358	130.61.85.191	192.168.2.16
May 6, 2024 04:56:51.106061935 CEST	21	50197	150.255.30.207	192.168.2.16
May 6, 2024 04:56:51.118021965 CEST	2121	50198	150.255.30.207	192.168.2.16
May 6, 2024 04:56:51.127985001 CEST	50312	2121	192.168.2.16	91.203.165.183
May 6, 2024 04:56:51.143989086 CEST	50311	21	192.168.2.16	91.203.165.183
May 6, 2024 04:56:51.166090965 CEST	2121	50359	130.61.85.191	192.168.2.16
May 6, 2024 04:56:51.171566963 CEST	21	50362	34.128.145.40	192.168.2.16
May 6, 2024 04:56:51.171626091 CEST	50362	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:51.171693087 CEST	50362	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:51.171854973 CEST	50367	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:51.175777912 CEST	21	50350	34.128.145.40	192.168.2.16
May 6, 2024 04:56:51.177925110 CEST	2121	50363	34.128.145.40	192.168.2.16
May 6, 2024 04:56:51.177974939 CEST	50363	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:51.178042889 CEST	50363	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:51.178225040 CEST	50368	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:51.182563066 CEST	2121	50357	220.91.126.18	192.168.2.16
May 6, 2024 04:56:51.190994978 CEST	50318	2121	192.168.2.16	223.221.178.206
May 6, 2024 04:56:51.190996885 CEST	50304	2121	192.168.2.16	193.124.183.222
May 6, 2024 04:56:51.191234112 CEST	50369	21	192.168.2.16	84.119.151.112
May 6, 2024 04:56:51.206994057 CEST	50343	2121	192.168.2.16	189.172.31.228
May 6, 2024 04:56:51.211812973 CEST	21	50364	188.214.156.147	192.168.2.16
May 6, 2024 04:56:51.211878061 CEST	50364	21	192.168.2.16	188.214.156.147
May 6, 2024 04:56:51.223661900 CEST	50370	2121	192.168.2.16	84.119.151.112
May 6, 2024 04:56:51.223704100 CEST	50372	2121	192.168.2.16	91.207.42.121
May 6, 2024 04:56:51.223726988 CEST	50371	21	192.168.2.16	91.207.42.121
May 6, 2024 04:56:51.225137949 CEST	2121	50272	36.85.153.27	192.168.2.16
May 6, 2024 04:56:51.238970041 CEST	50262	21	192.168.2.16	105.130.167.223
May 6, 2024 04:56:51.238990068 CEST	50261	2121	192.168.2.16	105.130.167.223
May 6, 2024 04:56:51.238991976 CEST	50284	2121	192.168.2.16	126.78.66.219
May 6, 2024 04:56:51.239417076 CEST	50373	2121	192.168.2.16	124.49.54.1
May 6, 2024 04:56:51.239454985 CEST	50374	21	192.168.2.16	124.49.54.1
May 6, 2024 04:56:51.242861032 CEST	2121	50257	177.34.196.1	192.168.2.16
May 6, 2024 04:56:51.254966021 CEST	50207	2121	192.168.2.16	221.160.246.44
May 6, 2024 04:56:51.254966021 CEST	50208	21	192.168.2.16	221.160.246.44
May 6, 2024 04:56:51.255103111 CEST	50344	21	192.168.2.16	183.141.107.50
May 6, 2024 04:56:51.255379915 CEST	50375	21	192.168.2.16	80.213.20.177
May 6, 2024 04:56:51.263731003 CEST	21	50255	177.34.196.1	192.168.2.16
May 6, 2024 04:56:51.276648998 CEST	2121	50365	188.214.156.147	192.168.2.16
May 6, 2024 04:56:51.282305956 CEST	21	50367	34.128.145.40	192.168.2.16
May 6, 2024 04:56:51.282372952 CEST	50367	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:51.282394886 CEST	21	50362	34.128.145.40	192.168.2.16
May 6, 2024 04:56:51.286984921 CEST	50346	2121	192.168.2.16	183.141.107.50
May 6, 2024 04:56:51.287257910 CEST	50376	2121	192.168.2.16	80.213.20.177
May 6, 2024 04:56:51.287554026 CEST	2121	50224	111.26.192.63	192.168.2.16
May 6, 2024 04:56:51.287974119 CEST	2121	50368	34.128.145.40	192.168.2.16
May 6, 2024 04:56:51.287986994 CEST	2121	50363	34.128.145.40	192.168.2.16
May 6, 2024 04:56:51.288050890 CEST	50368	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:51.288157940 CEST	21	50277	94.8.106.34	192.168.2.16
May 6, 2024 04:56:51.288439035 CEST	50377	21	192.168.2.16	27.200.193.13
May 6, 2024 04:56:51.290045023 CEST	21	50223	111.26.192.63	192.168.2.16
May 6, 2024 04:56:51.291863918 CEST	2121	50278	94.8.106.34	192.168.2.16
May 6, 2024 04:56:51.303966045 CEST	50378	2121	192.168.2.16	27.200.193.13
May 6, 2024 04:56:51.319472075 CEST	50379	21	192.168.2.16	78.115.142.120
May 6, 2024 04:56:51.319534063 CEST	50380	2121	192.168.2.16	78.115.142.120
May 6, 2024 04:56:51.330259085 CEST	21	50169	154.148.45.69	192.168.2.16
May 6, 2024 04:56:51.330272913 CEST	2121	50170	154.148.45.69	192.168.2.16
May 6, 2024 04:56:51.330554008 CEST	50381	21	192.168.2.16	73.178.202.135
May 6, 2024 04:56:51.334992886 CEST	50283	21	192.168.2.16	126.78.66.219
May 6, 2024 04:56:51.336059093 CEST	50382	2121	192.168.2.16	73.178.202.135
May 6, 2024 04:56:51.336119890 CEST	50383	21	192.168.2.16	91.41.59.153
May 6, 2024 04:56:51.351815939 CEST	50384	2121	192.168.2.16	91.41.59.153
May 6, 2024 04:56:51.382992029 CEST	50204	2121	192.168.2.16	210.5.190.214
May 6, 2024 04:56:51.390527964 CEST	2121	50312	91.203.165.183	192.168.2.16
May 6, 2024 04:56:51.391926050 CEST	21	50367	34.128.145.40	192.168.2.16
May 6, 2024 04:56:51.391993999 CEST	50367	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:51.392062902 CEST	50367	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:51.392256975 CEST	50385	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:51.394965887 CEST	50203	21	192.168.2.16	210.5.190.214
May 6, 2024 04:56:51.397712946 CEST	2121	50368	34.128.145.40	192.168.2.16
May 6, 2024 04:56:51.397778034 CEST	50368	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:51.397830963 CEST	50368	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:51.397970915 CEST	50386	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:51.407433987 CEST	21	50311	91.203.165.183	192.168.2.16
May 6, 2024 04:56:51.414983034 CEST	50256	21	192.168.2.16	113.78.184.237
May 6, 2024 04:56:51.414983034 CEST	50335	2121	192.168.2.16	110.136.96.12
May 6, 2024 04:56:51.415204048 CEST	50387	21	192.168.2.16	117.161.132.183
May 6, 2024 04:56:51.431144953 CEST	21	50332	103.109.6.215	192.168.2.16
May 6, 2024 04:56:51.431190968 CEST	21	50332	103.109.6.215	192.168.2.16
May 6, 2024 04:56:51.431204081 CEST	50388	2121	192.168.2.16	117.161.132.183
May 6, 2024 04:56:51.431241989 CEST	50332	21	192.168.2.16	103.109.6.215
May 6, 2024 04:56:51.434186935 CEST	21	50366	103.109.6.215	192.168.2.16
May 6, 2024 04:56:51.434268951 CEST	50366	21	192.168.2.16	103.109.6.215
May 6, 2024 04:56:51.457663059 CEST	21	50364	188.214.156.147	192.168.2.16
May 6, 2024 04:56:51.457756996 CEST	50364	21	192.168.2.16	188.214.156.147
May 6, 2024 04:56:51.457935095 CEST	50389	21	192.168.2.16	94.131.47.117
May 6, 2024 04:56:51.462501049 CEST	2121	50304	193.124.183.222	192.168.2.16
May 6, 2024 04:56:51.462994099 CEST	50348	21	192.168.2.16	45.120.174.5
May 6, 2024 04:56:51.463221073 CEST	50390	2121	192.168.2.16	94.131.47.117
May 6, 2024 04:56:51.479000092 CEST	50258	2121	192.168.2.16	113.78.184.237
May 6, 2024 04:56:51.479146957 CEST	50391	21	192.168.2.16	24.181.4.6
May 6, 2024 04:56:51.494966030 CEST	50349	2121	192.168.2.16	45.120.174.5
May 6, 2024 04:56:51.501527071 CEST	21	50367	34.128.145.40	192.168.2.16
May 6, 2024 04:56:51.502340078 CEST	21	50385	34.128.145.40	192.168.2.16
May 6, 2024 04:56:51.502423048 CEST	50385	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:51.508171082 CEST	2121	50368	34.128.145.40	192.168.2.16
May 6, 2024 04:56:51.509574890 CEST	2121	50386	34.128.145.40	192.168.2.16
May 6, 2024 04:56:51.509639025 CEST	50386	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:51.510965109 CEST	50205	21	192.168.2.16	49.48.43.254
May 6, 2024 04:56:51.510986090 CEST	50206	2121	192.168.2.16	49.48.43.254
May 6, 2024 04:56:51.511253119 CEST	50392	2121	192.168.2.16	24.181.4.6
May 6, 2024 04:56:51.525105953 CEST	21	50262	105.130.167.223	192.168.2.16
May 6, 2024 04:56:51.525119066 CEST	2121	50261	105.130.167.223	192.168.2.16
May 6, 2024 04:56:51.525419950 CEST	2121	50284	126.78.66.219	192.168.2.16
May 6, 2024 04:56:51.525451899 CEST	50393	21	192.168.2.16	67.188.255.137
May 6, 2024 04:56:51.525738001 CEST	50394	2121	192.168.2.16	67.188.255.137
May 6, 2024 04:56:51.525981903 CEST	50354	21	192.168.2.16	220.91.126.18
May 6, 2024 04:56:51.542222977 CEST	50395	21	192.168.2.16	81.245.127.27
May 6, 2024 04:56:51.543968916 CEST	2121	50380	78.115.142.120	192.168.2.16
May 6, 2024 04:56:51.545903921 CEST	21	50379	78.115.142.120	192.168.2.16
May 6, 2024 04:56:51.557193041 CEST	21	50208	221.160.246.44	192.168.2.16
May 6, 2024 04:56:51.557898998 CEST	2121	50373	124.49.54.1	192.168.2.16
May 6, 2024 04:56:51.561150074 CEST	2121	50207	221.160.246.44	192.168.2.16
May 6, 2024 04:56:51.573753119 CEST	2121	50318	223.221.178.206	192.168.2.16
May 6, 2024 04:56:51.574387074 CEST	50396	2121	192.168.2.16	81.245.127.27
May 6, 2024 04:56:51.574498892 CEST	50398	2121	192.168.2.16	189.179.17.239
May 6, 2024 04:56:51.574500084 CEST	50397	21	192.168.2.16	189.179.17.239
May 6, 2024 04:56:51.605997086 CEST	50313	21	192.168.2.16	223.221.178.206
May 6, 2024 04:56:51.605998039 CEST	50358	21	192.168.2.16	130.61.85.191
May 6, 2024 04:56:51.606156111 CEST	50197	21	192.168.2.16	150.255.30.207
May 6, 2024 04:56:51.606265068 CEST	50399	21	192.168.2.16	173.235.82.189
May 6, 2024 04:56:51.606276035 CEST	50400	2121	192.168.2.16	173.235.82.189
May 6, 2024 04:56:51.612617016 CEST	21	50385	34.128.145.40	192.168.2.16
May 6, 2024 04:56:51.612688065 CEST	50385	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:51.612746000 CEST	50385	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:51.612926006 CEST	50401	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:51.619213104 CEST	2121	50386	34.128.145.40	192.168.2.16
May 6, 2024 04:56:51.619263887 CEST	50386	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:51.619323969 CEST	50386	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:51.619472027 CEST	50402	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:51.622263908 CEST	50403	21	192.168.2.16	23.197.37.196
May 6, 2024 04:56:51.622338057 CEST	50404	2121	192.168.2.16	23.197.37.196
May 6, 2024 04:56:51.622432947 CEST	50198	2121	192.168.2.16	150.255.30.207
May 6, 2024 04:56:51.636991978 CEST	50319	21	192.168.2.16	61.99.64.185
May 6, 2024 04:56:51.637459993 CEST	50352	21	192.168.2.16	98.122.64.212
May 6, 2024 04:56:51.647727013 CEST	21	50283	126.78.66.219	192.168.2.16
May 6, 2024 04:56:51.653002024 CEST	50353	2121	192.168.2.16	98.122.64.212
May 6, 2024 04:56:51.653583050 CEST	50405	2121	192.168.2.16	70.92.238.155
May 6, 2024 04:56:51.653659105 CEST	50406	21	192.168.2.16	70.92.238.155
May 6, 2024 04:56:51.669018984 CEST	50359	2121	192.168.2.16	130.61.85.191
May 6, 2024 04:56:51.669483900 CEST	50407	21	192.168.2.16	116.9.149.105
May 6, 2024 04:56:51.669559956 CEST	50408	2121	192.168.2.16	116.9.149.105
May 6, 2024 04:56:51.684978962 CEST	50320	2121	192.168.2.16	61.99.64.185
May 6, 2024 04:56:51.685559988 CEST	50357	2121	192.168.2.16	220.91.126.18
May 6, 2024 04:56:51.700897932 CEST	21	50364	188.214.156.147	192.168.2.16
May 6, 2024 04:56:51.701004028 CEST	50364	21	192.168.2.16	188.214.156.147
May 6, 2024 04:56:51.701277971 CEST	50409	21	192.168.2.16	139.59.34.85
May 6, 2024 04:56:51.702044964 CEST	21	50364	188.214.156.147	192.168.2.16
May 6, 2024 04:56:51.702092886 CEST	50364	21	192.168.2.16	188.214.156.147
May 6, 2024 04:56:51.705651045 CEST	2121	50394	67.188.255.137	192.168.2.16
May 6, 2024 04:56:51.706299067 CEST	21	50393	67.188.255.137	192.168.2.16
May 6, 2024 04:56:51.719822884 CEST	2121	50204	210.5.190.214	192.168.2.16
May 6, 2024 04:56:51.721918106 CEST	21	50385	34.128.145.40	192.168.2.16
May 6, 2024 04:56:51.722611904 CEST	21	50401	34.128.145.40	192.168.2.16
May 6, 2024 04:56:51.722681046 CEST	50401	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:51.728648901 CEST	2121	50402	34.128.145.40	192.168.2.16
May 6, 2024 04:56:51.728704929 CEST	50402	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:51.728785038 CEST	2121	50386	34.128.145.40	192.168.2.16
May 6, 2024 04:56:51.732969999 CEST	50272	2121	192.168.2.16	36.85.153.27
May 6, 2024 04:56:51.733284950 CEST	50410	2121	192.168.2.16	139.59.34.85
May 6, 2024 04:56:51.734489918 CEST	21	50203	210.5.190.214	192.168.2.16
May 6, 2024 04:56:51.749293089 CEST	50411	21	192.168.2.16	98.254.182.143
May 6, 2024 04:56:51.753562927 CEST	21	50256	113.78.184.237	192.168.2.16
May 6, 2024 04:56:51.765620947 CEST	50412	2121	192.168.2.16	98.254.182.143
May 6, 2024 04:56:51.780983925 CEST	50365	2121	192.168.2.16	188.214.156.147
May 6, 2024 04:56:51.781472921 CEST	50413	21	192.168.2.16	45.161.140.137
May 6, 2024 04:56:51.788597107 CEST	2121	50335	110.136.96.12	192.168.2.16
May 6, 2024 04:56:51.796964884 CEST	50224	2121	192.168.2.16	111.26.192.63
May 6, 2024 04:56:51.797555923 CEST	50223	21	192.168.2.16	111.26.192.63
May 6, 2024 04:56:51.807691097 CEST	21	50366	103.109.6.215	192.168.2.16
May 6, 2024 04:56:51.807822943 CEST	50366	21	192.168.2.16	103.109.6.215
May 6, 2024 04:56:51.813321114 CEST	50414	2121	192.168.2.16	45.161.140.137
May 6, 2024 04:56:51.829304934 CEST	50415	21	192.168.2.16	67.184.169.181
May 6, 2024 04:56:51.832681894 CEST	21	50354	220.91.126.18	192.168.2.16
May 6, 2024 04:56:51.834275961 CEST	2121	50258	113.78.184.237	192.168.2.16
May 6, 2024 04:56:51.835597992 CEST	21	50358	130.61.85.191	192.168.2.16
May 6, 2024 04:56:51.837934017 CEST	2121	50402	34.128.145.40	192.168.2.16
May 6, 2024 04:56:51.837990999 CEST	50402	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:51.838058949 CEST	50402	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:51.838239908 CEST	50416	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:51.845263958 CEST	50417	2121	192.168.2.16	67.184.169.181
May 6, 2024 04:56:51.846034050 CEST	21	50401	34.128.145.40	192.168.2.16
May 6, 2024 04:56:51.846096992 CEST	50401	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:51.846142054 CEST	50401	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:51.846282005 CEST	50418	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:51.861356020 CEST	50419	21	192.168.2.16	71.193.153.207
May 6, 2024 04:56:51.877682924 CEST	50420	21	192.168.2.16	195.205.150.94
May 6, 2024 04:56:51.877804041 CEST	50421	2121	192.168.2.16	71.193.153.207
May 6, 2024 04:56:51.877862930 CEST	50422	2121	192.168.2.16	195.205.150.94
May 6, 2024 04:56:51.878998995 CEST	2121	50206	49.48.43.254	192.168.2.16
May 6, 2024 04:56:51.880887985 CEST	21	50205	49.48.43.254	192.168.2.16
May 6, 2024 04:56:51.881467104 CEST	50423	21	192.168.2.16	181.171.153.111
May 6, 2024 04:56:51.893462896 CEST	50424	2121	192.168.2.16	181.171.153.111
May 6, 2024 04:56:51.900266886 CEST	2121	50359	130.61.85.191	192.168.2.16
May 6, 2024 04:56:51.909584045 CEST	50425	21	192.168.2.16	61.76.155.82
May 6, 2024 04:56:51.909606934 CEST	50426	2121	192.168.2.16	61.76.155.82
May 6, 2024 04:56:51.940979958 CEST	50360	2121	192.168.2.16	41.97.219.244
May 6, 2024 04:56:51.940995932 CEST	50361	21	192.168.2.16	41.97.219.244
May 6, 2024 04:56:51.947207928 CEST	2121	50402	34.128.145.40	192.168.2.16
May 6, 2024 04:56:51.947913885 CEST	2121	50416	34.128.145.40	192.168.2.16
May 6, 2024 04:56:51.947992086 CEST	50416	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:51.955470085 CEST	21	50418	34.128.145.40	192.168.2.16
May 6, 2024 04:56:51.955538988 CEST	50418	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:51.955853939 CEST	21	50401	34.128.145.40	192.168.2.16
May 6, 2024 04:56:51.957570076 CEST	50427	21	192.168.2.16	188.222.212.57
May 6, 2024 04:56:51.957571983 CEST	50428	2121	192.168.2.16	188.222.212.57
May 6, 2024 04:56:51.979728937 CEST	21	50313	223.221.178.206	192.168.2.16
May 6, 2024 04:56:51.989366055 CEST	50429	21	192.168.2.16	85.4.52.227
May 6, 2024 04:56:51.995860100 CEST	21	50197	150.255.30.207	192.168.2.16
May 6, 2024 04:56:51.995978117 CEST	2121	50357	220.91.126.18	192.168.2.16
May 6, 2024 04:56:51.996267080 CEST	50430	2121	192.168.2.16	85.4.52.227
May 6, 2024 04:56:52.005254030 CEST	50431	21	192.168.2.16	165.1.218.28
May 6, 2024 04:56:52.005467892 CEST	21	50413	45.161.140.137	192.168.2.16
May 6, 2024 04:56:52.007765055 CEST	2121	50198	150.255.30.207	192.168.2.16
May 6, 2024 04:56:52.009044886 CEST	50432	2121	192.168.2.16	165.1.218.28
May 6, 2024 04:56:52.025324106 CEST	2121	50365	188.214.156.147	192.168.2.16
May 6, 2024 04:56:52.044291019 CEST	2121	50414	45.161.140.137	192.168.2.16
May 6, 2024 04:56:52.051987886 CEST	50380	2121	192.168.2.16	78.115.142.120
May 6, 2024 04:56:52.051990986 CEST	50379	21	192.168.2.16	78.115.142.120
May 6, 2024 04:56:52.057914972 CEST	2121	50416	34.128.145.40	192.168.2.16
May 6, 2024 04:56:52.057979107 CEST	50416	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:52.058063030 CEST	50416	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:52.058252096 CEST	50433	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:52.066729069 CEST	21	50418	34.128.145.40	192.168.2.16
May 6, 2024 04:56:52.066818953 CEST	50418	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:52.066874981 CEST	50418	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:52.067078114 CEST	50434	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:52.067992926 CEST	50373	2121	192.168.2.16	124.49.54.1
May 6, 2024 04:56:52.082973003 CEST	50318	2121	192.168.2.16	223.221.178.206
May 6, 2024 04:56:52.115814924 CEST	21	50298	45.87.1.166	192.168.2.16
May 6, 2024 04:56:52.115972042 CEST	50298	21	192.168.2.16	45.87.1.166
May 6, 2024 04:56:52.116178036 CEST	50435	21	192.168.2.16	45.87.1.166
May 6, 2024 04:56:52.155116081 CEST	21	50423	181.171.153.111	192.168.2.16
May 6, 2024 04:56:52.167731047 CEST	2121	50416	34.128.145.40	192.168.2.16
May 6, 2024 04:56:52.167808056 CEST	2121	50433	34.128.145.40	192.168.2.16
May 6, 2024 04:56:52.167886019 CEST	50433	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:52.174854994 CEST	2121	50424	181.171.153.111	192.168.2.16
May 6, 2024 04:56:52.176069021 CEST	21	50418	34.128.145.40	192.168.2.16
May 6, 2024 04:56:52.176188946 CEST	21	50434	34.128.145.40	192.168.2.16
May 6, 2024 04:56:52.176256895 CEST	50434	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:52.181134939 CEST	21	50366	103.109.6.215	192.168.2.16
May 6, 2024 04:56:52.181257963 CEST	50366	21	192.168.2.16	103.109.6.215
May 6, 2024 04:56:52.194996119 CEST	50369	21	192.168.2.16	84.119.151.112
May 6, 2024 04:56:52.206263065 CEST	2121	50224	111.26.192.63	192.168.2.16
May 6, 2024 04:56:52.206748962 CEST	50436	21	192.168.2.16	83.57.93.232
May 6, 2024 04:56:52.207124949 CEST	21	50223	111.26.192.63	192.168.2.16
May 6, 2024 04:56:52.207510948 CEST	50437	2121	192.168.2.16	83.57.93.232
May 6, 2024 04:56:52.210968971 CEST	50327	21	192.168.2.16	68.189.69.171
May 6, 2024 04:56:52.210985899 CEST	50394	2121	192.168.2.16	67.188.255.137
May 6, 2024 04:56:52.215970993 CEST	50393	21	192.168.2.16	67.188.255.137
May 6, 2024 04:56:52.226994991 CEST	50372	2121	192.168.2.16	91.207.42.121
May 6, 2024 04:56:52.227014065 CEST	50371	21	192.168.2.16	91.207.42.121
May 6, 2024 04:56:52.227022886 CEST	50370	2121	192.168.2.16	84.119.151.112
May 6, 2024 04:56:52.242979050 CEST	50374	21	192.168.2.16	124.49.54.1
May 6, 2024 04:56:52.259979010 CEST	50375	21	192.168.2.16	80.213.20.177
May 6, 2024 04:56:52.276262045 CEST	2121	50380	78.115.142.120	192.168.2.16
May 6, 2024 04:56:52.278275967 CEST	2121	50433	34.128.145.40	192.168.2.16
May 6, 2024 04:56:52.278289080 CEST	21	50379	78.115.142.120	192.168.2.16
May 6, 2024 04:56:52.278336048 CEST	50433	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:52.278430939 CEST	50433	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:52.278614998 CEST	50438	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:52.286190033 CEST	21	50434	34.128.145.40	192.168.2.16
May 6, 2024 04:56:52.286247015 CEST	50434	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:52.286326885 CEST	50434	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:52.286510944 CEST	50439	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:52.289985895 CEST	50376	2121	192.168.2.16	80.213.20.177
May 6, 2024 04:56:52.290091038 CEST	50335	2121	192.168.2.16	110.136.96.12
May 6, 2024 04:56:52.290092945 CEST	50377	21	192.168.2.16	27.200.193.13
May 6, 2024 04:56:52.305984974 CEST	50378	2121	192.168.2.16	27.200.193.13
May 6, 2024 04:56:52.336997986 CEST	50382	2121	192.168.2.16	73.178.202.135
May 6, 2024 04:56:52.336998940 CEST	50354	21	192.168.2.16	220.91.126.18
May 6, 2024 04:56:52.337001085 CEST	50358	21	192.168.2.16	130.61.85.191
May 6, 2024 04:56:52.337018967 CEST	50381	21	192.168.2.16	73.178.202.135
May 6, 2024 04:56:52.337193966 CEST	50383	21	192.168.2.16	91.41.59.153
May 6, 2024 04:56:52.337404013 CEST	50440	21	192.168.2.16	149.224.112.238
May 6, 2024 04:56:52.337896109 CEST	21	50435	45.87.1.166	192.168.2.16
May 6, 2024 04:56:52.337976933 CEST	50435	21	192.168.2.16	45.87.1.166
May 6, 2024 04:56:52.341510057 CEST	21	50298	45.87.1.166	192.168.2.16
May 6, 2024 04:56:52.341578007 CEST	50298	21	192.168.2.16	45.87.1.166
May 6, 2024 04:56:52.353001118 CEST	50384	2121	192.168.2.16	91.41.59.153
May 6, 2024 04:56:52.384954929 CEST	2121	50373	124.49.54.1	192.168.2.16
May 6, 2024 04:56:52.387998104 CEST	2121	50433	34.128.145.40	192.168.2.16
May 6, 2024 04:56:52.388264894 CEST	2121	50438	34.128.145.40	192.168.2.16
May 6, 2024 04:56:52.388330936 CEST	50438	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:52.392482042 CEST	2121	50394	67.188.255.137	192.168.2.16
May 6, 2024 04:56:52.395531893 CEST	21	50434	34.128.145.40	192.168.2.16
May 6, 2024 04:56:52.396064043 CEST	21	50439	34.128.145.40	192.168.2.16
May 6, 2024 04:56:52.396123886 CEST	50439	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:52.397665024 CEST	21	50393	67.188.255.137	192.168.2.16
May 6, 2024 04:56:52.399280071 CEST	50441	2121	192.168.2.16	149.224.112.238
May 6, 2024 04:56:52.414983034 CEST	50359	2121	192.168.2.16	130.61.85.191
May 6, 2024 04:56:52.429986000 CEST	50387	21	192.168.2.16	117.161.132.183
May 6, 2024 04:56:52.430303097 CEST	50442	21	192.168.2.16	103.165.157.224
May 6, 2024 04:56:52.445972919 CEST	50388	2121	192.168.2.16	117.161.132.183
May 6, 2024 04:56:52.461992979 CEST	50389	21	192.168.2.16	94.131.47.117
May 6, 2024 04:56:52.465857029 CEST	2121	50318	223.221.178.206	192.168.2.16
May 6, 2024 04:56:52.477992058 CEST	50390	2121	192.168.2.16	94.131.47.117
May 6, 2024 04:56:52.478193045 CEST	50443	2121	192.168.2.16	103.165.157.224
May 6, 2024 04:56:52.478194952 CEST	50330	2121	192.168.2.16	68.189.69.171
May 6, 2024 04:56:52.493995905 CEST	50391	21	192.168.2.16	24.181.4.6
May 6, 2024 04:56:52.500065088 CEST	2121	50438	34.128.145.40	192.168.2.16
May 6, 2024 04:56:52.500118017 CEST	50438	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:52.500199080 CEST	50438	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:52.500391960 CEST	50444	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:52.505817890 CEST	21	50439	34.128.145.40	192.168.2.16
May 6, 2024 04:56:52.505876064 CEST	50439	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:52.505930901 CEST	50439	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:52.506094933 CEST	50445	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:52.509964943 CEST	50357	2121	192.168.2.16	220.91.126.18
May 6, 2024 04:56:52.509982109 CEST	50413	21	192.168.2.16	45.161.140.137
May 6, 2024 04:56:52.524966002 CEST	50392	2121	192.168.2.16	24.181.4.6
May 6, 2024 04:56:52.540972948 CEST	50365	2121	192.168.2.16	188.214.156.147
May 6, 2024 04:56:52.555814028 CEST	21	50366	103.109.6.215	192.168.2.16
May 6, 2024 04:56:52.555932999 CEST	50366	21	192.168.2.16	103.109.6.215
May 6, 2024 04:56:52.555984020 CEST	50414	2121	192.168.2.16	45.161.140.137
May 6, 2024 04:56:52.555986881 CEST	50395	21	192.168.2.16	81.245.127.27
May 6, 2024 04:56:52.555999994 CEST	50331	21	192.168.2.16	110.136.96.12
May 6, 2024 04:56:52.556180000 CEST	50446	21	192.168.2.16	103.109.6.215
May 6, 2024 04:56:52.564770937 CEST	21	50435	45.87.1.166	192.168.2.16
May 6, 2024 04:56:52.564894915 CEST	50435	21	192.168.2.16	45.87.1.166
May 6, 2024 04:56:52.566581964 CEST	21	50358	130.61.85.191	192.168.2.16
May 6, 2024 04:56:52.587970972 CEST	50396	2121	192.168.2.16	81.245.127.27
May 6, 2024 04:56:52.587973118 CEST	50398	2121	192.168.2.16	189.179.17.239
May 6, 2024 04:56:52.588223934 CEST	50397	21	192.168.2.16	189.179.17.239
May 6, 2024 04:56:52.609833956 CEST	2121	50438	34.128.145.40	192.168.2.16
May 6, 2024 04:56:52.610826015 CEST	2121	50444	34.128.145.40	192.168.2.16
May 6, 2024 04:56:52.610891104 CEST	50444	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:52.615535021 CEST	21	50439	34.128.145.40	192.168.2.16
May 6, 2024 04:56:52.615591049 CEST	21	50445	34.128.145.40	192.168.2.16
May 6, 2024 04:56:52.615641117 CEST	50445	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:52.619966030 CEST	50399	21	192.168.2.16	173.235.82.189
May 6, 2024 04:56:52.619992018 CEST	50400	2121	192.168.2.16	173.235.82.189
May 6, 2024 04:56:52.634982109 CEST	50403	21	192.168.2.16	23.197.37.196
May 6, 2024 04:56:52.635000944 CEST	50404	2121	192.168.2.16	23.197.37.196
May 6, 2024 04:56:52.643892050 CEST	21	50354	220.91.126.18	192.168.2.16
May 6, 2024 04:56:52.644654989 CEST	2121	50359	130.61.85.191	192.168.2.16
May 6, 2024 04:56:52.664064884 CEST	2121	50335	110.136.96.12	192.168.2.16
May 6, 2024 04:56:52.666985989 CEST	50405	2121	192.168.2.16	70.92.238.155
May 6, 2024 04:56:52.667001009 CEST	50423	21	192.168.2.16	181.171.153.111
May 6, 2024 04:56:52.667001963 CEST	50406	21	192.168.2.16	70.92.238.155
May 6, 2024 04:56:52.679913044 CEST	50424	2121	192.168.2.16	181.171.153.111
May 6, 2024 04:56:52.679913998 CEST	50408	2121	192.168.2.16	116.9.149.105
May 6, 2024 04:56:52.683451891 CEST	50407	21	192.168.2.16	116.9.149.105
May 6, 2024 04:56:52.714965105 CEST	50409	21	192.168.2.16	139.59.34.85
May 6, 2024 04:56:52.721458912 CEST	2121	50444	34.128.145.40	192.168.2.16
May 6, 2024 04:56:52.721523046 CEST	50444	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:52.721607924 CEST	50444	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:52.721847057 CEST	50447	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:52.725799084 CEST	21	50445	34.128.145.40	192.168.2.16
May 6, 2024 04:56:52.725857973 CEST	50445	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:52.725939035 CEST	50445	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:52.726145983 CEST	50448	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:52.740765095 CEST	21	50413	45.161.140.137	192.168.2.16
May 6, 2024 04:56:52.746988058 CEST	50410	2121	192.168.2.16	139.59.34.85
May 6, 2024 04:56:52.763106108 CEST	50336	21	192.168.2.16	193.175.238.88
May 6, 2024 04:56:52.766958952 CEST	50411	21	192.168.2.16	98.254.182.143
May 6, 2024 04:56:52.775059938 CEST	21	50442	103.165.157.224	192.168.2.16
May 6, 2024 04:56:52.778990984 CEST	50412	2121	192.168.2.16	98.254.182.143
May 6, 2024 04:56:52.779144049 CEST	50380	2121	192.168.2.16	78.115.142.120
May 6, 2024 04:56:52.779863119 CEST	2121	50414	45.161.140.137	192.168.2.16
May 6, 2024 04:56:52.785391092 CEST	2121	50365	188.214.156.147	192.168.2.16
May 6, 2024 04:56:52.785415888 CEST	50379	21	192.168.2.16	78.115.142.120
May 6, 2024 04:56:52.787009954 CEST	21	50435	45.87.1.166	192.168.2.16
May 6, 2024 04:56:52.787163973 CEST	21	50435	45.87.1.166	192.168.2.16
May 6, 2024 04:56:52.787285089 CEST	50435	21	192.168.2.16	45.87.1.166
May 6, 2024 04:56:52.820008039 CEST	2121	50357	220.91.126.18	192.168.2.16
May 6, 2024 04:56:52.823152065 CEST	2121	50443	103.165.157.224	192.168.2.16
May 6, 2024 04:56:52.831202984 CEST	2121	50444	34.128.145.40	192.168.2.16
May 6, 2024 04:56:52.831505060 CEST	2121	50447	34.128.145.40	192.168.2.16
May 6, 2024 04:56:52.831576109 CEST	50447	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:52.836163044 CEST	21	50445	34.128.145.40	192.168.2.16
May 6, 2024 04:56:52.836620092 CEST	21	50448	34.128.145.40	192.168.2.16
May 6, 2024 04:56:52.836684942 CEST	50448	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:52.843017101 CEST	50415	21	192.168.2.16	67.184.169.181
May 6, 2024 04:56:52.859019995 CEST	50417	2121	192.168.2.16	67.184.169.181
May 6, 2024 04:56:52.874979973 CEST	50419	21	192.168.2.16	71.193.153.207
May 6, 2024 04:56:52.887428999 CEST	21	50296	109.205.180.149	192.168.2.16
May 6, 2024 04:56:52.887572050 CEST	50296	21	192.168.2.16	109.205.180.149
May 6, 2024 04:56:52.887731075 CEST	50449	21	192.168.2.16	109.205.180.149
May 6, 2024 04:56:52.890989065 CEST	50421	2121	192.168.2.16	71.193.153.207
May 6, 2024 04:56:52.891005039 CEST	50422	2121	192.168.2.16	195.205.150.94
May 6, 2024 04:56:52.891007900 CEST	50420	21	192.168.2.16	195.205.150.94
May 6, 2024 04:56:52.891154051 CEST	50373	2121	192.168.2.16	124.49.54.1
May 6, 2024 04:56:52.906966925 CEST	50394	2121	192.168.2.16	67.188.255.137
May 6, 2024 04:56:52.906969070 CEST	50393	21	192.168.2.16	67.188.255.137
May 6, 2024 04:56:52.922981024 CEST	50426	2121	192.168.2.16	61.76.155.82
May 6, 2024 04:56:52.922996044 CEST	50425	21	192.168.2.16	61.76.155.82
May 6, 2024 04:56:52.925163984 CEST	21	50446	103.109.6.215	192.168.2.16
May 6, 2024 04:56:52.925230026 CEST	50446	21	192.168.2.16	103.109.6.215
May 6, 2024 04:56:52.929104090 CEST	21	50366	103.109.6.215	192.168.2.16
May 6, 2024 04:56:52.929162979 CEST	21	50366	103.109.6.215	192.168.2.16
May 6, 2024 04:56:52.929203987 CEST	50366	21	192.168.2.16	103.109.6.215
May 6, 2024 04:56:52.939026117 CEST	21	50423	181.171.153.111	192.168.2.16
May 6, 2024 04:56:52.943089962 CEST	2121	50447	34.128.145.40	192.168.2.16
May 6, 2024 04:56:52.943135977 CEST	50447	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:52.943231106 CEST	50447	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:52.943428993 CEST	50450	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:52.946444035 CEST	21	50448	34.128.145.40	192.168.2.16
May 6, 2024 04:56:52.946496964 CEST	50448	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:52.946552992 CEST	50448	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:52.946724892 CEST	50451	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:52.947247982 CEST	2121	50424	181.171.153.111	192.168.2.16
May 6, 2024 04:56:52.970968962 CEST	50427	21	192.168.2.16	188.222.212.57
May 6, 2024 04:56:52.970993996 CEST	50428	2121	192.168.2.16	188.222.212.57
May 6, 2024 04:56:53.003031969 CEST	50429	21	192.168.2.16	85.4.52.227
May 6, 2024 04:56:53.003034115 CEST	50430	2121	192.168.2.16	85.4.52.227
May 6, 2024 04:56:53.004369974 CEST	2121	50380	78.115.142.120	192.168.2.16
May 6, 2024 04:56:53.005100012 CEST	50452	21	192.168.2.16	20.111.46.231
May 6, 2024 04:56:53.005718946 CEST	50454	21	192.168.2.16	96.91.172.122
May 6, 2024 04:56:53.005821943 CEST	50455	2121	192.168.2.16	96.91.172.122
May 6, 2024 04:56:53.005897045 CEST	50456	21	192.168.2.16	117.69.72.226
May 6, 2024 04:56:53.005897045 CEST	50453	2121	192.168.2.16	20.111.46.231
May 6, 2024 04:56:53.006000042 CEST	50458	2121	192.168.2.16	187.126.142.208
May 6, 2024 04:56:53.006074905 CEST	50457	2121	192.168.2.16	117.69.72.226
May 6, 2024 04:56:53.006098032 CEST	50459	21	192.168.2.16	187.126.142.208
May 6, 2024 04:56:53.006215096 CEST	50460	21	192.168.2.16	51.105.105.242
May 6, 2024 04:56:53.006278992 CEST	50461	2121	192.168.2.16	51.105.105.242
May 6, 2024 04:56:53.006350994 CEST	50463	21	192.168.2.16	222.190.5.46
May 6, 2024 04:56:53.006376982 CEST	50462	2121	192.168.2.16	222.190.5.46
May 6, 2024 04:56:53.006477118 CEST	50464	21	192.168.2.16	216.67.24.140
May 6, 2024 04:56:53.006556988 CEST	50465	2121	192.168.2.16	216.67.24.140
May 6, 2024 04:56:53.006647110 CEST	50466	21	192.168.2.16	98.96.97.42
May 6, 2024 04:56:53.006774902 CEST	50467	21	192.168.2.16	122.41.139.45
May 6, 2024 04:56:53.006782055 CEST	50468	2121	192.168.2.16	122.41.139.45
May 6, 2024 04:56:53.006830931 CEST	50469	21	192.168.2.16	206.71.159.50
May 6, 2024 04:56:53.006880045 CEST	50470	21	192.168.2.16	67.180.251.139
May 6, 2024 04:56:53.006900072 CEST	50471	2121	192.168.2.16	98.96.97.42
May 6, 2024 04:56:53.006911039 CEST	50472	21	192.168.2.16	211.44.88.172
May 6, 2024 04:56:53.006975889 CEST	50473	2121	192.168.2.16	206.71.159.50
May 6, 2024 04:56:53.006994963 CEST	50474	2121	192.168.2.16	211.44.88.172
May 6, 2024 04:56:53.011384964 CEST	21	50379	78.115.142.120	192.168.2.16
May 6, 2024 04:56:53.018989086 CEST	50431	21	192.168.2.16	165.1.218.28
May 6, 2024 04:56:53.019048929 CEST	50432	2121	192.168.2.16	165.1.218.28
May 6, 2024 04:56:53.021800995 CEST	50475	2121	192.168.2.16	67.180.251.139
May 6, 2024 04:56:53.022777081 CEST	50476	2121	192.168.2.16	158.23.81.6
May 6, 2024 04:56:53.022880077 CEST	50477	21	192.168.2.16	158.23.81.6
May 6, 2024 04:56:53.022895098 CEST	50478	21	192.168.2.16	101.249.29.72
May 6, 2024 04:56:53.022938967 CEST	50479	2121	192.168.2.16	101.249.29.72
May 6, 2024 04:56:53.023051977 CEST	50480	21	192.168.2.16	119.185.45.247
May 6, 2024 04:56:53.023154020 CEST	50481	2121	192.168.2.16	119.185.45.247
May 6, 2024 04:56:53.023242950 CEST	50482	2121	192.168.2.16	73.44.84.145
May 6, 2024 04:56:53.023313999 CEST	50483	21	192.168.2.16	73.44.84.145
May 6, 2024 04:56:53.023466110 CEST	50484	21	192.168.2.16	117.5.105.172
May 6, 2024 04:56:53.023559093 CEST	50485	2121	192.168.2.16	20.106.148.131
May 6, 2024 04:56:53.023561001 CEST	50486	2121	192.168.2.16	117.5.105.172
May 6, 2024 04:56:53.023761988 CEST	50487	2121	192.168.2.16	85.6.142.168
May 6, 2024 04:56:53.023825884 CEST	50488	21	192.168.2.16	24.17.76.59
May 6, 2024 04:56:53.023905993 CEST	50489	2121	192.168.2.16	218.147.235.186
May 6, 2024 04:56:53.024000883 CEST	50490	2121	192.168.2.16	24.17.76.59
May 6, 2024 04:56:53.024075031 CEST	50491	21	192.168.2.16	106.214.7.190
May 6, 2024 04:56:53.024143934 CEST	50492	2121	192.168.2.16	106.214.7.190
May 6, 2024 04:56:53.024281979 CEST	50493	21	192.168.2.16	211.210.139.133
May 6, 2024 04:56:53.024401903 CEST	50494	2121	192.168.2.16	211.210.139.133
May 6, 2024 04:56:53.024466038 CEST	50495	2121	192.168.2.16	85.244.169.185
May 6, 2024 04:56:53.024497986 CEST	50496	21	192.168.2.16	85.244.169.185
May 6, 2024 04:56:53.024687052 CEST	50498	2121	192.168.2.16	149.154.65.23
May 6, 2024 04:56:53.024770021 CEST	50499	21	192.168.2.16	191.223.41.72
May 6, 2024 04:56:53.024826050 CEST	50500	2121	192.168.2.16	191.223.41.72
May 6, 2024 04:56:53.024940014 CEST	50502	21	192.168.2.16	36.39.190.158
May 6, 2024 04:56:53.025053024 CEST	50503	2121	192.168.2.16	36.39.190.158
May 6, 2024 04:56:53.025252104 CEST	50505	2121	192.168.2.16	83.136.148.89
May 6, 2024 04:56:53.025254011 CEST	50504	21	192.168.2.16	83.136.148.89
May 6, 2024 04:56:53.025388956 CEST	50506	21	192.168.2.16	1.85.248.100
May 6, 2024 04:56:53.025443077 CEST	50507	2121	192.168.2.16	1.85.248.100
May 6, 2024 04:56:53.025628090 CEST	50508	21	192.168.2.16	69.11.194.63
May 6, 2024 04:56:53.025674105 CEST	50497	21	192.168.2.16	149.154.65.23
May 6, 2024 04:56:53.025676012 CEST	50509	2121	192.168.2.16	69.11.194.63
May 6, 2024 04:56:53.025727987 CEST	50510	21	192.168.2.16	218.147.235.186
May 6, 2024 04:56:53.025774956 CEST	50501	21	192.168.2.16	85.6.142.168
May 6, 2024 04:56:53.025825977 CEST	50511	21	192.168.2.16	20.106.148.131
May 6, 2024 04:56:53.035022020 CEST	50339	2121	192.168.2.16	193.175.238.88
May 6, 2024 04:56:53.036011934 CEST	50512	21	192.168.2.16	154.83.2.90
May 6, 2024 04:56:53.038268089 CEST	50513	2121	192.168.2.16	154.83.2.90
May 6, 2024 04:56:53.038563013 CEST	50514	21	192.168.2.16	39.127.143.189
May 6, 2024 04:56:53.038691044 CEST	50515	2121	192.168.2.16	39.127.143.189
May 6, 2024 04:56:53.038834095 CEST	50516	21	192.168.2.16	211.218.72.245
May 6, 2024 04:56:53.038876057 CEST	50517	2121	192.168.2.16	211.218.72.245
May 6, 2024 04:56:53.039163113 CEST	50518	21	192.168.2.16	173.75.32.106
May 6, 2024 04:56:53.052457094 CEST	21	50435	45.87.1.166	192.168.2.16
May 6, 2024 04:56:53.052751064 CEST	50519	2121	192.168.2.16	173.75.32.106
May 6, 2024 04:56:53.052896976 CEST	50522	2121	192.168.2.16	98.45.130.150
May 6, 2024 04:56:53.052917957 CEST	50520	21	192.168.2.16	179.223.58.150
May 6, 2024 04:56:53.052959919 CEST	50523	21	192.168.2.16	98.45.130.150
May 6, 2024 04:56:53.053044081 CEST	50521	2121	192.168.2.16	179.223.58.150
May 6, 2024 04:56:53.053044081 CEST	50524	21	192.168.2.16	213.112.243.210
May 6, 2024 04:56:53.053131104 CEST	2121	50447	34.128.145.40	192.168.2.16
May 6, 2024 04:56:53.053139925 CEST	50525	21	192.168.2.16	67.170.205.145
May 6, 2024 04:56:53.053162098 CEST	50526	2121	192.168.2.16	67.170.205.145
May 6, 2024 04:56:53.053328991 CEST	50528	2121	192.168.2.16	20.150.153.193
May 6, 2024 04:56:53.053329945 CEST	50527	2121	192.168.2.16	213.112.243.210
May 6, 2024 04:56:53.053349972 CEST	2121	50450	34.128.145.40	192.168.2.16
May 6, 2024 04:56:53.053400040 CEST	50529	21	192.168.2.16	64.225.92.66
May 6, 2024 04:56:53.053416014 CEST	50450	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:53.053437948 CEST	50530	21	192.168.2.16	20.150.153.193
May 6, 2024 04:56:53.053474903 CEST	50531	2121	192.168.2.16	64.225.92.66
May 6, 2024 04:56:53.053510904 CEST	50532	21	192.168.2.16	73.248.162.45
May 6, 2024 04:56:53.053730011 CEST	50533	2121	192.168.2.16	73.248.162.45
May 6, 2024 04:56:53.053786039 CEST	50534	21	192.168.2.16	98.16.119.74
May 6, 2024 04:56:53.053833961 CEST	50535	2121	192.168.2.16	98.16.119.74
May 6, 2024 04:56:53.053942919 CEST	50536	21	192.168.2.16	189.165.22.222
May 6, 2024 04:56:53.054033041 CEST	50537	2121	192.168.2.16	189.165.22.222
May 6, 2024 04:56:53.054104090 CEST	50538	21	192.168.2.16	182.98.150.37
May 6, 2024 04:56:53.054166079 CEST	50539	2121	192.168.2.16	182.98.150.37
May 6, 2024 04:56:53.054218054 CEST	50540	21	192.168.2.16	80.31.8.165
May 6, 2024 04:56:53.054275990 CEST	50541	2121	192.168.2.16	80.31.8.165
May 6, 2024 04:56:53.054287910 CEST	50542	21	192.168.2.16	221.168.159.170
May 6, 2024 04:56:53.056404114 CEST	21	50448	34.128.145.40	192.168.2.16
May 6, 2024 04:56:53.056718111 CEST	21	50451	34.128.145.40	192.168.2.16
May 6, 2024 04:56:53.056778908 CEST	50451	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:53.066988945 CEST	50358	21	192.168.2.16	130.61.85.191
May 6, 2024 04:56:53.067622900 CEST	50543	2121	192.168.2.16	221.168.159.170
May 6, 2024 04:56:53.067745924 CEST	50544	21	192.168.2.16	116.123.90.217
May 6, 2024 04:56:53.067847967 CEST	50545	2121	192.168.2.16	116.123.90.217
May 6, 2024 04:56:53.067903996 CEST	50546	21	192.168.2.16	1.80.113.33
May 6, 2024 04:56:53.067975044 CEST	50547	2121	192.168.2.16	1.80.113.33
May 6, 2024 04:56:53.068058968 CEST	50548	21	192.168.2.16	175.117.140.51
May 6, 2024 04:56:53.068118095 CEST	50550	21	192.168.2.16	86.120.6.251
May 6, 2024 04:56:53.068133116 CEST	50549	2121	192.168.2.16	175.117.140.51
May 6, 2024 04:56:53.082607985 CEST	50551	2121	192.168.2.16	86.120.6.251
May 6, 2024 04:56:53.082668066 CEST	50552	21	192.168.2.16	93.219.17.233
May 6, 2024 04:56:53.082782984 CEST	50553	2121	192.168.2.16	93.219.17.233
May 6, 2024 04:56:53.082854986 CEST	50554	21	192.168.2.16	115.8.11.239
May 6, 2024 04:56:53.082907915 CEST	50555	2121	192.168.2.16	115.8.11.239
May 6, 2024 04:56:53.082945108 CEST	50556	21	192.168.2.16	89.174.3.24
May 6, 2024 04:56:53.089164972 CEST	2121	50394	67.188.255.137	192.168.2.16
May 6, 2024 04:56:53.089605093 CEST	21	50393	67.188.255.137	192.168.2.16
May 6, 2024 04:56:53.097965002 CEST	50342	21	192.168.2.16	189.172.31.228
May 6, 2024 04:56:53.121042967 CEST	21	50449	109.205.180.149	192.168.2.16
May 6, 2024 04:56:53.121114016 CEST	50449	21	192.168.2.16	109.205.180.149
May 6, 2024 04:56:53.121179104 CEST	21	50296	109.205.180.149	192.168.2.16
May 6, 2024 04:56:53.121232986 CEST	50296	21	192.168.2.16	109.205.180.149
May 6, 2024 04:56:53.122414112 CEST	21	50296	109.205.180.149	192.168.2.16
May 6, 2024 04:56:53.122461081 CEST	50296	21	192.168.2.16	109.205.180.149
May 6, 2024 04:56:53.145126104 CEST	21	50466	98.96.97.42	192.168.2.16
May 6, 2024 04:56:53.145381927 CEST	2121	50471	98.96.97.42	192.168.2.16
May 6, 2024 04:56:53.145987988 CEST	50354	21	192.168.2.16	220.91.126.18
May 6, 2024 04:56:53.145987988 CEST	50359	2121	192.168.2.16	130.61.85.191
May 6, 2024 04:56:53.146018982 CEST	50252	2121	192.168.2.16	168.220.94.137
May 6, 2024 04:56:53.146095037 CEST	50251	21	192.168.2.16	168.220.94.137
May 6, 2024 04:56:53.146465063 CEST	50557	2121	192.168.2.16	89.174.3.24
May 6, 2024 04:56:53.146508932 CEST	50558	21	192.168.2.16	190.92.153.181
May 6, 2024 04:56:53.153291941 CEST	21	50469	206.71.159.50	192.168.2.16
May 6, 2024 04:56:53.154139996 CEST	2121	50473	206.71.159.50	192.168.2.16
May 6, 2024 04:56:53.163130999 CEST	2121	50450	34.128.145.40	192.168.2.16
May 6, 2024 04:56:53.163197041 CEST	50450	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:53.163264990 CEST	50450	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:53.163424015 CEST	50559	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:53.167898893 CEST	21	50451	34.128.145.40	192.168.2.16
May 6, 2024 04:56:53.167968035 CEST	50451	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:53.168016911 CEST	50451	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:53.168158054 CEST	50560	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:53.176963091 CEST	50335	2121	192.168.2.16	110.136.96.12
May 6, 2024 04:56:53.207916975 CEST	2121	50373	124.49.54.1	192.168.2.16
May 6, 2024 04:56:53.208991051 CEST	50343	2121	192.168.2.16	189.172.31.228
May 6, 2024 04:56:53.208997011 CEST	50436	21	192.168.2.16	83.57.93.232
May 6, 2024 04:56:53.209285975 CEST	50437	2121	192.168.2.16	83.57.93.232
May 6, 2024 04:56:53.239332914 CEST	2121	50505	83.136.148.89	192.168.2.16
May 6, 2024 04:56:53.240989923 CEST	50413	21	192.168.2.16	45.161.140.137
May 6, 2024 04:56:53.257010937 CEST	50344	21	192.168.2.16	183.141.107.50
May 6, 2024 04:56:53.257622004 CEST	21	50251	168.220.94.137	192.168.2.16
May 6, 2024 04:56:53.257633924 CEST	2121	50252	168.220.94.137	192.168.2.16
May 6, 2024 04:56:53.272825956 CEST	2121	50450	34.128.145.40	192.168.2.16
May 6, 2024 04:56:53.272994995 CEST	2121	50559	34.128.145.40	192.168.2.16
May 6, 2024 04:56:53.273056030 CEST	50559	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:53.277673006 CEST	21	50451	34.128.145.40	192.168.2.16
May 6, 2024 04:56:53.278564930 CEST	21	50560	34.128.145.40	192.168.2.16
May 6, 2024 04:56:53.278624058 CEST	50560	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:53.285336018 CEST	2121	50498	149.154.65.23	192.168.2.16
May 6, 2024 04:56:53.285851955 CEST	21	50497	149.154.65.23	192.168.2.16
May 6, 2024 04:56:53.285917044 CEST	50497	21	192.168.2.16	149.154.65.23
May 6, 2024 04:56:53.288970947 CEST	50414	2121	192.168.2.16	45.161.140.137
May 6, 2024 04:56:53.289068937 CEST	50365	2121	192.168.2.16	188.214.156.147
May 6, 2024 04:56:53.294599056 CEST	21	50446	103.109.6.215	192.168.2.16
May 6, 2024 04:56:53.294704914 CEST	50446	21	192.168.2.16	103.109.6.215
May 6, 2024 04:56:53.295974016 CEST	50442	21	192.168.2.16	103.165.157.224
May 6, 2024 04:56:53.296555042 CEST	21	50358	130.61.85.191	192.168.2.16
May 6, 2024 04:56:53.296586037 CEST	50346	2121	192.168.2.16	183.141.107.50
May 6, 2024 04:56:53.320055008 CEST	50357	2121	192.168.2.16	220.91.126.18
May 6, 2024 04:56:53.335992098 CEST	50443	2121	192.168.2.16	103.165.157.224
May 6, 2024 04:56:53.338275909 CEST	2121	50494	211.210.139.133	192.168.2.16
May 6, 2024 04:56:53.338824034 CEST	2121	50468	122.41.139.45	192.168.2.16
May 6, 2024 04:56:53.346448898 CEST	21	50472	211.44.88.172	192.168.2.16
May 6, 2024 04:56:53.346502066 CEST	2121	50474	211.44.88.172	192.168.2.16
May 6, 2024 04:56:53.349210978 CEST	21	50516	211.218.72.245	192.168.2.16
May 6, 2024 04:56:53.349617004 CEST	21	50514	39.127.143.189	192.168.2.16
May 6, 2024 04:56:53.350817919 CEST	2121	50517	211.218.72.245	192.168.2.16
May 6, 2024 04:56:53.351275921 CEST	21	50493	211.210.139.133	192.168.2.16
May 6, 2024 04:56:53.354682922 CEST	50440	21	192.168.2.16	149.224.112.238
May 6, 2024 04:56:53.355130911 CEST	21	50542	221.168.159.170	192.168.2.16
May 6, 2024 04:56:53.357295036 CEST	21	50449	109.205.180.149	192.168.2.16
May 6, 2024 04:56:53.357474089 CEST	50449	21	192.168.2.16	109.205.180.149
May 6, 2024 04:56:53.366425991 CEST	2121	50515	39.127.143.189	192.168.2.16
May 6, 2024 04:56:53.370307922 CEST	2121	50543	221.168.159.170	192.168.2.16
May 6, 2024 04:56:53.375488043 CEST	2121	50359	130.61.85.191	192.168.2.16
May 6, 2024 04:56:53.383079052 CEST	2121	50559	34.128.145.40	192.168.2.16
May 6, 2024 04:56:53.383140087 CEST	50559	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:53.383222103 CEST	50559	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:53.383439064 CEST	50561	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:53.389400959 CEST	21	50560	34.128.145.40	192.168.2.16
May 6, 2024 04:56:53.389446020 CEST	50560	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:53.389508009 CEST	50560	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:53.389667034 CEST	50562	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:53.393681049 CEST	21	50554	115.8.11.239	192.168.2.16
May 6, 2024 04:56:53.403383970 CEST	2121	50555	115.8.11.239	192.168.2.16
May 6, 2024 04:56:53.415987015 CEST	50441	2121	192.168.2.16	149.224.112.238
May 6, 2024 04:56:53.445090055 CEST	50423	21	192.168.2.16	181.171.153.111
May 6, 2024 04:56:53.453423977 CEST	21	50354	220.91.126.18	192.168.2.16
May 6, 2024 04:56:53.461004019 CEST	50424	2121	192.168.2.16	181.171.153.111
May 6, 2024 04:56:53.462791920 CEST	21	50413	45.161.140.137	192.168.2.16
May 6, 2024 04:56:53.477626085 CEST	50295	21	192.168.2.16	216.117.162.236
May 6, 2024 04:56:53.478288889 CEST	50563	21	192.168.2.16	216.117.162.236
May 6, 2024 04:56:53.481539965 CEST	50348	21	192.168.2.16	45.120.174.5
May 6, 2024 04:56:53.493694067 CEST	2121	50559	34.128.145.40	192.168.2.16
May 6, 2024 04:56:53.493871927 CEST	2121	50561	34.128.145.40	192.168.2.16
May 6, 2024 04:56:53.493969917 CEST	50561	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:53.499131918 CEST	21	50560	34.128.145.40	192.168.2.16
May 6, 2024 04:56:53.499145031 CEST	21	50562	34.128.145.40	192.168.2.16
May 6, 2024 04:56:53.499231100 CEST	50562	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:53.508994102 CEST	50349	2121	192.168.2.16	45.120.174.5
May 6, 2024 04:56:53.509192944 CEST	50380	2121	192.168.2.16	78.115.142.120
May 6, 2024 04:56:53.512737989 CEST	50379	21	192.168.2.16	78.115.142.120
May 6, 2024 04:56:53.512823105 CEST	2121	50414	45.161.140.137	192.168.2.16
May 6, 2024 04:56:53.533382893 CEST	2121	50365	188.214.156.147	192.168.2.16
May 6, 2024 04:56:53.552797079 CEST	2121	50335	110.136.96.12	192.168.2.16
May 6, 2024 04:56:53.590059996 CEST	50564	2121	192.168.2.16	190.92.153.181
May 6, 2024 04:56:53.590858936 CEST	21	50449	109.205.180.149	192.168.2.16
May 6, 2024 04:56:53.591010094 CEST	21	50449	109.205.180.149	192.168.2.16
May 6, 2024 04:56:53.604537010 CEST	2121	50561	34.128.145.40	192.168.2.16
May 6, 2024 04:56:53.604592085 CEST	50561	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:53.608829021 CEST	21	50562	34.128.145.40	192.168.2.16
May 6, 2024 04:56:53.608879089 CEST	50562	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:53.608969927 CEST	50394	2121	192.168.2.16	67.188.255.137
May 6, 2024 04:56:53.610351086 CEST	50393	21	192.168.2.16	67.188.255.137
May 6, 2024 04:56:53.610476971 CEST	50561	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:53.610569000 CEST	50449	21	192.168.2.16	109.205.180.149
May 6, 2024 04:56:53.610620975 CEST	50562	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:53.612008095 CEST	21	50563	216.117.162.236	192.168.2.16
May 6, 2024 04:56:53.612078905 CEST	50563	21	192.168.2.16	216.117.162.236
May 6, 2024 04:56:53.629026890 CEST	50565	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:53.629122019 CEST	50566	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:53.629987001 CEST	2121	50357	220.91.126.18	192.168.2.16
May 6, 2024 04:56:53.640862942 CEST	21	50442	103.165.157.224	192.168.2.16
May 6, 2024 04:56:53.647295952 CEST	50567	21	192.168.2.16	187.251.200.253
May 6, 2024 04:56:53.649970055 CEST	50352	21	192.168.2.16	98.122.64.212
May 6, 2024 04:56:53.650729895 CEST	50471	2121	192.168.2.16	98.96.97.42
May 6, 2024 04:56:53.652440071 CEST	21	50295	216.117.162.236	192.168.2.16
May 6, 2024 04:56:53.655967951 CEST	50466	21	192.168.2.16	98.96.97.42
May 6, 2024 04:56:53.663959026 CEST	21	50446	103.109.6.215	192.168.2.16
May 6, 2024 04:56:53.665746927 CEST	50446	21	192.168.2.16	103.109.6.215
May 6, 2024 04:56:53.665983915 CEST	50353	2121	192.168.2.16	98.122.64.212
May 6, 2024 04:56:53.665996075 CEST	50469	21	192.168.2.16	206.71.159.50
May 6, 2024 04:56:53.665998936 CEST	50473	2121	192.168.2.16	206.71.159.50
May 6, 2024 04:56:53.680917025 CEST	2121	50443	103.165.157.224	192.168.2.16
May 6, 2024 04:56:53.684210062 CEST	50568	2121	192.168.2.16	187.251.200.253
May 6, 2024 04:56:53.713979959 CEST	50373	2121	192.168.2.16	124.49.54.1
May 6, 2024 04:56:53.715811014 CEST	21	50423	181.171.153.111	192.168.2.16
May 6, 2024 04:56:53.720073938 CEST	2121	50561	34.128.145.40	192.168.2.16
May 6, 2024 04:56:53.720890999 CEST	21	50562	34.128.145.40	192.168.2.16
May 6, 2024 04:56:53.730782032 CEST	2121	50424	181.171.153.111	192.168.2.16
May 6, 2024 04:56:53.737169027 CEST	2121	50380	78.115.142.120	192.168.2.16
May 6, 2024 04:56:53.740782976 CEST	21	50379	78.115.142.120	192.168.2.16
May 6, 2024 04:56:53.740794897 CEST	21	50566	34.128.145.40	192.168.2.16
May 6, 2024 04:56:53.740804911 CEST	2121	50565	34.128.145.40	192.168.2.16
May 6, 2024 04:56:53.740854979 CEST	50566	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:53.740875959 CEST	50565	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:53.745992899 CEST	50505	2121	192.168.2.16	83.136.148.89
May 6, 2024 04:56:53.765042067 CEST	21	50563	216.117.162.236	192.168.2.16
May 6, 2024 04:56:53.768485069 CEST	50563	21	192.168.2.16	216.117.162.236
May 6, 2024 04:56:53.784374952 CEST	21	50295	216.117.162.236	192.168.2.16
May 6, 2024 04:56:53.784430027 CEST	50295	21	192.168.2.16	216.117.162.236
May 6, 2024 04:56:53.784780025 CEST	21	50295	216.117.162.236	192.168.2.16
May 6, 2024 04:56:53.784821987 CEST	50295	21	192.168.2.16	216.117.162.236
May 6, 2024 04:56:53.785170078 CEST	21	50295	216.117.162.236	192.168.2.16
May 6, 2024 04:56:53.785203934 CEST	50295	21	192.168.2.16	216.117.162.236
May 6, 2024 04:56:53.789129019 CEST	2121	50471	98.96.97.42	192.168.2.16
May 6, 2024 04:56:53.790513992 CEST	21	50295	216.117.162.236	192.168.2.16
May 6, 2024 04:56:53.790559053 CEST	50295	21	192.168.2.16	216.117.162.236
May 6, 2024 04:56:53.790679932 CEST	2121	50394	67.188.255.137	192.168.2.16
May 6, 2024 04:56:53.791309118 CEST	21	50393	67.188.255.137	192.168.2.16
May 6, 2024 04:56:53.793970108 CEST	50498	2121	192.168.2.16	149.154.65.23
May 6, 2024 04:56:53.794183016 CEST	21	50466	98.96.97.42	192.168.2.16
May 6, 2024 04:56:53.809986115 CEST	50358	21	192.168.2.16	130.61.85.191
May 6, 2024 04:56:53.812478065 CEST	2121	50473	206.71.159.50	192.168.2.16
May 6, 2024 04:56:53.812541008 CEST	21	50469	206.71.159.50	192.168.2.16
May 6, 2024 04:56:53.842977047 CEST	50494	2121	192.168.2.16	211.210.139.133
May 6, 2024 04:56:53.842994928 CEST	50468	2121	192.168.2.16	122.41.139.45
May 6, 2024 04:56:53.850482941 CEST	21	50566	34.128.145.40	192.168.2.16
May 6, 2024 04:56:53.850533962 CEST	50566	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:53.850555897 CEST	2121	50565	34.128.145.40	192.168.2.16
May 6, 2024 04:56:53.850600958 CEST	50565	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:53.854696989 CEST	50566	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:53.854780912 CEST	50565	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:53.857970953 CEST	50472	21	192.168.2.16	211.44.88.172
May 6, 2024 04:56:53.858644009 CEST	50493	21	192.168.2.16	211.210.139.133
May 6, 2024 04:56:53.863964081 CEST	50474	2121	192.168.2.16	211.44.88.172
May 6, 2024 04:56:53.863969088 CEST	50517	2121	192.168.2.16	211.218.72.245
May 6, 2024 04:56:53.863981962 CEST	50514	21	192.168.2.16	39.127.143.189
May 6, 2024 04:56:53.863982916 CEST	50542	21	192.168.2.16	221.168.159.170
May 6, 2024 04:56:53.863984108 CEST	50516	21	192.168.2.16	211.218.72.245
May 6, 2024 04:56:53.874002934 CEST	50543	2121	192.168.2.16	221.168.159.170
May 6, 2024 04:56:53.874025106 CEST	50515	2121	192.168.2.16	39.127.143.189
May 6, 2024 04:56:53.879832029 CEST	50569	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:53.879851103 CEST	50570	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:53.882991076 CEST	21	50449	109.205.180.149	192.168.2.16
May 6, 2024 04:56:53.894961119 CEST	50359	2121	192.168.2.16	130.61.85.191
May 6, 2024 04:56:53.895461082 CEST	50554	21	192.168.2.16	115.8.11.239
May 6, 2024 04:56:53.902656078 CEST	21	50563	216.117.162.236	192.168.2.16
May 6, 2024 04:56:53.903085947 CEST	21	50563	216.117.162.236	192.168.2.16
May 6, 2024 04:56:53.903253078 CEST	50563	21	192.168.2.16	216.117.162.236
May 6, 2024 04:56:53.908955097 CEST	50555	2121	192.168.2.16	115.8.11.239
May 6, 2024 04:56:53.953979015 CEST	50360	2121	192.168.2.16	41.97.219.244
May 6, 2024 04:56:53.955954075 CEST	50354	21	192.168.2.16	220.91.126.18
May 6, 2024 04:56:53.955986023 CEST	50361	21	192.168.2.16	41.97.219.244
May 6, 2024 04:56:53.960067987 CEST	2121	50505	83.136.148.89	192.168.2.16
May 6, 2024 04:56:53.964215994 CEST	21	50566	34.128.145.40	192.168.2.16
May 6, 2024 04:56:53.964432001 CEST	2121	50565	34.128.145.40	192.168.2.16
May 6, 2024 04:56:53.969968081 CEST	50413	21	192.168.2.16	45.161.140.137
May 6, 2024 04:56:53.989062071 CEST	2121	50569	34.128.145.40	192.168.2.16
May 6, 2024 04:56:53.989126921 CEST	50569	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:53.989445925 CEST	21	50570	34.128.145.40	192.168.2.16
May 6, 2024 04:56:53.989495039 CEST	50570	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:54.017971039 CEST	50452	21	192.168.2.16	20.111.46.231
May 6, 2024 04:56:54.017996073 CEST	50455	2121	192.168.2.16	96.91.172.122
May 6, 2024 04:56:54.017996073 CEST	50464	21	192.168.2.16	216.67.24.140
May 6, 2024 04:56:54.017996073 CEST	50456	21	192.168.2.16	117.69.72.226
May 6, 2024 04:56:54.017997980 CEST	50458	2121	192.168.2.16	187.126.142.208
May 6, 2024 04:56:54.017998934 CEST	50454	21	192.168.2.16	96.91.172.122
May 6, 2024 04:56:54.019187927 CEST	50465	2121	192.168.2.16	216.67.24.140
May 6, 2024 04:56:54.019188881 CEST	50462	2121	192.168.2.16	222.190.5.46
May 6, 2024 04:56:54.019188881 CEST	50470	21	192.168.2.16	67.180.251.139
May 6, 2024 04:56:54.019191980 CEST	50453	2121	192.168.2.16	20.111.46.231
May 6, 2024 04:56:54.019191980 CEST	50459	21	192.168.2.16	187.126.142.208
May 6, 2024 04:56:54.019191980 CEST	50461	2121	192.168.2.16	51.105.105.242
May 6, 2024 04:56:54.019963980 CEST	50457	2121	192.168.2.16	117.69.72.226
May 6, 2024 04:56:54.019982100 CEST	50467	21	192.168.2.16	122.41.139.45
May 6, 2024 04:56:54.019983053 CEST	50460	21	192.168.2.16	51.105.105.242
May 6, 2024 04:56:54.019984961 CEST	50463	21	192.168.2.16	222.190.5.46
May 6, 2024 04:56:54.020052910 CEST	50414	2121	192.168.2.16	45.161.140.137
May 6, 2024 04:56:54.031068087 CEST	2121	50373	124.49.54.1	192.168.2.16
May 6, 2024 04:56:54.033972025 CEST	50478	21	192.168.2.16	101.249.29.72
May 6, 2024 04:56:54.033974886 CEST	50475	2121	192.168.2.16	67.180.251.139
May 6, 2024 04:56:54.033988953 CEST	50477	21	192.168.2.16	158.23.81.6
May 6, 2024 04:56:54.033988953 CEST	50483	21	192.168.2.16	73.44.84.145
May 6, 2024 04:56:54.033992052 CEST	50485	2121	192.168.2.16	20.106.148.131
May 6, 2024 04:56:54.033999920 CEST	50481	2121	192.168.2.16	119.185.45.247
May 6, 2024 04:56:54.033999920 CEST	50489	2121	192.168.2.16	218.147.235.186
May 6, 2024 04:56:54.034024000 CEST	50484	21	192.168.2.16	117.5.105.172
May 6, 2024 04:56:54.034024954 CEST	50507	2121	192.168.2.16	1.85.248.100
May 6, 2024 04:56:54.034025908 CEST	50500	2121	192.168.2.16	191.223.41.72
May 6, 2024 04:56:54.034025908 CEST	50509	2121	192.168.2.16	69.11.194.63
May 6, 2024 04:56:54.034027100 CEST	50492	2121	192.168.2.16	106.214.7.190
May 6, 2024 04:56:54.034025908 CEST	50501	21	192.168.2.16	85.6.142.168
May 6, 2024 04:56:54.034028053 CEST	50476	2121	192.168.2.16	158.23.81.6
May 6, 2024 04:56:54.034028053 CEST	50479	2121	192.168.2.16	101.249.29.72
May 6, 2024 04:56:54.034028053 CEST	50482	2121	192.168.2.16	73.44.84.145
May 6, 2024 04:56:54.034029961 CEST	50488	21	192.168.2.16	24.17.76.59
May 6, 2024 04:56:54.034029961 CEST	50502	21	192.168.2.16	36.39.190.158
May 6, 2024 04:56:54.034061909 CEST	50490	2121	192.168.2.16	24.17.76.59
May 6, 2024 04:56:54.034061909 CEST	50365	2121	192.168.2.16	188.214.156.147
May 6, 2024 04:56:54.034061909 CEST	50506	21	192.168.2.16	1.85.248.100
May 6, 2024 04:56:54.034064054 CEST	50499	21	192.168.2.16	191.223.41.72
May 6, 2024 04:56:54.034064054 CEST	50480	21	192.168.2.16	119.185.45.247
May 6, 2024 04:56:54.034065008 CEST	50511	21	192.168.2.16	20.106.148.131
May 6, 2024 04:56:54.034065008 CEST	50487	2121	192.168.2.16	85.6.142.168
May 6, 2024 04:56:54.034065008 CEST	50495	2121	192.168.2.16	85.244.169.185
May 6, 2024 04:56:54.034065008 CEST	50486	2121	192.168.2.16	117.5.105.172
May 6, 2024 04:56:54.034065008 CEST	50510	21	192.168.2.16	218.147.235.186
May 6, 2024 04:56:54.034066916 CEST	50496	21	192.168.2.16	85.244.169.185
May 6, 2024 04:56:54.034066916 CEST	50508	21	192.168.2.16	69.11.194.63
May 6, 2024 04:56:54.034066916 CEST	50504	21	192.168.2.16	83.136.148.89
May 6, 2024 04:56:54.034068108 CEST	50491	21	192.168.2.16	106.214.7.190
May 6, 2024 04:56:54.034068108 CEST	50503	2121	192.168.2.16	36.39.190.158
May 6, 2024 04:56:54.036199093 CEST	21	50446	103.109.6.215	192.168.2.16
May 6, 2024 04:56:54.036341906 CEST	50446	21	192.168.2.16	103.109.6.215
May 6, 2024 04:56:54.036622047 CEST	50571	21	192.168.2.16	103.109.6.215
May 6, 2024 04:56:54.039570093 CEST	21	50358	130.61.85.191	192.168.2.16
May 6, 2024 04:56:54.039917946 CEST	50572	21	192.168.2.16	20.125.78.0
May 6, 2024 04:56:54.049983025 CEST	50512	21	192.168.2.16	154.83.2.90
May 6, 2024 04:56:54.050005913 CEST	50518	21	192.168.2.16	173.75.32.106
May 6, 2024 04:56:54.050008059 CEST	50513	2121	192.168.2.16	154.83.2.90
May 6, 2024 04:56:54.055131912 CEST	2121	50498	149.154.65.23	192.168.2.16
May 6, 2024 04:56:54.065983057 CEST	50519	2121	192.168.2.16	173.75.32.106
May 6, 2024 04:56:54.065985918 CEST	50522	2121	192.168.2.16	98.45.130.150
May 6, 2024 04:56:54.066006899 CEST	50524	21	192.168.2.16	213.112.243.210
May 6, 2024 04:56:54.066006899 CEST	50526	2121	192.168.2.16	67.170.205.145
May 6, 2024 04:56:54.066008091 CEST	50520	21	192.168.2.16	179.223.58.150
May 6, 2024 04:56:54.066009998 CEST	50525	21	192.168.2.16	67.170.205.145
May 6, 2024 04:56:54.066009045 CEST	50529	21	192.168.2.16	64.225.92.66
May 6, 2024 04:56:54.066040993 CEST	50528	2121	192.168.2.16	20.150.153.193
May 6, 2024 04:56:54.066041946 CEST	50521	2121	192.168.2.16	179.223.58.150
May 6, 2024 04:56:54.066042900 CEST	50534	21	192.168.2.16	98.16.119.74
May 6, 2024 04:56:54.066045046 CEST	50527	2121	192.168.2.16	213.112.243.210
May 6, 2024 04:56:54.066045046 CEST	50537	2121	192.168.2.16	189.165.22.222
May 6, 2024 04:56:54.066046000 CEST	50532	21	192.168.2.16	73.248.162.45
May 6, 2024 04:56:54.066046000 CEST	50541	2121	192.168.2.16	80.31.8.165
May 6, 2024 04:56:54.066045046 CEST	50539	2121	192.168.2.16	182.98.150.37
May 6, 2024 04:56:54.066046000 CEST	50531	2121	192.168.2.16	64.225.92.66
May 6, 2024 04:56:54.066046000 CEST	50535	2121	192.168.2.16	98.16.119.74
May 6, 2024 04:56:54.066046000 CEST	50536	21	192.168.2.16	189.165.22.222
May 6, 2024 04:56:54.066049099 CEST	50523	21	192.168.2.16	98.45.130.150
May 6, 2024 04:56:54.066046000 CEST	50538	21	192.168.2.16	182.98.150.37
May 6, 2024 04:56:54.066049099 CEST	50530	21	192.168.2.16	20.150.153.193
May 6, 2024 04:56:54.067209959 CEST	50533	2121	192.168.2.16	73.248.162.45
May 6, 2024 04:56:54.067213058 CEST	50540	21	192.168.2.16	80.31.8.165
May 6, 2024 04:56:54.076997995 CEST	21	50563	216.117.162.236	192.168.2.16
May 6, 2024 04:56:54.081981897 CEST	50547	2121	192.168.2.16	1.80.113.33
May 6, 2024 04:56:54.081983089 CEST	50550	21	192.168.2.16	86.120.6.251
May 6, 2024 04:56:54.081984043 CEST	50545	2121	192.168.2.16	116.123.90.217
May 6, 2024 04:56:54.081999063 CEST	50549	2121	192.168.2.16	175.117.140.51
May 6, 2024 04:56:54.082001925 CEST	50546	21	192.168.2.16	1.80.113.33
May 6, 2024 04:56:54.082004070 CEST	50552	21	192.168.2.16	93.219.17.233
May 6, 2024 04:56:54.082005978 CEST	50544	21	192.168.2.16	116.123.90.217
May 6, 2024 04:56:54.083138943 CEST	50553	2121	192.168.2.16	93.219.17.233
May 6, 2024 04:56:54.083144903 CEST	50548	21	192.168.2.16	175.117.140.51
May 6, 2024 04:56:54.083144903 CEST	50551	2121	192.168.2.16	86.120.6.251
May 6, 2024 04:56:54.083144903 CEST	50556	21	192.168.2.16	89.174.3.24
May 6, 2024 04:56:54.099083900 CEST	2121	50569	34.128.145.40	192.168.2.16
May 6, 2024 04:56:54.099133968 CEST	21	50570	34.128.145.40	192.168.2.16
May 6, 2024 04:56:54.099147081 CEST	50569	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:54.099183083 CEST	50570	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:54.099268913 CEST	50570	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:54.099412918 CEST	50569	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:54.099581003 CEST	50573	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:54.099647045 CEST	50574	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:54.125813007 CEST	2121	50359	130.61.85.191	192.168.2.16
May 6, 2024 04:56:54.126373053 CEST	50575	2121	192.168.2.16	20.125.78.0
May 6, 2024 04:56:54.145009041 CEST	50357	2121	192.168.2.16	220.91.126.18
May 6, 2024 04:56:54.154390097 CEST	2121	50494	211.210.139.133	192.168.2.16
May 6, 2024 04:56:54.157977104 CEST	50442	21	192.168.2.16	103.165.157.224
May 6, 2024 04:56:54.160972118 CEST	50557	2121	192.168.2.16	89.174.3.24
May 6, 2024 04:56:54.165138960 CEST	50558	21	192.168.2.16	190.92.153.181
May 6, 2024 04:56:54.165397882 CEST	21	50542	221.168.159.170	192.168.2.16
May 6, 2024 04:56:54.174576998 CEST	21	50514	39.127.143.189	192.168.2.16
May 6, 2024 04:56:54.175961971 CEST	21	50516	211.218.72.245	192.168.2.16
May 6, 2024 04:56:54.176450014 CEST	2121	50468	122.41.139.45	192.168.2.16
May 6, 2024 04:56:54.177634001 CEST	2121	50543	221.168.159.170	192.168.2.16
May 6, 2024 04:56:54.177776098 CEST	2121	50517	211.218.72.245	192.168.2.16
May 6, 2024 04:56:54.184056997 CEST	21	50493	211.210.139.133	192.168.2.16
May 6, 2024 04:56:54.191869974 CEST	21	50413	45.161.140.137	192.168.2.16
May 6, 2024 04:56:54.192980051 CEST	50443	2121	192.168.2.16	103.165.157.224
May 6, 2024 04:56:54.196139097 CEST	50369	21	192.168.2.16	84.119.151.112
May 6, 2024 04:56:54.197499990 CEST	21	50472	211.44.88.172	192.168.2.16
May 6, 2024 04:56:54.199786901 CEST	2121	50515	39.127.143.189	192.168.2.16
May 6, 2024 04:56:54.203372955 CEST	2121	50474	211.44.88.172	192.168.2.16
May 6, 2024 04:56:54.206867933 CEST	21	50554	115.8.11.239	192.168.2.16
May 6, 2024 04:56:54.209227085 CEST	50576	21	192.168.2.16	178.186.179.18
May 6, 2024 04:56:54.209239006 CEST	2121	50569	34.128.145.40	192.168.2.16
May 6, 2024 04:56:54.209315062 CEST	2121	50574	34.128.145.40	192.168.2.16
May 6, 2024 04:56:54.209326982 CEST	21	50573	34.128.145.40	192.168.2.16
May 6, 2024 04:56:54.209384918 CEST	50574	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:54.211137056 CEST	50573	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:54.224984884 CEST	50423	21	192.168.2.16	181.171.153.111
May 6, 2024 04:56:54.229624033 CEST	2121	50555	115.8.11.239	192.168.2.16
May 6, 2024 04:56:54.240962982 CEST	50371	21	192.168.2.16	91.207.42.121
May 6, 2024 04:56:54.240977049 CEST	50372	2121	192.168.2.16	91.207.42.121
May 6, 2024 04:56:54.240981102 CEST	50370	2121	192.168.2.16	84.119.151.112
May 6, 2024 04:56:54.240992069 CEST	50424	2121	192.168.2.16	181.171.153.111
May 6, 2024 04:56:54.240992069 CEST	50380	2121	192.168.2.16	78.115.142.120
May 6, 2024 04:56:54.240993977 CEST	50379	21	192.168.2.16	78.115.142.120
May 6, 2024 04:56:54.244223118 CEST	2121	50414	45.161.140.137	192.168.2.16
May 6, 2024 04:56:54.256966114 CEST	50374	21	192.168.2.16	124.49.54.1
May 6, 2024 04:56:54.261921883 CEST	21	50354	220.91.126.18	192.168.2.16
May 6, 2024 04:56:54.272972107 CEST	50375	21	192.168.2.16	80.213.20.177
May 6, 2024 04:56:54.273328066 CEST	50577	2121	192.168.2.16	178.186.179.18
May 6, 2024 04:56:54.279244900 CEST	2121	50365	188.214.156.147	192.168.2.16
May 6, 2024 04:56:54.289429903 CEST	50578	21	192.168.2.16	89.58.52.251
May 6, 2024 04:56:54.289457083 CEST	50471	2121	192.168.2.16	98.96.97.42
May 6, 2024 04:56:54.289457083 CEST	50376	2121	192.168.2.16	80.213.20.177
May 6, 2024 04:56:54.304977894 CEST	50394	2121	192.168.2.16	67.188.255.137
May 6, 2024 04:56:54.304981947 CEST	50393	21	192.168.2.16	67.188.255.137
May 6, 2024 04:56:54.305003881 CEST	50466	21	192.168.2.16	98.96.97.42
May 6, 2024 04:56:54.305007935 CEST	50377	21	192.168.2.16	27.200.193.13
May 6, 2024 04:56:54.320552111 CEST	21	50573	34.128.145.40	192.168.2.16
May 6, 2024 04:56:54.320610046 CEST	50573	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:54.320679903 CEST	50573	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:54.320847034 CEST	50579	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:54.320983887 CEST	50378	2121	192.168.2.16	27.200.193.13
May 6, 2024 04:56:54.320992947 CEST	50473	2121	192.168.2.16	206.71.159.50
May 6, 2024 04:56:54.321002960 CEST	50469	21	192.168.2.16	206.71.159.50
May 6, 2024 04:56:54.323024035 CEST	2121	50574	34.128.145.40	192.168.2.16
May 6, 2024 04:56:54.323065042 CEST	50574	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:54.323904991 CEST	50574	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:54.324068069 CEST	50580	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:54.352008104 CEST	50381	21	192.168.2.16	73.178.202.135
May 6, 2024 04:56:54.352617025 CEST	50383	21	192.168.2.16	91.41.59.153
May 6, 2024 04:56:54.353395939 CEST	50382	2121	192.168.2.16	73.178.202.135
May 6, 2024 04:56:54.368973017 CEST	50384	2121	192.168.2.16	91.41.59.153
May 6, 2024 04:56:54.384792089 CEST	21	50571	103.109.6.215	192.168.2.16
May 6, 2024 04:56:54.384876966 CEST	50571	21	192.168.2.16	103.109.6.215
May 6, 2024 04:56:54.405392885 CEST	21	50446	103.109.6.215	192.168.2.16
May 6, 2024 04:56:54.405467033 CEST	21	50446	103.109.6.215	192.168.2.16
May 6, 2024 04:56:54.405522108 CEST	50446	21	192.168.2.16	103.109.6.215
May 6, 2024 04:56:54.427911997 CEST	2121	50471	98.96.97.42	192.168.2.16
May 6, 2024 04:56:54.429847002 CEST	21	50573	34.128.145.40	192.168.2.16
May 6, 2024 04:56:54.430459023 CEST	21	50579	34.128.145.40	192.168.2.16
May 6, 2024 04:56:54.430526018 CEST	50579	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:54.430983067 CEST	50570	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:54.430999041 CEST	50387	21	192.168.2.16	117.161.132.183
May 6, 2024 04:56:54.433888912 CEST	2121	50574	34.128.145.40	192.168.2.16
May 6, 2024 04:56:54.434530973 CEST	2121	50580	34.128.145.40	192.168.2.16
May 6, 2024 04:56:54.434592962 CEST	50580	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:54.443259001 CEST	21	50466	98.96.97.42	192.168.2.16
May 6, 2024 04:56:54.447666883 CEST	50388	2121	192.168.2.16	117.161.132.183
May 6, 2024 04:56:54.455661058 CEST	2121	50357	220.91.126.18	192.168.2.16
May 6, 2024 04:56:54.462567091 CEST	50505	2121	192.168.2.16	83.136.148.89
May 6, 2024 04:56:54.465338945 CEST	2121	50380	78.115.142.120	192.168.2.16
May 6, 2024 04:56:54.467173100 CEST	21	50497	149.154.65.23	192.168.2.16
May 6, 2024 04:56:54.467283010 CEST	50497	21	192.168.2.16	149.154.65.23
May 6, 2024 04:56:54.467358112 CEST	21	50379	78.115.142.120	192.168.2.16
May 6, 2024 04:56:54.467578888 CEST	21	50469	206.71.159.50	192.168.2.16
May 6, 2024 04:56:54.467638016 CEST	50581	2121	192.168.2.16	89.58.52.251
May 6, 2024 04:56:54.468048096 CEST	2121	50473	206.71.159.50	192.168.2.16
May 6, 2024 04:56:54.477005959 CEST	50389	21	192.168.2.16	94.131.47.117
May 6, 2024 04:56:54.478763103 CEST	50582	2121	192.168.2.16	152.89.185.57
May 6, 2024 04:56:54.478945971 CEST	50583	21	192.168.2.16	104.17.99.214
May 6, 2024 04:56:54.478976011 CEST	50584	2121	192.168.2.16	104.17.99.214
May 6, 2024 04:56:54.479072094 CEST	50585	21	192.168.2.16	152.89.185.57
May 6, 2024 04:56:54.487237930 CEST	2121	50394	67.188.255.137	192.168.2.16
May 6, 2024 04:56:54.487931013 CEST	21	50393	67.188.255.137	192.168.2.16
May 6, 2024 04:56:54.488487959 CEST	50586	21	192.168.2.16	67.189.133.104
May 6, 2024 04:56:54.488822937 CEST	50587	2121	192.168.2.16	67.189.133.104
May 6, 2024 04:56:54.492986917 CEST	50390	2121	192.168.2.16	94.131.47.117
May 6, 2024 04:56:54.499372005 CEST	21	50423	181.171.153.111	192.168.2.16
May 6, 2024 04:56:54.502806902 CEST	21	50442	103.165.157.224	192.168.2.16
May 6, 2024 04:56:54.510909081 CEST	50391	21	192.168.2.16	24.181.4.6
May 6, 2024 04:56:54.510910988 CEST	2121	50424	181.171.153.111	192.168.2.16
May 6, 2024 04:56:54.537858009 CEST	2121	50443	103.165.157.224	192.168.2.16
May 6, 2024 04:56:54.539984941 CEST	50392	2121	192.168.2.16	24.181.4.6
May 6, 2024 04:56:54.540000916 CEST	50373	2121	192.168.2.16	124.49.54.1
May 6, 2024 04:56:54.540256023 CEST	21	50579	34.128.145.40	192.168.2.16
May 6, 2024 04:56:54.540309906 CEST	50579	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:54.540379047 CEST	50579	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:54.540541887 CEST	21	50570	34.128.145.40	192.168.2.16
May 6, 2024 04:56:54.540558100 CEST	50588	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:54.545370102 CEST	2121	50580	34.128.145.40	192.168.2.16
May 6, 2024 04:56:54.545424938 CEST	50580	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:54.545466900 CEST	50580	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:54.545594931 CEST	50589	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:54.556020975 CEST	50498	2121	192.168.2.16	149.154.65.23
May 6, 2024 04:56:54.556025028 CEST	50395	21	192.168.2.16	81.245.127.27
May 6, 2024 04:56:54.556246996 CEST	50590	21	192.168.2.16	192.63.179.50
May 6, 2024 04:56:54.600970030 CEST	50398	2121	192.168.2.16	189.179.17.239
May 6, 2024 04:56:54.600996971 CEST	50397	21	192.168.2.16	189.179.17.239
May 6, 2024 04:56:54.600996971 CEST	50396	2121	192.168.2.16	81.245.127.27
May 6, 2024 04:56:54.602159977 CEST	50564	2121	192.168.2.16	190.92.153.181
May 6, 2024 04:56:54.632965088 CEST	50399	21	192.168.2.16	173.235.82.189
May 6, 2024 04:56:54.632991076 CEST	50400	2121	192.168.2.16	173.235.82.189
May 6, 2024 04:56:54.648993015 CEST	50403	21	192.168.2.16	23.197.37.196
May 6, 2024 04:56:54.649049044 CEST	50404	2121	192.168.2.16	23.197.37.196
May 6, 2024 04:56:54.649055004 CEST	50567	21	192.168.2.16	187.251.200.253
May 6, 2024 04:56:54.649900913 CEST	21	50579	34.128.145.40	192.168.2.16
May 6, 2024 04:56:54.650841951 CEST	21	50588	34.128.145.40	192.168.2.16
May 6, 2024 04:56:54.650913954 CEST	50588	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:54.655137062 CEST	2121	50589	34.128.145.40	192.168.2.16
May 6, 2024 04:56:54.655195951 CEST	50589	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:54.655591965 CEST	2121	50580	34.128.145.40	192.168.2.16
May 6, 2024 04:56:54.664994955 CEST	50494	2121	192.168.2.16	211.210.139.133
May 6, 2024 04:56:54.676668882 CEST	2121	50505	83.136.148.89	192.168.2.16
May 6, 2024 04:56:54.680970907 CEST	50405	2121	192.168.2.16	70.92.238.155
May 6, 2024 04:56:54.680969954 CEST	50542	21	192.168.2.16	221.168.159.170
May 6, 2024 04:56:54.680984974 CEST	50516	21	192.168.2.16	211.218.72.245
May 6, 2024 04:56:54.680991888 CEST	50514	21	192.168.2.16	39.127.143.189
May 6, 2024 04:56:54.680991888 CEST	50517	2121	192.168.2.16	211.218.72.245
May 6, 2024 04:56:54.680996895 CEST	50406	21	192.168.2.16	70.92.238.155
May 6, 2024 04:56:54.680996895 CEST	50468	2121	192.168.2.16	122.41.139.45
May 6, 2024 04:56:54.682476044 CEST	50408	2121	192.168.2.16	116.9.149.105
May 6, 2024 04:56:54.682476044 CEST	50543	2121	192.168.2.16	221.168.159.170
May 6, 2024 04:56:54.696970940 CEST	50493	21	192.168.2.16	211.210.139.133
May 6, 2024 04:56:54.696973085 CEST	50407	21	192.168.2.16	116.9.149.105
May 6, 2024 04:56:54.696996927 CEST	50413	21	192.168.2.16	45.161.140.137
May 6, 2024 04:56:54.696996927 CEST	50568	2121	192.168.2.16	187.251.200.253
May 6, 2024 04:56:54.712975979 CEST	50474	2121	192.168.2.16	211.44.88.172
May 6, 2024 04:56:54.712990046 CEST	50472	21	192.168.2.16	211.44.88.172
May 6, 2024 04:56:54.712990999 CEST	50515	2121	192.168.2.16	39.127.143.189
May 6, 2024 04:56:54.712995052 CEST	50554	21	192.168.2.16	115.8.11.239
May 6, 2024 04:56:54.727756977 CEST	21	50497	149.154.65.23	192.168.2.16
May 6, 2024 04:56:54.727819920 CEST	50497	21	192.168.2.16	149.154.65.23
May 6, 2024 04:56:54.728384018 CEST	21	50585	152.89.185.57	192.168.2.16
May 6, 2024 04:56:54.728420019 CEST	2121	50582	152.89.185.57	192.168.2.16
May 6, 2024 04:56:54.728987932 CEST	50409	21	192.168.2.16	139.59.34.85
May 6, 2024 04:56:54.733207941 CEST	21	50571	103.109.6.215	192.168.2.16
May 6, 2024 04:56:54.733378887 CEST	50571	21	192.168.2.16	103.109.6.215
May 6, 2024 04:56:54.745068073 CEST	50555	2121	192.168.2.16	115.8.11.239
May 6, 2024 04:56:54.745069981 CEST	50414	2121	192.168.2.16	45.161.140.137
May 6, 2024 04:56:54.759973049 CEST	50410	2121	192.168.2.16	139.59.34.85
May 6, 2024 04:56:54.760247946 CEST	50591	2121	192.168.2.16	192.63.179.50
May 6, 2024 04:56:54.761382103 CEST	21	50588	34.128.145.40	192.168.2.16
May 6, 2024 04:56:54.761434078 CEST	50588	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:54.761507034 CEST	50588	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:54.761708021 CEST	50592	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:54.764839888 CEST	2121	50589	34.128.145.40	192.168.2.16
May 6, 2024 04:56:54.764889002 CEST	50589	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:54.764925957 CEST	50589	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:54.765058041 CEST	50593	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:54.784969091 CEST	50411	21	192.168.2.16	98.254.182.143
May 6, 2024 04:56:54.791991949 CEST	50412	2121	192.168.2.16	98.254.182.143
May 6, 2024 04:56:54.816821098 CEST	2121	50498	149.154.65.23	192.168.2.16
May 6, 2024 04:56:54.856091976 CEST	50415	21	192.168.2.16	67.184.169.181
May 6, 2024 04:56:54.857053995 CEST	2121	50373	124.49.54.1	192.168.2.16
May 6, 2024 04:56:54.871818066 CEST	21	50588	34.128.145.40	192.168.2.16
May 6, 2024 04:56:54.871994019 CEST	50417	2121	192.168.2.16	67.184.169.181
May 6, 2024 04:56:54.872149944 CEST	21	50592	34.128.145.40	192.168.2.16
May 6, 2024 04:56:54.872216940 CEST	50592	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:54.872220039 CEST	50594	21	192.168.2.16	98.242.36.116
May 6, 2024 04:56:54.874214888 CEST	2121	50593	34.128.145.40	192.168.2.16
May 6, 2024 04:56:54.874264002 CEST	50593	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:54.887969971 CEST	50419	21	192.168.2.16	71.193.153.207
May 6, 2024 04:56:54.903989077 CEST	50420	21	192.168.2.16	195.205.150.94
May 6, 2024 04:56:54.905333042 CEST	50421	2121	192.168.2.16	71.193.153.207
May 6, 2024 04:56:54.905334949 CEST	50422	2121	192.168.2.16	195.205.150.94
May 6, 2024 04:56:54.919204950 CEST	21	50413	45.161.140.137	192.168.2.16
May 6, 2024 04:56:54.935973883 CEST	50471	2121	192.168.2.16	98.96.97.42
May 6, 2024 04:56:54.935973883 CEST	50426	2121	192.168.2.16	61.76.155.82
May 6, 2024 04:56:54.935982943 CEST	50425	21	192.168.2.16	61.76.155.82
May 6, 2024 04:56:54.936398029 CEST	50595	2121	192.168.2.16	98.242.36.116
May 6, 2024 04:56:54.952140093 CEST	50466	21	192.168.2.16	98.96.97.42
May 6, 2024 04:56:54.969074965 CEST	2121	50414	45.161.140.137	192.168.2.16
May 6, 2024 04:56:54.976295948 CEST	2121	50494	211.210.139.133	192.168.2.16
May 6, 2024 04:56:54.982263088 CEST	21	50542	221.168.159.170	192.168.2.16
May 6, 2024 04:56:54.982970953 CEST	50428	2121	192.168.2.16	188.222.212.57
May 6, 2024 04:56:54.982984066 CEST	50469	21	192.168.2.16	206.71.159.50
May 6, 2024 04:56:54.983050108 CEST	50473	2121	192.168.2.16	206.71.159.50
May 6, 2024 04:56:54.983242035 CEST	50596	21	192.168.2.16	87.2.36.15
May 6, 2024 04:56:54.983477116 CEST	50427	21	192.168.2.16	188.222.212.57
May 6, 2024 04:56:54.983506918 CEST	2121	50593	34.128.145.40	192.168.2.16
May 6, 2024 04:56:54.983553886 CEST	50593	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:54.983628035 CEST	50593	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:54.983822107 CEST	50597	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:54.984515905 CEST	21	50592	34.128.145.40	192.168.2.16
May 6, 2024 04:56:54.984565973 CEST	50592	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:54.984636068 CEST	50592	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:54.984817982 CEST	50598	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:54.985460043 CEST	2121	50543	221.168.159.170	192.168.2.16
May 6, 2024 04:56:54.991581917 CEST	21	50514	39.127.143.189	192.168.2.16
May 6, 2024 04:56:54.991595030 CEST	21	50516	211.218.72.245	192.168.2.16
May 6, 2024 04:56:54.993469000 CEST	2121	50517	211.218.72.245	192.168.2.16
May 6, 2024 04:56:55.013298988 CEST	2121	50468	122.41.139.45	192.168.2.16
May 6, 2024 04:56:55.014971018 CEST	50423	21	192.168.2.16	181.171.153.111
May 6, 2024 04:56:55.014972925 CEST	50430	2121	192.168.2.16	85.4.52.227
May 6, 2024 04:56:55.014978886 CEST	50442	21	192.168.2.16	103.165.157.224
May 6, 2024 04:56:55.014982939 CEST	50424	2121	192.168.2.16	181.171.153.111
May 6, 2024 04:56:55.014986038 CEST	50429	21	192.168.2.16	85.4.52.227
May 6, 2024 04:56:55.022181034 CEST	21	50493	211.210.139.133	192.168.2.16
May 6, 2024 04:56:55.023406982 CEST	21	50554	115.8.11.239	192.168.2.16
May 6, 2024 04:56:55.030999899 CEST	50432	2121	192.168.2.16	165.1.218.28
May 6, 2024 04:56:55.031310081 CEST	50599	2121	192.168.2.16	87.2.36.15
May 6, 2024 04:56:55.034960032 CEST	50431	21	192.168.2.16	165.1.218.28
May 6, 2024 04:56:55.040704966 CEST	2121	50515	39.127.143.189	192.168.2.16
May 6, 2024 04:56:55.046991110 CEST	50443	2121	192.168.2.16	103.165.157.224
May 6, 2024 04:56:55.047950983 CEST	50572	21	192.168.2.16	20.125.78.0
May 6, 2024 04:56:55.052506924 CEST	2121	50474	211.44.88.172	192.168.2.16
May 6, 2024 04:56:55.052556038 CEST	21	50472	211.44.88.172	192.168.2.16
May 6, 2024 04:56:55.064944029 CEST	2121	50555	115.8.11.239	192.168.2.16
May 6, 2024 04:56:55.074368000 CEST	2121	50471	98.96.97.42	192.168.2.16
May 6, 2024 04:56:55.081480026 CEST	21	50571	103.109.6.215	192.168.2.16
May 6, 2024 04:56:55.081738949 CEST	50571	21	192.168.2.16	103.109.6.215
May 6, 2024 04:56:55.090462923 CEST	21	50466	98.96.97.42	192.168.2.16
May 6, 2024 04:56:55.092799902 CEST	2121	50593	34.128.145.40	192.168.2.16
May 6, 2024 04:56:55.093369961 CEST	2121	50597	34.128.145.40	192.168.2.16
May 6, 2024 04:56:55.093528986 CEST	50597	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:55.094243050 CEST	21	50592	34.128.145.40	192.168.2.16
May 6, 2024 04:56:55.094469070 CEST	21	50598	34.128.145.40	192.168.2.16
May 6, 2024 04:56:55.094536066 CEST	50598	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:55.094986916 CEST	50589	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:55.095279932 CEST	50600	21	192.168.2.16	108.165.114.34
May 6, 2024 04:56:55.126979113 CEST	50575	2121	192.168.2.16	20.125.78.0
May 6, 2024 04:56:55.129477978 CEST	21	50469	206.71.159.50	192.168.2.16
May 6, 2024 04:56:55.129488945 CEST	2121	50473	206.71.159.50	192.168.2.16
May 6, 2024 04:56:55.190973043 CEST	50505	2121	192.168.2.16	83.136.148.89
May 6, 2024 04:56:55.203609943 CEST	2121	50597	34.128.145.40	192.168.2.16
May 6, 2024 04:56:55.203669071 CEST	50597	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:55.203746080 CEST	50597	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:55.203967094 CEST	50601	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:55.204199076 CEST	21	50598	34.128.145.40	192.168.2.16
May 6, 2024 04:56:55.204252005 CEST	50598	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:55.204334974 CEST	50598	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:55.204504013 CEST	2121	50589	34.128.145.40	192.168.2.16
May 6, 2024 04:56:55.204547882 CEST	50602	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:55.207310915 CEST	50603	2121	192.168.2.16	108.165.114.34
May 6, 2024 04:56:55.222979069 CEST	50437	2121	192.168.2.16	83.57.93.232
May 6, 2024 04:56:55.222980976 CEST	50576	21	192.168.2.16	178.186.179.18
May 6, 2024 04:56:55.222989082 CEST	50436	21	192.168.2.16	83.57.93.232
May 6, 2024 04:56:55.238967896 CEST	50585	21	192.168.2.16	152.89.185.57
May 6, 2024 04:56:55.238986015 CEST	50582	2121	192.168.2.16	152.89.185.57
May 6, 2024 04:56:55.255223989 CEST	50604	21	192.168.2.16	98.33.116.168
May 6, 2024 04:56:55.281636953 CEST	2121	50252	168.220.94.137	192.168.2.16
May 6, 2024 04:56:55.281647921 CEST	21	50251	168.220.94.137	192.168.2.16
May 6, 2024 04:56:55.281692028 CEST	50252	2121	192.168.2.16	168.220.94.137
May 6, 2024 04:56:55.282959938 CEST	2121	50424	181.171.153.111	192.168.2.16
May 6, 2024 04:56:55.282991886 CEST	50251	21	192.168.2.16	168.220.94.137
May 6, 2024 04:56:55.286982059 CEST	50577	2121	192.168.2.16	178.186.179.18
May 6, 2024 04:56:55.287278891 CEST	50605	2121	192.168.2.16	98.33.116.168
May 6, 2024 04:56:55.287293911 CEST	21	50423	181.171.153.111	192.168.2.16
May 6, 2024 04:56:55.302973032 CEST	50578	21	192.168.2.16	89.58.52.251
May 6, 2024 04:56:55.303395033 CEST	50606	21	192.168.2.16	93.176.173.211
May 6, 2024 04:56:55.303451061 CEST	50607	2121	192.168.2.16	93.176.173.211
May 6, 2024 04:56:55.313222885 CEST	2121	50597	34.128.145.40	192.168.2.16
May 6, 2024 04:56:55.313519955 CEST	2121	50601	34.128.145.40	192.168.2.16
May 6, 2024 04:56:55.313579082 CEST	50601	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:55.313905954 CEST	21	50598	34.128.145.40	192.168.2.16
May 6, 2024 04:56:55.314116001 CEST	21	50602	34.128.145.40	192.168.2.16
May 6, 2024 04:56:55.314169884 CEST	50602	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:55.318984985 CEST	50498	2121	192.168.2.16	149.154.65.23
May 6, 2024 04:56:55.359796047 CEST	21	50442	103.165.157.224	192.168.2.16
May 6, 2024 04:56:55.367007971 CEST	50440	21	192.168.2.16	149.224.112.238
May 6, 2024 04:56:55.394098997 CEST	2121	50443	103.165.157.224	192.168.2.16
May 6, 2024 04:56:55.407139063 CEST	2121	50505	83.136.148.89	192.168.2.16
May 6, 2024 04:56:55.423193932 CEST	2121	50601	34.128.145.40	192.168.2.16
May 6, 2024 04:56:55.423252106 CEST	50601	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:55.423357964 CEST	50601	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:55.423607111 CEST	50608	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:55.430994987 CEST	50441	2121	192.168.2.16	149.224.112.238
May 6, 2024 04:56:55.431252003 CEST	21	50602	34.128.145.40	192.168.2.16
May 6, 2024 04:56:55.431298018 CEST	21	50571	103.109.6.215	192.168.2.16
May 6, 2024 04:56:55.431310892 CEST	50602	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:55.431396008 CEST	50602	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:55.431550026 CEST	50571	21	192.168.2.16	103.109.6.215
May 6, 2024 04:56:55.431710005 CEST	50610	21	192.168.2.16	103.109.6.215
May 6, 2024 04:56:55.431710005 CEST	50609	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:55.463301897 CEST	50611	21	192.168.2.16	110.231.130.41
May 6, 2024 04:56:55.479022026 CEST	50581	2121	192.168.2.16	89.58.52.251
May 6, 2024 04:56:55.479037046 CEST	50583	21	192.168.2.16	104.17.99.214
May 6, 2024 04:56:55.479038000 CEST	50584	2121	192.168.2.16	104.17.99.214
May 6, 2024 04:56:55.479051113 CEST	50494	2121	192.168.2.16	211.210.139.133
May 6, 2024 04:56:55.488364935 CEST	21	50585	152.89.185.57	192.168.2.16
May 6, 2024 04:56:55.494973898 CEST	50542	21	192.168.2.16	221.168.159.170
May 6, 2024 04:56:55.495004892 CEST	50587	2121	192.168.2.16	67.189.133.104
May 6, 2024 04:56:55.495007992 CEST	50517	2121	192.168.2.16	211.218.72.245
May 6, 2024 04:56:55.495006084 CEST	50543	2121	192.168.2.16	221.168.159.170
May 6, 2024 04:56:55.495524883 CEST	50612	2121	192.168.2.16	110.231.130.41
May 6, 2024 04:56:55.495527029 CEST	50514	21	192.168.2.16	39.127.143.189
May 6, 2024 04:56:55.495527983 CEST	50516	21	192.168.2.16	211.218.72.245
May 6, 2024 04:56:55.495533943 CEST	50586	21	192.168.2.16	67.189.133.104
May 6, 2024 04:56:55.526993990 CEST	50493	21	192.168.2.16	211.210.139.133
May 6, 2024 04:56:55.526993990 CEST	50468	2121	192.168.2.16	122.41.139.45
May 6, 2024 04:56:55.527206898 CEST	50554	21	192.168.2.16	115.8.11.239
May 6, 2024 04:56:55.532835007 CEST	2121	50601	34.128.145.40	192.168.2.16
May 6, 2024 04:56:55.533169031 CEST	2121	50608	34.128.145.40	192.168.2.16
May 6, 2024 04:56:55.533230066 CEST	50608	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:55.543031931 CEST	50515	2121	192.168.2.16	39.127.143.189
May 6, 2024 04:56:55.544382095 CEST	21	50609	34.128.145.40	192.168.2.16
May 6, 2024 04:56:55.544445038 CEST	50609	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:55.558978081 CEST	50474	2121	192.168.2.16	211.44.88.172
May 6, 2024 04:56:55.559019089 CEST	50590	21	192.168.2.16	192.63.179.50
May 6, 2024 04:56:55.559026003 CEST	50472	21	192.168.2.16	211.44.88.172
May 6, 2024 04:56:55.574970961 CEST	50555	2121	192.168.2.16	115.8.11.239
May 6, 2024 04:56:55.575974941 CEST	50471	2121	192.168.2.16	98.96.97.42
May 6, 2024 04:56:55.579530001 CEST	2121	50498	149.154.65.23	192.168.2.16
May 6, 2024 04:56:55.591001034 CEST	50466	21	192.168.2.16	98.96.97.42
May 6, 2024 04:56:55.638994932 CEST	50469	21	192.168.2.16	206.71.159.50
May 6, 2024 04:56:55.639300108 CEST	50613	21	192.168.2.16	222.235.83.57
May 6, 2024 04:56:55.639301062 CEST	50473	2121	192.168.2.16	206.71.159.50
May 6, 2024 04:56:55.642767906 CEST	2121	50608	34.128.145.40	192.168.2.16
May 6, 2024 04:56:55.642819881 CEST	50608	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:55.642874956 CEST	50608	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:55.643035889 CEST	50614	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:55.654961109 CEST	21	50609	34.128.145.40	192.168.2.16
May 6, 2024 04:56:55.655010939 CEST	50609	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:55.655122995 CEST	50609	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:55.655361891 CEST	50615	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:55.655483007 CEST	50616	2121	192.168.2.16	222.235.83.57
May 6, 2024 04:56:55.687936068 CEST	21	50435	45.87.1.166	192.168.2.16
May 6, 2024 04:56:55.688067913 CEST	50435	21	192.168.2.16	45.87.1.166
May 6, 2024 04:56:55.688234091 CEST	50617	21	192.168.2.16	45.87.1.166
May 6, 2024 04:56:55.714327097 CEST	2121	50471	98.96.97.42	192.168.2.16
May 6, 2024 04:56:55.714696884 CEST	50618	21	192.168.2.16	46.90.129.21
May 6, 2024 04:56:55.731883049 CEST	21	50466	98.96.97.42	192.168.2.16
May 6, 2024 04:56:55.732300997 CEST	50619	2121	192.168.2.16	46.90.129.21
May 6, 2024 04:56:55.752749920 CEST	2121	50608	34.128.145.40	192.168.2.16
May 6, 2024 04:56:55.752902031 CEST	2121	50614	34.128.145.40	192.168.2.16
May 6, 2024 04:56:55.753120899 CEST	50614	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:55.764636040 CEST	21	50609	34.128.145.40	192.168.2.16
May 6, 2024 04:56:55.765204906 CEST	21	50615	34.128.145.40	192.168.2.16
May 6, 2024 04:56:55.765270948 CEST	50615	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:55.767098904 CEST	50602	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:55.767098904 CEST	50591	2121	192.168.2.16	192.63.179.50
May 6, 2024 04:56:55.779789925 CEST	21	50571	103.109.6.215	192.168.2.16
May 6, 2024 04:56:55.779890060 CEST	21	50571	103.109.6.215	192.168.2.16
May 6, 2024 04:56:55.780066967 CEST	50571	21	192.168.2.16	103.109.6.215
May 6, 2024 04:56:55.785545111 CEST	21	50469	206.71.159.50	192.168.2.16
May 6, 2024 04:56:55.785845041 CEST	2121	50473	206.71.159.50	192.168.2.16
May 6, 2024 04:56:55.792303085 CEST	2121	50494	211.210.139.133	192.168.2.16
May 6, 2024 04:56:55.796561003 CEST	21	50542	221.168.159.170	192.168.2.16
May 6, 2024 04:56:55.797704935 CEST	2121	50543	221.168.159.170	192.168.2.16
May 6, 2024 04:56:55.799531937 CEST	50620	21	192.168.2.16	124.91.229.153
May 6, 2024 04:56:55.799690962 CEST	50621	2121	192.168.2.16	124.91.229.153
May 6, 2024 04:56:55.800403118 CEST	21	50610	103.109.6.215	192.168.2.16
May 6, 2024 04:56:55.800471067 CEST	50610	21	192.168.2.16	103.109.6.215
May 6, 2024 04:56:55.805474043 CEST	21	50516	211.218.72.245	192.168.2.16
May 6, 2024 04:56:55.806868076 CEST	21	50514	39.127.143.189	192.168.2.16
May 6, 2024 04:56:55.807348967 CEST	2121	50517	211.218.72.245	192.168.2.16
May 6, 2024 04:56:55.837187052 CEST	21	50554	115.8.11.239	192.168.2.16
May 6, 2024 04:56:55.852529049 CEST	21	50493	211.210.139.133	192.168.2.16
May 6, 2024 04:56:55.859236956 CEST	2121	50468	122.41.139.45	192.168.2.16
May 6, 2024 04:56:55.862951994 CEST	2121	50614	34.128.145.40	192.168.2.16
May 6, 2024 04:56:55.862976074 CEST	50442	21	192.168.2.16	103.165.157.224
May 6, 2024 04:56:55.863013029 CEST	50614	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:55.863079071 CEST	50614	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:55.863270998 CEST	50622	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:55.873051882 CEST	2121	50515	39.127.143.189	192.168.2.16
May 6, 2024 04:56:55.875458956 CEST	21	50615	34.128.145.40	192.168.2.16
May 6, 2024 04:56:55.875519991 CEST	50615	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:55.875592947 CEST	50615	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:55.875838995 CEST	50623	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:55.876838923 CEST	21	50602	34.128.145.40	192.168.2.16
May 6, 2024 04:56:55.879053116 CEST	50594	21	192.168.2.16	98.242.36.116
May 6, 2024 04:56:55.894994974 CEST	50443	2121	192.168.2.16	103.165.157.224
May 6, 2024 04:56:55.895334005 CEST	2121	50555	115.8.11.239	192.168.2.16
May 6, 2024 04:56:55.898592949 CEST	2121	50474	211.44.88.172	192.168.2.16
May 6, 2024 04:56:55.898606062 CEST	21	50472	211.44.88.172	192.168.2.16
May 6, 2024 04:56:55.910192966 CEST	21	50435	45.87.1.166	192.168.2.16
May 6, 2024 04:56:55.910247087 CEST	50435	21	192.168.2.16	45.87.1.166
May 6, 2024 04:56:55.917882919 CEST	21	50617	45.87.1.166	192.168.2.16
May 6, 2024 04:56:55.917958975 CEST	50617	21	192.168.2.16	45.87.1.166
May 6, 2024 04:56:55.925975084 CEST	50505	2121	192.168.2.16	83.136.148.89
May 6, 2024 04:56:55.943078995 CEST	50595	2121	192.168.2.16	98.242.36.116
May 6, 2024 04:56:55.943610907 CEST	50624	21	192.168.2.16	85.16.183.122
May 6, 2024 04:56:55.943696022 CEST	50625	2121	192.168.2.16	85.16.183.122
May 6, 2024 04:56:55.972407103 CEST	2121	50622	34.128.145.40	192.168.2.16
May 6, 2024 04:56:55.972467899 CEST	50622	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:55.972584009 CEST	2121	50614	34.128.145.40	192.168.2.16
May 6, 2024 04:56:55.985306978 CEST	21	50623	34.128.145.40	192.168.2.16
May 6, 2024 04:56:55.985378027 CEST	50623	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:55.990981102 CEST	50596	21	192.168.2.16	87.2.36.15
May 6, 2024 04:56:55.991084099 CEST	50585	21	192.168.2.16	152.89.185.57
May 6, 2024 04:56:56.022986889 CEST	50452	21	192.168.2.16	20.111.46.231
May 6, 2024 04:56:56.023001909 CEST	50454	21	192.168.2.16	96.91.172.122
May 6, 2024 04:56:56.023001909 CEST	50457	2121	192.168.2.16	117.69.72.226
May 6, 2024 04:56:56.023004055 CEST	50455	2121	192.168.2.16	96.91.172.122
May 6, 2024 04:56:56.023031950 CEST	50465	2121	192.168.2.16	216.67.24.140
May 6, 2024 04:56:56.023030996 CEST	50453	2121	192.168.2.16	20.111.46.231
May 6, 2024 04:56:56.023030996 CEST	50459	21	192.168.2.16	187.126.142.208
May 6, 2024 04:56:56.023032904 CEST	50458	2121	192.168.2.16	187.126.142.208
May 6, 2024 04:56:56.023034096 CEST	50464	21	192.168.2.16	216.67.24.140
May 6, 2024 04:56:56.023032904 CEST	50460	21	192.168.2.16	51.105.105.242
May 6, 2024 04:56:56.023032904 CEST	50467	21	192.168.2.16	122.41.139.45
May 6, 2024 04:56:56.023030996 CEST	50463	21	192.168.2.16	222.190.5.46
May 6, 2024 04:56:56.023034096 CEST	50456	21	192.168.2.16	117.69.72.226
May 6, 2024 04:56:56.023313046 CEST	50470	21	192.168.2.16	67.180.251.139
May 6, 2024 04:56:56.023314953 CEST	50462	2121	192.168.2.16	222.190.5.46
May 6, 2024 04:56:56.023314953 CEST	50461	2121	192.168.2.16	51.105.105.242
May 6, 2024 04:56:56.038988113 CEST	50475	2121	192.168.2.16	67.180.251.139
May 6, 2024 04:56:56.038988113 CEST	50599	2121	192.168.2.16	87.2.36.15
May 6, 2024 04:56:56.038999081 CEST	50477	21	192.168.2.16	158.23.81.6
May 6, 2024 04:56:56.038999081 CEST	50478	21	192.168.2.16	101.249.29.72
May 6, 2024 04:56:56.038999081 CEST	50483	21	192.168.2.16	73.44.84.145
May 6, 2024 04:56:56.039005995 CEST	50476	2121	192.168.2.16	158.23.81.6
May 6, 2024 04:56:56.039005995 CEST	50481	2121	192.168.2.16	119.185.45.247
May 6, 2024 04:56:56.039030075 CEST	50492	2121	192.168.2.16	106.214.7.190
May 6, 2024 04:56:56.039031982 CEST	50507	2121	192.168.2.16	1.85.248.100
May 6, 2024 04:56:56.039033890 CEST	50485	2121	192.168.2.16	20.106.148.131
May 6, 2024 04:56:56.039033890 CEST	50488	21	192.168.2.16	24.17.76.59
May 6, 2024 04:56:56.039036036 CEST	50484	21	192.168.2.16	117.5.105.172
May 6, 2024 04:56:56.039036036 CEST	50480	21	192.168.2.16	119.185.45.247
May 6, 2024 04:56:56.039037943 CEST	50491	21	192.168.2.16	106.214.7.190
May 6, 2024 04:56:56.039036036 CEST	50496	21	192.168.2.16	85.244.169.185
May 6, 2024 04:56:56.039036989 CEST	50489	2121	192.168.2.16	218.147.235.186
May 6, 2024 04:56:56.039036036 CEST	50487	2121	192.168.2.16	85.6.142.168
May 6, 2024 04:56:56.039036989 CEST	50479	2121	192.168.2.16	101.249.29.72
May 6, 2024 04:56:56.039036036 CEST	50500	2121	192.168.2.16	191.223.41.72
May 6, 2024 04:56:56.039036036 CEST	50509	2121	192.168.2.16	69.11.194.63
May 6, 2024 04:56:56.039062023 CEST	50490	2121	192.168.2.16	24.17.76.59
May 6, 2024 04:56:56.039062023 CEST	50506	21	192.168.2.16	1.85.248.100
May 6, 2024 04:56:56.039062977 CEST	50499	21	192.168.2.16	191.223.41.72
May 6, 2024 04:56:56.039062977 CEST	50511	21	192.168.2.16	20.106.148.131
May 6, 2024 04:56:56.039063931 CEST	50504	21	192.168.2.16	83.136.148.89
May 6, 2024 04:56:56.039062977 CEST	50495	2121	192.168.2.16	85.244.169.185
May 6, 2024 04:56:56.039066076 CEST	50502	21	192.168.2.16	36.39.190.158
May 6, 2024 04:56:56.039067030 CEST	50501	21	192.168.2.16	85.6.142.168
May 6, 2024 04:56:56.039066076 CEST	50482	2121	192.168.2.16	73.44.84.145
May 6, 2024 04:56:56.039067030 CEST	50486	2121	192.168.2.16	117.5.105.172
May 6, 2024 04:56:56.039066076 CEST	50508	21	192.168.2.16	69.11.194.63
May 6, 2024 04:56:56.039074898 CEST	50503	2121	192.168.2.16	36.39.190.158
May 6, 2024 04:56:56.039324999 CEST	50510	21	192.168.2.16	218.147.235.186
May 6, 2024 04:56:56.054971933 CEST	50512	21	192.168.2.16	154.83.2.90
May 6, 2024 04:56:56.054991007 CEST	50513	2121	192.168.2.16	154.83.2.90
May 6, 2024 04:56:56.055433989 CEST	50518	21	192.168.2.16	173.75.32.106
May 6, 2024 04:56:56.071001053 CEST	50519	2121	192.168.2.16	173.75.32.106
May 6, 2024 04:56:56.071003914 CEST	50523	21	192.168.2.16	98.45.130.150
May 6, 2024 04:56:56.071002960 CEST	50521	2121	192.168.2.16	179.223.58.150
May 6, 2024 04:56:56.071024895 CEST	50527	2121	192.168.2.16	213.112.243.210
May 6, 2024 04:56:56.071024895 CEST	50537	2121	192.168.2.16	189.165.22.222
May 6, 2024 04:56:56.071024895 CEST	50520	21	192.168.2.16	179.223.58.150
May 6, 2024 04:56:56.071024895 CEST	50528	2121	192.168.2.16	20.150.153.193
May 6, 2024 04:56:56.071027040 CEST	50531	2121	192.168.2.16	64.225.92.66
May 6, 2024 04:56:56.071027040 CEST	50538	21	192.168.2.16	182.98.150.37
May 6, 2024 04:56:56.071027994 CEST	50526	2121	192.168.2.16	67.170.205.145
May 6, 2024 04:56:56.071029902 CEST	50532	21	192.168.2.16	73.248.162.45
May 6, 2024 04:56:56.071029902 CEST	50535	2121	192.168.2.16	98.16.119.74
May 6, 2024 04:56:56.071062088 CEST	50541	2121	192.168.2.16	80.31.8.165
May 6, 2024 04:56:56.071063042 CEST	50540	21	192.168.2.16	80.31.8.165
May 6, 2024 04:56:56.071063042 CEST	50533	2121	192.168.2.16	73.248.162.45
May 6, 2024 04:56:56.071064949 CEST	50522	2121	192.168.2.16	98.45.130.150
May 6, 2024 04:56:56.071085930 CEST	50524	21	192.168.2.16	213.112.243.210
May 6, 2024 04:56:56.071086884 CEST	50529	21	192.168.2.16	64.225.92.66
May 6, 2024 04:56:56.071086884 CEST	50525	21	192.168.2.16	67.170.205.145
May 6, 2024 04:56:56.071096897 CEST	50534	21	192.168.2.16	98.16.119.74
May 6, 2024 04:56:56.071098089 CEST	50530	21	192.168.2.16	20.150.153.193
May 6, 2024 04:56:56.071100950 CEST	50536	21	192.168.2.16	189.165.22.222
May 6, 2024 04:56:56.073153973 CEST	50539	2121	192.168.2.16	182.98.150.37
May 6, 2024 04:56:56.082266092 CEST	2121	50622	34.128.145.40	192.168.2.16
May 6, 2024 04:56:56.082324028 CEST	50622	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:56.082418919 CEST	50622	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:56.082653046 CEST	50626	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:56.086977959 CEST	50498	2121	192.168.2.16	149.154.65.23
May 6, 2024 04:56:56.086983919 CEST	50547	2121	192.168.2.16	1.80.113.33
May 6, 2024 04:56:56.086987019 CEST	50549	2121	192.168.2.16	175.117.140.51
May 6, 2024 04:56:56.086998940 CEST	50546	21	192.168.2.16	1.80.113.33
May 6, 2024 04:56:56.086998940 CEST	50545	2121	192.168.2.16	116.123.90.217
May 6, 2024 04:56:56.087013960 CEST	50544	21	192.168.2.16	116.123.90.217
May 6, 2024 04:56:56.087018967 CEST	50550	21	192.168.2.16	86.120.6.251
May 6, 2024 04:56:56.087021112 CEST	50548	21	192.168.2.16	175.117.140.51
May 6, 2024 04:56:56.087021112 CEST	50552	21	192.168.2.16	93.219.17.233
May 6, 2024 04:56:56.087021112 CEST	50551	2121	192.168.2.16	86.120.6.251
May 6, 2024 04:56:56.087027073 CEST	50553	2121	192.168.2.16	93.219.17.233
May 6, 2024 04:56:56.087048054 CEST	50556	21	192.168.2.16	89.174.3.24
May 6, 2024 04:56:56.096566916 CEST	21	50623	34.128.145.40	192.168.2.16
May 6, 2024 04:56:56.096626043 CEST	50623	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:56.096852064 CEST	50623	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:56.096949100 CEST	50627	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:56.102991104 CEST	50600	21	192.168.2.16	108.165.114.34
May 6, 2024 04:56:56.140064955 CEST	2121	50505	83.136.148.89	192.168.2.16
May 6, 2024 04:56:56.151001930 CEST	21	50617	45.87.1.166	192.168.2.16
May 6, 2024 04:56:56.151163101 CEST	50617	21	192.168.2.16	45.87.1.166
May 6, 2024 04:56:56.151602030 CEST	50628	21	192.168.2.16	91.229.92.88
May 6, 2024 04:56:56.166996956 CEST	50557	2121	192.168.2.16	89.174.3.24
May 6, 2024 04:56:56.167227983 CEST	50558	21	192.168.2.16	190.92.153.181
May 6, 2024 04:56:56.169307947 CEST	21	50610	103.109.6.215	192.168.2.16
May 6, 2024 04:56:56.169420004 CEST	50610	21	192.168.2.16	103.109.6.215
May 6, 2024 04:56:56.191529036 CEST	2121	50622	34.128.145.40	192.168.2.16
May 6, 2024 04:56:56.191905022 CEST	2121	50626	34.128.145.40	192.168.2.16
May 6, 2024 04:56:56.191978931 CEST	50626	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:56.199008942 CEST	50615	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:56.199326992 CEST	50629	2121	192.168.2.16	91.229.92.88
May 6, 2024 04:56:56.206379890 CEST	21	50627	34.128.145.40	192.168.2.16
May 6, 2024 04:56:56.206391096 CEST	21	50623	34.128.145.40	192.168.2.16
May 6, 2024 04:56:56.206459045 CEST	50627	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:56.207901955 CEST	21	50442	103.165.157.224	192.168.2.16
May 6, 2024 04:56:56.215002060 CEST	50603	2121	192.168.2.16	108.165.114.34
May 6, 2024 04:56:56.231523991 CEST	50630	21	192.168.2.16	24.62.255.253
May 6, 2024 04:56:56.231568098 CEST	50631	2121	192.168.2.16	24.62.255.253
May 6, 2024 04:56:56.231638908 CEST	50633	21	192.168.2.16	93.216.201.153
May 6, 2024 04:56:56.231638908 CEST	50632	2121	192.168.2.16	93.216.201.153
May 6, 2024 04:56:56.240057945 CEST	2121	50443	103.165.157.224	192.168.2.16
May 6, 2024 04:56:56.240386009 CEST	21	50585	152.89.185.57	192.168.2.16
May 6, 2024 04:56:56.247217894 CEST	50634	21	192.168.2.16	222.223.37.205
May 6, 2024 04:56:56.262994051 CEST	50604	21	192.168.2.16	98.33.116.168
May 6, 2024 04:56:56.263326883 CEST	50635	2121	192.168.2.16	222.223.37.205
May 6, 2024 04:56:56.263456106 CEST	50636	21	192.168.2.16	41.230.218.202
May 6, 2024 04:56:56.295119047 CEST	50494	2121	192.168.2.16	211.210.139.133
May 6, 2024 04:56:56.295252085 CEST	50605	2121	192.168.2.16	98.33.116.168
May 6, 2024 04:56:56.295336008 CEST	50637	2121	192.168.2.16	41.230.218.202
May 6, 2024 04:56:56.295361042 CEST	50638	21	192.168.2.16	59.21.168.97
May 6, 2024 04:56:56.301234007 CEST	2121	50626	34.128.145.40	192.168.2.16
May 6, 2024 04:56:56.301286936 CEST	50626	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:56.301347017 CEST	50626	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:56.301501036 CEST	50639	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:56.308623075 CEST	21	50615	34.128.145.40	192.168.2.16
May 6, 2024 04:56:56.310977936 CEST	50542	21	192.168.2.16	221.168.159.170
May 6, 2024 04:56:56.310981035 CEST	50543	2121	192.168.2.16	221.168.159.170
May 6, 2024 04:56:56.310995102 CEST	50606	21	192.168.2.16	93.176.173.211
May 6, 2024 04:56:56.310996056 CEST	50516	21	192.168.2.16	211.218.72.245
May 6, 2024 04:56:56.310997009 CEST	50517	2121	192.168.2.16	211.218.72.245
May 6, 2024 04:56:56.310997009 CEST	50514	21	192.168.2.16	39.127.143.189
May 6, 2024 04:56:56.311054945 CEST	50607	2121	192.168.2.16	93.176.173.211
May 6, 2024 04:56:56.311167955 CEST	50640	2121	192.168.2.16	59.21.168.97
May 6, 2024 04:56:56.317969084 CEST	21	50627	34.128.145.40	192.168.2.16
May 6, 2024 04:56:56.318037987 CEST	50627	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:56.318078041 CEST	50627	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:56.318190098 CEST	50641	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:56.320025921 CEST	2121	50252	168.220.94.137	192.168.2.16
May 6, 2024 04:56:56.320075989 CEST	50252	2121	192.168.2.16	168.220.94.137
May 6, 2024 04:56:56.334781885 CEST	21	50556	89.174.3.24	192.168.2.16
May 6, 2024 04:56:56.342997074 CEST	50554	21	192.168.2.16	115.8.11.239
May 6, 2024 04:56:56.343370914 CEST	50642	21	192.168.2.16	73.45.29.118
May 6, 2024 04:56:56.343465090 CEST	50643	2121	192.168.2.16	73.45.29.118
May 6, 2024 04:56:56.343508005 CEST	50644	21	192.168.2.16	80.167.84.104
May 6, 2024 04:56:56.347649097 CEST	2121	50498	149.154.65.23	192.168.2.16
May 6, 2024 04:56:56.358969927 CEST	50493	21	192.168.2.16	211.210.139.133
May 6, 2024 04:56:56.359307051 CEST	50645	2121	192.168.2.16	80.167.84.104
May 6, 2024 04:56:56.359318972 CEST	50646	21	192.168.2.16	79.248.82.8
May 6, 2024 04:56:56.374000072 CEST	50515	2121	192.168.2.16	39.127.143.189
May 6, 2024 04:56:56.374001980 CEST	50468	2121	192.168.2.16	122.41.139.45
May 6, 2024 04:56:56.380812883 CEST	21	50617	45.87.1.166	192.168.2.16
May 6, 2024 04:56:56.381004095 CEST	21	50617	45.87.1.166	192.168.2.16
May 6, 2024 04:56:56.381119967 CEST	50617	21	192.168.2.16	45.87.1.166
May 6, 2024 04:56:56.405978918 CEST	50555	2121	192.168.2.16	115.8.11.239
May 6, 2024 04:56:56.406357050 CEST	50474	2121	192.168.2.16	211.44.88.172
May 6, 2024 04:56:56.406795025 CEST	50472	21	192.168.2.16	211.44.88.172
May 6, 2024 04:56:56.410522938 CEST	2121	50626	34.128.145.40	192.168.2.16
May 6, 2024 04:56:56.410676956 CEST	2121	50639	34.128.145.40	192.168.2.16
May 6, 2024 04:56:56.410742998 CEST	50639	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:56.422255039 CEST	50647	2121	192.168.2.16	79.248.82.8
May 6, 2024 04:56:56.427311897 CEST	21	50627	34.128.145.40	192.168.2.16
May 6, 2024 04:56:56.427366018 CEST	21	50641	34.128.145.40	192.168.2.16
May 6, 2024 04:56:56.427433014 CEST	50641	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:56.438205957 CEST	50648	21	192.168.2.16	174.20.97.27
May 6, 2024 04:56:56.469978094 CEST	50611	21	192.168.2.16	110.231.130.41
May 6, 2024 04:56:56.470309973 CEST	50649	21	192.168.2.16	91.41.188.118
May 6, 2024 04:56:56.470402002 CEST	50650	2121	192.168.2.16	174.20.97.27
May 6, 2024 04:56:56.486233950 CEST	50651	2121	192.168.2.16	91.41.188.118
May 6, 2024 04:56:56.496087074 CEST	21	50642	73.45.29.118	192.168.2.16
May 6, 2024 04:56:56.498446941 CEST	21	50636	41.230.218.202	192.168.2.16
May 6, 2024 04:56:56.502002001 CEST	50612	2121	192.168.2.16	110.231.130.41
May 6, 2024 04:56:56.502037048 CEST	2121	50643	73.45.29.118	192.168.2.16
May 6, 2024 04:56:56.511328936 CEST	21	50251	168.220.94.137	192.168.2.16
May 6, 2024 04:56:56.511378050 CEST	50251	21	192.168.2.16	168.220.94.137
May 6, 2024 04:56:56.518244982 CEST	50652	21	192.168.2.16	108.41.141.172
May 6, 2024 04:56:56.520077944 CEST	2121	50639	34.128.145.40	192.168.2.16
May 6, 2024 04:56:56.520131111 CEST	50639	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:56.520181894 CEST	50639	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:56.520317078 CEST	50653	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:56.530599117 CEST	2121	50637	41.230.218.202	192.168.2.16
May 6, 2024 04:56:56.536737919 CEST	21	50641	34.128.145.40	192.168.2.16
May 6, 2024 04:56:56.536789894 CEST	50641	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:56.536850929 CEST	50641	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:56.537019014 CEST	50654	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:56.537992954 CEST	21	50610	103.109.6.215	192.168.2.16
May 6, 2024 04:56:56.538117886 CEST	50610	21	192.168.2.16	103.109.6.215
May 6, 2024 04:56:56.550194025 CEST	50655	2121	192.168.2.16	108.41.141.172
May 6, 2024 04:56:56.582607985 CEST	50656	21	192.168.2.16	120.8.21.137
May 6, 2024 04:56:56.582643986 CEST	50657	21	192.168.2.16	100.2.122.180
May 6, 2024 04:56:56.582711935 CEST	50658	2121	192.168.2.16	120.8.21.137
May 6, 2024 04:56:56.591774940 CEST	21	50638	59.21.168.97	192.168.2.16
May 6, 2024 04:56:56.606429100 CEST	2121	50494	211.210.139.133	192.168.2.16
May 6, 2024 04:56:56.606765985 CEST	50659	2121	192.168.2.16	100.2.122.180
May 6, 2024 04:56:56.612246037 CEST	2121	50640	59.21.168.97	192.168.2.16
May 6, 2024 04:56:56.612415075 CEST	21	50542	221.168.159.170	192.168.2.16
May 6, 2024 04:56:56.613567114 CEST	2121	50543	221.168.159.170	192.168.2.16
May 6, 2024 04:56:56.613995075 CEST	50564	2121	192.168.2.16	190.92.153.181
May 6, 2024 04:56:56.614492893 CEST	50660	21	192.168.2.16	86.121.139.105
May 6, 2024 04:56:56.614573956 CEST	50661	2121	192.168.2.16	86.121.139.105
May 6, 2024 04:56:56.621566057 CEST	21	50516	211.218.72.245	192.168.2.16
May 6, 2024 04:56:56.621578932 CEST	21	50514	39.127.143.189	192.168.2.16
May 6, 2024 04:56:56.622159958 CEST	50662	2121	192.168.2.16	31.202.16.193
May 6, 2024 04:56:56.622217894 CEST	50663	21	192.168.2.16	31.202.16.193
May 6, 2024 04:56:56.622217894 CEST	50664	21	192.168.2.16	175.18.216.34
May 6, 2024 04:56:56.623402119 CEST	2121	50517	211.218.72.245	192.168.2.16
May 6, 2024 04:56:56.629334927 CEST	2121	50639	34.128.145.40	192.168.2.16
May 6, 2024 04:56:56.629481077 CEST	2121	50653	34.128.145.40	192.168.2.16
May 6, 2024 04:56:56.629542112 CEST	50653	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:56.630316973 CEST	50665	2121	192.168.2.16	175.18.216.34
May 6, 2024 04:56:56.630389929 CEST	50666	2121	192.168.2.16	1.251.243.65
May 6, 2024 04:56:56.630413055 CEST	50667	21	192.168.2.16	1.251.243.65
May 6, 2024 04:56:56.645978928 CEST	50613	21	192.168.2.16	222.235.83.57
May 6, 2024 04:56:56.646147966 CEST	21	50641	34.128.145.40	192.168.2.16
May 6, 2024 04:56:56.646194935 CEST	50668	21	192.168.2.16	178.187.219.73
May 6, 2024 04:56:56.646509886 CEST	21	50654	34.128.145.40	192.168.2.16
May 6, 2024 04:56:56.646572113 CEST	50654	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:56.653160095 CEST	21	50554	115.8.11.239	192.168.2.16
May 6, 2024 04:56:56.654453039 CEST	21	50617	45.87.1.166	192.168.2.16
May 6, 2024 04:56:56.661978006 CEST	50567	21	192.168.2.16	187.251.200.253
May 6, 2024 04:56:56.661995888 CEST	50616	2121	192.168.2.16	222.235.83.57
May 6, 2024 04:56:56.662410021 CEST	50669	2121	192.168.2.16	178.187.219.73
May 6, 2024 04:56:56.662445068 CEST	50670	21	192.168.2.16	23.220.172.150
May 6, 2024 04:56:56.678409100 CEST	50671	21	192.168.2.16	179.254.32.45
May 6, 2024 04:56:56.678445101 CEST	50672	2121	192.168.2.16	179.254.32.45
May 6, 2024 04:56:56.678510904 CEST	50673	2121	192.168.2.16	23.220.172.150
May 6, 2024 04:56:56.685355902 CEST	21	50493	211.210.139.133	192.168.2.16
May 6, 2024 04:56:56.701318026 CEST	2121	50515	39.127.143.189	192.168.2.16
May 6, 2024 04:56:56.706743956 CEST	2121	50468	122.41.139.45	192.168.2.16
May 6, 2024 04:56:56.709995985 CEST	50568	2121	192.168.2.16	187.251.200.253
May 6, 2024 04:56:56.710338116 CEST	50674	21	192.168.2.16	91.15.33.122
May 6, 2024 04:56:56.710494041 CEST	50675	2121	192.168.2.16	91.15.33.122
May 6, 2024 04:56:56.725991964 CEST	50618	21	192.168.2.16	46.90.129.21
May 6, 2024 04:56:56.726314068 CEST	50676	21	192.168.2.16	184.61.89.211
May 6, 2024 04:56:56.726492882 CEST	50677	2121	192.168.2.16	184.61.89.211
May 6, 2024 04:56:56.726702929 CEST	2121	50555	115.8.11.239	192.168.2.16
May 6, 2024 04:56:56.727039099 CEST	50678	21	192.168.2.16	212.187.25.212
May 6, 2024 04:56:56.738764048 CEST	2121	50653	34.128.145.40	192.168.2.16
May 6, 2024 04:56:56.738820076 CEST	50653	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:56.738883972 CEST	50653	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:56.739047050 CEST	50679	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:56.741974115 CEST	50585	21	192.168.2.16	152.89.185.57
May 6, 2024 04:56:56.742146015 CEST	50619	2121	192.168.2.16	46.90.129.21
May 6, 2024 04:56:56.742279053 CEST	50680	2121	192.168.2.16	212.187.25.212
May 6, 2024 04:56:56.745855093 CEST	2121	50474	211.44.88.172	192.168.2.16
May 6, 2024 04:56:56.746154070 CEST	21	50472	211.44.88.172	192.168.2.16
May 6, 2024 04:56:56.756129980 CEST	21	50654	34.128.145.40	192.168.2.16
May 6, 2024 04:56:56.756189108 CEST	50654	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:56.756345034 CEST	50654	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:56.756402016 CEST	50681	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:56.758485079 CEST	50682	21	192.168.2.16	50.3.33.187
May 6, 2024 04:56:56.758496046 CEST	50683	2121	192.168.2.16	50.3.33.187
May 6, 2024 04:56:56.758570910 CEST	50684	21	192.168.2.16	175.112.231.128
May 6, 2024 04:56:56.774236917 CEST	50685	2121	192.168.2.16	175.112.231.128
May 6, 2024 04:56:56.806009054 CEST	50621	2121	192.168.2.16	124.91.229.153
May 6, 2024 04:56:56.806010962 CEST	50620	21	192.168.2.16	124.91.229.153
May 6, 2024 04:56:56.838012934 CEST	50556	21	192.168.2.16	89.174.3.24
May 6, 2024 04:56:56.838474035 CEST	50686	21	192.168.2.16	71.115.207.213
May 6, 2024 04:56:56.851018906 CEST	2121	50653	34.128.145.40	192.168.2.16
May 6, 2024 04:56:56.851680040 CEST	2121	50679	34.128.145.40	192.168.2.16
May 6, 2024 04:56:56.851748943 CEST	50679	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:56.853362083 CEST	50687	2121	192.168.2.16	71.115.207.213
May 6, 2024 04:56:56.864077091 CEST	2121	50661	86.121.139.105	192.168.2.16
May 6, 2024 04:56:56.866404057 CEST	21	50681	34.128.145.40	192.168.2.16
May 6, 2024 04:56:56.866461992 CEST	50681	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:56.869294882 CEST	50688	21	192.168.2.16	94.21.5.245
May 6, 2024 04:56:56.885540962 CEST	50689	2121	192.168.2.16	94.21.5.245
May 6, 2024 04:56:56.885597944 CEST	50690	21	192.168.2.16	182.244.148.18
May 6, 2024 04:56:56.885637045 CEST	50691	2121	192.168.2.16	182.244.148.18
May 6, 2024 04:56:56.898933887 CEST	21	50682	50.3.33.187	192.168.2.16
May 6, 2024 04:56:56.910200119 CEST	21	50610	103.109.6.215	192.168.2.16
May 6, 2024 04:56:56.910355091 CEST	50610	21	192.168.2.16	103.109.6.215
May 6, 2024 04:56:56.910516977 CEST	50692	21	192.168.2.16	103.109.6.215
May 6, 2024 04:56:56.917409897 CEST	50693	21	192.168.2.16	121.159.44.62
May 6, 2024 04:56:56.917468071 CEST	50694	2121	192.168.2.16	121.159.44.62
May 6, 2024 04:56:56.949002981 CEST	50625	2121	192.168.2.16	85.16.183.122
May 6, 2024 04:56:56.949004889 CEST	50624	21	192.168.2.16	85.16.183.122
May 6, 2024 04:56:56.956263065 CEST	21	50667	1.251.243.65	192.168.2.16
May 6, 2024 04:56:56.964056969 CEST	2121	50666	1.251.243.65	192.168.2.16
May 6, 2024 04:56:56.965382099 CEST	50695	21	192.168.2.16	95.100.247.133
May 6, 2024 04:56:56.965466022 CEST	50696	2121	192.168.2.16	95.100.247.133
May 6, 2024 04:56:56.969625950 CEST	2121	50679	34.128.145.40	192.168.2.16
May 6, 2024 04:56:56.969675064 CEST	50679	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:56.969748974 CEST	50679	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:56.969918966 CEST	50697	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:56.979686022 CEST	21	50681	34.128.145.40	192.168.2.16
May 6, 2024 04:56:56.979736090 CEST	50681	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:56.979794979 CEST	50681	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:56.979934931 CEST	50698	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:56.994069099 CEST	21	50585	152.89.185.57	192.168.2.16
May 6, 2024 04:56:56.996984959 CEST	50642	21	192.168.2.16	73.45.29.118
May 6, 2024 04:56:56.997328997 CEST	50699	21	192.168.2.16	34.65.27.140
May 6, 2024 04:56:56.997507095 CEST	50700	2121	192.168.2.16	34.65.27.140
May 6, 2024 04:56:57.013005018 CEST	50643	2121	192.168.2.16	73.45.29.118
May 6, 2024 04:56:57.013006926 CEST	50636	21	192.168.2.16	41.230.218.202
May 6, 2024 04:56:57.013329029 CEST	50701	21	192.168.2.16	71.196.187.243
May 6, 2024 04:56:57.013427973 CEST	50702	2121	192.168.2.16	71.196.187.243
May 6, 2024 04:56:57.045006037 CEST	50637	2121	192.168.2.16	41.230.218.202
May 6, 2024 04:56:57.061007023 CEST	50572	21	192.168.2.16	20.125.78.0
May 6, 2024 04:56:57.077461004 CEST	50654	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:57.082837105 CEST	2121	50697	34.128.145.40	192.168.2.16
May 6, 2024 04:56:57.082906961 CEST	50697	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:57.083631992 CEST	2121	50679	34.128.145.40	192.168.2.16
May 6, 2024 04:56:57.092993975 CEST	50638	21	192.168.2.16	59.21.168.97
May 6, 2024 04:56:57.093400002 CEST	21	50698	34.128.145.40	192.168.2.16
May 6, 2024 04:56:57.093458891 CEST	50698	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:57.125005007 CEST	50640	2121	192.168.2.16	59.21.168.97
May 6, 2024 04:56:57.140995026 CEST	50575	2121	192.168.2.16	20.125.78.0
May 6, 2024 04:56:57.155287981 CEST	21	50642	73.45.29.118	192.168.2.16
May 6, 2024 04:56:57.157000065 CEST	50628	21	192.168.2.16	91.229.92.88
May 6, 2024 04:56:57.169449091 CEST	2121	50643	73.45.29.118	192.168.2.16
May 6, 2024 04:56:57.190495014 CEST	21	50654	34.128.145.40	192.168.2.16
May 6, 2024 04:56:57.195523977 CEST	2121	50697	34.128.145.40	192.168.2.16
May 6, 2024 04:56:57.195599079 CEST	50697	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:57.195683002 CEST	50697	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:57.195903063 CEST	50703	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:57.204993963 CEST	50629	2121	192.168.2.16	91.229.92.88
May 6, 2024 04:56:57.207982063 CEST	21	50698	34.128.145.40	192.168.2.16
May 6, 2024 04:56:57.208029032 CEST	50698	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:57.208075047 CEST	50698	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:57.208203077 CEST	50704	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:57.216561079 CEST	21	50693	121.159.44.62	192.168.2.16
May 6, 2024 04:56:57.221479893 CEST	50705	21	192.168.2.16	38.171.11.236
May 6, 2024 04:56:57.221532106 CEST	50706	2121	192.168.2.16	38.171.11.236
May 6, 2024 04:56:57.222564936 CEST	2121	50694	121.159.44.62	192.168.2.16
May 6, 2024 04:56:57.236998081 CEST	50576	21	192.168.2.16	178.186.179.18
May 6, 2024 04:56:57.237021923 CEST	50632	2121	192.168.2.16	93.216.201.153
May 6, 2024 04:56:57.237023115 CEST	50633	21	192.168.2.16	93.216.201.153
May 6, 2024 04:56:57.237023115 CEST	50630	21	192.168.2.16	24.62.255.253
May 6, 2024 04:56:57.237024069 CEST	50631	2121	192.168.2.16	24.62.255.253
May 6, 2024 04:56:57.252578974 CEST	21	50636	41.230.218.202	192.168.2.16
May 6, 2024 04:56:57.252998114 CEST	50582	2121	192.168.2.16	152.89.185.57
May 6, 2024 04:56:57.253138065 CEST	50634	21	192.168.2.16	222.223.37.205
May 6, 2024 04:56:57.269000053 CEST	50635	2121	192.168.2.16	222.223.37.205
May 6, 2024 04:56:57.283771038 CEST	21	50610	103.109.6.215	192.168.2.16
May 6, 2024 04:56:57.283782005 CEST	21	50610	103.109.6.215	192.168.2.16
May 6, 2024 04:56:57.283828974 CEST	50610	21	192.168.2.16	103.109.6.215
May 6, 2024 04:56:57.284826994 CEST	2121	50637	41.230.218.202	192.168.2.16
May 6, 2024 04:56:57.285803080 CEST	21	50692	103.109.6.215	192.168.2.16
May 6, 2024 04:56:57.285876036 CEST	50692	21	192.168.2.16	103.109.6.215
May 6, 2024 04:56:57.301029921 CEST	50577	2121	192.168.2.16	178.186.179.18
May 6, 2024 04:56:57.309006929 CEST	2121	50703	34.128.145.40	192.168.2.16
May 6, 2024 04:56:57.309017897 CEST	2121	50697	34.128.145.40	192.168.2.16
May 6, 2024 04:56:57.309088945 CEST	50703	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:57.316970110 CEST	50681	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:57.316999912 CEST	50578	21	192.168.2.16	89.58.52.251
May 6, 2024 04:56:57.321427107 CEST	21	50704	34.128.145.40	192.168.2.16
May 6, 2024 04:56:57.321494102 CEST	50704	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:57.322170973 CEST	21	50698	34.128.145.40	192.168.2.16
May 6, 2024 04:56:57.348999977 CEST	50644	21	192.168.2.16	80.167.84.104
May 6, 2024 04:56:57.349354029 CEST	50707	21	192.168.2.16	39.116.40.5
May 6, 2024 04:56:57.364990950 CEST	50646	21	192.168.2.16	79.248.82.8
May 6, 2024 04:56:57.374970913 CEST	50645	2121	192.168.2.16	80.167.84.104
May 6, 2024 04:56:57.374980927 CEST	50661	2121	192.168.2.16	86.121.139.105
May 6, 2024 04:56:57.389839888 CEST	21	50638	59.21.168.97	192.168.2.16
May 6, 2024 04:56:57.392533064 CEST	21	50563	216.117.162.236	192.168.2.16
May 6, 2024 04:56:57.392652035 CEST	50563	21	192.168.2.16	216.117.162.236
May 6, 2024 04:56:57.392837048 CEST	50708	21	192.168.2.16	216.117.162.236
May 6, 2024 04:56:57.413093090 CEST	50682	21	192.168.2.16	50.3.33.187
May 6, 2024 04:56:57.413274050 CEST	50709	2121	192.168.2.16	39.116.40.5
May 6, 2024 04:56:57.418469906 CEST	2121	50703	34.128.145.40	192.168.2.16
May 6, 2024 04:56:57.418528080 CEST	50703	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:57.418634892 CEST	50703	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:57.418828011 CEST	50710	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:57.426979065 CEST	21	50681	34.128.145.40	192.168.2.16
May 6, 2024 04:56:57.427117109 CEST	2121	50640	59.21.168.97	192.168.2.16
May 6, 2024 04:56:57.428989887 CEST	50647	2121	192.168.2.16	79.248.82.8
May 6, 2024 04:56:57.430783987 CEST	21	50704	34.128.145.40	192.168.2.16
May 6, 2024 04:56:57.430844069 CEST	50704	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:57.431016922 CEST	50704	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:57.431126118 CEST	50711	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:57.444993973 CEST	50648	21	192.168.2.16	174.20.97.27
May 6, 2024 04:56:57.461004019 CEST	50667	21	192.168.2.16	1.251.243.65
May 6, 2024 04:56:57.476994991 CEST	50649	21	192.168.2.16	91.41.188.118
May 6, 2024 04:56:57.477001905 CEST	50666	2121	192.168.2.16	1.251.243.65
May 6, 2024 04:56:57.477010012 CEST	50650	2121	192.168.2.16	174.20.97.27
May 6, 2024 04:56:57.492978096 CEST	50581	2121	192.168.2.16	89.58.52.251
May 6, 2024 04:56:57.492978096 CEST	50583	21	192.168.2.16	104.17.99.214
May 6, 2024 04:56:57.493140936 CEST	50651	2121	192.168.2.16	91.41.188.118
May 6, 2024 04:56:57.493144989 CEST	50584	2121	192.168.2.16	104.17.99.214
May 6, 2024 04:56:57.502604008 CEST	2121	50582	152.89.185.57	192.168.2.16
May 6, 2024 04:56:57.508980036 CEST	50585	21	192.168.2.16	152.89.185.57
May 6, 2024 04:56:57.508981943 CEST	50586	21	192.168.2.16	67.189.133.104
May 6, 2024 04:56:57.509150982 CEST	50587	2121	192.168.2.16	67.189.133.104
May 6, 2024 04:56:57.524976015 CEST	50652	21	192.168.2.16	108.41.141.172
May 6, 2024 04:56:57.527112007 CEST	21	50563	216.117.162.236	192.168.2.16
May 6, 2024 04:56:57.527165890 CEST	50563	21	192.168.2.16	216.117.162.236
May 6, 2024 04:56:57.527384043 CEST	21	50563	216.117.162.236	192.168.2.16
May 6, 2024 04:56:57.527432919 CEST	50563	21	192.168.2.16	216.117.162.236
May 6, 2024 04:56:57.527837992 CEST	21	50563	216.117.162.236	192.168.2.16
May 6, 2024 04:56:57.527882099 CEST	50563	21	192.168.2.16	216.117.162.236
May 6, 2024 04:56:57.528630018 CEST	2121	50703	34.128.145.40	192.168.2.16
May 6, 2024 04:56:57.528795958 CEST	2121	50710	34.128.145.40	192.168.2.16
May 6, 2024 04:56:57.528851986 CEST	50710	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:57.529819965 CEST	21	50563	216.117.162.236	192.168.2.16
May 6, 2024 04:56:57.529865026 CEST	50563	21	192.168.2.16	216.117.162.236
May 6, 2024 04:56:57.540200949 CEST	21	50704	34.128.145.40	192.168.2.16
May 6, 2024 04:56:57.540772915 CEST	21	50711	34.128.145.40	192.168.2.16
May 6, 2024 04:56:57.540828943 CEST	50711	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:57.552490950 CEST	21	50682	50.3.33.187	192.168.2.16
May 6, 2024 04:56:57.556993961 CEST	50655	2121	192.168.2.16	108.41.141.172
May 6, 2024 04:56:57.572977066 CEST	50590	21	192.168.2.16	192.63.179.50
May 6, 2024 04:56:57.588969946 CEST	50658	2121	192.168.2.16	120.8.21.137
May 6, 2024 04:56:57.588988066 CEST	50656	21	192.168.2.16	120.8.21.137
May 6, 2024 04:56:57.589142084 CEST	50657	21	192.168.2.16	100.2.122.180
May 6, 2024 04:56:57.620975971 CEST	50659	2121	192.168.2.16	100.2.122.180
May 6, 2024 04:56:57.620985985 CEST	50660	21	192.168.2.16	86.121.139.105
May 6, 2024 04:56:57.624140978 CEST	2121	50661	86.121.139.105	192.168.2.16
May 6, 2024 04:56:57.636976004 CEST	50663	21	192.168.2.16	31.202.16.193
May 6, 2024 04:56:57.636992931 CEST	50664	21	192.168.2.16	175.18.216.34
May 6, 2024 04:56:57.636992931 CEST	50662	2121	192.168.2.16	31.202.16.193
May 6, 2024 04:56:57.637052059 CEST	50665	2121	192.168.2.16	175.18.216.34
May 6, 2024 04:56:57.638874054 CEST	2121	50710	34.128.145.40	192.168.2.16
May 6, 2024 04:56:57.638923883 CEST	50710	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:57.639003992 CEST	50710	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:57.639189959 CEST	50712	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:57.650681973 CEST	21	50711	34.128.145.40	192.168.2.16
May 6, 2024 04:56:57.650737047 CEST	50711	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:57.650800943 CEST	50711	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:57.650984049 CEST	50713	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:57.652992964 CEST	50668	21	192.168.2.16	178.187.219.73
May 6, 2024 04:56:57.656747103 CEST	21	50692	103.109.6.215	192.168.2.16
May 6, 2024 04:56:57.656883955 CEST	50692	21	192.168.2.16	103.109.6.215
May 6, 2024 04:56:57.668986082 CEST	50642	21	192.168.2.16	73.45.29.118
May 6, 2024 04:56:57.668987036 CEST	50670	21	192.168.2.16	23.220.172.150
May 6, 2024 04:56:57.669068098 CEST	50669	2121	192.168.2.16	178.187.219.73
May 6, 2024 04:56:57.684997082 CEST	50672	2121	192.168.2.16	179.254.32.45
May 6, 2024 04:56:57.685012102 CEST	50643	2121	192.168.2.16	73.45.29.118
May 6, 2024 04:56:57.685015917 CEST	50671	21	192.168.2.16	179.254.32.45
May 6, 2024 04:56:57.685142994 CEST	50673	2121	192.168.2.16	23.220.172.150
May 6, 2024 04:56:57.691580057 CEST	21	50707	39.116.40.5	192.168.2.16
May 6, 2024 04:56:57.716974974 CEST	50674	21	192.168.2.16	91.15.33.122
May 6, 2024 04:56:57.716995001 CEST	50675	2121	192.168.2.16	91.15.33.122
May 6, 2024 04:56:57.717139959 CEST	50693	21	192.168.2.16	121.159.44.62
May 6, 2024 04:56:57.732984066 CEST	50678	21	192.168.2.16	212.187.25.212
May 6, 2024 04:56:57.732997894 CEST	50677	2121	192.168.2.16	184.61.89.211
May 6, 2024 04:56:57.733017921 CEST	50694	2121	192.168.2.16	121.159.44.62
May 6, 2024 04:56:57.733139992 CEST	50676	21	192.168.2.16	184.61.89.211
May 6, 2024 04:56:57.741385937 CEST	2121	50709	39.116.40.5	192.168.2.16
May 6, 2024 04:56:57.748996973 CEST	50680	2121	192.168.2.16	212.187.25.212
May 6, 2024 04:56:57.750050068 CEST	2121	50712	34.128.145.40	192.168.2.16
May 6, 2024 04:56:57.750112057 CEST	50712	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:57.751117945 CEST	2121	50710	34.128.145.40	192.168.2.16
May 6, 2024 04:56:57.758430958 CEST	21	50585	152.89.185.57	192.168.2.16
May 6, 2024 04:56:57.760401011 CEST	21	50711	34.128.145.40	192.168.2.16
May 6, 2024 04:56:57.760699987 CEST	21	50713	34.128.145.40	192.168.2.16
May 6, 2024 04:56:57.760768890 CEST	50713	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:57.765043974 CEST	50684	21	192.168.2.16	175.112.231.128
May 6, 2024 04:56:57.765984058 CEST	50636	21	192.168.2.16	41.230.218.202
May 6, 2024 04:56:57.766185999 CEST	50683	2121	192.168.2.16	50.3.33.187
May 6, 2024 04:56:57.780977011 CEST	50685	2121	192.168.2.16	175.112.231.128
May 6, 2024 04:56:57.780977011 CEST	50591	2121	192.168.2.16	192.63.179.50
May 6, 2024 04:56:57.781261921 CEST	50714	21	192.168.2.16	123.128.168.1
May 6, 2024 04:56:57.783540010 CEST	21	50667	1.251.243.65	192.168.2.16
May 6, 2024 04:56:57.796998978 CEST	50637	2121	192.168.2.16	41.230.218.202
May 6, 2024 04:56:57.807162046 CEST	2121	50666	1.251.243.65	192.168.2.16
May 6, 2024 04:56:57.821969986 CEST	21	50642	73.45.29.118	192.168.2.16
May 6, 2024 04:56:57.837918997 CEST	2121	50643	73.45.29.118	192.168.2.16
May 6, 2024 04:56:57.844976902 CEST	50686	21	192.168.2.16	71.115.207.213
May 6, 2024 04:56:57.859733105 CEST	2121	50712	34.128.145.40	192.168.2.16
May 6, 2024 04:56:57.859785080 CEST	50712	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:57.859961987 CEST	50712	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:57.860068083 CEST	50715	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:57.861002922 CEST	50687	2121	192.168.2.16	71.115.207.213
May 6, 2024 04:56:57.870481014 CEST	21	50713	34.128.145.40	192.168.2.16
May 6, 2024 04:56:57.870537996 CEST	50713	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:57.870695114 CEST	50713	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:57.870776892 CEST	50716	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:57.876991034 CEST	50688	21	192.168.2.16	94.21.5.245
May 6, 2024 04:56:57.892978907 CEST	50689	2121	192.168.2.16	94.21.5.245
May 6, 2024 04:56:57.892998934 CEST	50690	21	192.168.2.16	182.244.148.18
May 6, 2024 04:56:57.893003941 CEST	50638	21	192.168.2.16	59.21.168.97
May 6, 2024 04:56:57.893003941 CEST	50594	21	192.168.2.16	98.242.36.116
May 6, 2024 04:56:57.893095970 CEST	50691	2121	192.168.2.16	182.244.148.18
May 6, 2024 04:56:57.941107988 CEST	50640	2121	192.168.2.16	59.21.168.97
May 6, 2024 04:56:57.962969065 CEST	50595	2121	192.168.2.16	98.242.36.116
May 6, 2024 04:56:57.969646931 CEST	2121	50712	34.128.145.40	192.168.2.16
May 6, 2024 04:56:57.969659090 CEST	2121	50715	34.128.145.40	192.168.2.16
May 6, 2024 04:56:57.969719887 CEST	50715	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:57.972978115 CEST	50696	2121	192.168.2.16	95.100.247.133
May 6, 2024 04:56:57.975976944 CEST	50695	21	192.168.2.16	95.100.247.133
May 6, 2024 04:56:57.980365038 CEST	21	50713	34.128.145.40	192.168.2.16
May 6, 2024 04:56:57.981117964 CEST	21	50716	34.128.145.40	192.168.2.16
May 6, 2024 04:56:57.981172085 CEST	50716	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:58.001503944 CEST	21	50636	41.230.218.202	192.168.2.16
May 6, 2024 04:56:58.004976988 CEST	50596	21	192.168.2.16	87.2.36.15
May 6, 2024 04:56:58.005064011 CEST	50699	21	192.168.2.16	34.65.27.140
May 6, 2024 04:56:58.005065918 CEST	50700	2121	192.168.2.16	34.65.27.140
May 6, 2024 04:56:58.005703926 CEST	50582	2121	192.168.2.16	152.89.185.57
May 6, 2024 04:56:58.013706923 CEST	21	50693	121.159.44.62	192.168.2.16
May 6, 2024 04:56:58.016679049 CEST	21	50449	109.205.180.149	192.168.2.16
May 6, 2024 04:56:58.016798973 CEST	50449	21	192.168.2.16	109.205.180.149
May 6, 2024 04:56:58.016957998 CEST	50717	21	192.168.2.16	109.205.180.149
May 6, 2024 04:56:58.020036936 CEST	50701	21	192.168.2.16	71.196.187.243
May 6, 2024 04:56:58.020075083 CEST	50702	2121	192.168.2.16	71.196.187.243
May 6, 2024 04:56:58.021369934 CEST	50719	21	192.168.2.16	135.181.57.96
May 6, 2024 04:56:58.021469116 CEST	50720	2121	192.168.2.16	217.95.121.142
May 6, 2024 04:56:58.021517992 CEST	50722	21	192.168.2.16	217.95.121.142
May 6, 2024 04:56:58.021537066 CEST	50721	21	192.168.2.16	85.137.228.99
May 6, 2024 04:56:58.021574020 CEST	50723	2121	192.168.2.16	85.137.228.99
May 6, 2024 04:56:58.021660089 CEST	50724	21	192.168.2.16	93.185.159.51
May 6, 2024 04:56:58.021828890 CEST	50725	21	192.168.2.16	121.152.228.54
May 6, 2024 04:56:58.021893978 CEST	50726	2121	192.168.2.16	93.185.159.51
May 6, 2024 04:56:58.021959066 CEST	50727	21	192.168.2.16	27.203.118.210
May 6, 2024 04:56:58.022027969 CEST	50728	2121	192.168.2.16	27.203.118.210
May 6, 2024 04:56:58.022030115 CEST	50729	2121	192.168.2.16	101.65.79.36
May 6, 2024 04:56:58.022030115 CEST	50718	2121	192.168.2.16	123.128.168.1
May 6, 2024 04:56:58.022062063 CEST	50730	21	192.168.2.16	101.65.79.36
May 6, 2024 04:56:58.022114992 CEST	50731	21	192.168.2.16	116.139.82.91
May 6, 2024 04:56:58.022245884 CEST	50733	2121	192.168.2.16	121.152.228.54
May 6, 2024 04:56:58.022248983 CEST	50732	2121	192.168.2.16	135.181.57.96
May 6, 2024 04:56:58.027533054 CEST	21	50692	103.109.6.215	192.168.2.16
May 6, 2024 04:56:58.027648926 CEST	50692	21	192.168.2.16	103.109.6.215
May 6, 2024 04:56:58.031503916 CEST	2121	50637	41.230.218.202	192.168.2.16
May 6, 2024 04:56:58.036180973 CEST	2121	50694	121.159.44.62	192.168.2.16
May 6, 2024 04:56:58.038173914 CEST	50734	2121	192.168.2.16	116.139.82.91
May 6, 2024 04:56:58.038219929 CEST	50735	21	192.168.2.16	156.242.212.172
May 6, 2024 04:56:58.038233995 CEST	50736	2121	192.168.2.16	156.242.212.172
May 6, 2024 04:56:58.038352013 CEST	50737	21	192.168.2.16	71.34.106.185
May 6, 2024 04:56:58.038455009 CEST	50738	2121	192.168.2.16	71.34.106.185
May 6, 2024 04:56:58.038683891 CEST	50739	21	192.168.2.16	119.154.190.4
May 6, 2024 04:56:58.038886070 CEST	50740	2121	192.168.2.16	119.154.190.4
May 6, 2024 04:56:58.038887978 CEST	50741	2121	192.168.2.16	154.210.32.21
May 6, 2024 04:56:58.038937092 CEST	50743	21	192.168.2.16	200.216.148.34
May 6, 2024 04:56:58.038950920 CEST	50742	21	192.168.2.16	154.210.32.21
May 6, 2024 04:56:58.039021969 CEST	50744	2121	192.168.2.16	200.216.148.34
May 6, 2024 04:56:58.039191961 CEST	50745	21	192.168.2.16	118.98.35.10
May 6, 2024 04:56:58.039233923 CEST	50746	2121	192.168.2.16	118.98.35.10
May 6, 2024 04:56:58.039249897 CEST	50747	21	192.168.2.16	45.33.5.34
May 6, 2024 04:56:58.039309025 CEST	50748	21	192.168.2.16	114.42.229.208
May 6, 2024 04:56:58.039374113 CEST	50749	2121	192.168.2.16	45.33.5.34
May 6, 2024 04:56:58.039459944 CEST	50750	2121	192.168.2.16	114.42.229.208
May 6, 2024 04:56:58.039508104 CEST	50751	21	192.168.2.16	39.68.11.249
May 6, 2024 04:56:58.039654016 CEST	50754	21	192.168.2.16	208.184.124.137
May 6, 2024 04:56:58.039674044 CEST	50755	2121	192.168.2.16	208.184.124.137
May 6, 2024 04:56:58.039832115 CEST	50756	21	192.168.2.16	209.183.149.234
May 6, 2024 04:56:58.040002108 CEST	50757	2121	192.168.2.16	37.20.148.191
May 6, 2024 04:56:58.040026903 CEST	50758	21	192.168.2.16	5.129.51.197
May 6, 2024 04:56:58.040102959 CEST	50759	2121	192.168.2.16	73.234.5.204
May 6, 2024 04:56:58.040199995 CEST	50760	21	192.168.2.16	171.231.31.165
May 6, 2024 04:56:58.040246010 CEST	50761	2121	192.168.2.16	96.10.238.106
May 6, 2024 04:56:58.040246010 CEST	50762	2121	192.168.2.16	209.183.149.234
May 6, 2024 04:56:58.040293932 CEST	50752	2121	192.168.2.16	39.68.11.249
May 6, 2024 04:56:58.040347099 CEST	50763	21	192.168.2.16	37.20.148.191
May 6, 2024 04:56:58.040365934 CEST	50753	21	192.168.2.16	96.10.238.106
May 6, 2024 04:56:58.040535927 CEST	50764	21	192.168.2.16	73.234.5.204
May 6, 2024 04:56:58.040579081 CEST	50765	2121	192.168.2.16	171.231.31.165
May 6, 2024 04:56:58.052028894 CEST	50599	2121	192.168.2.16	87.2.36.15
May 6, 2024 04:56:58.052728891 CEST	50766	2121	192.168.2.16	5.129.51.197
May 6, 2024 04:56:58.052777052 CEST	50767	2121	192.168.2.16	185.48.149.208
May 6, 2024 04:56:58.052865982 CEST	50768	21	192.168.2.16	185.48.149.208
May 6, 2024 04:56:58.052881002 CEST	50769	21	192.168.2.16	73.248.132.178
May 6, 2024 04:56:58.052907944 CEST	50770	2121	192.168.2.16	73.248.132.178
May 6, 2024 04:56:58.068053007 CEST	50682	21	192.168.2.16	50.3.33.187
May 6, 2024 04:56:58.070172071 CEST	50771	21	192.168.2.16	109.172.100.131
May 6, 2024 04:56:58.070687056 CEST	50772	2121	192.168.2.16	109.172.100.131
May 6, 2024 04:56:58.070753098 CEST	50773	21	192.168.2.16	39.27.135.223
May 6, 2024 04:56:58.070841074 CEST	50774	2121	192.168.2.16	39.27.135.223
May 6, 2024 04:56:58.071595907 CEST	50775	21	192.168.2.16	111.18.251.50
May 6, 2024 04:56:58.071789980 CEST	50776	2121	192.168.2.16	111.18.251.50
May 6, 2024 04:56:58.071847916 CEST	50777	2121	192.168.2.16	66.69.12.241
May 6, 2024 04:56:58.071893930 CEST	50778	21	192.168.2.16	68.234.240.182
May 6, 2024 04:56:58.072002888 CEST	50779	21	192.168.2.16	66.69.12.241
May 6, 2024 04:56:58.072066069 CEST	50780	2121	192.168.2.16	68.234.240.182
May 6, 2024 04:56:58.072109938 CEST	50781	21	192.168.2.16	27.79.77.134
May 6, 2024 04:56:58.072249889 CEST	50782	2121	192.168.2.16	27.79.77.134
May 6, 2024 04:56:58.072302103 CEST	50783	21	192.168.2.16	107.190.0.105
May 6, 2024 04:56:58.072422981 CEST	50784	2121	192.168.2.16	107.190.0.105
May 6, 2024 04:56:58.072449923 CEST	50785	21	192.168.2.16	95.37.152.98
May 6, 2024 04:56:58.072547913 CEST	50786	21	192.168.2.16	76.176.42.197
May 6, 2024 04:56:58.072681904 CEST	50787	2121	192.168.2.16	95.37.152.98
May 6, 2024 04:56:58.072691917 CEST	50788	2121	192.168.2.16	76.176.42.197
May 6, 2024 04:56:58.072798014 CEST	50789	2121	192.168.2.16	98.255.42.68
May 6, 2024 04:56:58.072873116 CEST	50790	21	192.168.2.16	98.255.42.68
May 6, 2024 04:56:58.072931051 CEST	50791	21	192.168.2.16	188.191.254.52
May 6, 2024 04:56:58.073013067 CEST	50792	21	192.168.2.16	20.23.119.186
May 6, 2024 04:56:58.073035955 CEST	50793	2121	192.168.2.16	188.191.254.52
May 6, 2024 04:56:58.073107958 CEST	50794	2121	192.168.2.16	20.23.119.186
May 6, 2024 04:56:58.073132038 CEST	50795	21	192.168.2.16	220.255.44.99
May 6, 2024 04:56:58.073180914 CEST	50796	2121	192.168.2.16	220.255.44.99
May 6, 2024 04:56:58.073224068 CEST	50797	21	192.168.2.16	2.108.129.87
May 6, 2024 04:56:58.073302031 CEST	50798	2121	192.168.2.16	2.108.129.87
May 6, 2024 04:56:58.079364061 CEST	2121	50715	34.128.145.40	192.168.2.16
May 6, 2024 04:56:58.079428911 CEST	50715	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:58.079477072 CEST	50715	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:58.079616070 CEST	50799	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:58.084777117 CEST	50800	21	192.168.2.16	14.95.142.67
May 6, 2024 04:56:58.084825039 CEST	50801	2121	192.168.2.16	14.95.142.67
May 6, 2024 04:56:58.084841967 CEST	50802	21	192.168.2.16	4.231.28.100
May 6, 2024 04:56:58.084880114 CEST	50803	2121	192.168.2.16	4.231.28.100
May 6, 2024 04:56:58.091618061 CEST	21	50716	34.128.145.40	192.168.2.16
May 6, 2024 04:56:58.091695070 CEST	50716	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:58.091753006 CEST	50716	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:58.091916084 CEST	50804	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:58.115972996 CEST	50600	21	192.168.2.16	108.165.114.34
May 6, 2024 04:56:58.132000923 CEST	50661	2121	192.168.2.16	86.121.139.105
May 6, 2024 04:56:58.138489008 CEST	21	50714	123.128.168.1	192.168.2.16
May 6, 2024 04:56:58.148392916 CEST	50805	21	192.168.2.16	182.216.235.11
May 6, 2024 04:56:58.148425102 CEST	50806	2121	192.168.2.16	182.216.235.11
May 6, 2024 04:56:58.188996077 CEST	2121	50715	34.128.145.40	192.168.2.16
May 6, 2024 04:56:58.189172029 CEST	2121	50799	34.128.145.40	192.168.2.16
May 6, 2024 04:56:58.189228058 CEST	50799	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:58.189594030 CEST	21	50638	59.21.168.97	192.168.2.16
May 6, 2024 04:56:58.201334000 CEST	21	50716	34.128.145.40	192.168.2.16
May 6, 2024 04:56:58.202343941 CEST	21	50804	34.128.145.40	192.168.2.16
May 6, 2024 04:56:58.202398062 CEST	50804	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:58.206973076 CEST	50707	21	192.168.2.16	39.116.40.5
May 6, 2024 04:56:58.207470894 CEST	21	50682	50.3.33.187	192.168.2.16
May 6, 2024 04:56:58.227988005 CEST	50706	2121	192.168.2.16	38.171.11.236
May 6, 2024 04:56:58.227993011 CEST	50603	2121	192.168.2.16	108.165.114.34
May 6, 2024 04:56:58.228070974 CEST	50705	21	192.168.2.16	38.171.11.236
May 6, 2024 04:56:58.242485046 CEST	2121	50640	59.21.168.97	192.168.2.16
May 6, 2024 04:56:58.243993998 CEST	50709	2121	192.168.2.16	39.116.40.5
May 6, 2024 04:56:58.249635935 CEST	21	50717	109.205.180.149	192.168.2.16
May 6, 2024 04:56:58.249696970 CEST	50717	21	192.168.2.16	109.205.180.149
May 6, 2024 04:56:58.250354052 CEST	21	50449	109.205.180.149	192.168.2.16
May 6, 2024 04:56:58.250403881 CEST	50449	21	192.168.2.16	109.205.180.149
May 6, 2024 04:56:58.251796007 CEST	21	50449	109.205.180.149	192.168.2.16
May 6, 2024 04:56:58.251842976 CEST	50449	21	192.168.2.16	109.205.180.149
May 6, 2024 04:56:58.253041983 CEST	21	50719	135.181.57.96	192.168.2.16
May 6, 2024 04:56:58.255295992 CEST	2121	50582	152.89.185.57	192.168.2.16
May 6, 2024 04:56:58.270196915 CEST	2121	50732	135.181.57.96	192.168.2.16
May 6, 2024 04:56:58.273513079 CEST	21	50790	98.255.42.68	192.168.2.16
May 6, 2024 04:56:58.276276112 CEST	50604	21	192.168.2.16	98.33.116.168
May 6, 2024 04:56:58.278023958 CEST	2121	50789	98.255.42.68	192.168.2.16
May 6, 2024 04:56:58.279999018 CEST	21	50771	109.172.100.131	192.168.2.16
May 6, 2024 04:56:58.281819105 CEST	2121	50726	93.185.159.51	192.168.2.16
May 6, 2024 04:56:58.285320997 CEST	21	50724	93.185.159.51	192.168.2.16
May 6, 2024 04:56:58.288177967 CEST	2121	50772	109.172.100.131	192.168.2.16
May 6, 2024 04:56:58.291982889 CEST	50667	21	192.168.2.16	1.251.243.65
May 6, 2024 04:56:58.298928022 CEST	2121	50799	34.128.145.40	192.168.2.16
May 6, 2024 04:56:58.298980951 CEST	50799	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:58.299047947 CEST	50799	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:58.299221992 CEST	50807	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:58.307997942 CEST	50666	2121	192.168.2.16	1.251.243.65
May 6, 2024 04:56:58.312951088 CEST	21	50804	34.128.145.40	192.168.2.16
May 6, 2024 04:56:58.313009977 CEST	50804	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:58.313055038 CEST	50804	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:58.313206911 CEST	50808	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:58.316987038 CEST	50605	2121	192.168.2.16	98.33.116.168
May 6, 2024 04:56:58.317142010 CEST	50607	2121	192.168.2.16	93.176.173.211
May 6, 2024 04:56:58.322990894 CEST	50606	21	192.168.2.16	93.176.173.211
May 6, 2024 04:56:58.326756001 CEST	50642	21	192.168.2.16	73.45.29.118
May 6, 2024 04:56:58.328021049 CEST	2121	50733	121.152.228.54	192.168.2.16
May 6, 2024 04:56:58.329788923 CEST	21	50725	121.152.228.54	192.168.2.16
May 6, 2024 04:56:58.339000940 CEST	50643	2121	192.168.2.16	73.45.29.118
May 6, 2024 04:56:58.366688013 CEST	2121	50718	123.128.168.1	192.168.2.16
May 6, 2024 04:56:58.378768921 CEST	21	50773	39.27.135.223	192.168.2.16
May 6, 2024 04:56:58.379481077 CEST	2121	50774	39.27.135.223	192.168.2.16
May 6, 2024 04:56:58.380460024 CEST	21	50742	154.210.32.21	192.168.2.16
May 6, 2024 04:56:58.380520105 CEST	50742	21	192.168.2.16	154.210.32.21
May 6, 2024 04:56:58.381092072 CEST	2121	50661	86.121.139.105	192.168.2.16
May 6, 2024 04:56:58.393018961 CEST	21	50800	14.95.142.67	192.168.2.16
May 6, 2024 04:56:58.395349026 CEST	2121	50801	14.95.142.67	192.168.2.16
May 6, 2024 04:56:58.399692059 CEST	21	50692	103.109.6.215	192.168.2.16
May 6, 2024 04:56:58.399811029 CEST	50692	21	192.168.2.16	103.109.6.215
May 6, 2024 04:56:58.399971962 CEST	50809	21	192.168.2.16	103.109.6.215
May 6, 2024 04:56:58.403002977 CEST	50708	21	192.168.2.16	216.117.162.236
May 6, 2024 04:56:58.408720970 CEST	2121	50799	34.128.145.40	192.168.2.16
May 6, 2024 04:56:58.408798933 CEST	2121	50807	34.128.145.40	192.168.2.16
May 6, 2024 04:56:58.408864975 CEST	50807	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:58.419992924 CEST	21	50739	119.154.190.4	192.168.2.16
May 6, 2024 04:56:58.422378063 CEST	21	50808	34.128.145.40	192.168.2.16
May 6, 2024 04:56:58.422454119 CEST	50808	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:58.422574997 CEST	21	50804	34.128.145.40	192.168.2.16
May 6, 2024 04:56:58.425169945 CEST	2121	50740	119.154.190.4	192.168.2.16
May 6, 2024 04:56:58.479954958 CEST	21	50642	73.45.29.118	192.168.2.16
May 6, 2024 04:56:58.482975006 CEST	50611	21	192.168.2.16	110.231.130.41
May 6, 2024 04:56:58.484307051 CEST	21	50717	109.205.180.149	192.168.2.16
May 6, 2024 04:56:58.484457970 CEST	50717	21	192.168.2.16	109.205.180.149
May 6, 2024 04:56:58.490068913 CEST	2121	50643	73.45.29.118	192.168.2.16
May 6, 2024 04:56:58.500720978 CEST	2121	50776	111.18.251.50	192.168.2.16
May 6, 2024 04:56:58.514974117 CEST	50636	21	192.168.2.16	41.230.218.202
May 6, 2024 04:56:58.515000105 CEST	50612	2121	192.168.2.16	110.231.130.41
May 6, 2024 04:56:58.515000105 CEST	50693	21	192.168.2.16	121.159.44.62
May 6, 2024 04:56:58.518588066 CEST	2121	50807	34.128.145.40	192.168.2.16
May 6, 2024 04:56:58.518657923 CEST	50807	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:58.518723011 CEST	50807	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:58.518939018 CEST	50810	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:58.531692982 CEST	21	50808	34.128.145.40	192.168.2.16
May 6, 2024 04:56:58.531747103 CEST	50808	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:58.531799078 CEST	50808	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:58.531975985 CEST	50811	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:58.546997070 CEST	50637	2121	192.168.2.16	41.230.218.202
May 6, 2024 04:56:58.547012091 CEST	50694	2121	192.168.2.16	121.159.44.62
May 6, 2024 04:56:58.549622059 CEST	21	50707	39.116.40.5	192.168.2.16
May 6, 2024 04:56:58.571441889 CEST	2121	50709	39.116.40.5	192.168.2.16
May 6, 2024 04:56:58.595294952 CEST	50812	21	192.168.2.16	125.122.17.98
May 6, 2024 04:56:58.615051031 CEST	21	50667	1.251.243.65	192.168.2.16
May 6, 2024 04:56:58.628190994 CEST	2121	50810	34.128.145.40	192.168.2.16
May 6, 2024 04:56:58.628262043 CEST	50810	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:58.629127979 CEST	2121	50807	34.128.145.40	192.168.2.16
May 6, 2024 04:56:58.638876915 CEST	2121	50666	1.251.243.65	192.168.2.16
May 6, 2024 04:56:58.641170979 CEST	21	50811	34.128.145.40	192.168.2.16
May 6, 2024 04:56:58.641247988 CEST	50811	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:58.645145893 CEST	50714	21	192.168.2.16	123.128.168.1
May 6, 2024 04:56:58.658983946 CEST	50613	21	192.168.2.16	222.235.83.57
May 6, 2024 04:56:58.659245014 CEST	50813	2121	192.168.2.16	125.122.17.98
May 6, 2024 04:56:58.675013065 CEST	50616	2121	192.168.2.16	222.235.83.57
May 6, 2024 04:56:58.690977097 CEST	50638	21	192.168.2.16	59.21.168.97
May 6, 2024 04:56:58.691231966 CEST	50814	21	192.168.2.16	79.116.255.24
May 6, 2024 04:56:58.716991901 CEST	21	50717	109.205.180.149	192.168.2.16
May 6, 2024 04:56:58.717195034 CEST	21	50717	109.205.180.149	192.168.2.16
May 6, 2024 04:56:58.717325926 CEST	50717	21	192.168.2.16	109.205.180.149
May 6, 2024 04:56:58.723017931 CEST	50682	21	192.168.2.16	50.3.33.187
May 6, 2024 04:56:58.723751068 CEST	21	50742	154.210.32.21	192.168.2.16
May 6, 2024 04:56:58.723865032 CEST	50742	21	192.168.2.16	154.210.32.21
May 6, 2024 04:56:58.724124908 CEST	50815	2121	192.168.2.16	79.116.255.24
May 6, 2024 04:56:58.738354921 CEST	2121	50810	34.128.145.40	192.168.2.16
May 6, 2024 04:56:58.738436937 CEST	50810	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:58.738532066 CEST	50810	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:58.738986969 CEST	50618	21	192.168.2.16	46.90.129.21
May 6, 2024 04:56:58.743078947 CEST	50816	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:58.750715017 CEST	21	50636	41.230.218.202	192.168.2.16
May 6, 2024 04:56:58.751255035 CEST	21	50811	34.128.145.40	192.168.2.16
May 6, 2024 04:56:58.751322985 CEST	50811	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:58.752233982 CEST	21	50809	103.109.6.215	192.168.2.16
May 6, 2024 04:56:58.752311945 CEST	50809	21	192.168.2.16	103.109.6.215
May 6, 2024 04:56:58.755011082 CEST	50619	2121	192.168.2.16	46.90.129.21
May 6, 2024 04:56:58.755023003 CEST	50640	2121	192.168.2.16	59.21.168.97
May 6, 2024 04:56:58.755997896 CEST	50719	21	192.168.2.16	135.181.57.96
May 6, 2024 04:56:58.761198044 CEST	50811	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:58.761496067 CEST	50817	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:58.769999981 CEST	50582	2121	192.168.2.16	152.89.185.57
May 6, 2024 04:56:58.770478010 CEST	21	50692	103.109.6.215	192.168.2.16
May 6, 2024 04:56:58.770498991 CEST	21	50692	103.109.6.215	192.168.2.16
May 6, 2024 04:56:58.770550966 CEST	50692	21	192.168.2.16	103.109.6.215
May 6, 2024 04:56:58.770580053 CEST	50732	2121	192.168.2.16	135.181.57.96
May 6, 2024 04:56:58.782845974 CEST	2121	50637	41.230.218.202	192.168.2.16
May 6, 2024 04:56:58.785013914 CEST	50789	2121	192.168.2.16	98.255.42.68
May 6, 2024 04:56:58.785020113 CEST	50790	21	192.168.2.16	98.255.42.68
May 6, 2024 04:56:58.785018921 CEST	50771	21	192.168.2.16	109.172.100.131
May 6, 2024 04:56:58.785020113 CEST	50726	2121	192.168.2.16	93.185.159.51
May 6, 2024 04:56:58.799992085 CEST	50724	21	192.168.2.16	93.185.159.51
May 6, 2024 04:56:58.800970078 CEST	50772	2121	192.168.2.16	109.172.100.131
May 6, 2024 04:56:58.811835051 CEST	21	50693	121.159.44.62	192.168.2.16
May 6, 2024 04:56:58.815979958 CEST	50620	21	192.168.2.16	124.91.229.153
May 6, 2024 04:56:58.815994978 CEST	50621	2121	192.168.2.16	124.91.229.153
May 6, 2024 04:56:58.831974030 CEST	50725	21	192.168.2.16	121.152.228.54
May 6, 2024 04:56:58.831974983 CEST	50733	2121	192.168.2.16	121.152.228.54
May 6, 2024 04:56:58.847709894 CEST	2121	50810	34.128.145.40	192.168.2.16
May 6, 2024 04:56:58.849845886 CEST	2121	50694	121.159.44.62	192.168.2.16
May 6, 2024 04:56:58.852711916 CEST	2121	50816	34.128.145.40	192.168.2.16
May 6, 2024 04:56:58.852802038 CEST	50816	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:58.861998081 CEST	50808	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:58.862382889 CEST	21	50682	50.3.33.187	192.168.2.16
May 6, 2024 04:56:58.870414019 CEST	21	50811	34.128.145.40	192.168.2.16
May 6, 2024 04:56:58.870613098 CEST	21	50817	34.128.145.40	192.168.2.16
May 6, 2024 04:56:58.870673895 CEST	50817	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:58.878981113 CEST	50718	2121	192.168.2.16	123.128.168.1
May 6, 2024 04:56:58.893974066 CEST	50774	2121	192.168.2.16	39.27.135.223
May 6, 2024 04:56:58.893992901 CEST	50773	21	192.168.2.16	39.27.135.223
May 6, 2024 04:56:58.893994093 CEST	50661	2121	192.168.2.16	86.121.139.105
May 6, 2024 04:56:58.894948006 CEST	50800	21	192.168.2.16	14.95.142.67
May 6, 2024 04:56:58.909972906 CEST	50801	2121	192.168.2.16	14.95.142.67
May 6, 2024 04:56:58.925982952 CEST	50739	21	192.168.2.16	119.154.190.4
May 6, 2024 04:56:58.926131964 CEST	50740	2121	192.168.2.16	119.154.190.4
May 6, 2024 04:56:58.956978083 CEST	50624	21	192.168.2.16	85.16.183.122
May 6, 2024 04:56:58.956990957 CEST	50625	2121	192.168.2.16	85.16.183.122
May 6, 2024 04:56:58.962682962 CEST	21	50790	98.255.42.68	192.168.2.16
May 6, 2024 04:56:58.964864969 CEST	2121	50816	34.128.145.40	192.168.2.16
May 6, 2024 04:56:58.964911938 CEST	50816	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:58.967283964 CEST	2121	50789	98.255.42.68	192.168.2.16
May 6, 2024 04:56:58.972161055 CEST	21	50808	34.128.145.40	192.168.2.16
May 6, 2024 04:56:58.980391026 CEST	50816	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:58.980674028 CEST	21	50817	34.128.145.40	192.168.2.16
May 6, 2024 04:56:58.980720043 CEST	50817	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:58.987978935 CEST	50642	21	192.168.2.16	73.45.29.118
May 6, 2024 04:56:58.988670111 CEST	21	50719	135.181.57.96	192.168.2.16
May 6, 2024 04:56:58.988679886 CEST	21	50638	59.21.168.97	192.168.2.16
May 6, 2024 04:56:58.990263939 CEST	21	50717	109.205.180.149	192.168.2.16
May 6, 2024 04:56:58.995711088 CEST	21	50771	109.172.100.131	192.168.2.16
May 6, 2024 04:56:58.998545885 CEST	50818	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:58.998617887 CEST	50817	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:58.998780966 CEST	50819	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:59.001274109 CEST	21	50714	123.128.168.1	192.168.2.16
May 6, 2024 04:56:59.003983974 CEST	50643	2121	192.168.2.16	73.45.29.118
May 6, 2024 04:56:59.005048037 CEST	50776	2121	192.168.2.16	111.18.251.50
May 6, 2024 04:56:59.018299103 CEST	2121	50732	135.181.57.96	192.168.2.16
May 6, 2024 04:56:59.019571066 CEST	2121	50582	152.89.185.57	192.168.2.16
May 6, 2024 04:56:59.019839048 CEST	2121	50772	109.172.100.131	192.168.2.16
May 6, 2024 04:56:59.025984049 CEST	50723	2121	192.168.2.16	85.137.228.99
May 6, 2024 04:56:59.025995970 CEST	50722	21	192.168.2.16	217.95.121.142
May 6, 2024 04:56:59.025996923 CEST	50730	21	192.168.2.16	101.65.79.36
May 6, 2024 04:56:59.034979105 CEST	50729	2121	192.168.2.16	101.65.79.36
May 6, 2024 04:56:59.034981012 CEST	50728	2121	192.168.2.16	27.203.118.210
May 6, 2024 04:56:59.034990072 CEST	50721	21	192.168.2.16	85.137.228.99
May 6, 2024 04:56:59.034991026 CEST	50720	2121	192.168.2.16	217.95.121.142
May 6, 2024 04:56:59.034997940 CEST	50731	21	192.168.2.16	116.139.82.91
May 6, 2024 04:56:59.034998894 CEST	50727	21	192.168.2.16	27.203.118.210
May 6, 2024 04:56:59.038271904 CEST	50820	21	192.168.2.16	86.82.116.212
May 6, 2024 04:56:59.045392990 CEST	2121	50726	93.185.159.51	192.168.2.16
May 6, 2024 04:56:59.050981045 CEST	50735	21	192.168.2.16	156.242.212.172
May 6, 2024 04:56:59.050981045 CEST	50734	2121	192.168.2.16	116.139.82.91
May 6, 2024 04:56:59.050997972 CEST	50736	2121	192.168.2.16	156.242.212.172
May 6, 2024 04:56:59.051001072 CEST	50750	2121	192.168.2.16	114.42.229.208
May 6, 2024 04:56:59.051002979 CEST	50738	2121	192.168.2.16	71.34.106.185
May 6, 2024 04:56:59.051003933 CEST	50737	21	192.168.2.16	71.34.106.185
May 6, 2024 04:56:59.051003933 CEST	50748	21	192.168.2.16	114.42.229.208
May 6, 2024 04:56:59.051004887 CEST	50746	2121	192.168.2.16	118.98.35.10
May 6, 2024 04:56:59.051004887 CEST	50743	21	192.168.2.16	200.216.148.34
May 6, 2024 04:56:59.051018953 CEST	50744	2121	192.168.2.16	200.216.148.34
May 6, 2024 04:56:59.051018953 CEST	50753	21	192.168.2.16	96.10.238.106
May 6, 2024 04:56:59.051018953 CEST	50751	21	192.168.2.16	39.68.11.249
May 6, 2024 04:56:59.051021099 CEST	50754	21	192.168.2.16	208.184.124.137
May 6, 2024 04:56:59.051021099 CEST	50757	2121	192.168.2.16	37.20.148.191
May 6, 2024 04:56:59.051024914 CEST	50755	2121	192.168.2.16	208.184.124.137
May 6, 2024 04:56:59.051024914 CEST	50765	2121	192.168.2.16	171.231.31.165
May 6, 2024 04:56:59.051027060 CEST	50758	21	192.168.2.16	5.129.51.197
May 6, 2024 04:56:59.051027060 CEST	50759	2121	192.168.2.16	73.234.5.204
May 6, 2024 04:56:59.051028967 CEST	50756	21	192.168.2.16	209.183.149.234
May 6, 2024 04:56:59.051028967 CEST	50761	2121	192.168.2.16	96.10.238.106
May 6, 2024 04:56:59.053138018 CEST	50752	2121	192.168.2.16	39.68.11.249
May 6, 2024 04:56:59.055063963 CEST	50741	2121	192.168.2.16	154.210.32.21
May 6, 2024 04:56:59.055077076 CEST	50747	21	192.168.2.16	45.33.5.34
May 6, 2024 04:56:59.055078030 CEST	50745	21	192.168.2.16	118.98.35.10
May 6, 2024 04:56:59.055088997 CEST	50760	21	192.168.2.16	171.231.31.165
May 6, 2024 04:56:59.055093050 CEST	50749	2121	192.168.2.16	45.33.5.34
May 6, 2024 04:56:59.055104017 CEST	50763	21	192.168.2.16	37.20.148.191
May 6, 2024 04:56:59.055105925 CEST	50764	21	192.168.2.16	73.234.5.204
May 6, 2024 04:56:59.055107117 CEST	50762	2121	192.168.2.16	209.183.149.234
May 6, 2024 04:56:59.055289030 CEST	50821	2121	192.168.2.16	86.82.116.212
May 6, 2024 04:56:59.055294037 CEST	50707	21	192.168.2.16	39.116.40.5
May 6, 2024 04:56:59.055840969 CEST	2121	50640	59.21.168.97	192.168.2.16
May 6, 2024 04:56:59.064848900 CEST	21	50724	93.185.159.51	192.168.2.16
May 6, 2024 04:56:59.065614939 CEST	21	50742	154.210.32.21	192.168.2.16
May 6, 2024 04:56:59.065668106 CEST	50742	21	192.168.2.16	154.210.32.21
May 6, 2024 04:56:59.066237926 CEST	21	50742	154.210.32.21	192.168.2.16
May 6, 2024 04:56:59.066278934 CEST	50742	21	192.168.2.16	154.210.32.21
May 6, 2024 04:56:59.066975117 CEST	50766	2121	192.168.2.16	5.129.51.197
May 6, 2024 04:56:59.066981077 CEST	50769	21	192.168.2.16	73.248.132.178
May 6, 2024 04:56:59.066991091 CEST	50768	21	192.168.2.16	185.48.149.208
May 6, 2024 04:56:59.066992044 CEST	50767	2121	192.168.2.16	185.48.149.208
May 6, 2024 04:56:59.069140911 CEST	50770	2121	192.168.2.16	73.248.132.178
May 6, 2024 04:56:59.074965000 CEST	50781	21	192.168.2.16	27.79.77.134
May 6, 2024 04:56:59.077145100 CEST	50709	2121	192.168.2.16	39.116.40.5
May 6, 2024 04:56:59.077146053 CEST	50783	21	192.168.2.16	107.190.0.105
May 6, 2024 04:56:59.082981110 CEST	50775	21	192.168.2.16	111.18.251.50
May 6, 2024 04:56:59.082981110 CEST	50778	21	192.168.2.16	68.234.240.182
May 6, 2024 04:56:59.082982063 CEST	50779	21	192.168.2.16	66.69.12.241
May 6, 2024 04:56:59.082998991 CEST	50785	21	192.168.2.16	95.37.152.98
May 6, 2024 04:56:59.082998991 CEST	50788	2121	192.168.2.16	76.176.42.197
May 6, 2024 04:56:59.083000898 CEST	50786	21	192.168.2.16	76.176.42.197
May 6, 2024 04:56:59.083000898 CEST	50796	2121	192.168.2.16	220.255.44.99
May 6, 2024 04:56:59.083000898 CEST	50777	2121	192.168.2.16	66.69.12.241
May 6, 2024 04:56:59.083002090 CEST	50780	2121	192.168.2.16	68.234.240.182
May 6, 2024 04:56:59.083002090 CEST	50782	2121	192.168.2.16	27.79.77.134
May 6, 2024 04:56:59.083003044 CEST	50798	2121	192.168.2.16	2.108.129.87
May 6, 2024 04:56:59.083002090 CEST	50791	21	192.168.2.16	188.191.254.52
May 6, 2024 04:56:59.083014011 CEST	50794	2121	192.168.2.16	20.23.119.186
May 6, 2024 04:56:59.083014965 CEST	50787	2121	192.168.2.16	95.37.152.98
May 6, 2024 04:56:59.083020926 CEST	50795	21	192.168.2.16	220.255.44.99
May 6, 2024 04:56:59.083020926 CEST	50784	2121	192.168.2.16	107.190.0.105
May 6, 2024 04:56:59.083020926 CEST	50793	2121	192.168.2.16	188.191.254.52
May 6, 2024 04:56:59.083023071 CEST	50792	21	192.168.2.16	20.23.119.186
May 6, 2024 04:56:59.085139036 CEST	50797	21	192.168.2.16	2.108.129.87
May 6, 2024 04:56:59.089942932 CEST	2121	50816	34.128.145.40	192.168.2.16
May 6, 2024 04:56:59.098973036 CEST	50803	2121	192.168.2.16	4.231.28.100
May 6, 2024 04:56:59.101140976 CEST	50802	21	192.168.2.16	4.231.28.100
May 6, 2024 04:56:59.104130983 CEST	21	50809	103.109.6.215	192.168.2.16
May 6, 2024 04:56:59.107883930 CEST	21	50817	34.128.145.40	192.168.2.16
May 6, 2024 04:56:59.108225107 CEST	2121	50818	34.128.145.40	192.168.2.16
May 6, 2024 04:56:59.108285904 CEST	50818	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:59.109328985 CEST	21	50819	34.128.145.40	192.168.2.16
May 6, 2024 04:56:59.109383106 CEST	50819	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:59.121764898 CEST	50809	21	192.168.2.16	103.109.6.215
May 6, 2024 04:56:59.129977942 CEST	50667	21	192.168.2.16	1.251.243.65
May 6, 2024 04:56:59.139965057 CEST	2121	50733	121.152.228.54	192.168.2.16
May 6, 2024 04:56:59.141673088 CEST	21	50725	121.152.228.54	192.168.2.16
May 6, 2024 04:56:59.142107010 CEST	21	50642	73.45.29.118	192.168.2.16
May 6, 2024 04:56:59.145200968 CEST	50822	21	192.168.2.16	187.6.77.125
May 6, 2024 04:56:59.145442963 CEST	50823	2121	192.168.2.16	187.6.77.125
May 6, 2024 04:56:59.146011114 CEST	50666	2121	192.168.2.16	1.251.243.65
May 6, 2024 04:56:59.147111893 CEST	2121	50661	86.121.139.105	192.168.2.16
May 6, 2024 04:56:59.157938957 CEST	2121	50643	73.45.29.118	192.168.2.16
May 6, 2024 04:56:59.158273935 CEST	50824	21	192.168.2.16	187.199.50.175
May 6, 2024 04:56:59.161973953 CEST	50805	21	192.168.2.16	182.216.235.11
May 6, 2024 04:56:59.165142059 CEST	50806	2121	192.168.2.16	182.216.235.11
May 6, 2024 04:56:59.165143013 CEST	50628	21	192.168.2.16	91.229.92.88
May 6, 2024 04:56:59.202341080 CEST	21	50773	39.27.135.223	192.168.2.16
May 6, 2024 04:56:59.202444077 CEST	21	50800	14.95.142.67	192.168.2.16
May 6, 2024 04:56:59.203119993 CEST	2121	50774	39.27.135.223	192.168.2.16
May 6, 2024 04:56:59.209983110 CEST	50629	2121	192.168.2.16	91.229.92.88
May 6, 2024 04:56:59.210252047 CEST	50825	2121	192.168.2.16	187.199.50.175
May 6, 2024 04:56:59.218024969 CEST	2121	50818	34.128.145.40	192.168.2.16
May 6, 2024 04:56:59.218071938 CEST	50818	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:59.218142986 CEST	50818	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:59.218914032 CEST	50826	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:59.219938040 CEST	21	50819	34.128.145.40	192.168.2.16
May 6, 2024 04:56:59.219984055 CEST	50819	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:59.220022917 CEST	50819	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:59.220143080 CEST	50827	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:59.220594883 CEST	2121	50801	14.95.142.67	192.168.2.16
May 6, 2024 04:56:59.223536015 CEST	2121	50718	123.128.168.1	192.168.2.16
May 6, 2024 04:56:59.241976976 CEST	50631	2121	192.168.2.16	24.62.255.253
May 6, 2024 04:56:59.241998911 CEST	50632	2121	192.168.2.16	93.216.201.153
May 6, 2024 04:56:59.241998911 CEST	50630	21	192.168.2.16	24.62.255.253
May 6, 2024 04:56:59.242012024 CEST	50633	21	192.168.2.16	93.216.201.153
May 6, 2024 04:56:59.257992029 CEST	50636	21	192.168.2.16	41.230.218.202
May 6, 2024 04:56:59.258253098 CEST	50634	21	192.168.2.16	222.223.37.205
May 6, 2024 04:56:59.274043083 CEST	50635	2121	192.168.2.16	222.223.37.205
May 6, 2024 04:56:59.274300098 CEST	50828	21	192.168.2.16	124.226.170.100
May 6, 2024 04:56:59.290004015 CEST	50637	2121	192.168.2.16	41.230.218.202
May 6, 2024 04:56:59.290261984 CEST	50829	2121	192.168.2.16	124.226.170.100
May 6, 2024 04:56:59.306915045 CEST	21	50739	119.154.190.4	192.168.2.16
May 6, 2024 04:56:59.315124989 CEST	2121	50740	119.154.190.4	192.168.2.16
May 6, 2024 04:56:59.321981907 CEST	50693	21	192.168.2.16	121.159.44.62
May 6, 2024 04:56:59.328655958 CEST	2121	50818	34.128.145.40	192.168.2.16
May 6, 2024 04:56:59.329332113 CEST	2121	50826	34.128.145.40	192.168.2.16
May 6, 2024 04:56:59.329396009 CEST	50826	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:59.329631090 CEST	21	50819	34.128.145.40	192.168.2.16
May 6, 2024 04:56:59.329643965 CEST	21	50827	34.128.145.40	192.168.2.16
May 6, 2024 04:56:59.329699039 CEST	50827	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:59.353996038 CEST	50644	21	192.168.2.16	80.167.84.104
May 6, 2024 04:56:59.357142925 CEST	50694	2121	192.168.2.16	121.159.44.62
May 6, 2024 04:56:59.369997978 CEST	50682	21	192.168.2.16	50.3.33.187
May 6, 2024 04:56:59.370155096 CEST	50646	21	192.168.2.16	79.248.82.8
May 6, 2024 04:56:59.385996103 CEST	50645	2121	192.168.2.16	80.167.84.104
May 6, 2024 04:56:59.397365093 CEST	21	50707	39.116.40.5	192.168.2.16
May 6, 2024 04:56:59.405128002 CEST	2121	50709	39.116.40.5	192.168.2.16
May 6, 2024 04:56:59.433866978 CEST	2121	50776	111.18.251.50	192.168.2.16
May 6, 2024 04:56:59.433975935 CEST	50647	2121	192.168.2.16	79.248.82.8
May 6, 2024 04:56:59.439297915 CEST	21	50827	34.128.145.40	192.168.2.16
May 6, 2024 04:56:59.439363956 CEST	50827	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:59.439426899 CEST	50827	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:59.439620972 CEST	50830	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:59.440042973 CEST	2121	50826	34.128.145.40	192.168.2.16
May 6, 2024 04:56:59.440092087 CEST	50826	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:59.440186024 CEST	50826	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:59.440432072 CEST	50831	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:59.450001955 CEST	50648	21	192.168.2.16	174.20.97.27
May 6, 2024 04:56:59.453219891 CEST	21	50667	1.251.243.65	192.168.2.16
May 6, 2024 04:56:59.466766119 CEST	50790	21	192.168.2.16	98.255.42.68
May 6, 2024 04:56:59.473952055 CEST	21	50809	103.109.6.215	192.168.2.16
May 6, 2024 04:56:59.474101067 CEST	50809	21	192.168.2.16	103.109.6.215
May 6, 2024 04:56:59.477040052 CEST	2121	50666	1.251.243.65	192.168.2.16
May 6, 2024 04:56:59.480988979 CEST	50649	21	192.168.2.16	91.41.188.118
May 6, 2024 04:56:59.481017113 CEST	50789	2121	192.168.2.16	98.255.42.68
May 6, 2024 04:56:59.481668949 CEST	50833	2121	192.168.2.16	198.46.170.76
May 6, 2024 04:56:59.481749058 CEST	50832	21	192.168.2.16	198.46.170.76
May 6, 2024 04:56:59.481751919 CEST	50834	21	192.168.2.16	85.167.179.246
May 6, 2024 04:56:59.488971949 CEST	50650	2121	192.168.2.16	174.20.97.27
May 6, 2024 04:56:59.488982916 CEST	50719	21	192.168.2.16	135.181.57.96
May 6, 2024 04:56:59.492511988 CEST	21	50636	41.230.218.202	192.168.2.16
May 6, 2024 04:56:59.492832899 CEST	50835	2121	192.168.2.16	85.167.179.246
May 6, 2024 04:56:59.497030020 CEST	50638	21	192.168.2.16	59.21.168.97
May 6, 2024 04:56:59.497136116 CEST	50651	2121	192.168.2.16	91.41.188.118
May 6, 2024 04:56:59.497303963 CEST	50836	21	192.168.2.16	177.106.18.23
May 6, 2024 04:56:59.497380018 CEST	50837	2121	192.168.2.16	177.106.18.23
May 6, 2024 04:56:59.497499943 CEST	50771	21	192.168.2.16	109.172.100.131
May 6, 2024 04:56:59.504045010 CEST	21	50617	45.87.1.166	192.168.2.16
May 6, 2024 04:56:59.504168987 CEST	50617	21	192.168.2.16	45.87.1.166
May 6, 2024 04:56:59.504318953 CEST	50838	21	192.168.2.16	45.87.1.166
May 6, 2024 04:56:59.509489059 CEST	21	50682	50.3.33.187	192.168.2.16
May 6, 2024 04:56:59.512991905 CEST	50714	21	192.168.2.16	123.128.168.1
May 6, 2024 04:56:59.524570942 CEST	2121	50637	41.230.218.202	192.168.2.16
May 6, 2024 04:56:59.524955988 CEST	50839	21	192.168.2.16	189.172.251.148
May 6, 2024 04:56:59.528995037 CEST	50732	2121	192.168.2.16	135.181.57.96
May 6, 2024 04:56:59.529140949 CEST	50772	2121	192.168.2.16	109.172.100.131
May 6, 2024 04:56:59.529140949 CEST	50652	21	192.168.2.16	108.41.141.172
May 6, 2024 04:56:59.530016899 CEST	50840	2121	192.168.2.16	189.172.251.148
May 6, 2024 04:56:59.548856974 CEST	21	50830	34.128.145.40	192.168.2.16
May 6, 2024 04:56:59.548942089 CEST	21	50827	34.128.145.40	192.168.2.16
May 6, 2024 04:56:59.548949957 CEST	50830	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:59.549807072 CEST	2121	50826	34.128.145.40	192.168.2.16
May 6, 2024 04:56:59.550364971 CEST	2121	50831	34.128.145.40	192.168.2.16
May 6, 2024 04:56:59.550432920 CEST	50831	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:59.561009884 CEST	50726	2121	192.168.2.16	93.185.159.51
May 6, 2024 04:56:59.561146021 CEST	50640	2121	192.168.2.16	59.21.168.97
May 6, 2024 04:56:59.561232090 CEST	50655	2121	192.168.2.16	108.41.141.172
May 6, 2024 04:56:59.561472893 CEST	50841	21	192.168.2.16	98.196.13.22
May 6, 2024 04:56:59.576994896 CEST	50724	21	192.168.2.16	93.185.159.51
May 6, 2024 04:56:59.593023062 CEST	50658	2121	192.168.2.16	120.8.21.137
May 6, 2024 04:56:59.593024015 CEST	50657	21	192.168.2.16	100.2.122.180
May 6, 2024 04:56:59.593024969 CEST	50656	21	192.168.2.16	120.8.21.137
May 6, 2024 04:56:59.608994961 CEST	50812	21	192.168.2.16	125.122.17.98
May 6, 2024 04:56:59.618526936 CEST	21	50693	121.159.44.62	192.168.2.16
May 6, 2024 04:56:59.625005007 CEST	50659	2121	192.168.2.16	100.2.122.180
May 6, 2024 04:56:59.625005007 CEST	50660	21	192.168.2.16	86.121.139.105
May 6, 2024 04:56:59.634141922 CEST	2121	50833	198.46.170.76	192.168.2.16
May 6, 2024 04:56:59.640990019 CEST	50662	2121	192.168.2.16	31.202.16.193
May 6, 2024 04:56:59.641143084 CEST	50665	2121	192.168.2.16	175.18.216.34
May 6, 2024 04:56:59.642151117 CEST	50663	21	192.168.2.16	31.202.16.193
May 6, 2024 04:56:59.642151117 CEST	50664	21	192.168.2.16	175.18.216.34
May 6, 2024 04:56:59.643974066 CEST	21	50832	198.46.170.76	192.168.2.16
May 6, 2024 04:56:59.643999100 CEST	50733	2121	192.168.2.16	121.152.228.54
May 6, 2024 04:56:59.645598888 CEST	21	50790	98.255.42.68	192.168.2.16
May 6, 2024 04:56:59.656987906 CEST	50668	21	192.168.2.16	178.187.219.73
May 6, 2024 04:56:59.657574892 CEST	50661	2121	192.168.2.16	86.121.139.105
May 6, 2024 04:56:59.657579899 CEST	50725	21	192.168.2.16	121.152.228.54
May 6, 2024 04:56:59.658351898 CEST	21	50830	34.128.145.40	192.168.2.16
May 6, 2024 04:56:59.658405066 CEST	50830	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:59.658768892 CEST	50830	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:59.658963919 CEST	50842	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:59.659271955 CEST	2121	50694	121.159.44.62	192.168.2.16
May 6, 2024 04:56:59.660455942 CEST	2121	50831	34.128.145.40	192.168.2.16
May 6, 2024 04:56:59.660506964 CEST	50831	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:59.660593033 CEST	50831	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:59.661920071 CEST	2121	50789	98.255.42.68	192.168.2.16
May 6, 2024 04:56:59.662142992 CEST	50843	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:59.672986984 CEST	50813	2121	192.168.2.16	125.122.17.98
May 6, 2024 04:56:59.673003912 CEST	50669	2121	192.168.2.16	178.187.219.73
May 6, 2024 04:56:59.673005104 CEST	50670	21	192.168.2.16	23.220.172.150
May 6, 2024 04:56:59.688987970 CEST	50673	2121	192.168.2.16	23.220.172.150
May 6, 2024 04:56:59.691977978 CEST	50672	2121	192.168.2.16	179.254.32.45
May 6, 2024 04:56:59.692599058 CEST	50671	21	192.168.2.16	179.254.32.45
May 6, 2024 04:56:59.705003977 CEST	50773	21	192.168.2.16	39.27.135.223
May 6, 2024 04:56:59.705013037 CEST	50800	21	192.168.2.16	14.95.142.67
May 6, 2024 04:56:59.705786943 CEST	50814	21	192.168.2.16	79.116.255.24
May 6, 2024 04:56:59.705872059 CEST	50774	2121	192.168.2.16	39.27.135.223
May 6, 2024 04:56:59.707453012 CEST	21	50771	109.172.100.131	192.168.2.16
May 6, 2024 04:56:59.719335079 CEST	2121	50837	177.106.18.23	192.168.2.16
May 6, 2024 04:56:59.720633984 CEST	21	50719	135.181.57.96	192.168.2.16
May 6, 2024 04:56:59.721585989 CEST	50675	2121	192.168.2.16	91.15.33.122
May 6, 2024 04:56:59.721839905 CEST	50674	21	192.168.2.16	91.15.33.122
May 6, 2024 04:56:59.721923113 CEST	50801	2121	192.168.2.16	14.95.142.67
May 6, 2024 04:56:59.722338915 CEST	21	50836	177.106.18.23	192.168.2.16
May 6, 2024 04:56:59.727363110 CEST	21	50838	45.87.1.166	192.168.2.16
May 6, 2024 04:56:59.727427006 CEST	50838	21	192.168.2.16	45.87.1.166
May 6, 2024 04:56:59.733766079 CEST	21	50617	45.87.1.166	192.168.2.16
May 6, 2024 04:56:59.733817101 CEST	50617	21	192.168.2.16	45.87.1.166
May 6, 2024 04:56:59.735985041 CEST	50815	2121	192.168.2.16	79.116.255.24
May 6, 2024 04:56:59.736097097 CEST	50676	21	192.168.2.16	184.61.89.211
May 6, 2024 04:56:59.736917973 CEST	50718	2121	192.168.2.16	123.128.168.1
May 6, 2024 04:56:59.736947060 CEST	50677	2121	192.168.2.16	184.61.89.211
May 6, 2024 04:56:59.737005949 CEST	50678	21	192.168.2.16	212.187.25.212
May 6, 2024 04:56:59.746984959 CEST	2121	50772	109.172.100.131	192.168.2.16
May 6, 2024 04:56:59.751985073 CEST	50680	2121	192.168.2.16	212.187.25.212
May 6, 2024 04:56:59.767998934 CEST	50683	2121	192.168.2.16	50.3.33.187
May 6, 2024 04:56:59.768228054 CEST	50844	2121	192.168.2.16	98.196.13.22
May 6, 2024 04:56:59.768284082 CEST	21	50830	34.128.145.40	192.168.2.16
May 6, 2024 04:56:59.768342018 CEST	50684	21	192.168.2.16	175.112.231.128
May 6, 2024 04:56:59.768608093 CEST	21	50842	34.128.145.40	192.168.2.16
May 6, 2024 04:56:59.768676043 CEST	50842	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:59.770524979 CEST	2121	50831	34.128.145.40	192.168.2.16
May 6, 2024 04:56:59.772212982 CEST	2121	50843	34.128.145.40	192.168.2.16
May 6, 2024 04:56:59.772268057 CEST	50843	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:59.776802063 CEST	2121	50732	135.181.57.96	192.168.2.16
May 6, 2024 04:56:59.784009933 CEST	50685	2121	192.168.2.16	175.112.231.128
May 6, 2024 04:56:59.793708086 CEST	21	50638	59.21.168.97	192.168.2.16
May 6, 2024 04:56:59.794094086 CEST	50845	21	192.168.2.16	188.81.134.237
May 6, 2024 04:56:59.816000938 CEST	50740	2121	192.168.2.16	119.154.190.4
May 6, 2024 04:56:59.816011906 CEST	50739	21	192.168.2.16	119.154.190.4
May 6, 2024 04:56:59.820749044 CEST	2121	50726	93.185.159.51	192.168.2.16
May 6, 2024 04:56:59.827337980 CEST	21	50809	103.109.6.215	192.168.2.16
May 6, 2024 04:56:59.827487946 CEST	50809	21	192.168.2.16	103.109.6.215
May 6, 2024 04:56:59.827653885 CEST	50846	21	192.168.2.16	103.109.6.215
May 6, 2024 04:56:59.840559959 CEST	21	50724	93.185.159.51	192.168.2.16
May 6, 2024 04:56:59.848000050 CEST	50686	21	192.168.2.16	71.115.207.213
May 6, 2024 04:56:59.862262011 CEST	2121	50640	59.21.168.97	192.168.2.16
May 6, 2024 04:56:59.864007950 CEST	50687	2121	192.168.2.16	71.115.207.213
May 6, 2024 04:56:59.869306087 CEST	21	50714	123.128.168.1	192.168.2.16
May 6, 2024 04:56:59.878381014 CEST	21	50842	34.128.145.40	192.168.2.16
May 6, 2024 04:56:59.878436089 CEST	50842	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:59.878506899 CEST	50842	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:59.878675938 CEST	50847	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:59.880004883 CEST	50688	21	192.168.2.16	94.21.5.245
May 6, 2024 04:56:59.880284071 CEST	50848	2121	192.168.2.16	188.81.134.237
May 6, 2024 04:56:59.880361080 CEST	50849	21	192.168.2.16	61.152.1.106
May 6, 2024 04:56:59.883055925 CEST	2121	50843	34.128.145.40	192.168.2.16
May 6, 2024 04:56:59.883106947 CEST	50843	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:59.883177042 CEST	50843	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:59.883348942 CEST	50850	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:59.895983934 CEST	50689	2121	192.168.2.16	94.21.5.245
May 6, 2024 04:56:59.895993948 CEST	50691	2121	192.168.2.16	182.244.148.18
May 6, 2024 04:56:59.897144079 CEST	50690	21	192.168.2.16	182.244.148.18
May 6, 2024 04:56:59.906781912 CEST	2121	50661	86.121.139.105	192.168.2.16
May 6, 2024 04:56:59.911979914 CEST	50707	21	192.168.2.16	39.116.40.5
May 6, 2024 04:56:59.912044048 CEST	50709	2121	192.168.2.16	39.116.40.5
May 6, 2024 04:56:59.928332090 CEST	50851	2121	192.168.2.16	61.152.1.106
May 6, 2024 04:56:59.943978071 CEST	50776	2121	192.168.2.16	111.18.251.50
May 6, 2024 04:56:59.944329023 CEST	50852	21	192.168.2.16	196.85.17.173
May 6, 2024 04:56:59.950683117 CEST	2121	50733	121.152.228.54	192.168.2.16
May 6, 2024 04:56:59.955496073 CEST	21	50838	45.87.1.166	192.168.2.16
May 6, 2024 04:56:59.955626965 CEST	50838	21	192.168.2.16	45.87.1.166
May 6, 2024 04:56:59.960010052 CEST	50667	21	192.168.2.16	1.251.243.65
May 6, 2024 04:56:59.965342045 CEST	21	50725	121.152.228.54	192.168.2.16
May 6, 2024 04:56:59.975980997 CEST	50695	21	192.168.2.16	95.100.247.133
May 6, 2024 04:56:59.976097107 CEST	50696	2121	192.168.2.16	95.100.247.133
May 6, 2024 04:56:59.988419056 CEST	21	50847	34.128.145.40	192.168.2.16
May 6, 2024 04:56:59.988487005 CEST	50847	21	192.168.2.16	34.128.145.40
May 6, 2024 04:56:59.988926888 CEST	21	50842	34.128.145.40	192.168.2.16
May 6, 2024 04:56:59.991977930 CEST	50666	2121	192.168.2.16	1.251.243.65
May 6, 2024 04:56:59.992232084 CEST	50853	2121	192.168.2.16	196.85.17.173
May 6, 2024 04:56:59.992942095 CEST	2121	50850	34.128.145.40	192.168.2.16
May 6, 2024 04:56:59.992995024 CEST	50850	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:56:59.993217945 CEST	2121	50843	34.128.145.40	192.168.2.16
May 6, 2024 04:57:00.007977962 CEST	50699	21	192.168.2.16	34.65.27.140
May 6, 2024 04:57:00.007994890 CEST	50700	2121	192.168.2.16	34.65.27.140
May 6, 2024 04:57:00.012721062 CEST	21	50773	39.27.135.223	192.168.2.16
May 6, 2024 04:57:00.013314009 CEST	21	50800	14.95.142.67	192.168.2.16
May 6, 2024 04:57:00.014519930 CEST	2121	50774	39.27.135.223	192.168.2.16
May 6, 2024 04:57:00.023999929 CEST	50701	21	192.168.2.16	71.196.187.243
May 6, 2024 04:57:00.024000883 CEST	50702	2121	192.168.2.16	71.196.187.243
May 6, 2024 04:57:00.033654928 CEST	2121	50801	14.95.142.67	192.168.2.16
May 6, 2024 04:57:00.039995909 CEST	50820	21	192.168.2.16	86.82.116.212
May 6, 2024 04:57:00.040371895 CEST	50854	21	192.168.2.16	90.197.40.84
May 6, 2024 04:57:00.055999041 CEST	50821	2121	192.168.2.16	86.82.116.212
May 6, 2024 04:57:00.082571030 CEST	2121	50718	123.128.168.1	192.168.2.16
May 6, 2024 04:57:00.098603964 CEST	21	50847	34.128.145.40	192.168.2.16
May 6, 2024 04:57:00.098654985 CEST	50847	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:00.098718882 CEST	50847	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:00.098886013 CEST	50855	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:00.102772951 CEST	2121	50850	34.128.145.40	192.168.2.16
May 6, 2024 04:57:00.102818966 CEST	50850	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:00.102859974 CEST	50850	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:00.103019953 CEST	50856	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:00.103277922 CEST	50857	2121	192.168.2.16	90.197.40.84
May 6, 2024 04:57:00.119015932 CEST	50693	21	192.168.2.16	121.159.44.62
May 6, 2024 04:57:00.135014057 CEST	50833	2121	192.168.2.16	198.46.170.76
May 6, 2024 04:57:00.150991917 CEST	50822	21	192.168.2.16	187.6.77.125
May 6, 2024 04:57:00.151002884 CEST	50790	21	192.168.2.16	98.255.42.68
May 6, 2024 04:57:00.151020050 CEST	50832	21	192.168.2.16	198.46.170.76
May 6, 2024 04:57:00.151021004 CEST	50823	2121	192.168.2.16	187.6.77.125
May 6, 2024 04:57:00.166980028 CEST	50824	21	192.168.2.16	187.199.50.175
May 6, 2024 04:57:00.167010069 CEST	50694	2121	192.168.2.16	121.159.44.62
May 6, 2024 04:57:00.167020082 CEST	50789	2121	192.168.2.16	98.255.42.68
May 6, 2024 04:57:00.178767920 CEST	21	50838	45.87.1.166	192.168.2.16
May 6, 2024 04:57:00.179080963 CEST	21	50809	103.109.6.215	192.168.2.16
May 6, 2024 04:57:00.179126978 CEST	21	50809	103.109.6.215	192.168.2.16
May 6, 2024 04:57:00.179164886 CEST	21	50838	45.87.1.166	192.168.2.16
May 6, 2024 04:57:00.179178953 CEST	50809	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:00.179307938 CEST	50838	21	192.168.2.16	45.87.1.166
May 6, 2024 04:57:00.184395075 CEST	21	50846	103.109.6.215	192.168.2.16
May 6, 2024 04:57:00.184459925 CEST	50846	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:00.197032928 CEST	21	50739	119.154.190.4	192.168.2.16
May 6, 2024 04:57:00.208429098 CEST	21	50855	34.128.145.40	192.168.2.16
May 6, 2024 04:57:00.208494902 CEST	50855	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:00.209081888 CEST	21	50847	34.128.145.40	192.168.2.16
May 6, 2024 04:57:00.212394953 CEST	2121	50850	34.128.145.40	192.168.2.16
May 6, 2024 04:57:00.212620020 CEST	2121	50856	34.128.145.40	192.168.2.16
May 6, 2024 04:57:00.212668896 CEST	50856	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:00.214987040 CEST	50771	21	192.168.2.16	109.172.100.131
May 6, 2024 04:57:00.215279102 CEST	50825	2121	192.168.2.16	187.199.50.175
May 6, 2024 04:57:00.215279102 CEST	50858	21	192.168.2.16	73.228.3.37
May 6, 2024 04:57:00.215317965 CEST	2121	50740	119.154.190.4	192.168.2.16
May 6, 2024 04:57:00.221745968 CEST	21	50849	61.152.1.106	192.168.2.16
May 6, 2024 04:57:00.230981112 CEST	50837	2121	192.168.2.16	177.106.18.23
May 6, 2024 04:57:00.230982065 CEST	50719	21	192.168.2.16	135.181.57.96
May 6, 2024 04:57:00.230998039 CEST	50836	21	192.168.2.16	177.106.18.23
May 6, 2024 04:57:00.230999947 CEST	50705	21	192.168.2.16	38.171.11.236
May 6, 2024 04:57:00.231684923 CEST	50706	2121	192.168.2.16	38.171.11.236
May 6, 2024 04:57:00.239316940 CEST	2121	50709	39.116.40.5	192.168.2.16
May 6, 2024 04:57:00.246979952 CEST	50772	2121	192.168.2.16	109.172.100.131
May 6, 2024 04:57:00.253469944 CEST	21	50707	39.116.40.5	192.168.2.16
May 6, 2024 04:57:00.263449907 CEST	50859	2121	192.168.2.16	73.228.3.37
May 6, 2024 04:57:00.264597893 CEST	2121	50853	196.85.17.173	192.168.2.16
May 6, 2024 04:57:00.264610052 CEST	21	50852	196.85.17.173	192.168.2.16
May 6, 2024 04:57:00.279005051 CEST	50828	21	192.168.2.16	124.226.170.100
May 6, 2024 04:57:00.279616117 CEST	50732	2121	192.168.2.16	135.181.57.96
May 6, 2024 04:57:00.283116102 CEST	21	50667	1.251.243.65	192.168.2.16
May 6, 2024 04:57:00.283495903 CEST	50860	21	192.168.2.16	88.88.238.12
May 6, 2024 04:57:00.287527084 CEST	2121	50833	198.46.170.76	192.168.2.16
May 6, 2024 04:57:00.295006990 CEST	50829	2121	192.168.2.16	124.226.170.100
May 6, 2024 04:57:00.295264959 CEST	50861	2121	192.168.2.16	88.88.238.12
May 6, 2024 04:57:00.311408997 CEST	50862	21	192.168.2.16	24.127.243.192
May 6, 2024 04:57:00.311430931 CEST	50863	2121	192.168.2.16	24.127.243.192
May 6, 2024 04:57:00.313327074 CEST	21	50832	198.46.170.76	192.168.2.16
May 6, 2024 04:57:00.318371058 CEST	21	50855	34.128.145.40	192.168.2.16
May 6, 2024 04:57:00.318423033 CEST	50855	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:00.318483114 CEST	50855	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:00.318640947 CEST	50864	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:00.322338104 CEST	2121	50856	34.128.145.40	192.168.2.16
May 6, 2024 04:57:00.322391987 CEST	50856	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:00.322429895 CEST	50856	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:00.322539091 CEST	50865	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:00.322938919 CEST	2121	50666	1.251.243.65	192.168.2.16
May 6, 2024 04:57:00.326992989 CEST	50726	2121	192.168.2.16	93.185.159.51
May 6, 2024 04:57:00.329678059 CEST	21	50790	98.255.42.68	192.168.2.16
May 6, 2024 04:57:00.343178034 CEST	50866	21	192.168.2.16	94.143.150.245
May 6, 2024 04:57:00.343180895 CEST	50724	21	192.168.2.16	93.185.159.51
May 6, 2024 04:57:00.350153923 CEST	2121	50789	98.255.42.68	192.168.2.16
May 6, 2024 04:57:00.372360945 CEST	2121	50776	111.18.251.50	192.168.2.16
May 6, 2024 04:57:00.374994040 CEST	50714	21	192.168.2.16	123.128.168.1
May 6, 2024 04:57:00.407001019 CEST	50708	21	192.168.2.16	216.117.162.236
May 6, 2024 04:57:00.416726112 CEST	21	50693	121.159.44.62	192.168.2.16
May 6, 2024 04:57:00.424649000 CEST	21	50771	109.172.100.131	192.168.2.16
May 6, 2024 04:57:00.427918911 CEST	21	50864	34.128.145.40	192.168.2.16
May 6, 2024 04:57:00.427930117 CEST	21	50855	34.128.145.40	192.168.2.16
May 6, 2024 04:57:00.428010941 CEST	50864	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:00.432013988 CEST	2121	50856	34.128.145.40	192.168.2.16
May 6, 2024 04:57:00.433090925 CEST	2121	50865	34.128.145.40	192.168.2.16
May 6, 2024 04:57:00.433156013 CEST	50865	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:00.439214945 CEST	50867	2121	192.168.2.16	94.143.150.245
May 6, 2024 04:57:00.444247961 CEST	21	50838	45.87.1.166	192.168.2.16
May 6, 2024 04:57:00.453296900 CEST	2121	50837	177.106.18.23	192.168.2.16
May 6, 2024 04:57:00.455003023 CEST	50733	2121	192.168.2.16	121.152.228.54
May 6, 2024 04:57:00.456127882 CEST	21	50836	177.106.18.23	192.168.2.16
May 6, 2024 04:57:00.462650061 CEST	21	50719	135.181.57.96	192.168.2.16
May 6, 2024 04:57:00.465359926 CEST	2121	50772	109.172.100.131	192.168.2.16
May 6, 2024 04:57:00.469568968 CEST	2121	50694	121.159.44.62	192.168.2.16
May 6, 2024 04:57:00.470987082 CEST	50725	21	192.168.2.16	121.152.228.54
May 6, 2024 04:57:00.471205950 CEST	50868	21	192.168.2.16	89.166.186.213
May 6, 2024 04:57:00.487024069 CEST	50834	21	192.168.2.16	85.167.179.246
May 6, 2024 04:57:00.487315893 CEST	50869	2121	192.168.2.16	89.166.186.213
May 6, 2024 04:57:00.502981901 CEST	50835	2121	192.168.2.16	85.167.179.246
May 6, 2024 04:57:00.503340960 CEST	50870	21	192.168.2.16	73.113.237.7
May 6, 2024 04:57:00.519004107 CEST	50774	2121	192.168.2.16	39.27.135.223
May 6, 2024 04:57:00.519006014 CEST	50773	21	192.168.2.16	39.27.135.223
May 6, 2024 04:57:00.521140099 CEST	50800	21	192.168.2.16	14.95.142.67
May 6, 2024 04:57:00.527380943 CEST	2121	50732	135.181.57.96	192.168.2.16
May 6, 2024 04:57:00.534980059 CEST	50801	2121	192.168.2.16	14.95.142.67
May 6, 2024 04:57:00.534980059 CEST	50839	21	192.168.2.16	189.172.251.148
May 6, 2024 04:57:00.534998894 CEST	50840	2121	192.168.2.16	189.172.251.148
May 6, 2024 04:57:00.537276030 CEST	21	50864	34.128.145.40	192.168.2.16
May 6, 2024 04:57:00.537333965 CEST	50864	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:00.537398100 CEST	50864	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:00.537564039 CEST	50871	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:00.541595936 CEST	21	50846	103.109.6.215	192.168.2.16
May 6, 2024 04:57:00.541749954 CEST	50846	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:00.544473886 CEST	2121	50865	34.128.145.40	192.168.2.16
May 6, 2024 04:57:00.544526100 CEST	50865	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:00.544590950 CEST	50865	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:00.544773102 CEST	50872	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:00.566983938 CEST	50841	21	192.168.2.16	98.196.13.22
May 6, 2024 04:57:00.583005905 CEST	50718	2121	192.168.2.16	123.128.168.1
May 6, 2024 04:57:00.586615086 CEST	2121	50726	93.185.159.51	192.168.2.16
May 6, 2024 04:57:00.606812954 CEST	21	50724	93.185.159.51	192.168.2.16
May 6, 2024 04:57:00.643728018 CEST	21	50866	94.143.150.245	192.168.2.16
May 6, 2024 04:57:00.646519899 CEST	21	50864	34.128.145.40	192.168.2.16
May 6, 2024 04:57:00.647157907 CEST	21	50871	34.128.145.40	192.168.2.16
May 6, 2024 04:57:00.647222996 CEST	50871	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:00.647263050 CEST	50873	2121	192.168.2.16	73.113.237.7
May 6, 2024 04:57:00.654261112 CEST	2121	50865	34.128.145.40	192.168.2.16
May 6, 2024 04:57:00.654434919 CEST	2121	50872	34.128.145.40	192.168.2.16
May 6, 2024 04:57:00.654489994 CEST	50872	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:00.663228035 CEST	50874	21	192.168.2.16	49.251.132.174
May 6, 2024 04:57:00.710025072 CEST	50739	21	192.168.2.16	119.154.190.4
May 6, 2024 04:57:00.726001024 CEST	50740	2121	192.168.2.16	119.154.190.4
May 6, 2024 04:57:00.726001978 CEST	50849	21	192.168.2.16	61.152.1.106
May 6, 2024 04:57:00.726289988 CEST	50875	2121	192.168.2.16	49.251.132.174
May 6, 2024 04:57:00.731360912 CEST	21	50714	123.128.168.1	192.168.2.16
May 6, 2024 04:57:00.738665104 CEST	2121	50867	94.143.150.245	192.168.2.16
May 6, 2024 04:57:00.742005110 CEST	50709	2121	192.168.2.16	39.116.40.5
May 6, 2024 04:57:00.742263079 CEST	50876	21	192.168.2.16	96.250.204.200
May 6, 2024 04:57:00.756827116 CEST	21	50871	34.128.145.40	192.168.2.16
May 6, 2024 04:57:00.756876945 CEST	50871	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:00.756937027 CEST	50871	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:00.757093906 CEST	50877	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:00.757982016 CEST	50707	21	192.168.2.16	39.116.40.5
May 6, 2024 04:57:00.761214018 CEST	2121	50733	121.152.228.54	192.168.2.16
May 6, 2024 04:57:00.765853882 CEST	2121	50872	34.128.145.40	192.168.2.16
May 6, 2024 04:57:00.765902996 CEST	50872	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:00.765970945 CEST	50872	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:00.766115904 CEST	50878	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:00.773983002 CEST	50844	2121	192.168.2.16	98.196.13.22
May 6, 2024 04:57:00.773983955 CEST	50853	2121	192.168.2.16	196.85.17.173
May 6, 2024 04:57:00.776556969 CEST	50852	21	192.168.2.16	196.85.17.173
May 6, 2024 04:57:00.779340982 CEST	21	50725	121.152.228.54	192.168.2.16
May 6, 2024 04:57:00.789995909 CEST	50833	2121	192.168.2.16	198.46.170.76
May 6, 2024 04:57:00.805980921 CEST	50845	21	192.168.2.16	188.81.134.237
May 6, 2024 04:57:00.806369066 CEST	50879	2121	192.168.2.16	96.250.204.200
May 6, 2024 04:57:00.806422949 CEST	50880	21	192.168.2.16	81.178.147.208
May 6, 2024 04:57:00.822014093 CEST	50832	21	192.168.2.16	198.46.170.76
May 6, 2024 04:57:00.826556921 CEST	21	50773	39.27.135.223	192.168.2.16
May 6, 2024 04:57:00.828316927 CEST	21	50800	14.95.142.67	192.168.2.16
May 6, 2024 04:57:00.828327894 CEST	2121	50774	39.27.135.223	192.168.2.16
May 6, 2024 04:57:00.838012934 CEST	50790	21	192.168.2.16	98.255.42.68
May 6, 2024 04:57:00.845052004 CEST	2121	50801	14.95.142.67	192.168.2.16
May 6, 2024 04:57:00.854010105 CEST	50789	2121	192.168.2.16	98.255.42.68
May 6, 2024 04:57:00.867146969 CEST	21	50871	34.128.145.40	192.168.2.16
May 6, 2024 04:57:00.869821072 CEST	21	50877	34.128.145.40	192.168.2.16
May 6, 2024 04:57:00.869885921 CEST	50877	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:00.876069069 CEST	2121	50878	34.128.145.40	192.168.2.16
May 6, 2024 04:57:00.876149893 CEST	50878	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:00.886003971 CEST	50848	2121	192.168.2.16	188.81.134.237
May 6, 2024 04:57:00.886003971 CEST	50776	2121	192.168.2.16	111.18.251.50
May 6, 2024 04:57:00.898566008 CEST	21	50846	103.109.6.215	192.168.2.16
May 6, 2024 04:57:00.898691893 CEST	50846	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:00.934004068 CEST	50771	21	192.168.2.16	109.172.100.131
May 6, 2024 04:57:00.934088945 CEST	50851	2121	192.168.2.16	61.152.1.106
May 6, 2024 04:57:00.934114933 CEST	2121	50718	123.128.168.1	192.168.2.16
May 6, 2024 04:57:00.943846941 CEST	2121	50833	198.46.170.76	192.168.2.16
May 6, 2024 04:57:00.950472116 CEST	50881	2121	192.168.2.16	81.178.147.208
May 6, 2024 04:57:00.950556993 CEST	50882	21	192.168.2.16	174.23.164.228
May 6, 2024 04:57:00.965981960 CEST	50836	21	192.168.2.16	177.106.18.23
May 6, 2024 04:57:00.965998888 CEST	50772	2121	192.168.2.16	109.172.100.131
May 6, 2024 04:57:00.966000080 CEST	50837	2121	192.168.2.16	177.106.18.23
May 6, 2024 04:57:00.969144106 CEST	50719	21	192.168.2.16	135.181.57.96
May 6, 2024 04:57:00.979599953 CEST	21	50877	34.128.145.40	192.168.2.16
May 6, 2024 04:57:00.979660988 CEST	50877	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:00.979707003 CEST	50877	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:00.979871988 CEST	50883	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:00.984431028 CEST	21	50832	198.46.170.76	192.168.2.16
May 6, 2024 04:57:00.985944986 CEST	2121	50878	34.128.145.40	192.168.2.16
May 6, 2024 04:57:00.985995054 CEST	50878	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:00.986049891 CEST	50878	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:00.986217976 CEST	50884	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:01.014086008 CEST	21	50790	98.255.42.68	192.168.2.16
May 6, 2024 04:57:01.030004978 CEST	50732	2121	192.168.2.16	135.181.57.96
May 6, 2024 04:57:01.030005932 CEST	50723	2121	192.168.2.16	85.137.228.99
May 6, 2024 04:57:01.030185938 CEST	50885	2121	192.168.2.16	174.23.164.228
May 6, 2024 04:57:01.030188084 CEST	50730	21	192.168.2.16	101.65.79.36
May 6, 2024 04:57:01.030189037 CEST	50722	21	192.168.2.16	217.95.121.142
May 6, 2024 04:57:01.034465075 CEST	2121	50789	98.255.42.68	192.168.2.16
May 6, 2024 04:57:01.045981884 CEST	50728	2121	192.168.2.16	27.203.118.210
May 6, 2024 04:57:01.045981884 CEST	50729	2121	192.168.2.16	101.65.79.36
May 6, 2024 04:57:01.046001911 CEST	50854	21	192.168.2.16	90.197.40.84
May 6, 2024 04:57:01.046008110 CEST	50720	2121	192.168.2.16	217.95.121.142
May 6, 2024 04:57:01.046010017 CEST	50727	21	192.168.2.16	27.203.118.210
May 6, 2024 04:57:01.046010971 CEST	50721	21	192.168.2.16	85.137.228.99
May 6, 2024 04:57:01.046062946 CEST	50731	21	192.168.2.16	116.139.82.91
May 6, 2024 04:57:01.046127081 CEST	50886	21	192.168.2.16	153.3.24.183
May 6, 2024 04:57:01.061985016 CEST	50734	2121	192.168.2.16	116.139.82.91
May 6, 2024 04:57:01.061986923 CEST	50735	21	192.168.2.16	156.242.212.172
May 6, 2024 04:57:01.061986923 CEST	50737	21	192.168.2.16	71.34.106.185
May 6, 2024 04:57:01.062000036 CEST	50750	2121	192.168.2.16	114.42.229.208
May 6, 2024 04:57:01.062001944 CEST	50736	2121	192.168.2.16	156.242.212.172
May 6, 2024 04:57:01.062002897 CEST	50738	2121	192.168.2.16	71.34.106.185
May 6, 2024 04:57:01.062005043 CEST	50744	2121	192.168.2.16	200.216.148.34
May 6, 2024 04:57:01.062005997 CEST	50746	2121	192.168.2.16	118.98.35.10
May 6, 2024 04:57:01.062005997 CEST	50748	21	192.168.2.16	114.42.229.208
May 6, 2024 04:57:01.062005997 CEST	50743	21	192.168.2.16	200.216.148.34
May 6, 2024 04:57:01.062005997 CEST	50741	2121	192.168.2.16	154.210.32.21
May 6, 2024 04:57:01.062032938 CEST	50747	21	192.168.2.16	45.33.5.34
May 6, 2024 04:57:01.062033892 CEST	50752	2121	192.168.2.16	39.68.11.249
May 6, 2024 04:57:01.062033892 CEST	50749	2121	192.168.2.16	45.33.5.34
May 6, 2024 04:57:01.062035084 CEST	50758	21	192.168.2.16	5.129.51.197
May 6, 2024 04:57:01.062035084 CEST	50759	2121	192.168.2.16	73.234.5.204
May 6, 2024 04:57:01.062035084 CEST	50754	21	192.168.2.16	208.184.124.137
May 6, 2024 04:57:01.062035084 CEST	50757	2121	192.168.2.16	37.20.148.191
May 6, 2024 04:57:01.062036037 CEST	50753	21	192.168.2.16	96.10.238.106
May 6, 2024 04:57:01.062036037 CEST	50751	21	192.168.2.16	39.68.11.249
May 6, 2024 04:57:01.062036037 CEST	50760	21	192.168.2.16	171.231.31.165
May 6, 2024 04:57:01.062037945 CEST	50756	21	192.168.2.16	209.183.149.234
May 6, 2024 04:57:01.062037945 CEST	50745	21	192.168.2.16	118.98.35.10
May 6, 2024 04:57:01.062037945 CEST	50761	2121	192.168.2.16	96.10.238.106
May 6, 2024 04:57:01.062038898 CEST	50755	2121	192.168.2.16	208.184.124.137
May 6, 2024 04:57:01.062037945 CEST	50762	2121	192.168.2.16	209.183.149.234
May 6, 2024 04:57:01.062038898 CEST	50765	2121	192.168.2.16	171.231.31.165
May 6, 2024 04:57:01.063282013 CEST	2121	50853	196.85.17.173	192.168.2.16
May 6, 2024 04:57:01.063296080 CEST	21	50852	196.85.17.173	192.168.2.16
May 6, 2024 04:57:01.063312054 CEST	50763	21	192.168.2.16	37.20.148.191
May 6, 2024 04:57:01.063313007 CEST	50764	21	192.168.2.16	73.234.5.204
May 6, 2024 04:57:01.066473007 CEST	21	50849	61.152.1.106	192.168.2.16
May 6, 2024 04:57:01.069835901 CEST	2121	50709	39.116.40.5	192.168.2.16
May 6, 2024 04:57:01.077980995 CEST	50766	2121	192.168.2.16	5.129.51.197
May 6, 2024 04:57:01.077995062 CEST	50767	2121	192.168.2.16	185.48.149.208
May 6, 2024 04:57:01.077996969 CEST	50769	21	192.168.2.16	73.248.132.178
May 6, 2024 04:57:01.077996969 CEST	50768	21	192.168.2.16	185.48.149.208
May 6, 2024 04:57:01.077995062 CEST	50781	21	192.168.2.16	27.79.77.134
May 6, 2024 04:57:01.078284025 CEST	50783	21	192.168.2.16	107.190.0.105
May 6, 2024 04:57:01.078284025 CEST	50770	2121	192.168.2.16	73.248.132.178
May 6, 2024 04:57:01.089153051 CEST	21	50883	34.128.145.40	192.168.2.16
May 6, 2024 04:57:01.089215040 CEST	50883	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:01.089384079 CEST	21	50877	34.128.145.40	192.168.2.16
May 6, 2024 04:57:01.093998909 CEST	50778	21	192.168.2.16	68.234.240.182
May 6, 2024 04:57:01.094000101 CEST	50779	21	192.168.2.16	66.69.12.241
May 6, 2024 04:57:01.094033957 CEST	50777	2121	192.168.2.16	66.69.12.241
May 6, 2024 04:57:01.094033957 CEST	50796	2121	192.168.2.16	220.255.44.99
May 6, 2024 04:57:01.094038010 CEST	50775	21	192.168.2.16	111.18.251.50
May 6, 2024 04:57:01.094038010 CEST	50785	21	192.168.2.16	95.37.152.98
May 6, 2024 04:57:01.094038963 CEST	50780	2121	192.168.2.16	68.234.240.182
May 6, 2024 04:57:01.094039917 CEST	50788	2121	192.168.2.16	76.176.42.197
May 6, 2024 04:57:01.094038963 CEST	50794	2121	192.168.2.16	20.23.119.186
May 6, 2024 04:57:01.094041109 CEST	50798	2121	192.168.2.16	2.108.129.87
May 6, 2024 04:57:01.094041109 CEST	50872	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:01.094041109 CEST	50787	2121	192.168.2.16	95.37.152.98
May 6, 2024 04:57:01.094043016 CEST	50782	2121	192.168.2.16	27.79.77.134
May 6, 2024 04:57:01.094043970 CEST	50786	21	192.168.2.16	76.176.42.197
May 6, 2024 04:57:01.094043016 CEST	50784	2121	192.168.2.16	107.190.0.105
May 6, 2024 04:57:01.094043970 CEST	50797	21	192.168.2.16	2.108.129.87
May 6, 2024 04:57:01.094043016 CEST	50793	2121	192.168.2.16	188.191.254.52
May 6, 2024 04:57:01.094249010 CEST	50887	2121	192.168.2.16	153.3.24.183
May 6, 2024 04:57:01.094249010 CEST	50726	2121	192.168.2.16	93.185.159.51
May 6, 2024 04:57:01.094249964 CEST	50792	21	192.168.2.16	20.23.119.186
May 6, 2024 04:57:01.094250917 CEST	50791	21	192.168.2.16	188.191.254.52
May 6, 2024 04:57:01.094250917 CEST	50795	21	192.168.2.16	220.255.44.99
May 6, 2024 04:57:01.095706940 CEST	2121	50884	34.128.145.40	192.168.2.16
May 6, 2024 04:57:01.095767975 CEST	50884	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:01.095958948 CEST	21	50739	119.154.190.4	192.168.2.16
May 6, 2024 04:57:01.096573114 CEST	2121	50878	34.128.145.40	192.168.2.16
May 6, 2024 04:57:01.099662066 CEST	21	50707	39.116.40.5	192.168.2.16
May 6, 2024 04:57:01.109986067 CEST	50857	2121	192.168.2.16	90.197.40.84
May 6, 2024 04:57:01.110220909 CEST	50888	21	192.168.2.16	47.184.148.221
May 6, 2024 04:57:01.110224009 CEST	50802	21	192.168.2.16	4.231.28.100
May 6, 2024 04:57:01.113977909 CEST	50803	2121	192.168.2.16	4.231.28.100
May 6, 2024 04:57:01.116394997 CEST	50724	21	192.168.2.16	93.185.159.51
May 6, 2024 04:57:01.128985882 CEST	2121	50740	119.154.190.4	192.168.2.16
May 6, 2024 04:57:01.143762112 CEST	21	50771	109.172.100.131	192.168.2.16
May 6, 2024 04:57:01.158673048 CEST	50889	2121	192.168.2.16	47.184.148.221
May 6, 2024 04:57:01.158771992 CEST	50890	21	192.168.2.16	39.79.119.188
May 6, 2024 04:57:01.159137011 CEST	50866	21	192.168.2.16	94.143.150.245
May 6, 2024 04:57:01.173990011 CEST	50806	2121	192.168.2.16	182.216.235.11
May 6, 2024 04:57:01.173991919 CEST	50805	21	192.168.2.16	182.216.235.11
May 6, 2024 04:57:01.185003042 CEST	2121	50772	109.172.100.131	192.168.2.16
May 6, 2024 04:57:01.189665079 CEST	2121	50837	177.106.18.23	192.168.2.16
May 6, 2024 04:57:01.192661047 CEST	21	50836	177.106.18.23	192.168.2.16
May 6, 2024 04:57:01.202084064 CEST	21	50719	135.181.57.96	192.168.2.16
May 6, 2024 04:57:01.205049992 CEST	2121	50872	34.128.145.40	192.168.2.16
May 6, 2024 04:57:01.206311941 CEST	50891	2121	192.168.2.16	39.79.119.188
May 6, 2024 04:57:01.206418991 CEST	50892	21	192.168.2.16	52.232.177.70
May 6, 2024 04:57:01.206959963 CEST	2121	50884	34.128.145.40	192.168.2.16
May 6, 2024 04:57:01.207026958 CEST	50884	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:01.207109928 CEST	50884	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:01.207307100 CEST	50893	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:01.209692955 CEST	21	50883	34.128.145.40	192.168.2.16
May 6, 2024 04:57:01.209748983 CEST	50883	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:01.209814072 CEST	50883	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:01.210011005 CEST	50894	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:01.222009897 CEST	50858	21	192.168.2.16	73.228.3.37
May 6, 2024 04:57:01.222248077 CEST	50895	2121	192.168.2.16	52.232.177.70
May 6, 2024 04:57:01.238008022 CEST	50714	21	192.168.2.16	123.128.168.1
May 6, 2024 04:57:01.238560915 CEST	50897	2121	192.168.2.16	192.99.106.186
May 6, 2024 04:57:01.238560915 CEST	50896	21	192.168.2.16	24.16.214.30
May 6, 2024 04:57:01.238626003 CEST	50898	2121	192.168.2.16	24.16.214.30
May 6, 2024 04:57:01.238650084 CEST	50899	21	192.168.2.16	192.99.106.186
May 6, 2024 04:57:01.254013062 CEST	50867	2121	192.168.2.16	94.143.150.245
May 6, 2024 04:57:01.254224062 CEST	50900	21	192.168.2.16	183.190.225.111
May 6, 2024 04:57:01.256856918 CEST	21	50846	103.109.6.215	192.168.2.16
May 6, 2024 04:57:01.256973028 CEST	50846	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:01.257114887 CEST	50901	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:01.269988060 CEST	50733	2121	192.168.2.16	121.152.228.54
May 6, 2024 04:57:01.269989967 CEST	50859	2121	192.168.2.16	73.228.3.37
May 6, 2024 04:57:01.270335913 CEST	50902	2121	192.168.2.16	183.190.225.111
May 6, 2024 04:57:01.277789116 CEST	2121	50732	135.181.57.96	192.168.2.16
May 6, 2024 04:57:01.279012918 CEST	2121	50851	61.152.1.106	192.168.2.16
May 6, 2024 04:57:01.286006927 CEST	50725	21	192.168.2.16	121.152.228.54
May 6, 2024 04:57:01.286751032 CEST	50860	21	192.168.2.16	88.88.238.12
May 6, 2024 04:57:01.302023888 CEST	50861	2121	192.168.2.16	88.88.238.12
May 6, 2024 04:57:01.302320004 CEST	50903	21	192.168.2.16	173.77.154.6
May 6, 2024 04:57:01.314311981 CEST	2121	50776	111.18.251.50	192.168.2.16
May 6, 2024 04:57:01.316425085 CEST	2121	50893	34.128.145.40	192.168.2.16
May 6, 2024 04:57:01.316481113 CEST	50893	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:01.316580057 CEST	2121	50884	34.128.145.40	192.168.2.16
May 6, 2024 04:57:01.318027973 CEST	50862	21	192.168.2.16	24.127.243.192
May 6, 2024 04:57:01.318396091 CEST	50863	2121	192.168.2.16	24.127.243.192
May 6, 2024 04:57:01.319276094 CEST	21	50894	34.128.145.40	192.168.2.16
May 6, 2024 04:57:01.319339991 CEST	50894	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:01.319948912 CEST	21	50883	34.128.145.40	192.168.2.16
May 6, 2024 04:57:01.333996058 CEST	50773	21	192.168.2.16	39.27.135.223
May 6, 2024 04:57:01.334002972 CEST	50774	2121	192.168.2.16	39.27.135.223
May 6, 2024 04:57:01.334003925 CEST	50800	21	192.168.2.16	14.95.142.67
May 6, 2024 04:57:01.349996090 CEST	50801	2121	192.168.2.16	14.95.142.67
May 6, 2024 04:57:01.350352049 CEST	50904	2121	192.168.2.16	173.77.154.6
May 6, 2024 04:57:01.354147911 CEST	2121	50726	93.185.159.51	192.168.2.16
May 6, 2024 04:57:01.366538048 CEST	50905	21	192.168.2.16	70.23.80.23
May 6, 2024 04:57:01.366575003 CEST	50906	2121	192.168.2.16	70.23.80.23
May 6, 2024 04:57:01.366662025 CEST	50907	21	192.168.2.16	178.69.67.82
May 6, 2024 04:57:01.380002022 CEST	21	50724	93.185.159.51	192.168.2.16
May 6, 2024 04:57:01.398471117 CEST	50908	2121	192.168.2.16	178.69.67.82
May 6, 2024 04:57:01.426789045 CEST	2121	50893	34.128.145.40	192.168.2.16
May 6, 2024 04:57:01.426845074 CEST	50893	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:01.426918983 CEST	50893	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:01.427129984 CEST	50909	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:01.429078102 CEST	21	50894	34.128.145.40	192.168.2.16
May 6, 2024 04:57:01.429124117 CEST	50894	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:01.429188967 CEST	50894	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:01.429378986 CEST	50910	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:01.430207014 CEST	50911	21	192.168.2.16	177.184.244.134
May 6, 2024 04:57:01.445982933 CEST	50718	2121	192.168.2.16	123.128.168.1
May 6, 2024 04:57:01.446001053 CEST	50833	2121	192.168.2.16	198.46.170.76
May 6, 2024 04:57:01.446182966 CEST	50912	2121	192.168.2.16	177.184.244.134
May 6, 2024 04:57:01.457317114 CEST	2121	50887	153.3.24.183	192.168.2.16
May 6, 2024 04:57:01.460581064 CEST	21	50866	94.143.150.245	192.168.2.16
May 6, 2024 04:57:01.477988958 CEST	50868	21	192.168.2.16	89.166.186.213
May 6, 2024 04:57:01.478305101 CEST	50913	21	192.168.2.16	5.196.4.8
May 6, 2024 04:57:01.478411913 CEST	50914	2121	192.168.2.16	5.196.4.8
May 6, 2024 04:57:01.494014025 CEST	50832	21	192.168.2.16	198.46.170.76
May 6, 2024 04:57:01.494321108 CEST	50915	21	192.168.2.16	78.194.40.191
May 6, 2024 04:57:01.495075941 CEST	50869	2121	192.168.2.16	89.166.186.213
May 6, 2024 04:57:01.509983063 CEST	50870	21	192.168.2.16	73.113.237.7
May 6, 2024 04:57:01.526422977 CEST	50916	2121	192.168.2.16	78.194.40.191
May 6, 2024 04:57:01.537658930 CEST	2121	50893	34.128.145.40	192.168.2.16
May 6, 2024 04:57:01.538208961 CEST	2121	50909	34.128.145.40	192.168.2.16
May 6, 2024 04:57:01.538290977 CEST	50909	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:01.539911032 CEST	21	50894	34.128.145.40	192.168.2.16
May 6, 2024 04:57:01.540424109 CEST	21	50910	34.128.145.40	192.168.2.16
May 6, 2024 04:57:01.540478945 CEST	50910	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:01.541992903 CEST	21	50890	39.79.119.188	192.168.2.16
May 6, 2024 04:57:01.555577993 CEST	2121	50867	94.143.150.245	192.168.2.16
May 6, 2024 04:57:01.558238029 CEST	50917	21	192.168.2.16	37.232.181.128
May 6, 2024 04:57:01.573988914 CEST	50853	2121	192.168.2.16	196.85.17.173
May 6, 2024 04:57:01.574096918 CEST	50849	21	192.168.2.16	61.152.1.106
May 6, 2024 04:57:01.574109077 CEST	50852	21	192.168.2.16	196.85.17.173
May 6, 2024 04:57:01.576255083 CEST	2121	50733	121.152.228.54	192.168.2.16
May 6, 2024 04:57:01.576656103 CEST	50918	2121	192.168.2.16	37.232.181.128
May 6, 2024 04:57:01.584445953 CEST	2121	50891	39.79.119.188	192.168.2.16
May 6, 2024 04:57:01.590406895 CEST	50919	21	192.168.2.16	183.93.194.84
May 6, 2024 04:57:01.590459108 CEST	50920	21	192.168.2.16	111.167.166.59
May 6, 2024 04:57:01.590549946 CEST	50921	2121	192.168.2.16	183.93.194.84
May 6, 2024 04:57:01.596698046 CEST	21	50725	121.152.228.54	192.168.2.16
May 6, 2024 04:57:01.596719027 CEST	21	50714	123.128.168.1	192.168.2.16
May 6, 2024 04:57:01.597224951 CEST	50922	2121	192.168.2.16	111.167.166.59
May 6, 2024 04:57:01.599992037 CEST	2121	50833	198.46.170.76	192.168.2.16
May 6, 2024 04:57:01.606014013 CEST	50739	21	192.168.2.16	119.154.190.4
May 6, 2024 04:57:01.606442928 CEST	50923	21	192.168.2.16	147.30.47.219
May 6, 2024 04:57:01.606513023 CEST	50924	2121	192.168.2.16	147.30.47.219
May 6, 2024 04:57:01.613641977 CEST	21	50846	103.109.6.215	192.168.2.16
May 6, 2024 04:57:01.613651991 CEST	21	50846	103.109.6.215	192.168.2.16
May 6, 2024 04:57:01.613713980 CEST	50846	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:01.622025967 CEST	50812	21	192.168.2.16	125.122.17.98
May 6, 2024 04:57:01.622299910 CEST	50925	21	192.168.2.16	49.12.113.196
May 6, 2024 04:57:01.626672983 CEST	21	50901	103.109.6.215	192.168.2.16
May 6, 2024 04:57:01.626724005 CEST	50901	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:01.637339115 CEST	50740	2121	192.168.2.16	119.154.190.4
May 6, 2024 04:57:01.637571096 CEST	50926	2121	192.168.2.16	49.12.113.196
May 6, 2024 04:57:01.637736082 CEST	50927	21	192.168.2.16	45.51.151.109
May 6, 2024 04:57:01.637789965 CEST	50928	2121	192.168.2.16	45.51.151.109
May 6, 2024 04:57:01.637805939 CEST	50929	21	192.168.2.16	148.244.123.98
May 6, 2024 04:57:01.641176939 CEST	21	50773	39.27.135.223	192.168.2.16
May 6, 2024 04:57:01.642700911 CEST	21	50800	14.95.142.67	192.168.2.16
May 6, 2024 04:57:01.642956018 CEST	2121	50774	39.27.135.223	192.168.2.16
May 6, 2024 04:57:01.648992062 CEST	2121	50909	34.128.145.40	192.168.2.16
May 6, 2024 04:57:01.649039984 CEST	50909	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:01.649113894 CEST	50909	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:01.649275064 CEST	50930	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:01.650995016 CEST	21	50910	34.128.145.40	192.168.2.16
May 6, 2024 04:57:01.651050091 CEST	50910	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:01.651098013 CEST	50910	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:01.651335001 CEST	50931	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:01.653348923 CEST	50873	2121	192.168.2.16	73.113.237.7
May 6, 2024 04:57:01.653506994 CEST	50932	2121	192.168.2.16	148.244.123.98
May 6, 2024 04:57:01.653579950 CEST	50933	2121	192.168.2.16	2.139.125.236
May 6, 2024 04:57:01.653629065 CEST	50934	21	192.168.2.16	2.139.125.236
May 6, 2024 04:57:01.653656960 CEST	50935	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:01.656225920 CEST	21	50832	198.46.170.76	192.168.2.16
May 6, 2024 04:57:01.659411907 CEST	2121	50801	14.95.142.67	192.168.2.16
May 6, 2024 04:57:01.668983936 CEST	50874	21	192.168.2.16	49.251.132.174
May 6, 2024 04:57:01.669364929 CEST	50936	2121	192.168.2.16	81.88.252.91
May 6, 2024 04:57:01.669464111 CEST	50937	21	192.168.2.16	115.62.151.227
May 6, 2024 04:57:01.684026957 CEST	50813	2121	192.168.2.16	125.122.17.98
May 6, 2024 04:57:01.684530020 CEST	50938	2121	192.168.2.16	115.62.151.227
May 6, 2024 04:57:01.684586048 CEST	50939	21	192.168.2.16	81.235.207.79
May 6, 2024 04:57:01.684609890 CEST	50940	2121	192.168.2.16	81.235.207.79
May 6, 2024 04:57:01.684679031 CEST	50941	21	192.168.2.16	118.52.94.214
May 6, 2024 04:57:01.699981928 CEST	50836	21	192.168.2.16	177.106.18.23
May 6, 2024 04:57:01.699982882 CEST	50837	2121	192.168.2.16	177.106.18.23
May 6, 2024 04:57:01.716022968 CEST	50814	21	192.168.2.16	79.116.255.24
May 6, 2024 04:57:01.716383934 CEST	50942	21	192.168.2.16	124.75.148.85
May 6, 2024 04:57:01.716439009 CEST	50943	2121	192.168.2.16	118.52.94.214
May 6, 2024 04:57:01.731981039 CEST	50875	2121	192.168.2.16	49.251.132.174
May 6, 2024 04:57:01.732424021 CEST	50944	21	192.168.2.16	118.49.123.89
May 6, 2024 04:57:01.732485056 CEST	50945	2121	192.168.2.16	124.75.148.85
May 6, 2024 04:57:01.732533932 CEST	50946	2121	192.168.2.16	118.49.123.89
May 6, 2024 04:57:01.748008966 CEST	50815	2121	192.168.2.16	79.116.255.24
May 6, 2024 04:57:01.748008966 CEST	50876	21	192.168.2.16	96.250.204.200
May 6, 2024 04:57:01.748317003 CEST	50947	21	192.168.2.16	77.29.161.74
May 6, 2024 04:57:01.758430004 CEST	2121	50930	34.128.145.40	192.168.2.16
May 6, 2024 04:57:01.758480072 CEST	50930	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:01.758717060 CEST	2121	50909	34.128.145.40	192.168.2.16
May 6, 2024 04:57:01.760690928 CEST	21	50910	34.128.145.40	192.168.2.16
May 6, 2024 04:57:01.760961056 CEST	21	50931	34.128.145.40	192.168.2.16
May 6, 2024 04:57:01.761022091 CEST	50931	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:01.764933109 CEST	50948	2121	192.168.2.16	77.29.161.74
May 6, 2024 04:57:01.764998913 CEST	50949	21	192.168.2.16	82.30.35.13
May 6, 2024 04:57:01.779995918 CEST	50851	2121	192.168.2.16	61.152.1.106
May 6, 2024 04:57:01.780680895 CEST	50950	2121	192.168.2.16	82.30.35.13
May 6, 2024 04:57:01.792821884 CEST	2121	50718	123.128.168.1	192.168.2.16
May 6, 2024 04:57:01.793199062 CEST	50951	21	192.168.2.16	193.114.113.2
May 6, 2024 04:57:01.812006950 CEST	50880	21	192.168.2.16	81.178.147.208
May 6, 2024 04:57:01.812007904 CEST	50879	2121	192.168.2.16	96.250.204.200
May 6, 2024 04:57:01.828115940 CEST	50776	2121	192.168.2.16	111.18.251.50
May 6, 2024 04:57:01.844688892 CEST	50952	2121	192.168.2.16	193.114.113.2
May 6, 2024 04:57:01.860311031 CEST	50953	21	192.168.2.16	94.7.60.240
May 6, 2024 04:57:01.863250971 CEST	2121	50853	196.85.17.173	192.168.2.16
May 6, 2024 04:57:01.863265038 CEST	21	50852	196.85.17.173	192.168.2.16
May 6, 2024 04:57:01.867770910 CEST	2121	50930	34.128.145.40	192.168.2.16
May 6, 2024 04:57:01.867834091 CEST	50930	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:01.867894888 CEST	50930	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:01.868065119 CEST	50954	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:01.870603085 CEST	21	50931	34.128.145.40	192.168.2.16
May 6, 2024 04:57:01.870656967 CEST	50931	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:01.870696068 CEST	50931	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:01.870801926 CEST	50955	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:01.876229048 CEST	50956	2121	192.168.2.16	94.7.60.240
May 6, 2024 04:57:01.892499924 CEST	50957	21	192.168.2.16	80.152.145.3
May 6, 2024 04:57:01.892580032 CEST	50958	21	192.168.2.16	119.114.47.158
May 6, 2024 04:57:01.892580986 CEST	50959	2121	192.168.2.16	80.152.145.3
May 6, 2024 04:57:01.914167881 CEST	21	50935	81.88.252.91	192.168.2.16
May 6, 2024 04:57:01.914236069 CEST	50935	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:01.922327995 CEST	2121	50837	177.106.18.23	192.168.2.16
May 6, 2024 04:57:01.925120115 CEST	21	50836	177.106.18.23	192.168.2.16
May 6, 2024 04:57:01.939786911 CEST	2121	50936	81.88.252.91	192.168.2.16
May 6, 2024 04:57:01.954999924 CEST	50881	2121	192.168.2.16	81.178.147.208
May 6, 2024 04:57:01.955001116 CEST	50882	21	192.168.2.16	174.23.164.228
May 6, 2024 04:57:01.960016012 CEST	2121	50921	183.93.194.84	192.168.2.16
May 6, 2024 04:57:01.970997095 CEST	50887	2121	192.168.2.16	153.3.24.183
May 6, 2024 04:57:01.970998049 CEST	50866	21	192.168.2.16	94.143.150.245
May 6, 2024 04:57:01.971385956 CEST	50960	2121	192.168.2.16	119.114.47.158
May 6, 2024 04:57:01.971396923 CEST	50961	21	192.168.2.16	72.222.131.245
May 6, 2024 04:57:01.977575064 CEST	2121	50930	34.128.145.40	192.168.2.16
May 6, 2024 04:57:01.978756905 CEST	2121	50954	34.128.145.40	192.168.2.16
May 6, 2024 04:57:01.978818893 CEST	50954	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:01.980472088 CEST	21	50955	34.128.145.40	192.168.2.16
May 6, 2024 04:57:01.980621099 CEST	50955	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:01.980894089 CEST	21	50739	119.154.190.4	192.168.2.16
May 6, 2024 04:57:01.987508059 CEST	21	50941	118.52.94.214	192.168.2.16
May 6, 2024 04:57:01.996493101 CEST	21	50901	103.109.6.215	192.168.2.16
May 6, 2024 04:57:01.996608019 CEST	50901	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:02.003484011 CEST	50962	2121	192.168.2.16	72.222.131.245
May 6, 2024 04:57:02.003568888 CEST	50963	21	192.168.2.16	189.70.108.134
May 6, 2024 04:57:02.003587008 CEST	50964	2121	192.168.2.16	189.70.108.134
May 6, 2024 04:57:02.019290924 CEST	50965	21	192.168.2.16	23.0.185.171
May 6, 2024 04:57:02.019351006 CEST	50966	2121	192.168.2.16	23.0.185.171
May 6, 2024 04:57:02.028981924 CEST	2121	50943	118.52.94.214	192.168.2.16
May 6, 2024 04:57:02.031826973 CEST	21	50944	118.49.123.89	192.168.2.16
May 6, 2024 04:57:02.035001993 CEST	50885	2121	192.168.2.16	174.23.164.228
May 6, 2024 04:57:02.035203934 CEST	2121	50740	119.154.190.4	192.168.2.16
May 6, 2024 04:57:02.042861938 CEST	2121	50946	118.49.123.89	192.168.2.16
May 6, 2024 04:57:02.050987005 CEST	50890	21	192.168.2.16	39.79.119.188
May 6, 2024 04:57:02.051003933 CEST	50886	21	192.168.2.16	153.3.24.183
May 6, 2024 04:57:02.051013947 CEST	50820	21	192.168.2.16	86.82.116.212
May 6, 2024 04:57:02.051249027 CEST	50967	21	192.168.2.16	35.245.73.88
May 6, 2024 04:57:02.067008972 CEST	50821	2121	192.168.2.16	86.82.116.212
May 6, 2024 04:57:02.067290068 CEST	50867	2121	192.168.2.16	94.143.150.245
May 6, 2024 04:57:02.095253944 CEST	2121	50954	34.128.145.40	192.168.2.16
May 6, 2024 04:57:02.096293926 CEST	21	50955	34.128.145.40	192.168.2.16
May 6, 2024 04:57:02.096376896 CEST	50955	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:02.096462011 CEST	50954	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:02.096493006 CEST	50954	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:02.096510887 CEST	50955	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:02.096736908 CEST	50968	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:02.096744061 CEST	50969	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:02.098985910 CEST	50891	2121	192.168.2.16	39.79.119.188
May 6, 2024 04:57:02.114995956 CEST	50833	2121	192.168.2.16	198.46.170.76
May 6, 2024 04:57:02.114996910 CEST	50888	21	192.168.2.16	47.184.148.221
May 6, 2024 04:57:02.130373001 CEST	2121	50851	61.152.1.106	192.168.2.16
May 6, 2024 04:57:02.163008928 CEST	50822	21	192.168.2.16	187.6.77.125
May 6, 2024 04:57:02.163012028 CEST	50823	2121	192.168.2.16	187.6.77.125
May 6, 2024 04:57:02.163079023 CEST	50832	21	192.168.2.16	198.46.170.76
May 6, 2024 04:57:02.163238049 CEST	50889	2121	192.168.2.16	47.184.148.221
May 6, 2024 04:57:02.179228067 CEST	50824	21	192.168.2.16	187.199.50.175
May 6, 2024 04:57:02.188206911 CEST	21	50935	81.88.252.91	192.168.2.16
May 6, 2024 04:57:02.189464092 CEST	50935	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:02.189466000 CEST	50970	2121	192.168.2.16	35.245.73.88
May 6, 2024 04:57:02.195455074 CEST	50931	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:02.205879927 CEST	2121	50968	34.128.145.40	192.168.2.16
May 6, 2024 04:57:02.206068039 CEST	50968	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:02.206088066 CEST	21	50955	34.128.145.40	192.168.2.16
May 6, 2024 04:57:02.206758022 CEST	21	50969	34.128.145.40	192.168.2.16
May 6, 2024 04:57:02.206876993 CEST	50969	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:02.210009098 CEST	50892	21	192.168.2.16	52.232.177.70
May 6, 2024 04:57:02.226010084 CEST	50825	2121	192.168.2.16	187.199.50.175
May 6, 2024 04:57:02.226012945 CEST	50895	2121	192.168.2.16	52.232.177.70
May 6, 2024 04:57:02.226495028 CEST	50971	21	192.168.2.16	175.126.36.37
May 6, 2024 04:57:02.226496935 CEST	50972	2121	192.168.2.16	175.126.36.37
May 6, 2024 04:57:02.241992950 CEST	50898	2121	192.168.2.16	24.16.214.30
May 6, 2024 04:57:02.241993904 CEST	50897	2121	192.168.2.16	192.99.106.186
May 6, 2024 04:57:02.242008924 CEST	50899	21	192.168.2.16	192.99.106.186
May 6, 2024 04:57:02.242038012 CEST	50896	21	192.168.2.16	24.16.214.30
May 6, 2024 04:57:02.256598949 CEST	2121	50776	111.18.251.50	192.168.2.16
May 6, 2024 04:57:02.257992983 CEST	50900	21	192.168.2.16	183.190.225.111
May 6, 2024 04:57:02.267468929 CEST	2121	50833	198.46.170.76	192.168.2.16
May 6, 2024 04:57:02.267752886 CEST	50973	21	192.168.2.16	113.4.85.37
May 6, 2024 04:57:02.272139072 CEST	21	50866	94.143.150.245	192.168.2.16
May 6, 2024 04:57:02.274100065 CEST	50902	2121	192.168.2.16	183.190.225.111
May 6, 2024 04:57:02.274379015 CEST	50974	2121	192.168.2.16	113.4.85.37
May 6, 2024 04:57:02.290267944 CEST	50828	21	192.168.2.16	124.226.170.100
May 6, 2024 04:57:02.306001902 CEST	50829	2121	192.168.2.16	124.226.170.100
May 6, 2024 04:57:02.306005955 CEST	50903	21	192.168.2.16	173.77.154.6
May 6, 2024 04:57:02.307773113 CEST	21	50931	34.128.145.40	192.168.2.16
May 6, 2024 04:57:02.319031000 CEST	21	50969	34.128.145.40	192.168.2.16
May 6, 2024 04:57:02.319155931 CEST	50969	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:02.319155931 CEST	50969	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:02.319323063 CEST	50975	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:02.319531918 CEST	2121	50968	34.128.145.40	192.168.2.16
May 6, 2024 04:57:02.319657087 CEST	50968	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:02.319657087 CEST	50968	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:02.319835901 CEST	50976	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:02.325089931 CEST	2121	50970	35.245.73.88	192.168.2.16
May 6, 2024 04:57:02.327195883 CEST	21	50832	198.46.170.76	192.168.2.16
May 6, 2024 04:57:02.334307909 CEST	2121	50887	153.3.24.183	192.168.2.16
May 6, 2024 04:57:02.338284969 CEST	50977	21	192.168.2.16	35.137.130.185
May 6, 2024 04:57:02.354011059 CEST	50904	2121	192.168.2.16	173.77.154.6
May 6, 2024 04:57:02.366175890 CEST	21	50901	103.109.6.215	192.168.2.16
May 6, 2024 04:57:02.366322041 CEST	50901	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:02.369992971 CEST	50905	21	192.168.2.16	70.23.80.23
May 6, 2024 04:57:02.369992971 CEST	50907	21	192.168.2.16	178.69.67.82
May 6, 2024 04:57:02.369993925 CEST	50853	2121	192.168.2.16	196.85.17.173
May 6, 2024 04:57:02.370016098 CEST	50906	2121	192.168.2.16	70.23.80.23
May 6, 2024 04:57:02.370017052 CEST	50852	21	192.168.2.16	196.85.17.173
May 6, 2024 04:57:02.372735023 CEST	2121	50867	94.143.150.245	192.168.2.16
May 6, 2024 04:57:02.401999950 CEST	50908	2121	192.168.2.16	178.69.67.82
May 6, 2024 04:57:02.404139042 CEST	50978	21	192.168.2.16	216.117.162.236
May 6, 2024 04:57:02.426736116 CEST	21	50890	39.79.119.188	192.168.2.16
May 6, 2024 04:57:02.430736065 CEST	21	50969	34.128.145.40	192.168.2.16
May 6, 2024 04:57:02.431025982 CEST	21	50975	34.128.145.40	192.168.2.16
May 6, 2024 04:57:02.431262016 CEST	50975	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:02.431549072 CEST	2121	50968	34.128.145.40	192.168.2.16
May 6, 2024 04:57:02.431560993 CEST	2121	50976	34.128.145.40	192.168.2.16
May 6, 2024 04:57:02.431646109 CEST	50976	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:02.434010983 CEST	50836	21	192.168.2.16	177.106.18.23
May 6, 2024 04:57:02.434012890 CEST	50837	2121	192.168.2.16	177.106.18.23
May 6, 2024 04:57:02.434014082 CEST	50954	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:02.434601068 CEST	50911	21	192.168.2.16	177.184.244.134
May 6, 2024 04:57:02.451430082 CEST	50936	2121	192.168.2.16	81.88.252.91
May 6, 2024 04:57:02.451548100 CEST	50912	2121	192.168.2.16	177.184.244.134
May 6, 2024 04:57:02.455945969 CEST	21	50935	81.88.252.91	192.168.2.16
May 6, 2024 04:57:02.461330891 CEST	21	50935	81.88.252.91	192.168.2.16
May 6, 2024 04:57:02.461857080 CEST	50935	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:02.463217020 CEST	21	50935	81.88.252.91	192.168.2.16
May 6, 2024 04:57:02.466000080 CEST	50921	2121	192.168.2.16	183.93.194.84
May 6, 2024 04:57:02.477081060 CEST	2121	50891	39.79.119.188	192.168.2.16
May 6, 2024 04:57:02.482021093 CEST	50913	21	192.168.2.16	5.196.4.8
May 6, 2024 04:57:02.482021093 CEST	50914	2121	192.168.2.16	5.196.4.8
May 6, 2024 04:57:02.498009920 CEST	50915	21	192.168.2.16	78.194.40.191
May 6, 2024 04:57:02.498008966 CEST	50834	21	192.168.2.16	85.167.179.246
May 6, 2024 04:57:02.498008966 CEST	50941	21	192.168.2.16	118.52.94.214
May 6, 2024 04:57:02.513987064 CEST	50835	2121	192.168.2.16	85.167.179.246
May 6, 2024 04:57:02.530006886 CEST	50943	2121	192.168.2.16	118.52.94.214
May 6, 2024 04:57:02.530006886 CEST	50916	2121	192.168.2.16	78.194.40.191
May 6, 2024 04:57:02.541183949 CEST	21	50975	34.128.145.40	192.168.2.16
May 6, 2024 04:57:02.541204929 CEST	2121	50976	34.128.145.40	192.168.2.16
May 6, 2024 04:57:02.541279078 CEST	50975	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:02.541281939 CEST	50976	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:02.541414976 CEST	50975	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:02.541713953 CEST	50976	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:02.541716099 CEST	50979	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:02.542453051 CEST	50980	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:02.544414997 CEST	2121	50954	34.128.145.40	192.168.2.16
May 6, 2024 04:57:02.545986891 CEST	50839	21	192.168.2.16	189.172.251.148
May 6, 2024 04:57:02.546015978 CEST	50944	21	192.168.2.16	118.49.123.89
May 6, 2024 04:57:02.546035051 CEST	50946	2121	192.168.2.16	118.49.123.89
May 6, 2024 04:57:02.546099901 CEST	50840	2121	192.168.2.16	189.172.251.148
May 6, 2024 04:57:02.563453913 CEST	50917	21	192.168.2.16	37.232.181.128
May 6, 2024 04:57:02.576982975 CEST	50841	21	192.168.2.16	98.196.13.22
May 6, 2024 04:57:02.576984882 CEST	50918	2121	192.168.2.16	37.232.181.128
May 6, 2024 04:57:02.593018055 CEST	50919	21	192.168.2.16	183.93.194.84
May 6, 2024 04:57:02.593024969 CEST	50920	21	192.168.2.16	111.167.166.59
May 6, 2024 04:57:02.609009027 CEST	50922	2121	192.168.2.16	111.167.166.59
May 6, 2024 04:57:02.609025955 CEST	50923	21	192.168.2.16	147.30.47.219
May 6, 2024 04:57:02.609042883 CEST	50924	2121	192.168.2.16	147.30.47.219
May 6, 2024 04:57:02.625004053 CEST	50925	21	192.168.2.16	49.12.113.196
May 6, 2024 04:57:02.641000986 CEST	50926	2121	192.168.2.16	49.12.113.196
May 6, 2024 04:57:02.641000986 CEST	50851	2121	192.168.2.16	61.152.1.106
May 6, 2024 04:57:02.641025066 CEST	50927	21	192.168.2.16	45.51.151.109
May 6, 2024 04:57:02.643997908 CEST	50928	2121	192.168.2.16	45.51.151.109
May 6, 2024 04:57:02.644002914 CEST	50929	21	192.168.2.16	148.244.123.98
May 6, 2024 04:57:02.650871038 CEST	21	50975	34.128.145.40	192.168.2.16
May 6, 2024 04:57:02.652132988 CEST	2121	50980	34.128.145.40	192.168.2.16
May 6, 2024 04:57:02.652148008 CEST	21	50979	34.128.145.40	192.168.2.16
May 6, 2024 04:57:02.652224064 CEST	50979	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:02.652266979 CEST	50980	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:02.654520035 CEST	2121	50976	34.128.145.40	192.168.2.16
May 6, 2024 04:57:02.656306982 CEST	2121	50837	177.106.18.23	192.168.2.16
May 6, 2024 04:57:02.657004118 CEST	50932	2121	192.168.2.16	148.244.123.98
May 6, 2024 04:57:02.657005072 CEST	50933	2121	192.168.2.16	2.139.125.236
May 6, 2024 04:57:02.657344103 CEST	50934	21	192.168.2.16	2.139.125.236
May 6, 2024 04:57:02.657345057 CEST	50981	2121	192.168.2.16	35.137.130.185
May 6, 2024 04:57:02.659293890 CEST	21	50836	177.106.18.23	192.168.2.16
May 6, 2024 04:57:02.663111925 CEST	21	50852	196.85.17.173	192.168.2.16
May 6, 2024 04:57:02.663122892 CEST	2121	50853	196.85.17.173	192.168.2.16
May 6, 2024 04:57:02.673229933 CEST	50937	21	192.168.2.16	115.62.151.227
May 6, 2024 04:57:02.673229933 CEST	50982	21	192.168.2.16	136.38.108.12
May 6, 2024 04:57:02.689011097 CEST	50939	21	192.168.2.16	81.235.207.79
May 6, 2024 04:57:02.689013958 CEST	50940	2121	192.168.2.16	81.235.207.79
May 6, 2024 04:57:02.689018011 CEST	50938	2121	192.168.2.16	115.62.151.227
May 6, 2024 04:57:02.721071005 CEST	50942	21	192.168.2.16	124.75.148.85
May 6, 2024 04:57:02.723908901 CEST	2121	50936	81.88.252.91	192.168.2.16
May 6, 2024 04:57:02.737266064 CEST	21	50901	103.109.6.215	192.168.2.16
May 6, 2024 04:57:02.737296104 CEST	50945	2121	192.168.2.16	124.75.148.85
May 6, 2024 04:57:02.737601042 CEST	50983	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:02.737602949 CEST	50901	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:02.755335093 CEST	50947	21	192.168.2.16	77.29.161.74
May 6, 2024 04:57:02.761960983 CEST	2121	50980	34.128.145.40	192.168.2.16
May 6, 2024 04:57:02.762077093 CEST	50980	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:02.762077093 CEST	50980	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:02.762264013 CEST	50984	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:02.762729883 CEST	21	50979	34.128.145.40	192.168.2.16
May 6, 2024 04:57:02.762846947 CEST	50979	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:02.762846947 CEST	50979	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:02.763017893 CEST	50985	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:02.769185066 CEST	50949	21	192.168.2.16	82.30.35.13
May 6, 2024 04:57:02.769186974 CEST	50948	2121	192.168.2.16	77.29.161.74
May 6, 2024 04:57:02.784987926 CEST	50844	2121	192.168.2.16	98.196.13.22
May 6, 2024 04:57:02.784989119 CEST	50866	21	192.168.2.16	94.143.150.245
May 6, 2024 04:57:02.787597895 CEST	50950	2121	192.168.2.16	82.30.35.13
May 6, 2024 04:57:02.801011086 CEST	50951	21	192.168.2.16	193.114.113.2
May 6, 2024 04:57:02.801105022 CEST	21	50941	118.52.94.214	192.168.2.16
May 6, 2024 04:57:02.819155931 CEST	50845	21	192.168.2.16	188.81.134.237
May 6, 2024 04:57:02.833093882 CEST	50970	2121	192.168.2.16	35.245.73.88
May 6, 2024 04:57:02.835990906 CEST	2121	50921	183.93.194.84	192.168.2.16
May 6, 2024 04:57:02.842653036 CEST	2121	50943	118.52.94.214	192.168.2.16
May 6, 2024 04:57:02.845468998 CEST	21	50944	118.49.123.89	192.168.2.16
May 6, 2024 04:57:02.849025011 CEST	50887	2121	192.168.2.16	153.3.24.183
May 6, 2024 04:57:02.849025011 CEST	50952	2121	192.168.2.16	193.114.113.2
May 6, 2024 04:57:02.853084087 CEST	21	50717	109.205.180.149	192.168.2.16
May 6, 2024 04:57:02.853454113 CEST	50986	21	192.168.2.16	109.205.180.149
May 6, 2024 04:57:02.853457928 CEST	50717	21	192.168.2.16	109.205.180.149
May 6, 2024 04:57:02.857470989 CEST	2121	50946	118.49.123.89	192.168.2.16
May 6, 2024 04:57:02.859261036 CEST	21	50982	136.38.108.12	192.168.2.16
May 6, 2024 04:57:02.867022038 CEST	50953	21	192.168.2.16	94.7.60.240
May 6, 2024 04:57:02.871795893 CEST	2121	50980	34.128.145.40	192.168.2.16
May 6, 2024 04:57:02.871809959 CEST	2121	50984	34.128.145.40	192.168.2.16
May 6, 2024 04:57:02.872010946 CEST	50984	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:02.872396946 CEST	21	50985	34.128.145.40	192.168.2.16
May 6, 2024 04:57:02.872490883 CEST	21	50979	34.128.145.40	192.168.2.16
May 6, 2024 04:57:02.872519970 CEST	50985	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:02.881011963 CEST	50867	2121	192.168.2.16	94.143.150.245
May 6, 2024 04:57:02.881012917 CEST	50956	2121	192.168.2.16	94.7.60.240
May 6, 2024 04:57:02.897017002 CEST	50958	21	192.168.2.16	119.114.47.158
May 6, 2024 04:57:02.897017002 CEST	50959	2121	192.168.2.16	80.152.145.3
May 6, 2024 04:57:02.897017002 CEST	50848	2121	192.168.2.16	188.81.134.237
May 6, 2024 04:57:02.897052050 CEST	50957	21	192.168.2.16	80.152.145.3
May 6, 2024 04:57:02.929100037 CEST	50890	21	192.168.2.16	39.79.119.188
May 6, 2024 04:57:02.965250015 CEST	2121	50970	35.245.73.88	192.168.2.16
May 6, 2024 04:57:02.976018906 CEST	50960	2121	192.168.2.16	119.114.47.158
May 6, 2024 04:57:02.976020098 CEST	50961	21	192.168.2.16	72.222.131.245
May 6, 2024 04:57:02.982016087 CEST	21	50985	34.128.145.40	192.168.2.16
May 6, 2024 04:57:02.982150078 CEST	2121	50984	34.128.145.40	192.168.2.16
May 6, 2024 04:57:02.982218027 CEST	50985	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:02.982219934 CEST	50984	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:02.982355118 CEST	50985	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:02.982355118 CEST	50984	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:02.982620001 CEST	50988	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:02.982621908 CEST	50987	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:02.992002010 CEST	50891	2121	192.168.2.16	39.79.119.188
May 6, 2024 04:57:03.008013964 CEST	50962	2121	192.168.2.16	72.222.131.245
May 6, 2024 04:57:03.008013964 CEST	50964	2121	192.168.2.16	189.70.108.134
May 6, 2024 04:57:03.008014917 CEST	50963	21	192.168.2.16	189.70.108.134
May 6, 2024 04:57:03.024040937 CEST	50965	21	192.168.2.16	23.0.185.171
May 6, 2024 04:57:03.024046898 CEST	50966	2121	192.168.2.16	23.0.185.171
May 6, 2024 04:57:03.025012016 CEST	50989	2121	192.168.2.16	136.38.108.12
May 6, 2024 04:57:03.025015116 CEST	50990	21	192.168.2.16	97.87.237.82
May 6, 2024 04:57:03.025165081 CEST	50992	21	192.168.2.16	187.205.163.244
May 6, 2024 04:57:03.025167942 CEST	50991	2121	192.168.2.16	97.87.237.82
May 6, 2024 04:57:03.025300980 CEST	50994	21	192.168.2.16	219.77.222.201
May 6, 2024 04:57:03.025302887 CEST	50993	2121	192.168.2.16	187.205.163.244
May 6, 2024 04:57:03.025424957 CEST	50995	2121	192.168.2.16	219.77.222.201
May 6, 2024 04:57:03.025425911 CEST	50996	21	192.168.2.16	24.117.48.30
May 6, 2024 04:57:03.027160883 CEST	50997	2121	192.168.2.16	24.117.48.30
May 6, 2024 04:57:03.038527966 CEST	21	50942	124.75.148.85	192.168.2.16
May 6, 2024 04:57:03.042340994 CEST	50998	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:03.042340994 CEST	50999	2121	192.168.2.16	23.13.208.6
May 6, 2024 04:57:03.042505980 CEST	51000	21	192.168.2.16	201.203.223.53
May 6, 2024 04:57:03.042506933 CEST	51002	2121	192.168.2.16	201.203.223.53
May 6, 2024 04:57:03.042571068 CEST	51003	21	192.168.2.16	82.20.33.242
May 6, 2024 04:57:03.042665958 CEST	51004	2121	192.168.2.16	82.20.33.242
May 6, 2024 04:57:03.042773008 CEST	51005	21	192.168.2.16	83.167.171.106
May 6, 2024 04:57:03.042831898 CEST	51006	21	192.168.2.16	83.233.98.133
May 6, 2024 04:57:03.042901993 CEST	51008	2121	192.168.2.16	83.233.98.133
May 6, 2024 04:57:03.042903900 CEST	51007	2121	192.168.2.16	83.167.171.106
May 6, 2024 04:57:03.043024063 CEST	51009	21	192.168.2.16	47.148.251.104
May 6, 2024 04:57:03.043085098 CEST	51010	2121	192.168.2.16	47.148.251.104
May 6, 2024 04:57:03.043090105 CEST	51011	21	192.168.2.16	89.14.103.144
May 6, 2024 04:57:03.043243885 CEST	51013	21	192.168.2.16	88.135.167.244
May 6, 2024 04:57:03.043245077 CEST	51012	2121	192.168.2.16	89.14.103.144
May 6, 2024 04:57:03.043334007 CEST	51014	2121	192.168.2.16	187.224.222.88
May 6, 2024 04:57:03.043498993 CEST	51015	21	192.168.2.16	108.141.10.130
May 6, 2024 04:57:03.043576956 CEST	51017	21	192.168.2.16	115.84.102.17
May 6, 2024 04:57:03.043579102 CEST	51016	2121	192.168.2.16	115.84.102.17
May 6, 2024 04:57:03.043685913 CEST	51019	21	192.168.2.16	73.53.25.65
May 6, 2024 04:57:03.043689013 CEST	51018	21	192.168.2.16	153.33.171.16
May 6, 2024 04:57:03.043773890 CEST	51020	2121	192.168.2.16	73.53.25.65
May 6, 2024 04:57:03.043790102 CEST	51001	2121	192.168.2.16	87.106.26.129
May 6, 2024 04:57:03.043792009 CEST	51021	2121	192.168.2.16	153.33.171.16
May 6, 2024 04:57:03.043895006 CEST	51022	21	192.168.2.16	166.239.139.201
May 6, 2024 04:57:03.043895006 CEST	51023	21	192.168.2.16	23.13.208.6
May 6, 2024 04:57:03.044009924 CEST	51025	2121	192.168.2.16	108.141.10.130
May 6, 2024 04:57:03.044013023 CEST	51024	21	192.168.2.16	187.224.222.88
May 6, 2024 04:57:03.044137955 CEST	51026	2121	192.168.2.16	88.135.167.244
May 6, 2024 04:57:03.056001902 CEST	50854	21	192.168.2.16	90.197.40.84
May 6, 2024 04:57:03.056001902 CEST	50967	21	192.168.2.16	35.245.73.88
May 6, 2024 04:57:03.056799889 CEST	51028	2121	192.168.2.16	71.92.75.150
May 6, 2024 04:57:03.056801081 CEST	51027	2121	192.168.2.16	166.239.139.201
May 6, 2024 04:57:03.056855917 CEST	51030	21	192.168.2.16	5.230.77.248
May 6, 2024 04:57:03.056857109 CEST	51029	21	192.168.2.16	71.92.75.150
May 6, 2024 04:57:03.056991100 CEST	51031	2121	192.168.2.16	5.230.77.248
May 6, 2024 04:57:03.073407888 CEST	51032	21	192.168.2.16	119.49.105.48
May 6, 2024 04:57:03.073640108 CEST	51034	2121	192.168.2.16	119.49.105.48
May 6, 2024 04:57:03.073641062 CEST	51033	21	192.168.2.16	220.79.57.162
May 6, 2024 04:57:03.073709965 CEST	51035	2121	192.168.2.16	220.79.57.162
May 6, 2024 04:57:03.073878050 CEST	51036	21	192.168.2.16	206.255.93.126
May 6, 2024 04:57:03.073879004 CEST	51037	21	192.168.2.16	213.118.155.25
May 6, 2024 04:57:03.073960066 CEST	51038	2121	192.168.2.16	206.255.93.126
May 6, 2024 04:57:03.074074984 CEST	51039	2121	192.168.2.16	213.118.155.25
May 6, 2024 04:57:03.074134111 CEST	51041	2121	192.168.2.16	31.180.139.145
May 6, 2024 04:57:03.074136972 CEST	51040	21	192.168.2.16	31.180.139.145
May 6, 2024 04:57:03.074266911 CEST	51043	21	192.168.2.16	86.24.158.131
May 6, 2024 04:57:03.074268103 CEST	51042	2121	192.168.2.16	86.24.158.131
May 6, 2024 04:57:03.074327946 CEST	51044	21	192.168.2.16	123.175.103.149
May 6, 2024 04:57:03.074402094 CEST	51045	2121	192.168.2.16	123.175.103.149
May 6, 2024 04:57:03.085226059 CEST	21	50866	94.143.150.245	192.168.2.16
May 6, 2024 04:57:03.086185932 CEST	21	50717	109.205.180.149	192.168.2.16
May 6, 2024 04:57:03.086287975 CEST	50717	21	192.168.2.16	109.205.180.149
May 6, 2024 04:57:03.086308956 CEST	21	50986	109.205.180.149	192.168.2.16
May 6, 2024 04:57:03.086441994 CEST	50986	21	192.168.2.16	109.205.180.149
May 6, 2024 04:57:03.087460041 CEST	21	50717	109.205.180.149	192.168.2.16
May 6, 2024 04:57:03.087511063 CEST	50717	21	192.168.2.16	109.205.180.149
May 6, 2024 04:57:03.088835001 CEST	21	50983	103.109.6.215	192.168.2.16
May 6, 2024 04:57:03.088862896 CEST	51046	21	192.168.2.16	40.86.3.227
May 6, 2024 04:57:03.089021921 CEST	51047	21	192.168.2.16	51.105.22.66
May 6, 2024 04:57:03.089021921 CEST	50983	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:03.089176893 CEST	51049	2121	192.168.2.16	51.105.22.66
May 6, 2024 04:57:03.089180946 CEST	51048	2121	192.168.2.16	40.86.3.227
May 6, 2024 04:57:03.089318991 CEST	51050	21	192.168.2.16	177.222.250.182
May 6, 2024 04:57:03.089319944 CEST	51051	2121	192.168.2.16	177.222.250.182
May 6, 2024 04:57:03.089457989 CEST	51053	21	192.168.2.16	184.25.59.17
May 6, 2024 04:57:03.089462042 CEST	51052	2121	192.168.2.16	184.25.59.17
May 6, 2024 04:57:03.089483023 CEST	51054	21	192.168.2.16	76.127.9.130
May 6, 2024 04:57:03.091574907 CEST	21	50985	34.128.145.40	192.168.2.16
May 6, 2024 04:57:03.092205048 CEST	2121	50987	34.128.145.40	192.168.2.16
May 6, 2024 04:57:03.092252016 CEST	21	50988	34.128.145.40	192.168.2.16
May 6, 2024 04:57:03.092257977 CEST	50987	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:03.092308998 CEST	50988	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:03.092700005 CEST	2121	50984	34.128.145.40	192.168.2.16
May 6, 2024 04:57:03.107220888 CEST	21	50901	103.109.6.215	192.168.2.16
May 6, 2024 04:57:03.107377052 CEST	21	50901	103.109.6.215	192.168.2.16
May 6, 2024 04:57:03.107424021 CEST	50901	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:03.119987011 CEST	50857	2121	192.168.2.16	90.197.40.84
May 6, 2024 04:57:03.152391911 CEST	51055	2121	192.168.2.16	76.127.9.130
May 6, 2024 04:57:03.152429104 CEST	51056	21	192.168.2.16	186.29.164.212
May 6, 2024 04:57:03.168020964 CEST	50853	2121	192.168.2.16	196.85.17.173
May 6, 2024 04:57:03.168801069 CEST	50852	21	192.168.2.16	196.85.17.173
May 6, 2024 04:57:03.180414915 CEST	2121	50867	94.143.150.245	192.168.2.16
May 6, 2024 04:57:03.202100992 CEST	21	50988	34.128.145.40	192.168.2.16
May 6, 2024 04:57:03.202114105 CEST	2121	50987	34.128.145.40	192.168.2.16
May 6, 2024 04:57:03.202174902 CEST	50988	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:03.202177048 CEST	50987	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:03.202241898 CEST	50988	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:03.202379942 CEST	50987	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:03.202543974 CEST	51057	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:03.202584982 CEST	51058	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:03.210457087 CEST	2121	50989	136.38.108.12	192.168.2.16
May 6, 2024 04:57:03.212452888 CEST	2121	50887	153.3.24.183	192.168.2.16
May 6, 2024 04:57:03.221544981 CEST	21	51000	201.203.223.53	192.168.2.16
May 6, 2024 04:57:03.224423885 CEST	2121	51002	201.203.223.53	192.168.2.16
May 6, 2024 04:57:03.232012033 CEST	50972	2121	192.168.2.16	175.126.36.37
May 6, 2024 04:57:03.232012033 CEST	50936	2121	192.168.2.16	81.88.252.91
May 6, 2024 04:57:03.232012033 CEST	50858	21	192.168.2.16	73.228.3.37
May 6, 2024 04:57:03.232022047 CEST	50971	21	192.168.2.16	175.126.36.37
May 6, 2024 04:57:03.270848036 CEST	21	50998	87.106.26.129	192.168.2.16
May 6, 2024 04:57:03.270915985 CEST	50998	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:03.271882057 CEST	2121	51001	87.106.26.129	192.168.2.16
May 6, 2024 04:57:03.276304007 CEST	2121	51007	83.167.171.106	192.168.2.16
May 6, 2024 04:57:03.279648066 CEST	21	51030	5.230.77.248	192.168.2.16
May 6, 2024 04:57:03.279886961 CEST	2121	51031	5.230.77.248	192.168.2.16
May 6, 2024 04:57:03.279989004 CEST	50973	21	192.168.2.16	113.4.85.37
May 6, 2024 04:57:03.279989004 CEST	50859	2121	192.168.2.16	73.228.3.37
May 6, 2024 04:57:03.280077934 CEST	50974	2121	192.168.2.16	113.4.85.37
May 6, 2024 04:57:03.296020031 CEST	50860	21	192.168.2.16	88.88.238.12
May 6, 2024 04:57:03.298490047 CEST	21	51005	83.167.171.106	192.168.2.16
May 6, 2024 04:57:03.300894022 CEST	2121	51008	83.233.98.133	192.168.2.16
May 6, 2024 04:57:03.304709911 CEST	21	50890	39.79.119.188	192.168.2.16
May 6, 2024 04:57:03.305562019 CEST	21	51006	83.233.98.133	192.168.2.16
May 6, 2024 04:57:03.311821938 CEST	21	50988	34.128.145.40	192.168.2.16
May 6, 2024 04:57:03.311912060 CEST	2121	50987	34.128.145.40	192.168.2.16
May 6, 2024 04:57:03.312000990 CEST	50941	21	192.168.2.16	118.52.94.214
May 6, 2024 04:57:03.312000990 CEST	50861	2121	192.168.2.16	88.88.238.12
May 6, 2024 04:57:03.312133074 CEST	21	51057	34.128.145.40	192.168.2.16
May 6, 2024 04:57:03.312196970 CEST	51057	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:03.312979937 CEST	2121	51058	34.128.145.40	192.168.2.16
May 6, 2024 04:57:03.313033104 CEST	51058	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:03.321235895 CEST	21	50986	109.205.180.149	192.168.2.16
May 6, 2024 04:57:03.321418047 CEST	50986	21	192.168.2.16	109.205.180.149
May 6, 2024 04:57:03.321440935 CEST	2121	51051	177.222.250.182	192.168.2.16
May 6, 2024 04:57:03.321830988 CEST	21	51050	177.222.250.182	192.168.2.16
May 6, 2024 04:57:03.327986956 CEST	50862	21	192.168.2.16	24.127.243.192
May 6, 2024 04:57:03.327990055 CEST	50863	2121	192.168.2.16	24.127.243.192
May 6, 2024 04:57:03.343983889 CEST	50977	21	192.168.2.16	35.137.130.185
May 6, 2024 04:57:03.345990896 CEST	50921	2121	192.168.2.16	183.93.194.84
May 6, 2024 04:57:03.349143028 CEST	50943	2121	192.168.2.16	118.52.94.214
May 6, 2024 04:57:03.357762098 CEST	21	51040	31.180.139.145	192.168.2.16
May 6, 2024 04:57:03.360007048 CEST	50944	21	192.168.2.16	118.49.123.89
May 6, 2024 04:57:03.360008001 CEST	50946	2121	192.168.2.16	118.49.123.89
May 6, 2024 04:57:03.360178947 CEST	50982	21	192.168.2.16	136.38.108.12
May 6, 2024 04:57:03.370102882 CEST	2121	50891	39.79.119.188	192.168.2.16
May 6, 2024 04:57:03.375255108 CEST	2121	51035	220.79.57.162	192.168.2.16
May 6, 2024 04:57:03.381952047 CEST	21	51033	220.79.57.162	192.168.2.16
May 6, 2024 04:57:03.407999039 CEST	50978	21	192.168.2.16	216.117.162.236
May 6, 2024 04:57:03.420751095 CEST	2121	51016	115.84.102.17	192.168.2.16
May 6, 2024 04:57:03.422056913 CEST	21	51057	34.128.145.40	192.168.2.16
May 6, 2024 04:57:03.422117949 CEST	51057	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:03.422175884 CEST	51057	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:03.422344923 CEST	51059	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:03.423459053 CEST	2121	51058	34.128.145.40	192.168.2.16
May 6, 2024 04:57:03.423507929 CEST	51058	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:03.423573017 CEST	51058	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:03.423787117 CEST	51060	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:03.427150011 CEST	21	51017	115.84.102.17	192.168.2.16
May 6, 2024 04:57:03.433602095 CEST	2121	51045	123.175.103.149	192.168.2.16
May 6, 2024 04:57:03.440442085 CEST	21	50983	103.109.6.215	192.168.2.16
May 6, 2024 04:57:03.440565109 CEST	50983	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:03.471364021 CEST	2121	50853	196.85.17.173	192.168.2.16
May 6, 2024 04:57:03.471379042 CEST	21	50852	196.85.17.173	192.168.2.16
May 6, 2024 04:57:03.471776962 CEST	51061	2121	192.168.2.16	186.29.164.212
May 6, 2024 04:57:03.471987963 CEST	50970	2121	192.168.2.16	35.245.73.88
May 6, 2024 04:57:03.488007069 CEST	50868	21	192.168.2.16	89.166.186.213
May 6, 2024 04:57:03.488277912 CEST	51062	21	192.168.2.16	93.188.96.195
May 6, 2024 04:57:03.505100012 CEST	50869	2121	192.168.2.16	89.166.186.213
May 6, 2024 04:57:03.512480021 CEST	2121	50936	81.88.252.91	192.168.2.16
May 6, 2024 04:57:03.519989967 CEST	50870	21	192.168.2.16	73.113.237.7
May 6, 2024 04:57:03.526226044 CEST	21	50998	87.106.26.129	192.168.2.16
May 6, 2024 04:57:03.526345015 CEST	50998	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:03.526627064 CEST	51063	2121	192.168.2.16	93.188.96.195
May 6, 2024 04:57:03.531742096 CEST	21	51057	34.128.145.40	192.168.2.16
May 6, 2024 04:57:03.531883955 CEST	21	51059	34.128.145.40	192.168.2.16
May 6, 2024 04:57:03.531958103 CEST	51059	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:03.533373117 CEST	2121	51060	34.128.145.40	192.168.2.16
May 6, 2024 04:57:03.533430099 CEST	51060	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:03.534492970 CEST	2121	51058	34.128.145.40	192.168.2.16
May 6, 2024 04:57:03.545506001 CEST	21	50982	136.38.108.12	192.168.2.16
May 6, 2024 04:57:03.552011967 CEST	50942	21	192.168.2.16	124.75.148.85
May 6, 2024 04:57:03.554894924 CEST	21	50986	109.205.180.149	192.168.2.16
May 6, 2024 04:57:03.555104971 CEST	21	50986	109.205.180.149	192.168.2.16
May 6, 2024 04:57:03.555224895 CEST	50986	21	192.168.2.16	109.205.180.149
May 6, 2024 04:57:03.600390911 CEST	51064	21	192.168.2.16	90.199.215.58
May 6, 2024 04:57:03.600414038 CEST	50866	21	192.168.2.16	94.143.150.245
May 6, 2024 04:57:03.604151964 CEST	2121	50970	35.245.73.88	192.168.2.16
May 6, 2024 04:57:03.614711046 CEST	21	50941	118.52.94.214	192.168.2.16
May 6, 2024 04:57:03.641516924 CEST	21	51059	34.128.145.40	192.168.2.16
May 6, 2024 04:57:03.641575098 CEST	51059	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:03.641644955 CEST	51059	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:03.641823053 CEST	51065	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:03.643023968 CEST	2121	51060	34.128.145.40	192.168.2.16
May 6, 2024 04:57:03.643074989 CEST	51060	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:03.643115044 CEST	51060	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:03.643230915 CEST	51066	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:03.659063101 CEST	21	50944	118.49.123.89	192.168.2.16
May 6, 2024 04:57:03.661802053 CEST	2121	50943	118.52.94.214	192.168.2.16
May 6, 2024 04:57:03.663990021 CEST	50873	2121	192.168.2.16	73.113.237.7
May 6, 2024 04:57:03.664366007 CEST	50981	2121	192.168.2.16	35.137.130.185
May 6, 2024 04:57:03.664365053 CEST	51067	2121	192.168.2.16	90.199.215.58
May 6, 2024 04:57:03.669935942 CEST	2121	50946	118.49.123.89	192.168.2.16
May 6, 2024 04:57:03.680007935 CEST	50874	21	192.168.2.16	49.251.132.174
May 6, 2024 04:57:03.696096897 CEST	50867	2121	192.168.2.16	94.143.150.245
May 6, 2024 04:57:03.696228027 CEST	51068	21	192.168.2.16	45.184.37.34
May 6, 2024 04:57:03.712107897 CEST	50989	2121	192.168.2.16	136.38.108.12
May 6, 2024 04:57:03.715466022 CEST	2121	50921	183.93.194.84	192.168.2.16
May 6, 2024 04:57:03.728007078 CEST	51000	21	192.168.2.16	201.203.223.53
May 6, 2024 04:57:03.728008986 CEST	51002	2121	192.168.2.16	201.203.223.53
May 6, 2024 04:57:03.728029013 CEST	50887	2121	192.168.2.16	153.3.24.183
May 6, 2024 04:57:03.728343964 CEST	51069	2121	192.168.2.16	45.184.37.34
May 6, 2024 04:57:03.743992090 CEST	50875	2121	192.168.2.16	49.251.132.174
May 6, 2024 04:57:03.751019001 CEST	21	51065	34.128.145.40	192.168.2.16
May 6, 2024 04:57:03.751076937 CEST	51065	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:03.751192093 CEST	21	51059	34.128.145.40	192.168.2.16
May 6, 2024 04:57:03.752691984 CEST	2121	51060	34.128.145.40	192.168.2.16
May 6, 2024 04:57:03.752794981 CEST	2121	51066	34.128.145.40	192.168.2.16
May 6, 2024 04:57:03.752846003 CEST	51066	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:03.755049944 CEST	21	50998	87.106.26.129	192.168.2.16
May 6, 2024 04:57:03.756376028 CEST	21	50998	87.106.26.129	192.168.2.16
May 6, 2024 04:57:03.756418943 CEST	50998	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:03.759989023 CEST	50876	21	192.168.2.16	96.250.204.200
May 6, 2024 04:57:03.775999069 CEST	51001	2121	192.168.2.16	87.106.26.129
May 6, 2024 04:57:03.776010036 CEST	51007	2121	192.168.2.16	83.167.171.106
May 6, 2024 04:57:03.791687965 CEST	21	50983	103.109.6.215	192.168.2.16
May 6, 2024 04:57:03.791806936 CEST	50983	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:03.791996956 CEST	51030	21	192.168.2.16	5.230.77.248
May 6, 2024 04:57:03.792010069 CEST	51031	2121	192.168.2.16	5.230.77.248
May 6, 2024 04:57:03.807988882 CEST	51005	21	192.168.2.16	83.167.171.106
May 6, 2024 04:57:03.808015108 CEST	50890	21	192.168.2.16	39.79.119.188
May 6, 2024 04:57:03.808018923 CEST	51006	21	192.168.2.16	83.233.98.133
May 6, 2024 04:57:03.808020115 CEST	51008	2121	192.168.2.16	83.233.98.133
May 6, 2024 04:57:03.823987961 CEST	50880	21	192.168.2.16	81.178.147.208
May 6, 2024 04:57:03.824001074 CEST	51051	2121	192.168.2.16	177.222.250.182
May 6, 2024 04:57:03.824004889 CEST	50879	2121	192.168.2.16	96.250.204.200
May 6, 2024 04:57:03.825145006 CEST	51050	21	192.168.2.16	177.222.250.182
May 6, 2024 04:57:03.827197075 CEST	21	50986	109.205.180.149	192.168.2.16
May 6, 2024 04:57:03.851682901 CEST	21	50838	45.87.1.166	192.168.2.16
May 6, 2024 04:57:03.851872921 CEST	50838	21	192.168.2.16	45.87.1.166
May 6, 2024 04:57:03.852124929 CEST	51070	21	192.168.2.16	45.87.1.166
May 6, 2024 04:57:03.860296965 CEST	21	51065	34.128.145.40	192.168.2.16
May 6, 2024 04:57:03.860368967 CEST	51065	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:03.860464096 CEST	51065	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:03.860685110 CEST	51071	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:03.862462997 CEST	2121	51066	34.128.145.40	192.168.2.16
May 6, 2024 04:57:03.862519026 CEST	51066	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:03.862581015 CEST	51066	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:03.862788916 CEST	51072	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:03.869430065 CEST	21	50942	124.75.148.85	192.168.2.16
May 6, 2024 04:57:03.871993065 CEST	50891	2121	192.168.2.16	39.79.119.188
May 6, 2024 04:57:03.875401020 CEST	51040	21	192.168.2.16	31.180.139.145
May 6, 2024 04:57:03.876116991 CEST	51035	2121	192.168.2.16	220.79.57.162
May 6, 2024 04:57:03.887006044 CEST	51033	21	192.168.2.16	220.79.57.162
May 6, 2024 04:57:03.897502899 CEST	2121	50989	136.38.108.12	192.168.2.16
May 6, 2024 04:57:03.900741100 CEST	21	50866	94.143.150.245	192.168.2.16
May 6, 2024 04:57:03.908191919 CEST	21	51000	201.203.223.53	192.168.2.16
May 6, 2024 04:57:03.909363985 CEST	2121	51002	201.203.223.53	192.168.2.16
May 6, 2024 04:57:03.918245077 CEST	51073	21	192.168.2.16	131.93.181.247
May 6, 2024 04:57:03.934012890 CEST	51017	21	192.168.2.16	115.84.102.17
May 6, 2024 04:57:03.936990023 CEST	51016	2121	192.168.2.16	115.84.102.17
May 6, 2024 04:57:03.949014902 CEST	51045	2121	192.168.2.16	123.175.103.149
May 6, 2024 04:57:03.965008974 CEST	50881	2121	192.168.2.16	81.178.147.208
May 6, 2024 04:57:03.965013981 CEST	50882	21	192.168.2.16	174.23.164.228
May 6, 2024 04:57:03.969677925 CEST	21	51065	34.128.145.40	192.168.2.16
May 6, 2024 04:57:03.970340014 CEST	21	51071	34.128.145.40	192.168.2.16
May 6, 2024 04:57:03.970412016 CEST	51071	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:03.972007990 CEST	2121	51072	34.128.145.40	192.168.2.16
May 6, 2024 04:57:03.972065926 CEST	51072	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:03.972104073 CEST	2121	51066	34.128.145.40	192.168.2.16
May 6, 2024 04:57:03.995795012 CEST	2121	50867	94.143.150.245	192.168.2.16
May 6, 2024 04:57:04.004245043 CEST	2121	51001	87.106.26.129	192.168.2.16
May 6, 2024 04:57:04.006346941 CEST	2121	51007	83.167.171.106	192.168.2.16
May 6, 2024 04:57:04.013288021 CEST	51074	2121	192.168.2.16	131.93.181.247
May 6, 2024 04:57:04.014767885 CEST	21	51030	5.230.77.248	192.168.2.16
May 6, 2024 04:57:04.014857054 CEST	2121	51031	5.230.77.248	192.168.2.16
May 6, 2024 04:57:04.028018951 CEST	50995	2121	192.168.2.16	219.77.222.201
May 6, 2024 04:57:04.028018951 CEST	50990	21	192.168.2.16	97.87.237.82
May 6, 2024 04:57:04.028018951 CEST	50996	21	192.168.2.16	24.117.48.30
May 6, 2024 04:57:04.028021097 CEST	50936	2121	192.168.2.16	81.88.252.91
May 6, 2024 04:57:04.028021097 CEST	50994	21	192.168.2.16	219.77.222.201
May 6, 2024 04:57:04.028072119 CEST	50992	21	192.168.2.16	187.205.163.244
May 6, 2024 04:57:04.028072119 CEST	50993	2121	192.168.2.16	187.205.163.244
May 6, 2024 04:57:04.028074026 CEST	50991	2121	192.168.2.16	97.87.237.82
May 6, 2024 04:57:04.028074026 CEST	50997	2121	192.168.2.16	24.117.48.30
May 6, 2024 04:57:04.043996096 CEST	51004	2121	192.168.2.16	82.20.33.242
May 6, 2024 04:57:04.043997049 CEST	50885	2121	192.168.2.16	174.23.164.228
May 6, 2024 04:57:04.044020891 CEST	51013	21	192.168.2.16	88.135.167.244
May 6, 2024 04:57:04.044020891 CEST	51010	2121	192.168.2.16	47.148.251.104
May 6, 2024 04:57:04.044020891 CEST	51003	21	192.168.2.16	82.20.33.242
May 6, 2024 04:57:04.044023991 CEST	50999	2121	192.168.2.16	23.13.208.6
May 6, 2024 04:57:04.044023037 CEST	51012	2121	192.168.2.16	89.14.103.144
May 6, 2024 04:57:04.044023037 CEST	51009	21	192.168.2.16	47.148.251.104
May 6, 2024 04:57:04.044050932 CEST	51022	21	192.168.2.16	166.239.139.201
May 6, 2024 04:57:04.044054031 CEST	51011	21	192.168.2.16	89.14.103.144
May 6, 2024 04:57:04.044056892 CEST	51014	2121	192.168.2.16	187.224.222.88
May 6, 2024 04:57:04.044058084 CEST	51026	2121	192.168.2.16	88.135.167.244
May 6, 2024 04:57:04.044058084 CEST	51024	21	192.168.2.16	187.224.222.88
May 6, 2024 04:57:04.044059038 CEST	51015	21	192.168.2.16	108.141.10.130
May 6, 2024 04:57:04.044059992 CEST	51020	2121	192.168.2.16	73.53.25.65
May 6, 2024 04:57:04.044059992 CEST	51019	21	192.168.2.16	73.53.25.65
May 6, 2024 04:57:04.044061899 CEST	51018	21	192.168.2.16	153.33.171.16
May 6, 2024 04:57:04.044059038 CEST	51021	2121	192.168.2.16	153.33.171.16
May 6, 2024 04:57:04.044059992 CEST	51025	2121	192.168.2.16	108.141.10.130
May 6, 2024 04:57:04.044059992 CEST	51023	21	192.168.2.16	23.13.208.6
May 6, 2024 04:57:04.044344902 CEST	51075	21	192.168.2.16	76.158.216.180
May 6, 2024 04:57:04.056071043 CEST	2121	51051	177.222.250.182	192.168.2.16
May 6, 2024 04:57:04.057722092 CEST	21	51050	177.222.250.182	192.168.2.16
May 6, 2024 04:57:04.058445930 CEST	21	51005	83.167.171.106	192.168.2.16
May 6, 2024 04:57:04.059011936 CEST	50982	21	192.168.2.16	136.38.108.12
May 6, 2024 04:57:04.059012890 CEST	51027	2121	192.168.2.16	166.239.139.201
May 6, 2024 04:57:04.059032917 CEST	51029	21	192.168.2.16	71.92.75.150
May 6, 2024 04:57:04.059070110 CEST	50886	21	192.168.2.16	153.3.24.183
May 6, 2024 04:57:04.059142113 CEST	51028	2121	192.168.2.16	71.92.75.150
May 6, 2024 04:57:04.059279919 CEST	51076	2121	192.168.2.16	76.158.216.180
May 6, 2024 04:57:04.069473982 CEST	21	51006	83.233.98.133	192.168.2.16
May 6, 2024 04:57:04.074207067 CEST	2121	51008	83.233.98.133	192.168.2.16
May 6, 2024 04:57:04.074850082 CEST	21	50838	45.87.1.166	192.168.2.16
May 6, 2024 04:57:04.074862957 CEST	21	51070	45.87.1.166	192.168.2.16
May 6, 2024 04:57:04.074899912 CEST	50838	21	192.168.2.16	45.87.1.166
May 6, 2024 04:57:04.074938059 CEST	51070	21	192.168.2.16	45.87.1.166
May 6, 2024 04:57:04.075001955 CEST	51038	2121	192.168.2.16	206.255.93.126
May 6, 2024 04:57:04.075005054 CEST	51034	2121	192.168.2.16	119.49.105.48
May 6, 2024 04:57:04.075030088 CEST	51041	2121	192.168.2.16	31.180.139.145
May 6, 2024 04:57:04.075030088 CEST	51032	21	192.168.2.16	119.49.105.48
May 6, 2024 04:57:04.075031042 CEST	51036	21	192.168.2.16	206.255.93.126
May 6, 2024 04:57:04.075031042 CEST	51043	21	192.168.2.16	86.24.158.131
May 6, 2024 04:57:04.075031042 CEST	51037	21	192.168.2.16	213.118.155.25
May 6, 2024 04:57:04.075031042 CEST	51039	2121	192.168.2.16	213.118.155.25
May 6, 2024 04:57:04.075284958 CEST	51044	21	192.168.2.16	123.175.103.149
May 6, 2024 04:57:04.075287104 CEST	51042	2121	192.168.2.16	86.24.158.131
May 6, 2024 04:57:04.080080986 CEST	21	51071	34.128.145.40	192.168.2.16
May 6, 2024 04:57:04.080133915 CEST	51071	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:04.080197096 CEST	51071	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:04.080362082 CEST	51077	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:04.081752062 CEST	2121	51072	34.128.145.40	192.168.2.16
May 6, 2024 04:57:04.081796885 CEST	51072	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:04.081886053 CEST	51072	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:04.082073927 CEST	51078	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:04.090014935 CEST	51046	21	192.168.2.16	40.86.3.227
May 6, 2024 04:57:04.090014935 CEST	51048	2121	192.168.2.16	40.86.3.227
May 6, 2024 04:57:04.090038061 CEST	51052	2121	192.168.2.16	184.25.59.17
May 6, 2024 04:57:04.090038061 CEST	51054	21	192.168.2.16	76.127.9.130
May 6, 2024 04:57:04.090039015 CEST	51053	21	192.168.2.16	184.25.59.17
May 6, 2024 04:57:04.090039015 CEST	51047	21	192.168.2.16	51.105.22.66
May 6, 2024 04:57:04.090039015 CEST	51049	2121	192.168.2.16	51.105.22.66
May 6, 2024 04:57:04.090928078 CEST	2121	50887	153.3.24.183	192.168.2.16
May 6, 2024 04:57:04.105989933 CEST	50970	2121	192.168.2.16	35.245.73.88
May 6, 2024 04:57:04.121994019 CEST	50888	21	192.168.2.16	47.184.148.221
May 6, 2024 04:57:04.121994019 CEST	50941	21	192.168.2.16	118.52.94.214
May 6, 2024 04:57:04.144469023 CEST	21	50983	103.109.6.215	192.168.2.16
May 6, 2024 04:57:04.144637108 CEST	50983	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:04.144810915 CEST	51079	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:04.154014111 CEST	51056	21	192.168.2.16	186.29.164.212
May 6, 2024 04:57:04.154014111 CEST	51055	2121	192.168.2.16	76.127.9.130
May 6, 2024 04:57:04.154375076 CEST	51080	21	192.168.2.16	189.39.2.210
May 6, 2024 04:57:04.154457092 CEST	51081	2121	192.168.2.16	189.39.2.210
May 6, 2024 04:57:04.158169985 CEST	21	51040	31.180.139.145	192.168.2.16
May 6, 2024 04:57:04.169992924 CEST	50889	2121	192.168.2.16	47.184.148.221
May 6, 2024 04:57:04.170006037 CEST	50943	2121	192.168.2.16	118.52.94.214
May 6, 2024 04:57:04.170073986 CEST	50944	21	192.168.2.16	118.49.123.89
May 6, 2024 04:57:04.170078993 CEST	50946	2121	192.168.2.16	118.49.123.89
May 6, 2024 04:57:04.170293093 CEST	51082	21	192.168.2.16	179.26.2.92
May 6, 2024 04:57:04.176359892 CEST	2121	51035	220.79.57.162	192.168.2.16
May 6, 2024 04:57:04.183965921 CEST	21	50890	39.79.119.188	192.168.2.16
May 6, 2024 04:57:04.189846992 CEST	21	51071	34.128.145.40	192.168.2.16
May 6, 2024 04:57:04.190819025 CEST	21	51077	34.128.145.40	192.168.2.16
May 6, 2024 04:57:04.190888882 CEST	51077	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:04.191023111 CEST	2121	51072	34.128.145.40	192.168.2.16
May 6, 2024 04:57:04.191298962 CEST	2121	51078	34.128.145.40	192.168.2.16
May 6, 2024 04:57:04.191351891 CEST	51078	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:04.194061995 CEST	21	51033	220.79.57.162	192.168.2.16
May 6, 2024 04:57:04.215990067 CEST	50892	21	192.168.2.16	52.232.177.70
May 6, 2024 04:57:04.216010094 CEST	50921	2121	192.168.2.16	183.93.194.84
May 6, 2024 04:57:04.216231108 CEST	51083	2121	192.168.2.16	179.26.2.92
May 6, 2024 04:57:04.231004953 CEST	50895	2121	192.168.2.16	52.232.177.70
May 6, 2024 04:57:04.238209009 CEST	2121	50970	35.245.73.88	192.168.2.16
May 6, 2024 04:57:04.244254112 CEST	21	50982	136.38.108.12	192.168.2.16
May 6, 2024 04:57:04.247001886 CEST	50896	21	192.168.2.16	24.16.214.30
May 6, 2024 04:57:04.247003078 CEST	50898	2121	192.168.2.16	24.16.214.30
May 6, 2024 04:57:04.247004032 CEST	50897	2121	192.168.2.16	192.99.106.186
May 6, 2024 04:57:04.247853994 CEST	50899	21	192.168.2.16	192.99.106.186
May 6, 2024 04:57:04.249787092 CEST	2121	50891	39.79.119.188	192.168.2.16
May 6, 2024 04:57:04.263009071 CEST	50900	21	192.168.2.16	183.190.225.111
May 6, 2024 04:57:04.279011965 CEST	50902	2121	192.168.2.16	183.190.225.111
May 6, 2024 04:57:04.279243946 CEST	51084	21	192.168.2.16	67.246.152.7
May 6, 2024 04:57:04.295345068 CEST	51085	2121	192.168.2.16	67.246.152.7
May 6, 2024 04:57:04.296179056 CEST	2121	50936	81.88.252.91	192.168.2.16
May 6, 2024 04:57:04.300575018 CEST	2121	51078	34.128.145.40	192.168.2.16
May 6, 2024 04:57:04.300641060 CEST	51078	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:04.300745010 CEST	51078	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:04.301059961 CEST	51086	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:04.301373005 CEST	21	51077	34.128.145.40	192.168.2.16
May 6, 2024 04:57:04.301426888 CEST	51077	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:04.301487923 CEST	51077	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:04.301647902 CEST	51087	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:04.302032948 CEST	21	51070	45.87.1.166	192.168.2.16
May 6, 2024 04:57:04.302141905 CEST	51070	21	192.168.2.16	45.87.1.166
May 6, 2024 04:57:04.307610035 CEST	2121	51045	123.175.103.149	192.168.2.16
May 6, 2024 04:57:04.311012983 CEST	50903	21	192.168.2.16	173.77.154.6
May 6, 2024 04:57:04.314559937 CEST	2121	51016	115.84.102.17	192.168.2.16
May 6, 2024 04:57:04.317521095 CEST	21	51017	115.84.102.17	192.168.2.16
May 6, 2024 04:57:04.358006954 CEST	50904	2121	192.168.2.16	173.77.154.6
May 6, 2024 04:57:04.374012947 CEST	50906	2121	192.168.2.16	70.23.80.23
May 6, 2024 04:57:04.374012947 CEST	50907	21	192.168.2.16	178.69.67.82
May 6, 2024 04:57:04.374057055 CEST	50905	21	192.168.2.16	70.23.80.23
May 6, 2024 04:57:04.374057055 CEST	50942	21	192.168.2.16	124.75.148.85
May 6, 2024 04:57:04.405983925 CEST	50989	2121	192.168.2.16	136.38.108.12
May 6, 2024 04:57:04.406240940 CEST	50908	2121	192.168.2.16	178.69.67.82
May 6, 2024 04:57:04.410732031 CEST	2121	51078	34.128.145.40	192.168.2.16
May 6, 2024 04:57:04.411062956 CEST	21	51087	34.128.145.40	192.168.2.16
May 6, 2024 04:57:04.411128998 CEST	51087	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:04.411556005 CEST	2121	51086	34.128.145.40	192.168.2.16
May 6, 2024 04:57:04.411607027 CEST	51086	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:04.412208080 CEST	21	51077	34.128.145.40	192.168.2.16
May 6, 2024 04:57:04.421989918 CEST	51002	2121	192.168.2.16	201.203.223.53
May 6, 2024 04:57:04.421991110 CEST	51000	21	192.168.2.16	201.203.223.53
May 6, 2024 04:57:04.424868107 CEST	21	50941	118.52.94.214	192.168.2.16
May 6, 2024 04:57:04.438008070 CEST	50911	21	192.168.2.16	177.184.244.134
May 6, 2024 04:57:04.454008102 CEST	50912	2121	192.168.2.16	177.184.244.134
May 6, 2024 04:57:04.470163107 CEST	21	50944	118.49.123.89	192.168.2.16
May 6, 2024 04:57:04.480272055 CEST	2121	50946	118.49.123.89	192.168.2.16
May 6, 2024 04:57:04.482460022 CEST	2121	50943	118.52.94.214	192.168.2.16
May 6, 2024 04:57:04.484987020 CEST	51061	2121	192.168.2.16	186.29.164.212
May 6, 2024 04:57:04.485016108 CEST	50914	2121	192.168.2.16	5.196.4.8
May 6, 2024 04:57:04.485017061 CEST	50913	21	192.168.2.16	5.196.4.8
May 6, 2024 04:57:04.485246897 CEST	51088	21	192.168.2.16	117.93.14.87
May 6, 2024 04:57:04.495774031 CEST	21	50983	103.109.6.215	192.168.2.16
May 6, 2024 04:57:04.495832920 CEST	21	50983	103.109.6.215	192.168.2.16
May 6, 2024 04:57:04.495882034 CEST	50983	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:04.499994993 CEST	51062	21	192.168.2.16	93.188.96.195
May 6, 2024 04:57:04.500081062 CEST	50915	21	192.168.2.16	78.194.40.191
May 6, 2024 04:57:04.500246048 CEST	51089	2121	192.168.2.16	117.93.14.87
May 6, 2024 04:57:04.503273010 CEST	21	51079	103.109.6.215	192.168.2.16
May 6, 2024 04:57:04.503338099 CEST	51079	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:04.515989065 CEST	51001	2121	192.168.2.16	87.106.26.129
May 6, 2024 04:57:04.516007900 CEST	51007	2121	192.168.2.16	83.167.171.106
May 6, 2024 04:57:04.516009092 CEST	51030	21	192.168.2.16	5.230.77.248
May 6, 2024 04:57:04.516020060 CEST	51031	2121	192.168.2.16	5.230.77.248
May 6, 2024 04:57:04.520373106 CEST	21	51087	34.128.145.40	192.168.2.16
May 6, 2024 04:57:04.520425081 CEST	51087	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:04.520495892 CEST	51087	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:04.520667076 CEST	51090	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:04.522088051 CEST	2121	51086	34.128.145.40	192.168.2.16
May 6, 2024 04:57:04.522147894 CEST	51086	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:04.522207022 CEST	51086	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:04.522366047 CEST	51091	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:04.525105953 CEST	21	51070	45.87.1.166	192.168.2.16
May 6, 2024 04:57:04.525376081 CEST	21	51070	45.87.1.166	192.168.2.16
May 6, 2024 04:57:04.525510073 CEST	51070	21	192.168.2.16	45.87.1.166
May 6, 2024 04:57:04.531016111 CEST	51063	2121	192.168.2.16	93.188.96.195
May 6, 2024 04:57:04.531296968 CEST	50916	2121	192.168.2.16	78.194.40.191
May 6, 2024 04:57:04.531299114 CEST	51092	21	192.168.2.16	154.197.86.15
May 6, 2024 04:57:04.531408072 CEST	51093	2121	192.168.2.16	154.197.86.15
May 6, 2024 04:57:04.562997103 CEST	51051	2121	192.168.2.16	177.222.250.182
May 6, 2024 04:57:04.563066006 CEST	51050	21	192.168.2.16	177.222.250.182
May 6, 2024 04:57:04.563066959 CEST	50917	21	192.168.2.16	37.232.181.128
May 6, 2024 04:57:04.563071966 CEST	51005	21	192.168.2.16	83.167.171.106
May 6, 2024 04:57:04.563254118 CEST	51094	21	192.168.2.16	114.207.216.96
May 6, 2024 04:57:04.578994036 CEST	51006	21	192.168.2.16	83.233.98.133
May 6, 2024 04:57:04.579005957 CEST	51008	2121	192.168.2.16	83.233.98.133
May 6, 2024 04:57:04.579016924 CEST	50918	2121	192.168.2.16	37.232.181.128
May 6, 2024 04:57:04.585474968 CEST	2121	50921	183.93.194.84	192.168.2.16
May 6, 2024 04:57:04.591335058 CEST	2121	50989	136.38.108.12	192.168.2.16
May 6, 2024 04:57:04.595129967 CEST	50919	21	192.168.2.16	183.93.194.84
May 6, 2024 04:57:04.595129013 CEST	50887	2121	192.168.2.16	153.3.24.183
May 6, 2024 04:57:04.595130920 CEST	50920	21	192.168.2.16	111.167.166.59
May 6, 2024 04:57:04.600796938 CEST	21	51000	201.203.223.53	192.168.2.16
May 6, 2024 04:57:04.603697062 CEST	2121	51002	201.203.223.53	192.168.2.16
May 6, 2024 04:57:04.611133099 CEST	50923	21	192.168.2.16	147.30.47.219
May 6, 2024 04:57:04.611139059 CEST	51064	21	192.168.2.16	90.199.215.58
May 6, 2024 04:57:04.611141920 CEST	50924	2121	192.168.2.16	147.30.47.219
May 6, 2024 04:57:04.611141920 CEST	50922	2121	192.168.2.16	111.167.166.59
May 6, 2024 04:57:04.627015114 CEST	50925	21	192.168.2.16	49.12.113.196
May 6, 2024 04:57:04.629723072 CEST	21	51087	34.128.145.40	192.168.2.16
May 6, 2024 04:57:04.630289078 CEST	21	51090	34.128.145.40	192.168.2.16
May 6, 2024 04:57:04.630351067 CEST	51090	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:04.631943941 CEST	2121	51086	34.128.145.40	192.168.2.16
May 6, 2024 04:57:04.631992102 CEST	2121	51091	34.128.145.40	192.168.2.16
May 6, 2024 04:57:04.632042885 CEST	51091	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:04.643002033 CEST	50927	21	192.168.2.16	45.51.151.109
May 6, 2024 04:57:04.643018961 CEST	50928	2121	192.168.2.16	45.51.151.109
May 6, 2024 04:57:04.643021107 CEST	50929	21	192.168.2.16	148.244.123.98
May 6, 2024 04:57:04.643310070 CEST	50926	2121	192.168.2.16	49.12.113.196
May 6, 2024 04:57:04.658998013 CEST	50934	21	192.168.2.16	2.139.125.236
May 6, 2024 04:57:04.659013987 CEST	51040	21	192.168.2.16	31.180.139.145
May 6, 2024 04:57:04.659013987 CEST	50933	2121	192.168.2.16	2.139.125.236
May 6, 2024 04:57:04.659029961 CEST	50932	2121	192.168.2.16	148.244.123.98
May 6, 2024 04:57:04.674993038 CEST	51067	2121	192.168.2.16	90.199.215.58
May 6, 2024 04:57:04.675009012 CEST	50937	21	192.168.2.16	115.62.151.227
May 6, 2024 04:57:04.690989971 CEST	51035	2121	192.168.2.16	220.79.57.162
May 6, 2024 04:57:04.691006899 CEST	50890	21	192.168.2.16	39.79.119.188
May 6, 2024 04:57:04.691024065 CEST	50938	2121	192.168.2.16	115.62.151.227
May 6, 2024 04:57:04.691024065 CEST	50939	21	192.168.2.16	81.235.207.79
May 6, 2024 04:57:04.691982031 CEST	50940	2121	192.168.2.16	81.235.207.79
May 6, 2024 04:57:04.707010031 CEST	51068	21	192.168.2.16	45.184.37.34
May 6, 2024 04:57:04.707017899 CEST	51033	21	192.168.2.16	220.79.57.162
May 6, 2024 04:57:04.738817930 CEST	21	51030	5.230.77.248	192.168.2.16
May 6, 2024 04:57:04.738914967 CEST	2121	51031	5.230.77.248	192.168.2.16
May 6, 2024 04:57:04.738987923 CEST	51069	2121	192.168.2.16	45.184.37.34
May 6, 2024 04:57:04.739012957 CEST	50970	2121	192.168.2.16	35.245.73.88
May 6, 2024 04:57:04.739015102 CEST	50945	2121	192.168.2.16	124.75.148.85
May 6, 2024 04:57:04.740087032 CEST	21	51090	34.128.145.40	192.168.2.16
May 6, 2024 04:57:04.740154028 CEST	51090	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:04.740209103 CEST	51090	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:04.740386963 CEST	51095	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:04.741672993 CEST	2121	51091	34.128.145.40	192.168.2.16
May 6, 2024 04:57:04.741724968 CEST	51091	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:04.741796970 CEST	51091	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:04.741996050 CEST	51096	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:04.744039059 CEST	2121	51001	87.106.26.129	192.168.2.16
May 6, 2024 04:57:04.753989935 CEST	50982	21	192.168.2.16	136.38.108.12
May 6, 2024 04:57:04.756305933 CEST	2121	51007	83.167.171.106	192.168.2.16
May 6, 2024 04:57:04.756336927 CEST	50891	2121	192.168.2.16	39.79.119.188
May 6, 2024 04:57:04.756339073 CEST	50947	21	192.168.2.16	77.29.161.74
May 6, 2024 04:57:04.770009995 CEST	50948	2121	192.168.2.16	77.29.161.74
May 6, 2024 04:57:04.770010948 CEST	50949	21	192.168.2.16	82.30.35.13
May 6, 2024 04:57:04.770219088 CEST	51097	2121	192.168.2.16	114.207.216.96
May 6, 2024 04:57:04.785989046 CEST	50950	2121	192.168.2.16	82.30.35.13
May 6, 2024 04:57:04.792238951 CEST	21	51070	45.87.1.166	192.168.2.16
May 6, 2024 04:57:04.795133114 CEST	2121	51051	177.222.250.182	192.168.2.16
May 6, 2024 04:57:04.795600891 CEST	21	51050	177.222.250.182	192.168.2.16
May 6, 2024 04:57:04.802005053 CEST	50936	2121	192.168.2.16	81.88.252.91
May 6, 2024 04:57:04.802005053 CEST	50951	21	192.168.2.16	193.114.113.2
May 6, 2024 04:57:04.802316904 CEST	51098	21	192.168.2.16	220.235.242.246
May 6, 2024 04:57:04.813437939 CEST	21	51005	83.167.171.106	192.168.2.16
May 6, 2024 04:57:04.817995071 CEST	51045	2121	192.168.2.16	123.175.103.149
May 6, 2024 04:57:04.818396091 CEST	51016	2121	192.168.2.16	115.84.102.17
May 6, 2024 04:57:04.818397045 CEST	51017	21	192.168.2.16	115.84.102.17
May 6, 2024 04:57:04.836057901 CEST	2121	51089	117.93.14.87	192.168.2.16
May 6, 2024 04:57:04.840379000 CEST	21	51006	83.233.98.133	192.168.2.16
May 6, 2024 04:57:04.844218969 CEST	21	51088	117.93.14.87	192.168.2.16
May 6, 2024 04:57:04.846059084 CEST	2121	51008	83.233.98.133	192.168.2.16
May 6, 2024 04:57:04.849912882 CEST	21	51090	34.128.145.40	192.168.2.16
May 6, 2024 04:57:04.850492954 CEST	21	51095	34.128.145.40	192.168.2.16
May 6, 2024 04:57:04.850558996 CEST	51095	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:04.851422071 CEST	2121	51091	34.128.145.40	192.168.2.16
May 6, 2024 04:57:04.851566076 CEST	2121	51096	34.128.145.40	192.168.2.16
May 6, 2024 04:57:04.851624966 CEST	51096	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:04.852943897 CEST	50952	2121	192.168.2.16	193.114.113.2
May 6, 2024 04:57:04.861917019 CEST	21	51079	103.109.6.215	192.168.2.16
May 6, 2024 04:57:04.862076998 CEST	51079	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:04.866019011 CEST	50953	21	192.168.2.16	94.7.60.240
May 6, 2024 04:57:04.871237040 CEST	2121	50970	35.245.73.88	192.168.2.16
May 6, 2024 04:57:04.882034063 CEST	50956	2121	192.168.2.16	94.7.60.240
May 6, 2024 04:57:04.882529020 CEST	51099	2121	192.168.2.16	220.235.242.246
May 6, 2024 04:57:04.882586002 CEST	51100	21	192.168.2.16	123.162.147.215
May 6, 2024 04:57:04.882589102 CEST	51101	2121	192.168.2.16	123.162.147.215
May 6, 2024 04:57:04.898011923 CEST	50958	21	192.168.2.16	119.114.47.158
May 6, 2024 04:57:04.898013115 CEST	50957	21	192.168.2.16	80.152.145.3
May 6, 2024 04:57:04.898013115 CEST	50959	2121	192.168.2.16	80.152.145.3
May 6, 2024 04:57:04.909527063 CEST	2121	51093	154.197.86.15	192.168.2.16
May 6, 2024 04:57:04.909538031 CEST	21	51092	154.197.86.15	192.168.2.16
May 6, 2024 04:57:04.928994894 CEST	51073	21	192.168.2.16	131.93.181.247
May 6, 2024 04:57:04.929006100 CEST	50941	21	192.168.2.16	118.52.94.214
May 6, 2024 04:57:04.929438114 CEST	51102	21	192.168.2.16	83.239.172.170
May 6, 2024 04:57:04.939229012 CEST	21	50982	136.38.108.12	192.168.2.16
May 6, 2024 04:57:04.941942930 CEST	21	51040	31.180.139.145	192.168.2.16
May 6, 2024 04:57:04.957947969 CEST	2121	50887	153.3.24.183	192.168.2.16
May 6, 2024 04:57:04.960683107 CEST	21	51095	34.128.145.40	192.168.2.16
May 6, 2024 04:57:04.960755110 CEST	51095	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:04.960803986 CEST	51095	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:04.960966110 CEST	51103	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:04.961282015 CEST	2121	51096	34.128.145.40	192.168.2.16
May 6, 2024 04:57:04.961335897 CEST	51096	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:04.961405993 CEST	51096	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:04.961632013 CEST	51104	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:04.977016926 CEST	50944	21	192.168.2.16	118.49.123.89
May 6, 2024 04:57:04.977148056 CEST	50960	2121	192.168.2.16	119.114.47.158
May 6, 2024 04:57:04.977149963 CEST	50961	21	192.168.2.16	72.222.131.245
May 6, 2024 04:57:04.977184057 CEST	51105	2121	192.168.2.16	83.239.172.170
May 6, 2024 04:57:04.991558075 CEST	2121	51035	220.79.57.162	192.168.2.16
May 6, 2024 04:57:04.992986917 CEST	50946	2121	192.168.2.16	118.49.123.89
May 6, 2024 04:57:04.995986938 CEST	50943	2121	192.168.2.16	118.52.94.214
May 6, 2024 04:57:05.009102106 CEST	50964	2121	192.168.2.16	189.70.108.134
May 6, 2024 04:57:05.011718988 CEST	50963	21	192.168.2.16	189.70.108.134
May 6, 2024 04:57:05.011737108 CEST	50962	2121	192.168.2.16	72.222.131.245
May 6, 2024 04:57:05.015213013 CEST	21	51033	220.79.57.162	192.168.2.16
May 6, 2024 04:57:05.023988962 CEST	51074	2121	192.168.2.16	131.93.181.247
May 6, 2024 04:57:05.024012089 CEST	50965	21	192.168.2.16	23.0.185.171
May 6, 2024 04:57:05.024013042 CEST	50966	2121	192.168.2.16	23.0.185.171
May 6, 2024 04:57:05.040322065 CEST	51106	21	192.168.2.16	114.104.136.65
May 6, 2024 04:57:05.056005955 CEST	51075	21	192.168.2.16	76.158.216.180
May 6, 2024 04:57:05.056092978 CEST	50967	21	192.168.2.16	35.245.73.88
May 6, 2024 04:57:05.065433025 CEST	2121	50945	124.75.148.85	192.168.2.16
May 6, 2024 04:57:05.066932917 CEST	21	50890	39.79.119.188	192.168.2.16
May 6, 2024 04:57:05.069188118 CEST	2121	50936	81.88.252.91	192.168.2.16
May 6, 2024 04:57:05.070271015 CEST	21	51103	34.128.145.40	192.168.2.16
May 6, 2024 04:57:05.070334911 CEST	51103	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:05.070774078 CEST	21	51095	34.128.145.40	192.168.2.16
May 6, 2024 04:57:05.070939064 CEST	2121	51096	34.128.145.40	192.168.2.16
May 6, 2024 04:57:05.071192980 CEST	2121	51104	34.128.145.40	192.168.2.16
May 6, 2024 04:57:05.071244955 CEST	51104	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:05.071999073 CEST	51076	2121	192.168.2.16	76.158.216.180
May 6, 2024 04:57:05.088013887 CEST	50921	2121	192.168.2.16	183.93.194.84
May 6, 2024 04:57:05.088413954 CEST	51107	2121	192.168.2.16	114.104.136.65
May 6, 2024 04:57:05.088515997 CEST	51108	21	192.168.2.16	216.193.134.44
May 6, 2024 04:57:05.104003906 CEST	50989	2121	192.168.2.16	136.38.108.12
May 6, 2024 04:57:05.104110003 CEST	51002	2121	192.168.2.16	201.203.223.53
May 6, 2024 04:57:05.104113102 CEST	51000	21	192.168.2.16	201.203.223.53
May 6, 2024 04:57:05.104350090 CEST	51109	2121	192.168.2.16	216.193.134.44
May 6, 2024 04:57:05.134305000 CEST	2121	50891	39.79.119.188	192.168.2.16
May 6, 2024 04:57:05.152271986 CEST	51110	21	192.168.2.16	112.248.45.74
May 6, 2024 04:57:05.168016911 CEST	51081	2121	192.168.2.16	189.39.2.210
May 6, 2024 04:57:05.176006079 CEST	51080	21	192.168.2.16	189.39.2.210
May 6, 2024 04:57:05.176857948 CEST	2121	51045	123.175.103.149	192.168.2.16
May 6, 2024 04:57:05.179922104 CEST	21	51103	34.128.145.40	192.168.2.16
May 6, 2024 04:57:05.179990053 CEST	51103	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:05.180042982 CEST	51103	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:05.180187941 CEST	51111	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:05.181181908 CEST	2121	51104	34.128.145.40	192.168.2.16
May 6, 2024 04:57:05.181229115 CEST	51104	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:05.181289911 CEST	51104	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:05.181453943 CEST	51112	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:05.183993101 CEST	51082	21	192.168.2.16	179.26.2.92
May 6, 2024 04:57:05.192977905 CEST	21	51102	83.239.172.170	192.168.2.16
May 6, 2024 04:57:05.196522951 CEST	2121	51016	115.84.102.17	192.168.2.16
May 6, 2024 04:57:05.203068972 CEST	21	51017	115.84.102.17	192.168.2.16
May 6, 2024 04:57:05.216336012 CEST	51113	2121	192.168.2.16	112.248.45.74
May 6, 2024 04:57:05.221175909 CEST	21	51079	103.109.6.215	192.168.2.16
May 6, 2024 04:57:05.221314907 CEST	51079	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:05.232136011 CEST	21	50941	118.52.94.214	192.168.2.16
May 6, 2024 04:57:05.235999107 CEST	51083	2121	192.168.2.16	179.26.2.92
May 6, 2024 04:57:05.246898890 CEST	2121	51105	83.239.172.170	192.168.2.16
May 6, 2024 04:57:05.246994019 CEST	50972	2121	192.168.2.16	175.126.36.37
May 6, 2024 04:57:05.247016907 CEST	51030	21	192.168.2.16	5.230.77.248
May 6, 2024 04:57:05.247020960 CEST	51001	2121	192.168.2.16	87.106.26.129
May 6, 2024 04:57:05.247029066 CEST	51031	2121	192.168.2.16	5.230.77.248
May 6, 2024 04:57:05.247030973 CEST	50971	21	192.168.2.16	175.126.36.37
May 6, 2024 04:57:05.247349024 CEST	51114	21	192.168.2.16	70.170.86.10
May 6, 2024 04:57:05.254780054 CEST	2121	51109	216.193.134.44	192.168.2.16
May 6, 2024 04:57:05.261991978 CEST	51007	2121	192.168.2.16	83.167.171.106
May 6, 2024 04:57:05.265260935 CEST	21	51108	216.193.134.44	192.168.2.16
May 6, 2024 04:57:05.272139072 CEST	21	51100	123.162.147.215	192.168.2.16
May 6, 2024 04:57:05.273552895 CEST	2121	51101	123.162.147.215	192.168.2.16
May 6, 2024 04:57:05.275939941 CEST	21	50944	118.49.123.89	192.168.2.16
May 6, 2024 04:57:05.278233051 CEST	51115	2121	192.168.2.16	70.170.86.10
May 6, 2024 04:57:05.283622980 CEST	21	51000	201.203.223.53	192.168.2.16
May 6, 2024 04:57:05.285509109 CEST	2121	51002	201.203.223.53	192.168.2.16
May 6, 2024 04:57:05.290352106 CEST	21	51103	34.128.145.40	192.168.2.16
May 6, 2024 04:57:05.290364981 CEST	2121	50989	136.38.108.12	192.168.2.16
May 6, 2024 04:57:05.290376902 CEST	21	51111	34.128.145.40	192.168.2.16
May 6, 2024 04:57:05.290451050 CEST	51111	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:05.290813923 CEST	2121	51104	34.128.145.40	192.168.2.16
May 6, 2024 04:57:05.291332960 CEST	2121	51112	34.128.145.40	192.168.2.16
May 6, 2024 04:57:05.291388035 CEST	51112	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:05.293993950 CEST	50974	2121	192.168.2.16	113.4.85.37
May 6, 2024 04:57:05.293998957 CEST	51084	21	192.168.2.16	67.246.152.7
May 6, 2024 04:57:05.294379950 CEST	50973	21	192.168.2.16	113.4.85.37
May 6, 2024 04:57:05.294384003 CEST	51116	21	192.168.2.16	141.78.134.185
May 6, 2024 04:57:05.294564962 CEST	51117	2121	192.168.2.16	141.78.134.185
May 6, 2024 04:57:05.302988052 CEST	2121	50946	118.49.123.89	192.168.2.16
May 6, 2024 04:57:05.308505058 CEST	2121	50943	118.52.94.214	192.168.2.16
May 6, 2024 04:57:05.310010910 CEST	51085	2121	192.168.2.16	67.246.152.7
May 6, 2024 04:57:05.310010910 CEST	51050	21	192.168.2.16	177.222.250.182
May 6, 2024 04:57:05.310194969 CEST	51118	21	192.168.2.16	62.154.222.27
May 6, 2024 04:57:05.310197115 CEST	51051	2121	192.168.2.16	177.222.250.182
May 6, 2024 04:57:05.325990915 CEST	51005	21	192.168.2.16	83.167.171.106
May 6, 2024 04:57:05.326541901 CEST	51119	2121	192.168.2.16	62.154.222.27
May 6, 2024 04:57:05.326554060 CEST	51120	21	192.168.2.16	37.151.116.29
May 6, 2024 04:57:05.326653004 CEST	51121	21	192.168.2.16	167.58.12.150
May 6, 2024 04:57:05.326683044 CEST	51122	2121	192.168.2.16	37.151.116.29
May 6, 2024 04:57:05.342148066 CEST	51089	2121	192.168.2.16	117.93.14.87
May 6, 2024 04:57:05.342149973 CEST	51006	21	192.168.2.16	83.233.98.133
May 6, 2024 04:57:05.358005047 CEST	50977	21	192.168.2.16	35.137.130.185
May 6, 2024 04:57:05.358005047 CEST	51088	21	192.168.2.16	117.93.14.87
May 6, 2024 04:57:05.363987923 CEST	51008	2121	192.168.2.16	83.233.98.133
May 6, 2024 04:57:05.400628090 CEST	21	51111	34.128.145.40	192.168.2.16
May 6, 2024 04:57:05.400695086 CEST	51111	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:05.400744915 CEST	51111	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:05.400903940 CEST	51123	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:05.401056051 CEST	2121	51112	34.128.145.40	192.168.2.16
May 6, 2024 04:57:05.401106119 CEST	51112	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:05.401186943 CEST	51112	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:05.401380062 CEST	51124	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:05.421996117 CEST	51093	2121	192.168.2.16	154.197.86.15
May 6, 2024 04:57:05.421997070 CEST	51092	21	192.168.2.16	154.197.86.15
May 6, 2024 04:57:05.425147057 CEST	50978	21	192.168.2.16	216.117.162.236
May 6, 2024 04:57:05.453998089 CEST	51040	21	192.168.2.16	31.180.139.145
May 6, 2024 04:57:05.453998089 CEST	50982	21	192.168.2.16	136.38.108.12
May 6, 2024 04:57:05.457590103 CEST	2121	50921	183.93.194.84	192.168.2.16
May 6, 2024 04:57:05.469912052 CEST	21	51030	5.230.77.248	192.168.2.16
May 6, 2024 04:57:05.469952106 CEST	2121	51031	5.230.77.248	192.168.2.16
May 6, 2024 04:57:05.470248938 CEST	51125	2121	192.168.2.16	167.58.12.150
May 6, 2024 04:57:05.475162029 CEST	2121	51001	87.106.26.129	192.168.2.16
May 6, 2024 04:57:05.486354113 CEST	51126	21	192.168.2.16	94.174.23.203
May 6, 2024 04:57:05.496357918 CEST	2121	51007	83.167.171.106	192.168.2.16
May 6, 2024 04:57:05.502007961 CEST	51035	2121	192.168.2.16	220.79.57.162
May 6, 2024 04:57:05.502234936 CEST	51127	2121	192.168.2.16	94.174.23.203
May 6, 2024 04:57:05.509980917 CEST	21	51111	34.128.145.40	192.168.2.16
May 6, 2024 04:57:05.510411978 CEST	21	51123	34.128.145.40	192.168.2.16
May 6, 2024 04:57:05.510481119 CEST	51123	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:05.510564089 CEST	2121	51124	34.128.145.40	192.168.2.16
May 6, 2024 04:57:05.510617018 CEST	51124	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:05.511254072 CEST	2121	51112	34.128.145.40	192.168.2.16
May 6, 2024 04:57:05.518022060 CEST	51033	21	192.168.2.16	220.79.57.162
May 6, 2024 04:57:05.518321037 CEST	51128	21	192.168.2.16	61.137.243.218
May 6, 2024 04:57:05.542310953 CEST	2121	51051	177.222.250.182	192.168.2.16
May 6, 2024 04:57:05.542556047 CEST	21	51050	177.222.250.182	192.168.2.16
May 6, 2024 04:57:05.566034079 CEST	51094	21	192.168.2.16	114.207.216.96
May 6, 2024 04:57:05.566036940 CEST	50945	2121	192.168.2.16	124.75.148.85
May 6, 2024 04:57:05.573810101 CEST	21	51005	83.167.171.106	192.168.2.16
May 6, 2024 04:57:05.581156969 CEST	21	51079	103.109.6.215	192.168.2.16
May 6, 2024 04:57:05.581306934 CEST	51079	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:05.581492901 CEST	51129	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:05.612880945 CEST	21	51006	83.233.98.133	192.168.2.16
May 6, 2024 04:57:05.621351957 CEST	2121	51124	34.128.145.40	192.168.2.16
May 6, 2024 04:57:05.621408939 CEST	51124	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:05.621478081 CEST	21	51123	34.128.145.40	192.168.2.16
May 6, 2024 04:57:05.621499062 CEST	51124	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:05.621529102 CEST	51123	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:05.621651888 CEST	51123	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:05.621778965 CEST	51130	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:05.621786118 CEST	51131	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:05.626997948 CEST	2121	51008	83.233.98.133	192.168.2.16
May 6, 2024 04:57:05.639309883 CEST	21	50982	136.38.108.12	192.168.2.16
May 6, 2024 04:57:05.662358999 CEST	51132	2121	192.168.2.16	61.137.243.218
May 6, 2024 04:57:05.662446976 CEST	51133	21	192.168.2.16	85.23.25.24
May 6, 2024 04:57:05.677088022 CEST	51045	2121	192.168.2.16	123.175.103.149
May 6, 2024 04:57:05.677226067 CEST	51134	2121	192.168.2.16	85.23.25.24
May 6, 2024 04:57:05.678215981 CEST	2121	51089	117.93.14.87	192.168.2.16
May 6, 2024 04:57:05.681984901 CEST	50981	2121	192.168.2.16	35.137.130.185
May 6, 2024 04:57:05.706984997 CEST	51102	21	192.168.2.16	83.239.172.170
May 6, 2024 04:57:05.707037926 CEST	51016	2121	192.168.2.16	115.84.102.17
May 6, 2024 04:57:05.709003925 CEST	51017	21	192.168.2.16	115.84.102.17
May 6, 2024 04:57:05.730637074 CEST	2121	51124	34.128.145.40	192.168.2.16
May 6, 2024 04:57:05.731311083 CEST	2121	51130	34.128.145.40	192.168.2.16
May 6, 2024 04:57:05.731379032 CEST	51130	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:05.731411934 CEST	21	51131	34.128.145.40	192.168.2.16
May 6, 2024 04:57:05.731467009 CEST	51131	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:05.732063055 CEST	21	51123	34.128.145.40	192.168.2.16
May 6, 2024 04:57:05.736866951 CEST	21	51040	31.180.139.145	192.168.2.16
May 6, 2024 04:57:05.740329027 CEST	51135	21	192.168.2.16	14.175.222.24
May 6, 2024 04:57:05.756014109 CEST	51105	2121	192.168.2.16	83.239.172.170
May 6, 2024 04:57:05.756088972 CEST	51109	2121	192.168.2.16	216.193.134.44
May 6, 2024 04:57:05.756285906 CEST	51136	2121	192.168.2.16	14.175.222.24
May 6, 2024 04:57:05.771997929 CEST	51097	2121	192.168.2.16	114.207.216.96
May 6, 2024 04:57:05.772007942 CEST	51108	21	192.168.2.16	216.193.134.44
May 6, 2024 04:57:05.787000895 CEST	51101	2121	192.168.2.16	123.162.147.215
May 6, 2024 04:57:05.787013054 CEST	51000	21	192.168.2.16	201.203.223.53
May 6, 2024 04:57:05.787014008 CEST	51002	2121	192.168.2.16	201.203.223.53
May 6, 2024 04:57:05.787014008 CEST	51100	21	192.168.2.16	123.162.147.215
May 6, 2024 04:57:05.799392939 CEST	2121	51093	154.197.86.15	192.168.2.16
May 6, 2024 04:57:05.799407005 CEST	21	51092	154.197.86.15	192.168.2.16
May 6, 2024 04:57:05.801999092 CEST	50989	2121	192.168.2.16	136.38.108.12
May 6, 2024 04:57:05.803816080 CEST	2121	51035	220.79.57.162	192.168.2.16
May 6, 2024 04:57:05.805994987 CEST	51098	21	192.168.2.16	220.235.242.246
May 6, 2024 04:57:05.818542957 CEST	51137	21	192.168.2.16	76.137.75.49
May 6, 2024 04:57:05.818664074 CEST	51138	2121	192.168.2.16	76.137.75.49
May 6, 2024 04:57:05.827543974 CEST	21	51033	220.79.57.162	192.168.2.16
May 6, 2024 04:57:05.841000080 CEST	2121	51130	34.128.145.40	192.168.2.16
May 6, 2024 04:57:05.841144085 CEST	21	51131	34.128.145.40	192.168.2.16
May 6, 2024 04:57:05.841170073 CEST	51130	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:05.841171026 CEST	51130	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:05.841193914 CEST	51131	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:05.841252089 CEST	51131	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:05.841408968 CEST	51139	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:05.842570066 CEST	51140	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:05.897118092 CEST	51099	2121	192.168.2.16	220.235.242.246
May 6, 2024 04:57:05.916277885 CEST	2121	51109	216.193.134.44	192.168.2.16
May 6, 2024 04:57:05.938051939 CEST	21	51129	103.109.6.215	192.168.2.16
May 6, 2024 04:57:05.938124895 CEST	51129	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:05.940524101 CEST	21	51079	103.109.6.215	192.168.2.16
May 6, 2024 04:57:05.940711975 CEST	21	51079	103.109.6.215	192.168.2.16
May 6, 2024 04:57:05.940773964 CEST	51079	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:05.944907904 CEST	21	51108	216.193.134.44	192.168.2.16
May 6, 2024 04:57:05.950897932 CEST	2121	51130	34.128.145.40	192.168.2.16
May 6, 2024 04:57:05.950912952 CEST	2121	51139	34.128.145.40	192.168.2.16
May 6, 2024 04:57:05.950995922 CEST	51139	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:05.951267958 CEST	21	51131	34.128.145.40	192.168.2.16
May 6, 2024 04:57:05.953021049 CEST	21	51140	34.128.145.40	192.168.2.16
May 6, 2024 04:57:05.953083038 CEST	51140	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:05.961628914 CEST	51141	21	192.168.2.16	193.124.183.222
May 6, 2024 04:57:05.961638927 CEST	51142	21	192.168.2.16	188.214.156.147
May 6, 2024 04:57:05.966417074 CEST	21	51000	201.203.223.53	192.168.2.16
May 6, 2024 04:57:05.968287945 CEST	2121	51002	201.203.223.53	192.168.2.16
May 6, 2024 04:57:05.970659018 CEST	21	51102	83.239.172.170	192.168.2.16
May 6, 2024 04:57:05.976011992 CEST	51030	21	192.168.2.16	5.230.77.248
May 6, 2024 04:57:05.976011992 CEST	51031	2121	192.168.2.16	5.230.77.248
May 6, 2024 04:57:05.976013899 CEST	51001	2121	192.168.2.16	87.106.26.129
May 6, 2024 04:57:05.987441063 CEST	2121	50989	136.38.108.12	192.168.2.16
May 6, 2024 04:57:05.991532087 CEST	51143	21	192.168.2.16	168.220.94.137
May 6, 2024 04:57:05.991560936 CEST	51144	2121	192.168.2.16	168.220.94.137
May 6, 2024 04:57:06.007010937 CEST	51007	2121	192.168.2.16	83.167.171.106
May 6, 2024 04:57:06.007256031 CEST	51145	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:06.025440931 CEST	2121	51105	83.239.172.170	192.168.2.16
May 6, 2024 04:57:06.035801888 CEST	2121	51045	123.175.103.149	192.168.2.16
May 6, 2024 04:57:06.038997889 CEST	50990	21	192.168.2.16	97.87.237.82
May 6, 2024 04:57:06.038997889 CEST	50996	21	192.168.2.16	24.117.48.30
May 6, 2024 04:57:06.039005041 CEST	50994	21	192.168.2.16	219.77.222.201
May 6, 2024 04:57:06.039009094 CEST	50993	2121	192.168.2.16	187.205.163.244
May 6, 2024 04:57:06.039010048 CEST	50995	2121	192.168.2.16	219.77.222.201
May 6, 2024 04:57:06.039478064 CEST	50991	2121	192.168.2.16	97.87.237.82
May 6, 2024 04:57:06.039478064 CEST	51146	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:06.039478064 CEST	50997	2121	192.168.2.16	24.117.48.30
May 6, 2024 04:57:06.039480925 CEST	50992	21	192.168.2.16	187.205.163.244
May 6, 2024 04:57:06.054999113 CEST	51004	2121	192.168.2.16	82.20.33.242
May 6, 2024 04:57:06.055000067 CEST	51106	21	192.168.2.16	114.104.136.65
May 6, 2024 04:57:06.054999113 CEST	51051	2121	192.168.2.16	177.222.250.182
May 6, 2024 04:57:06.055017948 CEST	51010	2121	192.168.2.16	47.148.251.104
May 6, 2024 04:57:06.055017948 CEST	51003	21	192.168.2.16	82.20.33.242
May 6, 2024 04:57:06.055022955 CEST	51013	21	192.168.2.16	88.135.167.244
May 6, 2024 04:57:06.055025101 CEST	51009	21	192.168.2.16	47.148.251.104
May 6, 2024 04:57:06.055025101 CEST	51011	21	192.168.2.16	89.14.103.144
May 6, 2024 04:57:06.055025101 CEST	51050	21	192.168.2.16	177.222.250.182
May 6, 2024 04:57:06.055025101 CEST	51018	21	192.168.2.16	153.33.171.16
May 6, 2024 04:57:06.055026054 CEST	51015	21	192.168.2.16	108.141.10.130
May 6, 2024 04:57:06.055026054 CEST	51012	2121	192.168.2.16	89.14.103.144
May 6, 2024 04:57:06.055027962 CEST	51019	21	192.168.2.16	73.53.25.65
May 6, 2024 04:57:06.055166960 CEST	51022	21	192.168.2.16	166.239.139.201
May 6, 2024 04:57:06.055167913 CEST	51020	2121	192.168.2.16	73.53.25.65
May 6, 2024 04:57:06.055169106 CEST	51021	2121	192.168.2.16	153.33.171.16
May 6, 2024 04:57:06.055170059 CEST	51014	2121	192.168.2.16	187.224.222.88
May 6, 2024 04:57:06.055171013 CEST	51026	2121	192.168.2.16	88.135.167.244
May 6, 2024 04:57:06.055171013 CEST	51024	21	192.168.2.16	187.224.222.88
May 6, 2024 04:57:06.055172920 CEST	50999	2121	192.168.2.16	23.13.208.6
May 6, 2024 04:57:06.055172920 CEST	51025	2121	192.168.2.16	108.141.10.130
May 6, 2024 04:57:06.055172920 CEST	51023	21	192.168.2.16	23.13.208.6
May 6, 2024 04:57:06.055216074 CEST	51147	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:06.060883999 CEST	2121	51139	34.128.145.40	192.168.2.16
May 6, 2024 04:57:06.060940981 CEST	51139	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:06.061017990 CEST	51139	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:06.061170101 CEST	51148	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:06.063666105 CEST	21	51140	34.128.145.40	192.168.2.16
May 6, 2024 04:57:06.063719034 CEST	51140	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:06.063771963 CEST	51140	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:06.063905954 CEST	51149	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:06.071000099 CEST	51028	2121	192.168.2.16	71.92.75.150
May 6, 2024 04:57:06.071026087 CEST	51029	21	192.168.2.16	71.92.75.150
May 6, 2024 04:57:06.071038961 CEST	51027	2121	192.168.2.16	166.239.139.201
May 6, 2024 04:57:06.084043026 CEST	2121	51016	115.84.102.17	192.168.2.16
May 6, 2024 04:57:06.086997032 CEST	51005	21	192.168.2.16	83.167.171.106
May 6, 2024 04:57:06.086997032 CEST	51032	21	192.168.2.16	119.49.105.48
May 6, 2024 04:57:06.086997032 CEST	51038	2121	192.168.2.16	206.255.93.126
May 6, 2024 04:57:06.087018013 CEST	51034	2121	192.168.2.16	119.49.105.48
May 6, 2024 04:57:06.087018967 CEST	51039	2121	192.168.2.16	213.118.155.25
May 6, 2024 04:57:06.087018967 CEST	51044	21	192.168.2.16	123.175.103.149
May 6, 2024 04:57:06.087021112 CEST	51042	2121	192.168.2.16	86.24.158.131
May 6, 2024 04:57:06.087023020 CEST	51037	21	192.168.2.16	213.118.155.25
May 6, 2024 04:57:06.087023020 CEST	51036	21	192.168.2.16	206.255.93.126
May 6, 2024 04:57:06.087023020 CEST	51043	21	192.168.2.16	86.24.158.131
May 6, 2024 04:57:06.087050915 CEST	51041	2121	192.168.2.16	31.180.139.145
May 6, 2024 04:57:06.092799902 CEST	21	51017	115.84.102.17	192.168.2.16
May 6, 2024 04:57:06.100691080 CEST	2121	51144	168.220.94.137	192.168.2.16
May 6, 2024 04:57:06.100709915 CEST	21	51143	168.220.94.137	192.168.2.16
May 6, 2024 04:57:06.100744009 CEST	51144	2121	192.168.2.16	168.220.94.137
May 6, 2024 04:57:06.100781918 CEST	51143	21	192.168.2.16	168.220.94.137
May 6, 2024 04:57:06.102994919 CEST	51107	2121	192.168.2.16	114.104.136.65
May 6, 2024 04:57:06.102994919 CEST	51049	2121	192.168.2.16	51.105.22.66
May 6, 2024 04:57:06.102998018 CEST	51046	21	192.168.2.16	40.86.3.227
May 6, 2024 04:57:06.102998018 CEST	51048	2121	192.168.2.16	40.86.3.227
May 6, 2024 04:57:06.103008986 CEST	51047	21	192.168.2.16	51.105.22.66
May 6, 2024 04:57:06.103012085 CEST	51053	21	192.168.2.16	184.25.59.17
May 6, 2024 04:57:06.103013992 CEST	51052	2121	192.168.2.16	184.25.59.17
May 6, 2024 04:57:06.103013992 CEST	51054	21	192.168.2.16	76.127.9.130
May 6, 2024 04:57:06.118992090 CEST	51006	21	192.168.2.16	83.233.98.133
May 6, 2024 04:57:06.119287014 CEST	51150	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:06.134989977 CEST	51008	2121	192.168.2.16	83.233.98.133
May 6, 2024 04:57:06.139136076 CEST	21	51135	14.175.222.24	192.168.2.16
May 6, 2024 04:57:06.150726080 CEST	2121	51136	14.175.222.24	192.168.2.16
May 6, 2024 04:57:06.166995049 CEST	51055	2121	192.168.2.16	76.127.9.130
May 6, 2024 04:57:06.166999102 CEST	51110	21	192.168.2.16	112.248.45.74
May 6, 2024 04:57:06.167016029 CEST	51056	21	192.168.2.16	186.29.164.212
May 6, 2024 04:57:06.167197943 CEST	51151	21	192.168.2.16	69.254.36.116
May 6, 2024 04:57:06.170274019 CEST	2121	51148	34.128.145.40	192.168.2.16
May 6, 2024 04:57:06.170341015 CEST	51148	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:06.170501947 CEST	2121	51139	34.128.145.40	192.168.2.16
May 6, 2024 04:57:06.173449039 CEST	21	51149	34.128.145.40	192.168.2.16
May 6, 2024 04:57:06.173510075 CEST	51149	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:06.174225092 CEST	21	51140	34.128.145.40	192.168.2.16
May 6, 2024 04:57:06.178539038 CEST	21	51100	123.162.147.215	192.168.2.16
May 6, 2024 04:57:06.181521893 CEST	2121	51101	123.162.147.215	192.168.2.16
May 6, 2024 04:57:06.183010101 CEST	51089	2121	192.168.2.16	117.93.14.87
May 6, 2024 04:57:06.198823929 CEST	21	51030	5.230.77.248	192.168.2.16
May 6, 2024 04:57:06.198864937 CEST	2121	51031	5.230.77.248	192.168.2.16
May 6, 2024 04:57:06.199242115 CEST	51152	2121	192.168.2.16	69.254.36.116
May 6, 2024 04:57:06.204073906 CEST	2121	51001	87.106.26.129	192.168.2.16
May 6, 2024 04:57:06.204423904 CEST	51153	21	192.168.2.16	98.247.226.140
May 6, 2024 04:57:06.210237980 CEST	21	51142	188.214.156.147	192.168.2.16
May 6, 2024 04:57:06.210302114 CEST	51142	21	192.168.2.16	188.214.156.147
May 6, 2024 04:57:06.210637093 CEST	51154	2121	192.168.2.16	98.247.226.140
May 6, 2024 04:57:06.215317011 CEST	51155	21	192.168.2.16	116.36.57.71
May 6, 2024 04:57:06.230027914 CEST	51113	2121	192.168.2.16	112.248.45.74
May 6, 2024 04:57:06.230329037 CEST	51156	2121	192.168.2.16	116.36.57.71
May 6, 2024 04:57:06.235825062 CEST	21	51141	193.124.183.222	192.168.2.16
May 6, 2024 04:57:06.235886097 CEST	51141	21	192.168.2.16	193.124.183.222
May 6, 2024 04:57:06.241389990 CEST	2121	51007	83.167.171.106	192.168.2.16
May 6, 2024 04:57:06.241739035 CEST	51157	21	192.168.2.16	34.136.121.14
May 6, 2024 04:57:06.246002913 CEST	51040	21	192.168.2.16	31.180.139.145
May 6, 2024 04:57:06.246592045 CEST	51158	21	192.168.2.16	91.11.138.10
May 6, 2024 04:57:06.246654987 CEST	51159	2121	192.168.2.16	34.136.121.14
May 6, 2024 04:57:06.246680021 CEST	51160	2121	192.168.2.16	91.11.138.10
May 6, 2024 04:57:06.246740103 CEST	51161	21	192.168.2.16	94.43.212.205
May 6, 2024 04:57:06.262022972 CEST	51114	21	192.168.2.16	70.170.86.10
May 6, 2024 04:57:06.262331009 CEST	51162	2121	192.168.2.16	94.43.212.205
May 6, 2024 04:57:06.274727106 CEST	21	51145	149.154.65.23	192.168.2.16
May 6, 2024 04:57:06.274791956 CEST	51145	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:06.278024912 CEST	51115	2121	192.168.2.16	70.170.86.10
May 6, 2024 04:57:06.278637886 CEST	51163	21	192.168.2.16	217.153.42.210
May 6, 2024 04:57:06.279572010 CEST	2121	51148	34.128.145.40	192.168.2.16
May 6, 2024 04:57:06.279628038 CEST	51148	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:06.279683113 CEST	51148	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:06.279813051 CEST	51164	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:06.283210993 CEST	21	51149	34.128.145.40	192.168.2.16
May 6, 2024 04:57:06.283262968 CEST	51149	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:06.283318043 CEST	51149	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:06.283479929 CEST	51165	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:06.287306070 CEST	2121	51051	177.222.250.182	192.168.2.16
May 6, 2024 04:57:06.287728071 CEST	21	51050	177.222.250.182	192.168.2.16
May 6, 2024 04:57:06.294015884 CEST	51116	21	192.168.2.16	141.78.134.185
May 6, 2024 04:57:06.294842958 CEST	21	51129	103.109.6.215	192.168.2.16
May 6, 2024 04:57:06.294959068 CEST	51129	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:06.300993919 CEST	51117	2121	192.168.2.16	141.78.134.185
May 6, 2024 04:57:06.309998035 CEST	51092	21	192.168.2.16	154.197.86.15
May 6, 2024 04:57:06.309999943 CEST	51035	2121	192.168.2.16	220.79.57.162
May 6, 2024 04:57:06.310023069 CEST	51093	2121	192.168.2.16	154.197.86.15
May 6, 2024 04:57:06.310022116 CEST	51118	21	192.168.2.16	62.154.222.27
May 6, 2024 04:57:06.310445070 CEST	51166	2121	192.168.2.16	217.153.42.210
May 6, 2024 04:57:06.310516119 CEST	51167	21	192.168.2.16	212.114.3.239
May 6, 2024 04:57:06.310610056 CEST	51168	2121	192.168.2.16	212.114.3.239
May 6, 2024 04:57:06.320888996 CEST	21	51147	81.88.252.91	192.168.2.16
May 6, 2024 04:57:06.320956945 CEST	51147	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:06.327586889 CEST	51119	2121	192.168.2.16	62.154.222.27
May 6, 2024 04:57:06.338480949 CEST	21	51005	83.167.171.106	192.168.2.16
May 6, 2024 04:57:06.342000008 CEST	51121	21	192.168.2.16	167.58.12.150
May 6, 2024 04:57:06.342010975 CEST	51033	21	192.168.2.16	220.79.57.162
May 6, 2024 04:57:06.342012882 CEST	51122	2121	192.168.2.16	37.151.116.29
May 6, 2024 04:57:06.342015028 CEST	51120	21	192.168.2.16	37.151.116.29
May 6, 2024 04:57:06.344450951 CEST	21	51150	87.106.26.129	192.168.2.16
May 6, 2024 04:57:06.344504118 CEST	51150	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:06.358408928 CEST	51169	21	192.168.2.16	92.100.110.146
May 6, 2024 04:57:06.358411074 CEST	51170	2121	192.168.2.16	92.100.110.146
May 6, 2024 04:57:06.374609947 CEST	21	51146	154.210.32.21	192.168.2.16
May 6, 2024 04:57:06.374664068 CEST	51146	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:06.374685049 CEST	51171	21	192.168.2.16	190.75.173.166
May 6, 2024 04:57:06.374802113 CEST	51172	2121	192.168.2.16	190.75.173.166
May 6, 2024 04:57:06.374941111 CEST	51173	21	192.168.2.16	138.68.253.24
May 6, 2024 04:57:06.384609938 CEST	21	51006	83.233.98.133	192.168.2.16
May 6, 2024 04:57:06.389413118 CEST	2121	51164	34.128.145.40	192.168.2.16
May 6, 2024 04:57:06.389470100 CEST	51164	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:06.389638901 CEST	2121	51148	34.128.145.40	192.168.2.16
May 6, 2024 04:57:06.392860889 CEST	21	51149	34.128.145.40	192.168.2.16
May 6, 2024 04:57:06.393110991 CEST	21	51165	34.128.145.40	192.168.2.16
May 6, 2024 04:57:06.393183947 CEST	51165	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:06.397665977 CEST	2121	51008	83.233.98.133	192.168.2.16
May 6, 2024 04:57:06.406373024 CEST	51174	2121	192.168.2.16	138.68.253.24
May 6, 2024 04:57:06.406488895 CEST	51175	21	192.168.2.16	39.79.68.120
May 6, 2024 04:57:06.421997070 CEST	51109	2121	192.168.2.16	216.193.134.44
May 6, 2024 04:57:06.422252893 CEST	51176	2121	192.168.2.16	39.79.68.120
May 6, 2024 04:57:06.438169003 CEST	51177	21	192.168.2.16	110.251.67.124
May 6, 2024 04:57:06.454008102 CEST	51108	21	192.168.2.16	216.193.134.44
May 6, 2024 04:57:06.454178095 CEST	51178	2121	192.168.2.16	110.251.67.124
May 6, 2024 04:57:06.463232994 CEST	21	51142	188.214.156.147	192.168.2.16
May 6, 2024 04:57:06.463418007 CEST	51142	21	192.168.2.16	188.214.156.147
May 6, 2024 04:57:06.484993935 CEST	51102	21	192.168.2.16	83.239.172.170
May 6, 2024 04:57:06.485013962 CEST	51125	2121	192.168.2.16	167.58.12.150
May 6, 2024 04:57:06.485481024 CEST	51179	21	192.168.2.16	147.185.154.210
May 6, 2024 04:57:06.485588074 CEST	51180	2121	192.168.2.16	147.185.154.210
May 6, 2024 04:57:06.499300957 CEST	2121	51164	34.128.145.40	192.168.2.16
May 6, 2024 04:57:06.499353886 CEST	51164	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:06.499402046 CEST	51164	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:06.499543905 CEST	51181	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:06.499998093 CEST	51061	2121	192.168.2.16	186.29.164.212
May 6, 2024 04:57:06.500010014 CEST	51126	21	192.168.2.16	94.174.23.203
May 6, 2024 04:57:06.500205994 CEST	51182	21	192.168.2.16	172.247.137.215
May 6, 2024 04:57:06.500225067 CEST	51062	21	192.168.2.16	93.188.96.195
May 6, 2024 04:57:06.504407883 CEST	21	51165	34.128.145.40	192.168.2.16
May 6, 2024 04:57:06.504466057 CEST	51165	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:06.504515886 CEST	51165	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:06.504663944 CEST	51183	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:06.512362957 CEST	21	51141	193.124.183.222	192.168.2.16
May 6, 2024 04:57:06.512496948 CEST	51141	21	192.168.2.16	193.124.183.222
May 6, 2024 04:57:06.515991926 CEST	51127	2121	192.168.2.16	94.174.23.203
May 6, 2024 04:57:06.528836966 CEST	21	51040	31.180.139.145	192.168.2.16
May 6, 2024 04:57:06.531997919 CEST	51128	21	192.168.2.16	61.137.243.218
May 6, 2024 04:57:06.532020092 CEST	51105	2121	192.168.2.16	83.239.172.170
May 6, 2024 04:57:06.532021999 CEST	51063	2121	192.168.2.16	93.188.96.195
May 6, 2024 04:57:06.532280922 CEST	51184	2121	192.168.2.16	172.247.137.215
May 6, 2024 04:57:06.544811010 CEST	21	51145	149.154.65.23	192.168.2.16
May 6, 2024 04:57:06.545101881 CEST	51145	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:06.548166037 CEST	51045	2121	192.168.2.16	123.175.103.149
May 6, 2024 04:57:06.548481941 CEST	51185	21	192.168.2.16	112.228.87.214
May 6, 2024 04:57:06.556884050 CEST	2121	51162	94.43.212.205	192.168.2.16
May 6, 2024 04:57:06.564187050 CEST	51186	2121	192.168.2.16	112.228.87.214
May 6, 2024 04:57:06.569299936 CEST	2121	51166	217.153.42.210	192.168.2.16
May 6, 2024 04:57:06.575087070 CEST	2121	51172	190.75.173.166	192.168.2.16
May 6, 2024 04:57:06.580332041 CEST	51187	21	192.168.2.16	44.214.139.241
May 6, 2024 04:57:06.585971117 CEST	2121	51109	216.193.134.44	192.168.2.16
May 6, 2024 04:57:06.590188026 CEST	21	51147	81.88.252.91	192.168.2.16
May 6, 2024 04:57:06.590321064 CEST	51147	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:06.592472076 CEST	21	51150	87.106.26.129	192.168.2.16
May 6, 2024 04:57:06.592608929 CEST	51150	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:06.595997095 CEST	51016	2121	192.168.2.16	115.84.102.17
May 6, 2024 04:57:06.596030951 CEST	51017	21	192.168.2.16	115.84.102.17
May 6, 2024 04:57:06.596470118 CEST	51188	2121	192.168.2.16	44.214.139.241
May 6, 2024 04:57:06.596662998 CEST	51189	21	192.168.2.16	78.189.216.244
May 6, 2024 04:57:06.609038115 CEST	2121	51164	34.128.145.40	192.168.2.16
May 6, 2024 04:57:06.609900951 CEST	2121	51181	34.128.145.40	192.168.2.16
May 6, 2024 04:57:06.609960079 CEST	51181	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:06.610620975 CEST	2121	51035	220.79.57.162	192.168.2.16
May 6, 2024 04:57:06.612035990 CEST	51064	21	192.168.2.16	90.199.215.58
May 6, 2024 04:57:06.612451077 CEST	51190	21	192.168.2.16	73.19.158.94
May 6, 2024 04:57:06.612471104 CEST	51191	2121	192.168.2.16	78.189.216.244
May 6, 2024 04:57:06.612529039 CEST	51192	2121	192.168.2.16	73.19.158.94
May 6, 2024 04:57:06.614183903 CEST	21	51165	34.128.145.40	192.168.2.16
May 6, 2024 04:57:06.614341974 CEST	21	51183	34.128.145.40	192.168.2.16
May 6, 2024 04:57:06.614399910 CEST	51183	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:06.627321959 CEST	51193	21	192.168.2.16	68.10.23.248
May 6, 2024 04:57:06.627331972 CEST	51194	2121	192.168.2.16	68.10.23.248
May 6, 2024 04:57:06.638906002 CEST	21	51108	216.193.134.44	192.168.2.16
May 6, 2024 04:57:06.642990112 CEST	51135	21	192.168.2.16	14.175.222.24
May 6, 2024 04:57:06.643455982 CEST	51195	2121	192.168.2.16	78.48.173.211
May 6, 2024 04:57:06.643477917 CEST	51196	2121	192.168.2.16	103.148.249.3
May 6, 2024 04:57:06.643560886 CEST	51197	21	192.168.2.16	78.48.173.211
May 6, 2024 04:57:06.643603086 CEST	51198	21	192.168.2.16	103.148.249.3
May 6, 2024 04:57:06.649431944 CEST	21	51033	220.79.57.162	192.168.2.16
May 6, 2024 04:57:06.650542974 CEST	21	51129	103.109.6.215	192.168.2.16
May 6, 2024 04:57:06.650662899 CEST	51129	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:06.658993006 CEST	51136	2121	192.168.2.16	14.175.222.24
May 6, 2024 04:57:06.659410000 CEST	51199	21	192.168.2.16	142.39.230.26
May 6, 2024 04:57:06.659468889 CEST	51200	2121	192.168.2.16	142.39.230.26
May 6, 2024 04:57:06.659501076 CEST	51201	21	192.168.2.16	81.242.190.250
May 6, 2024 04:57:06.673994064 CEST	51133	21	192.168.2.16	85.23.25.24
May 6, 2024 04:57:06.674010038 CEST	51132	2121	192.168.2.16	61.137.243.218
May 6, 2024 04:57:06.674310923 CEST	51202	2121	192.168.2.16	81.242.190.250
May 6, 2024 04:57:06.674371004 CEST	51203	21	192.168.2.16	87.161.17.71
May 6, 2024 04:57:06.687403917 CEST	21	51092	154.197.86.15	192.168.2.16
May 6, 2024 04:57:06.688530922 CEST	2121	51093	154.197.86.15	192.168.2.16
May 6, 2024 04:57:06.689021111 CEST	51134	2121	192.168.2.16	85.23.25.24
May 6, 2024 04:57:06.689055920 CEST	51067	2121	192.168.2.16	90.199.215.58
May 6, 2024 04:57:06.689059019 CEST	51100	21	192.168.2.16	123.162.147.215
May 6, 2024 04:57:06.689146996 CEST	51101	2121	192.168.2.16	123.162.147.215
May 6, 2024 04:57:06.689388037 CEST	51204	2121	192.168.2.16	87.161.17.71
May 6, 2024 04:57:06.689421892 CEST	51205	21	192.168.2.16	91.68.87.212
May 6, 2024 04:57:06.689486027 CEST	51206	2121	192.168.2.16	91.68.87.212
May 6, 2024 04:57:06.711419106 CEST	21	51146	154.210.32.21	192.168.2.16
May 6, 2024 04:57:06.711580038 CEST	51146	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:06.712145090 CEST	21	51142	188.214.156.147	192.168.2.16
May 6, 2024 04:57:06.712240934 CEST	21	51142	188.214.156.147	192.168.2.16
May 6, 2024 04:57:06.712376118 CEST	51142	21	192.168.2.16	188.214.156.147
May 6, 2024 04:57:06.714364052 CEST	21	51187	44.214.139.241	192.168.2.16
May 6, 2024 04:57:06.720009089 CEST	51068	21	192.168.2.16	45.184.37.34
May 6, 2024 04:57:06.720216990 CEST	51207	21	192.168.2.16	211.58.118.61
May 6, 2024 04:57:06.721369028 CEST	2121	51181	34.128.145.40	192.168.2.16
May 6, 2024 04:57:06.721424103 CEST	51181	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:06.721484900 CEST	51181	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:06.721647024 CEST	51208	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:06.727904081 CEST	21	51183	34.128.145.40	192.168.2.16
May 6, 2024 04:57:06.727960110 CEST	51183	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:06.728003025 CEST	51183	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:06.728163958 CEST	51209	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:06.734675884 CEST	2121	51188	44.214.139.241	192.168.2.16
May 6, 2024 04:57:06.736275911 CEST	51210	2121	192.168.2.16	211.58.118.61
May 6, 2024 04:57:06.752023935 CEST	51069	2121	192.168.2.16	45.184.37.34
May 6, 2024 04:57:06.752326012 CEST	51211	21	192.168.2.16	120.29.254.249
May 6, 2024 04:57:06.752376080 CEST	21	51102	83.239.172.170	192.168.2.16
May 6, 2024 04:57:06.768373966 CEST	51212	2121	192.168.2.16	120.29.254.249
May 6, 2024 04:57:06.768434048 CEST	51213	21	192.168.2.16	154.37.158.121
May 6, 2024 04:57:06.783308983 CEST	51214	2121	192.168.2.16	154.37.158.121
May 6, 2024 04:57:06.791038036 CEST	21	51141	193.124.183.222	192.168.2.16
May 6, 2024 04:57:06.791143894 CEST	21	51141	193.124.183.222	192.168.2.16
May 6, 2024 04:57:06.791327953 CEST	51141	21	192.168.2.16	193.124.183.222
May 6, 2024 04:57:06.799288034 CEST	51215	21	192.168.2.16	212.125.22.162
May 6, 2024 04:57:06.805695057 CEST	2121	51105	83.239.172.170	192.168.2.16
May 6, 2024 04:57:06.816171885 CEST	21	51145	149.154.65.23	192.168.2.16
May 6, 2024 04:57:06.816195011 CEST	21	51145	149.154.65.23	192.168.2.16
May 6, 2024 04:57:06.816334009 CEST	51145	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:06.820605993 CEST	21	51150	87.106.26.129	192.168.2.16
May 6, 2024 04:57:06.820852995 CEST	21	51150	87.106.26.129	192.168.2.16
May 6, 2024 04:57:06.820991993 CEST	51150	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:06.830993891 CEST	51138	2121	192.168.2.16	76.137.75.49
May 6, 2024 04:57:06.831021070 CEST	51137	21	192.168.2.16	76.137.75.49
May 6, 2024 04:57:06.835063934 CEST	2121	51181	34.128.145.40	192.168.2.16
May 6, 2024 04:57:06.835336924 CEST	2121	51208	34.128.145.40	192.168.2.16
May 6, 2024 04:57:06.835393906 CEST	51208	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:06.841766119 CEST	21	51209	34.128.145.40	192.168.2.16
May 6, 2024 04:57:06.841815948 CEST	51209	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:06.842648029 CEST	21	51183	34.128.145.40	192.168.2.16
May 6, 2024 04:57:06.847313881 CEST	51216	2121	192.168.2.16	212.125.22.162
May 6, 2024 04:57:06.863296986 CEST	51217	21	192.168.2.16	193.35.147.121
May 6, 2024 04:57:06.864269018 CEST	21	51147	81.88.252.91	192.168.2.16
May 6, 2024 04:57:06.864383936 CEST	51147	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:06.879252911 CEST	51218	2121	192.168.2.16	193.35.147.121
May 6, 2024 04:57:06.895834923 CEST	51219	21	192.168.2.16	189.174.73.79
May 6, 2024 04:57:06.895961046 CEST	51221	2121	192.168.2.16	189.174.73.79
May 6, 2024 04:57:06.895977974 CEST	51220	21	192.168.2.16	187.224.253.249
May 6, 2024 04:57:06.906761885 CEST	2121	51045	123.175.103.149	192.168.2.16
May 6, 2024 04:57:06.927572966 CEST	51222	2121	192.168.2.16	187.224.253.249
May 6, 2024 04:57:06.943025112 CEST	51073	21	192.168.2.16	131.93.181.247
May 6, 2024 04:57:06.945410967 CEST	2121	51208	34.128.145.40	192.168.2.16
May 6, 2024 04:57:06.945467949 CEST	51208	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:06.945538044 CEST	51208	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:06.945723057 CEST	51223	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:06.951472044 CEST	21	51209	34.128.145.40	192.168.2.16
May 6, 2024 04:57:06.951531887 CEST	51209	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:06.951590061 CEST	51209	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:06.951771021 CEST	51224	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:06.961215019 CEST	21	51142	188.214.156.147	192.168.2.16
May 6, 2024 04:57:06.973933935 CEST	2121	51016	115.84.102.17	192.168.2.16
May 6, 2024 04:57:06.975400925 CEST	51225	21	192.168.2.16	2.137.219.108
May 6, 2024 04:57:06.975442886 CEST	51226	2121	192.168.2.16	2.137.219.108
May 6, 2024 04:57:06.979660034 CEST	21	51017	115.84.102.17	192.168.2.16
May 6, 2024 04:57:06.991420031 CEST	51227	21	192.168.2.16	73.228.123.129
May 6, 2024 04:57:06.991451979 CEST	51228	2121	192.168.2.16	73.228.123.129
May 6, 2024 04:57:06.998095989 CEST	21	51198	103.148.249.3	192.168.2.16
May 6, 2024 04:57:07.007397890 CEST	51229	2121	192.168.2.16	73.226.181.60
May 6, 2024 04:57:07.007508039 CEST	51230	21	192.168.2.16	73.226.181.60
May 6, 2024 04:57:07.007587910 CEST	51231	21	192.168.2.16	79.35.65.174
May 6, 2024 04:57:07.007782936 CEST	21	51129	103.109.6.215	192.168.2.16
May 6, 2024 04:57:07.007894993 CEST	51129	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:07.008018017 CEST	51232	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:07.022279978 CEST	51233	21	192.168.2.16	200.126.137.153
May 6, 2024 04:57:07.022396088 CEST	51234	2121	192.168.2.16	79.35.65.174
May 6, 2024 04:57:07.024709940 CEST	2121	51196	103.148.249.3	192.168.2.16
May 6, 2024 04:57:07.037997007 CEST	51074	2121	192.168.2.16	131.93.181.247
May 6, 2024 04:57:07.042834044 CEST	21	51135	14.175.222.24	192.168.2.16
May 6, 2024 04:57:07.045222044 CEST	21	51150	87.106.26.129	192.168.2.16
May 6, 2024 04:57:07.045358896 CEST	51150	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:07.045561075 CEST	51235	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:07.046653032 CEST	21	51146	154.210.32.21	192.168.2.16
May 6, 2024 04:57:07.046725035 CEST	21	51146	154.210.32.21	192.168.2.16
May 6, 2024 04:57:07.046844959 CEST	51146	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:07.050982952 CEST	2121	51136	14.175.222.24	192.168.2.16
May 6, 2024 04:57:07.054227114 CEST	51236	2121	192.168.2.16	200.126.137.153
May 6, 2024 04:57:07.055105925 CEST	2121	51208	34.128.145.40	192.168.2.16
May 6, 2024 04:57:07.056128979 CEST	2121	51223	34.128.145.40	192.168.2.16
May 6, 2024 04:57:07.056194067 CEST	51223	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:07.061275959 CEST	21	51209	34.128.145.40	192.168.2.16
May 6, 2024 04:57:07.061289072 CEST	21	51224	34.128.145.40	192.168.2.16
May 6, 2024 04:57:07.061356068 CEST	51224	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:07.070050001 CEST	51166	2121	192.168.2.16	217.153.42.210
May 6, 2024 04:57:07.070051908 CEST	51162	2121	192.168.2.16	94.43.212.205
May 6, 2024 04:57:07.070051908 CEST	51075	21	192.168.2.16	76.158.216.180
May 6, 2024 04:57:07.080662012 CEST	21	51100	123.162.147.215	192.168.2.16
May 6, 2024 04:57:07.083447933 CEST	2121	51101	123.162.147.215	192.168.2.16
May 6, 2024 04:57:07.083853960 CEST	21	51145	149.154.65.23	192.168.2.16
May 6, 2024 04:57:07.083986998 CEST	51145	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:07.084199905 CEST	51237	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:07.085997105 CEST	51076	2121	192.168.2.16	76.158.216.180
May 6, 2024 04:57:07.086014986 CEST	51172	2121	192.168.2.16	190.75.173.166
May 6, 2024 04:57:07.086015940 CEST	51109	2121	192.168.2.16	216.193.134.44
May 6, 2024 04:57:07.107507944 CEST	21	51141	193.124.183.222	192.168.2.16
May 6, 2024 04:57:07.150015116 CEST	51108	21	192.168.2.16	216.193.134.44
May 6, 2024 04:57:07.166774035 CEST	2121	51223	34.128.145.40	192.168.2.16
May 6, 2024 04:57:07.166831017 CEST	51223	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:07.166888952 CEST	51223	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:07.167059898 CEST	51238	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:07.170664072 CEST	21	51147	81.88.252.91	192.168.2.16
May 6, 2024 04:57:07.170675039 CEST	21	51147	81.88.252.91	192.168.2.16
May 6, 2024 04:57:07.170984030 CEST	51239	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:07.171212912 CEST	21	51224	34.128.145.40	192.168.2.16
May 6, 2024 04:57:07.171267033 CEST	51224	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:07.171324968 CEST	51224	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:07.171488047 CEST	51240	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:07.182013988 CEST	51081	2121	192.168.2.16	189.39.2.210
May 6, 2024 04:57:07.186000109 CEST	51151	21	192.168.2.16	69.254.36.116
May 6, 2024 04:57:07.189148903 CEST	51080	21	192.168.2.16	189.39.2.210
May 6, 2024 04:57:07.197999954 CEST	51093	2121	192.168.2.16	154.197.86.15
May 6, 2024 04:57:07.198000908 CEST	51082	21	192.168.2.16	179.26.2.92
May 6, 2024 04:57:07.198024988 CEST	51092	21	192.168.2.16	154.197.86.15
May 6, 2024 04:57:07.213992119 CEST	51152	2121	192.168.2.16	69.254.36.116
May 6, 2024 04:57:07.213994026 CEST	51153	21	192.168.2.16	98.247.226.140
May 6, 2024 04:57:07.214014053 CEST	51154	2121	192.168.2.16	98.247.226.140
May 6, 2024 04:57:07.230020046 CEST	51187	21	192.168.2.16	44.214.139.241
May 6, 2024 04:57:07.230499029 CEST	51241	2121	192.168.2.16	173.173.202.168
May 6, 2024 04:57:07.230943918 CEST	51242	21	192.168.2.16	173.173.202.168
May 6, 2024 04:57:07.231208086 CEST	51155	21	192.168.2.16	116.36.57.71
May 6, 2024 04:57:07.245026112 CEST	51188	2121	192.168.2.16	44.214.139.241
May 6, 2024 04:57:07.245026112 CEST	51156	2121	192.168.2.16	116.36.57.71
May 6, 2024 04:57:07.245028973 CEST	51083	2121	192.168.2.16	179.26.2.92
May 6, 2024 04:57:07.245259047 CEST	51157	21	192.168.2.16	34.136.121.14
May 6, 2024 04:57:07.245810986 CEST	2121	51109	216.193.134.44	192.168.2.16
May 6, 2024 04:57:07.248347998 CEST	21	51231	79.35.65.174	192.168.2.16
May 6, 2024 04:57:07.261007071 CEST	51160	2121	192.168.2.16	91.11.138.10
May 6, 2024 04:57:07.261020899 CEST	51102	21	192.168.2.16	83.239.172.170
May 6, 2024 04:57:07.261022091 CEST	51158	21	192.168.2.16	91.11.138.10
May 6, 2024 04:57:07.261029959 CEST	51161	21	192.168.2.16	94.43.212.205
May 6, 2024 04:57:07.261147976 CEST	51159	2121	192.168.2.16	34.136.121.14
May 6, 2024 04:57:07.266858101 CEST	21	51233	200.126.137.153	192.168.2.16
May 6, 2024 04:57:07.269592047 CEST	2121	51234	79.35.65.174	192.168.2.16
May 6, 2024 04:57:07.271255016 CEST	21	51150	87.106.26.129	192.168.2.16
May 6, 2024 04:57:07.271311998 CEST	51150	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:07.273545027 CEST	21	51235	87.106.26.129	192.168.2.16
May 6, 2024 04:57:07.273598909 CEST	51235	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:07.276526928 CEST	2121	51223	34.128.145.40	192.168.2.16
May 6, 2024 04:57:07.276711941 CEST	2121	51238	34.128.145.40	192.168.2.16
May 6, 2024 04:57:07.276766062 CEST	51238	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:07.277417898 CEST	51243	21	192.168.2.16	112.153.92.123
May 6, 2024 04:57:07.277514935 CEST	51244	2121	192.168.2.16	112.153.92.123
May 6, 2024 04:57:07.280916929 CEST	21	51224	34.128.145.40	192.168.2.16
May 6, 2024 04:57:07.281549931 CEST	21	51240	34.128.145.40	192.168.2.16
May 6, 2024 04:57:07.281610966 CEST	51240	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:07.286556005 CEST	2121	51172	190.75.173.166	192.168.2.16
May 6, 2024 04:57:07.291997910 CEST	51163	21	192.168.2.16	217.153.42.210
May 6, 2024 04:57:07.300988913 CEST	51084	21	192.168.2.16	67.246.152.7
May 6, 2024 04:57:07.308043957 CEST	51105	2121	192.168.2.16	83.239.172.170
May 6, 2024 04:57:07.313169956 CEST	2121	51236	200.126.137.153	192.168.2.16
May 6, 2024 04:57:07.323998928 CEST	51168	2121	192.168.2.16	212.114.3.239
May 6, 2024 04:57:07.323999882 CEST	51167	21	192.168.2.16	212.114.3.239
May 6, 2024 04:57:07.324023008 CEST	51085	2121	192.168.2.16	67.246.152.7
May 6, 2024 04:57:07.324877024 CEST	21	51108	216.193.134.44	192.168.2.16
May 6, 2024 04:57:07.328309059 CEST	2121	51166	217.153.42.210	192.168.2.16
May 6, 2024 04:57:07.340327024 CEST	51245	21	192.168.2.16	79.154.32.225
May 6, 2024 04:57:07.350996971 CEST	21	51145	149.154.65.23	192.168.2.16
May 6, 2024 04:57:07.351043940 CEST	51145	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:07.361114025 CEST	21	51237	149.154.65.23	192.168.2.16
May 6, 2024 04:57:07.361177921 CEST	51237	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:07.363389015 CEST	21	51129	103.109.6.215	192.168.2.16
May 6, 2024 04:57:07.363454103 CEST	21	51129	103.109.6.215	192.168.2.16
May 6, 2024 04:57:07.363497972 CEST	51129	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:07.363876104 CEST	2121	51162	94.43.212.205	192.168.2.16
May 6, 2024 04:57:07.363979101 CEST	21	51187	44.214.139.241	192.168.2.16
May 6, 2024 04:57:07.364027023 CEST	21	51232	103.109.6.215	192.168.2.16
May 6, 2024 04:57:07.364084959 CEST	51232	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:07.372003078 CEST	51169	21	192.168.2.16	92.100.110.146
May 6, 2024 04:57:07.372003078 CEST	51088	21	192.168.2.16	117.93.14.87
May 6, 2024 04:57:07.372005939 CEST	51170	2121	192.168.2.16	92.100.110.146
May 6, 2024 04:57:07.379267931 CEST	2121	51188	44.214.139.241	192.168.2.16
May 6, 2024 04:57:07.386521101 CEST	2121	51238	34.128.145.40	192.168.2.16
May 6, 2024 04:57:07.386569977 CEST	51238	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:07.386636972 CEST	51238	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:07.386804104 CEST	51246	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:07.388027906 CEST	51171	21	192.168.2.16	190.75.173.166
May 6, 2024 04:57:07.388087988 CEST	51173	21	192.168.2.16	138.68.253.24
May 6, 2024 04:57:07.389180899 CEST	21	51146	154.210.32.21	192.168.2.16
May 6, 2024 04:57:07.389307976 CEST	51146	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:07.389481068 CEST	51247	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:07.390053034 CEST	21	51146	154.210.32.21	192.168.2.16
May 6, 2024 04:57:07.390101910 CEST	51146	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:07.391664982 CEST	21	51240	34.128.145.40	192.168.2.16
May 6, 2024 04:57:07.391719103 CEST	51240	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:07.391752958 CEST	51240	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:07.391864061 CEST	51248	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:07.404294968 CEST	51249	21	192.168.2.16	216.117.162.236
May 6, 2024 04:57:07.407800913 CEST	21	51070	45.87.1.166	192.168.2.16
May 6, 2024 04:57:07.407910109 CEST	51070	21	192.168.2.16	45.87.1.166
May 6, 2024 04:57:07.408044100 CEST	51250	21	192.168.2.16	45.87.1.166
May 6, 2024 04:57:07.420001030 CEST	51174	2121	192.168.2.16	138.68.253.24
May 6, 2024 04:57:07.421143055 CEST	51175	21	192.168.2.16	39.79.68.120
May 6, 2024 04:57:07.436001062 CEST	51176	2121	192.168.2.16	39.79.68.120
May 6, 2024 04:57:07.436841965 CEST	21	51239	81.88.252.91	192.168.2.16
May 6, 2024 04:57:07.436909914 CEST	51239	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:07.456001043 CEST	51177	21	192.168.2.16	110.251.67.124
May 6, 2024 04:57:07.467999935 CEST	51178	2121	192.168.2.16	110.251.67.124
May 6, 2024 04:57:07.496418953 CEST	2121	51238	34.128.145.40	192.168.2.16
May 6, 2024 04:57:07.496591091 CEST	2121	51246	34.128.145.40	192.168.2.16
May 6, 2024 04:57:07.496651888 CEST	51246	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:07.499001026 CEST	51180	2121	192.168.2.16	147.185.154.210
May 6, 2024 04:57:07.499001026 CEST	51179	21	192.168.2.16	147.185.154.210
May 6, 2024 04:57:07.499088049 CEST	51198	21	192.168.2.16	103.148.249.3
May 6, 2024 04:57:07.501931906 CEST	21	51248	34.128.145.40	192.168.2.16
May 6, 2024 04:57:07.501996040 CEST	51248	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:07.515045881 CEST	51182	21	192.168.2.16	172.247.137.215
May 6, 2024 04:57:07.524964094 CEST	21	51102	83.239.172.170	192.168.2.16
May 6, 2024 04:57:07.525202990 CEST	21	51235	87.106.26.129	192.168.2.16
May 6, 2024 04:57:07.525382042 CEST	51235	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:07.531017065 CEST	51196	2121	192.168.2.16	103.148.249.3
May 6, 2024 04:57:07.547009945 CEST	51135	21	192.168.2.16	14.175.222.24
May 6, 2024 04:57:07.547010899 CEST	51184	2121	192.168.2.16	172.247.137.215
May 6, 2024 04:57:07.563124895 CEST	51136	2121	192.168.2.16	14.175.222.24
May 6, 2024 04:57:07.563126087 CEST	51185	21	192.168.2.16	112.228.87.214
May 6, 2024 04:57:07.575387955 CEST	2121	51093	154.197.86.15	192.168.2.16
May 6, 2024 04:57:07.575398922 CEST	21	51092	154.197.86.15	192.168.2.16
May 6, 2024 04:57:07.577486038 CEST	2121	51105	83.239.172.170	192.168.2.16
May 6, 2024 04:57:07.579004049 CEST	51186	2121	192.168.2.16	112.228.87.214
May 6, 2024 04:57:07.579005003 CEST	51094	21	192.168.2.16	114.207.216.96
May 6, 2024 04:57:07.595025063 CEST	51100	21	192.168.2.16	123.162.147.215
May 6, 2024 04:57:07.595990896 CEST	51101	2121	192.168.2.16	123.162.147.215
May 6, 2024 04:57:07.606343985 CEST	2121	51246	34.128.145.40	192.168.2.16
May 6, 2024 04:57:07.606405020 CEST	51246	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:07.606476068 CEST	51246	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:07.606723070 CEST	51251	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:07.610996962 CEST	51189	21	192.168.2.16	78.189.216.244
May 6, 2024 04:57:07.611912966 CEST	21	51248	34.128.145.40	192.168.2.16
May 6, 2024 04:57:07.611965895 CEST	51248	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:07.612047911 CEST	51248	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:07.612267971 CEST	51252	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:07.626997948 CEST	51192	2121	192.168.2.16	73.19.158.94
May 6, 2024 04:57:07.627001047 CEST	51191	2121	192.168.2.16	78.189.216.244
May 6, 2024 04:57:07.627015114 CEST	51194	2121	192.168.2.16	68.10.23.248
May 6, 2024 04:57:07.627015114 CEST	51190	21	192.168.2.16	73.19.158.94
May 6, 2024 04:57:07.627017975 CEST	51193	21	192.168.2.16	68.10.23.248
May 6, 2024 04:57:07.630783081 CEST	21	51070	45.87.1.166	192.168.2.16
May 6, 2024 04:57:07.630834103 CEST	51070	21	192.168.2.16	45.87.1.166
May 6, 2024 04:57:07.636856079 CEST	21	51250	45.87.1.166	192.168.2.16
May 6, 2024 04:57:07.636917114 CEST	51250	21	192.168.2.16	45.87.1.166
May 6, 2024 04:57:07.641516924 CEST	21	51237	149.154.65.23	192.168.2.16
May 6, 2024 04:57:07.641647100 CEST	51237	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:07.643016100 CEST	51195	2121	192.168.2.16	78.48.173.211
May 6, 2024 04:57:07.643136024 CEST	51197	21	192.168.2.16	78.48.173.211
May 6, 2024 04:57:07.659013987 CEST	51199	21	192.168.2.16	142.39.230.26
May 6, 2024 04:57:07.659290075 CEST	51201	21	192.168.2.16	81.242.190.250
May 6, 2024 04:57:07.659295082 CEST	51253	2121	192.168.2.16	79.154.32.225
May 6, 2024 04:57:07.661144018 CEST	51200	2121	192.168.2.16	142.39.230.26
May 6, 2024 04:57:07.675106049 CEST	51202	2121	192.168.2.16	81.242.190.250
May 6, 2024 04:57:07.675110102 CEST	51203	21	192.168.2.16	87.161.17.71
May 6, 2024 04:57:07.690993071 CEST	51206	2121	192.168.2.16	91.68.87.212
May 6, 2024 04:57:07.691008091 CEST	51204	2121	192.168.2.16	87.161.17.71
May 6, 2024 04:57:07.691011906 CEST	51205	21	192.168.2.16	91.68.87.212
May 6, 2024 04:57:07.705071926 CEST	21	51239	81.88.252.91	192.168.2.16
May 6, 2024 04:57:07.705224991 CEST	51239	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:07.716952085 CEST	2121	51246	34.128.145.40	192.168.2.16
May 6, 2024 04:57:07.717812061 CEST	2121	51251	34.128.145.40	192.168.2.16
May 6, 2024 04:57:07.717869043 CEST	51251	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:07.720323086 CEST	21	51232	103.109.6.215	192.168.2.16
May 6, 2024 04:57:07.720438004 CEST	51232	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:07.722826958 CEST	21	51252	34.128.145.40	192.168.2.16
May 6, 2024 04:57:07.722887039 CEST	51252	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:07.722891092 CEST	21	51248	34.128.145.40	192.168.2.16
May 6, 2024 04:57:07.723016024 CEST	51207	21	192.168.2.16	211.58.118.61
May 6, 2024 04:57:07.723016977 CEST	51240	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:07.724528074 CEST	21	51146	154.210.32.21	192.168.2.16
May 6, 2024 04:57:07.725768089 CEST	21	51247	154.210.32.21	192.168.2.16
May 6, 2024 04:57:07.725826979 CEST	51247	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:07.738023043 CEST	51210	2121	192.168.2.16	211.58.118.61
May 6, 2024 04:57:07.753114939 CEST	51211	21	192.168.2.16	120.29.254.249
May 6, 2024 04:57:07.753118992 CEST	51109	2121	192.168.2.16	216.193.134.44
May 6, 2024 04:57:07.753118038 CEST	51231	21	192.168.2.16	79.35.65.174
May 6, 2024 04:57:07.754899979 CEST	21	51235	87.106.26.129	192.168.2.16
May 6, 2024 04:57:07.755069017 CEST	21	51235	87.106.26.129	192.168.2.16
May 6, 2024 04:57:07.755228043 CEST	51235	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:07.768023968 CEST	51233	21	192.168.2.16	200.126.137.153
May 6, 2024 04:57:07.768029928 CEST	51212	2121	192.168.2.16	120.29.254.249
May 6, 2024 04:57:07.768049002 CEST	51213	21	192.168.2.16	154.37.158.121
May 6, 2024 04:57:07.784004927 CEST	51214	2121	192.168.2.16	154.37.158.121
May 6, 2024 04:57:07.784004927 CEST	51234	2121	192.168.2.16	79.35.65.174
May 6, 2024 04:57:07.784004927 CEST	51097	2121	192.168.2.16	114.207.216.96
May 6, 2024 04:57:07.800008059 CEST	51215	21	192.168.2.16	212.125.22.162
May 6, 2024 04:57:07.800024986 CEST	51172	2121	192.168.2.16	190.75.173.166
May 6, 2024 04:57:07.814999104 CEST	51098	21	192.168.2.16	220.235.242.246
May 6, 2024 04:57:07.815397024 CEST	51236	2121	192.168.2.16	200.126.137.153
May 6, 2024 04:57:07.827491999 CEST	2121	51251	34.128.145.40	192.168.2.16
May 6, 2024 04:57:07.827555895 CEST	51251	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:07.827713013 CEST	51251	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:07.827959061 CEST	51254	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:07.831017971 CEST	51166	2121	192.168.2.16	217.153.42.210
May 6, 2024 04:57:07.831127882 CEST	51108	21	192.168.2.16	216.193.134.44
May 6, 2024 04:57:07.832214117 CEST	21	51240	34.128.145.40	192.168.2.16
May 6, 2024 04:57:07.832477093 CEST	21	51252	34.128.145.40	192.168.2.16
May 6, 2024 04:57:07.832531929 CEST	51252	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:07.832592010 CEST	51252	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:07.832758904 CEST	51255	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:07.847011089 CEST	51216	2121	192.168.2.16	212.125.22.162
May 6, 2024 04:57:07.853511095 CEST	21	51198	103.148.249.3	192.168.2.16
May 6, 2024 04:57:07.870451927 CEST	21	51250	45.87.1.166	192.168.2.16
May 6, 2024 04:57:07.870588064 CEST	51250	21	192.168.2.16	45.87.1.166
May 6, 2024 04:57:07.878009081 CEST	51162	2121	192.168.2.16	94.43.212.205
May 6, 2024 04:57:07.878062963 CEST	51187	21	192.168.2.16	44.214.139.241
May 6, 2024 04:57:07.878144979 CEST	51217	21	192.168.2.16	193.35.147.121
May 6, 2024 04:57:07.893996954 CEST	51218	2121	192.168.2.16	193.35.147.121
May 6, 2024 04:57:07.897145987 CEST	51188	2121	192.168.2.16	44.214.139.241
May 6, 2024 04:57:07.903863907 CEST	2121	51109	216.193.134.44	192.168.2.16
May 6, 2024 04:57:07.910011053 CEST	51219	21	192.168.2.16	189.174.73.79
May 6, 2024 04:57:07.910021067 CEST	51221	2121	192.168.2.16	189.174.73.79
May 6, 2024 04:57:07.910022974 CEST	51220	21	192.168.2.16	187.224.253.249
May 6, 2024 04:57:07.912184954 CEST	51099	2121	192.168.2.16	220.235.242.246
May 6, 2024 04:57:07.912822962 CEST	2121	51196	103.148.249.3	192.168.2.16
May 6, 2024 04:57:07.918838024 CEST	21	51237	149.154.65.23	192.168.2.16
May 6, 2024 04:57:07.918912888 CEST	21	51237	149.154.65.23	192.168.2.16
May 6, 2024 04:57:07.919087887 CEST	51237	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:07.926475048 CEST	51256	21	192.168.2.16	87.95.172.48
May 6, 2024 04:57:07.937155008 CEST	2121	51254	34.128.145.40	192.168.2.16
May 6, 2024 04:57:07.937220097 CEST	2121	51251	34.128.145.40	192.168.2.16
May 6, 2024 04:57:07.937244892 CEST	51254	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:07.941834927 CEST	21	51252	34.128.145.40	192.168.2.16
May 6, 2024 04:57:07.942018032 CEST	51222	2121	192.168.2.16	187.224.253.249
May 6, 2024 04:57:07.942517042 CEST	21	51255	34.128.145.40	192.168.2.16
May 6, 2024 04:57:07.942575932 CEST	51255	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:07.946703911 CEST	21	51135	14.175.222.24	192.168.2.16
May 6, 2024 04:57:07.958822966 CEST	2121	51136	14.175.222.24	192.168.2.16
May 6, 2024 04:57:07.968143940 CEST	21	51239	81.88.252.91	192.168.2.16
May 6, 2024 04:57:07.968302965 CEST	51239	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:07.983592987 CEST	21	51235	87.106.26.129	192.168.2.16
May 6, 2024 04:57:07.983736038 CEST	51235	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:07.984030962 CEST	51257	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:07.986634016 CEST	21	51100	123.162.147.215	192.168.2.16
May 6, 2024 04:57:07.990020037 CEST	51225	21	192.168.2.16	2.137.219.108
May 6, 2024 04:57:07.990099907 CEST	51226	2121	192.168.2.16	2.137.219.108
May 6, 2024 04:57:07.994128942 CEST	21	51231	79.35.65.174	192.168.2.16
May 6, 2024 04:57:08.000145912 CEST	2121	51172	190.75.173.166	192.168.2.16
May 6, 2024 04:57:08.004404068 CEST	21	51108	216.193.134.44	192.168.2.16
May 6, 2024 04:57:08.006002903 CEST	51227	21	192.168.2.16	73.228.123.129
May 6, 2024 04:57:08.010857105 CEST	21	51233	200.126.137.153	192.168.2.16
May 6, 2024 04:57:08.012078047 CEST	21	51187	44.214.139.241	192.168.2.16
May 6, 2024 04:57:08.015997887 CEST	51228	2121	192.168.2.16	73.228.123.129
May 6, 2024 04:57:08.017153025 CEST	51229	2121	192.168.2.16	73.226.181.60
May 6, 2024 04:57:08.021998882 CEST	51230	21	192.168.2.16	73.226.181.60
May 6, 2024 04:57:08.022286892 CEST	51258	2121	192.168.2.16	87.95.172.48
May 6, 2024 04:57:08.031184912 CEST	2121	51234	79.35.65.174	192.168.2.16
May 6, 2024 04:57:08.031522036 CEST	2121	51188	44.214.139.241	192.168.2.16
May 6, 2024 04:57:08.037991047 CEST	51102	21	192.168.2.16	83.239.172.170
May 6, 2024 04:57:08.039257050 CEST	51259	21	192.168.2.16	121.23.57.57
May 6, 2024 04:57:08.039294004 CEST	51260	2121	192.168.2.16	121.23.57.57
May 6, 2024 04:57:08.039326906 CEST	51261	21	192.168.2.16	210.1.227.12
May 6, 2024 04:57:08.039491892 CEST	51262	2121	192.168.2.16	210.1.227.12
May 6, 2024 04:57:08.039549112 CEST	51263	21	192.168.2.16	114.206.121.118
May 6, 2024 04:57:08.039742947 CEST	51265	21	192.168.2.16	91.48.32.252
May 6, 2024 04:57:08.039864063 CEST	51264	2121	192.168.2.16	91.48.32.252
May 6, 2024 04:57:08.039865017 CEST	51266	2121	192.168.2.16	114.206.121.118
May 6, 2024 04:57:08.046461105 CEST	2121	51254	34.128.145.40	192.168.2.16
May 6, 2024 04:57:08.046534061 CEST	51254	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:08.046610117 CEST	51254	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:08.046792030 CEST	51267	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:08.052439928 CEST	21	51255	34.128.145.40	192.168.2.16
May 6, 2024 04:57:08.052491903 CEST	51255	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:08.052534103 CEST	51255	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:08.052656889 CEST	51268	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:08.055293083 CEST	51269	21	192.168.2.16	222.221.40.171
May 6, 2024 04:57:08.055551052 CEST	51271	21	192.168.2.16	24.192.177.91
May 6, 2024 04:57:08.055594921 CEST	51270	2121	192.168.2.16	222.221.40.171
May 6, 2024 04:57:08.055597067 CEST	51272	2121	192.168.2.16	24.192.177.91
May 6, 2024 04:57:08.055692911 CEST	51273	21	192.168.2.16	118.45.244.181
May 6, 2024 04:57:08.055735111 CEST	51274	2121	192.168.2.16	118.45.244.181
May 6, 2024 04:57:08.055759907 CEST	51275	21	192.168.2.16	188.115.100.134
May 6, 2024 04:57:08.055861950 CEST	51276	2121	192.168.2.16	188.115.100.134
May 6, 2024 04:57:08.056006908 CEST	51277	21	192.168.2.16	20.194.157.24
May 6, 2024 04:57:08.056063890 CEST	51278	2121	192.168.2.16	20.194.157.24
May 6, 2024 04:57:08.056085110 CEST	51279	21	192.168.2.16	187.246.238.3
May 6, 2024 04:57:08.056183100 CEST	51280	21	192.168.2.16	78.141.106.170
May 6, 2024 04:57:08.056260109 CEST	51282	2121	192.168.2.16	78.141.106.170
May 6, 2024 04:57:08.056344986 CEST	51283	21	192.168.2.16	84.180.28.91
May 6, 2024 04:57:08.056361914 CEST	51284	2121	192.168.2.16	84.180.28.91
May 6, 2024 04:57:08.056382895 CEST	51285	21	192.168.2.16	101.43.67.211
May 6, 2024 04:57:08.056382895 CEST	51281	2121	192.168.2.16	101.43.67.211
May 6, 2024 04:57:08.056413889 CEST	51286	21	192.168.2.16	88.7.80.68
May 6, 2024 04:57:08.056499004 CEST	51287	2121	192.168.2.16	187.246.238.3
May 6, 2024 04:57:08.063918114 CEST	21	51247	154.210.32.21	192.168.2.16
May 6, 2024 04:57:08.064083099 CEST	51247	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:08.069999933 CEST	51106	21	192.168.2.16	114.104.136.65
May 6, 2024 04:57:08.070451975 CEST	51288	2121	192.168.2.16	88.7.80.68
May 6, 2024 04:57:08.070533991 CEST	51289	21	192.168.2.16	123.57.30.154
May 6, 2024 04:57:08.070593119 CEST	51290	2121	192.168.2.16	123.57.30.154
May 6, 2024 04:57:08.073807955 CEST	2121	51236	200.126.137.153	192.168.2.16
May 6, 2024 04:57:08.076811075 CEST	21	51232	103.109.6.215	192.168.2.16
May 6, 2024 04:57:08.076935053 CEST	51232	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:08.085005999 CEST	51092	21	192.168.2.16	154.197.86.15
May 6, 2024 04:57:08.085030079 CEST	51093	2121	192.168.2.16	154.197.86.15
May 6, 2024 04:57:08.085038900 CEST	51105	2121	192.168.2.16	83.239.172.170
May 6, 2024 04:57:08.085834026 CEST	51291	21	192.168.2.16	85.16.179.135
May 6, 2024 04:57:08.085899115 CEST	51292	2121	192.168.2.16	85.16.179.135
May 6, 2024 04:57:08.086014986 CEST	51294	21	192.168.2.16	94.9.224.211
May 6, 2024 04:57:08.086075068 CEST	51293	21	192.168.2.16	1.254.113.197
May 6, 2024 04:57:08.086077929 CEST	51295	2121	192.168.2.16	94.9.224.211
May 6, 2024 04:57:08.086118937 CEST	51296	2121	192.168.2.16	1.254.113.197
May 6, 2024 04:57:08.086215973 CEST	51297	2121	192.168.2.16	188.4.106.112
May 6, 2024 04:57:08.086289883 CEST	51298	21	192.168.2.16	188.4.106.112
May 6, 2024 04:57:08.086323023 CEST	51299	21	192.168.2.16	182.230.41.250
May 6, 2024 04:57:08.086393118 CEST	51300	2121	192.168.2.16	182.230.41.250
May 6, 2024 04:57:08.089183092 CEST	2121	51166	217.153.42.210	192.168.2.16
May 6, 2024 04:57:08.099488974 CEST	21	51250	45.87.1.166	192.168.2.16
May 6, 2024 04:57:08.099714041 CEST	21	51250	45.87.1.166	192.168.2.16
May 6, 2024 04:57:08.099824905 CEST	51250	21	192.168.2.16	45.87.1.166
May 6, 2024 04:57:08.101653099 CEST	51301	21	192.168.2.16	121.196.14.246
May 6, 2024 04:57:08.101722002 CEST	51302	2121	192.168.2.16	121.196.14.246
May 6, 2024 04:57:08.101722002 CEST	51303	21	192.168.2.16	211.117.230.153
May 6, 2024 04:57:08.101753950 CEST	51304	2121	192.168.2.16	211.117.230.153
May 6, 2024 04:57:08.101859093 CEST	51305	21	192.168.2.16	174.124.220.86
May 6, 2024 04:57:08.101883888 CEST	51306	2121	192.168.2.16	174.124.220.86
May 6, 2024 04:57:08.101901054 CEST	51307	21	192.168.2.16	98.250.86.24
May 6, 2024 04:57:08.117016077 CEST	51107	2121	192.168.2.16	114.104.136.65
May 6, 2024 04:57:08.156547070 CEST	2121	51267	34.128.145.40	192.168.2.16
May 6, 2024 04:57:08.156627893 CEST	51267	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:08.156702042 CEST	2121	51254	34.128.145.40	192.168.2.16
May 6, 2024 04:57:08.162117958 CEST	21	51255	34.128.145.40	192.168.2.16
May 6, 2024 04:57:08.162313938 CEST	21	51268	34.128.145.40	192.168.2.16
May 6, 2024 04:57:08.162364006 CEST	51268	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:08.164402962 CEST	51308	2121	192.168.2.16	98.250.86.24
May 6, 2024 04:57:08.164407969 CEST	51309	21	192.168.2.16	181.139.185.112
May 6, 2024 04:57:08.173141956 CEST	2121	51162	94.43.212.205	192.168.2.16
May 6, 2024 04:57:08.180001020 CEST	51110	21	192.168.2.16	112.248.45.74
May 6, 2024 04:57:08.196897030 CEST	21	51237	149.154.65.23	192.168.2.16
May 6, 2024 04:57:08.197072029 CEST	51237	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:08.197330952 CEST	51310	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:08.212018013 CEST	21	51257	87.106.26.129	192.168.2.16
May 6, 2024 04:57:08.212083101 CEST	51257	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:08.212975025 CEST	2121	51144	168.220.94.137	192.168.2.16
May 6, 2024 04:57:08.212987900 CEST	21	51143	168.220.94.137	192.168.2.16
May 6, 2024 04:57:08.213021994 CEST	51144	2121	192.168.2.16	168.220.94.137
May 6, 2024 04:57:08.213151932 CEST	51143	21	192.168.2.16	168.220.94.137
May 6, 2024 04:57:08.213628054 CEST	21	51235	87.106.26.129	192.168.2.16
May 6, 2024 04:57:08.213676929 CEST	51235	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:08.243011951 CEST	51241	2121	192.168.2.16	173.173.202.168
May 6, 2024 04:57:08.243029118 CEST	51113	2121	192.168.2.16	112.248.45.74
May 6, 2024 04:57:08.243036985 CEST	51242	21	192.168.2.16	173.173.202.168
May 6, 2024 04:57:08.245795965 CEST	21	51239	81.88.252.91	192.168.2.16
May 6, 2024 04:57:08.245809078 CEST	21	51239	81.88.252.91	192.168.2.16
May 6, 2024 04:57:08.247216940 CEST	51311	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:08.266397953 CEST	2121	51267	34.128.145.40	192.168.2.16
May 6, 2024 04:57:08.266480923 CEST	51267	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:08.266568899 CEST	51267	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:08.266768932 CEST	51312	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:08.272172928 CEST	21	51268	34.128.145.40	192.168.2.16
May 6, 2024 04:57:08.272231102 CEST	51268	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:08.272295952 CEST	51268	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:08.272466898 CEST	51313	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:08.274997950 CEST	51114	21	192.168.2.16	70.170.86.10
May 6, 2024 04:57:08.291004896 CEST	51244	2121	192.168.2.16	112.153.92.123
May 6, 2024 04:57:08.291018009 CEST	51243	21	192.168.2.16	112.153.92.123
May 6, 2024 04:57:08.291248083 CEST	51115	2121	192.168.2.16	70.170.86.10
May 6, 2024 04:57:08.297401905 CEST	21	51305	174.124.220.86	192.168.2.16
May 6, 2024 04:57:08.301508904 CEST	21	51102	83.239.172.170	192.168.2.16
May 6, 2024 04:57:08.307014942 CEST	51116	21	192.168.2.16	141.78.134.185
May 6, 2024 04:57:08.307018042 CEST	51117	2121	192.168.2.16	141.78.134.185
May 6, 2024 04:57:08.323012114 CEST	51118	21	192.168.2.16	62.154.222.27
May 6, 2024 04:57:08.323211908 CEST	51314	2121	192.168.2.16	181.139.185.112
May 6, 2024 04:57:08.339107990 CEST	51119	2121	192.168.2.16	62.154.222.27
May 6, 2024 04:57:08.354538918 CEST	2121	51105	83.239.172.170	192.168.2.16
May 6, 2024 04:57:08.355015039 CEST	51245	21	192.168.2.16	79.154.32.225
May 6, 2024 04:57:08.355025053 CEST	51121	21	192.168.2.16	167.58.12.150
May 6, 2024 04:57:08.355029106 CEST	51122	2121	192.168.2.16	37.151.116.29
May 6, 2024 04:57:08.355036974 CEST	51198	21	192.168.2.16	103.148.249.3
May 6, 2024 04:57:08.355037928 CEST	51120	21	192.168.2.16	37.151.116.29
May 6, 2024 04:57:08.357098103 CEST	2121	51274	118.45.244.181	192.168.2.16
May 6, 2024 04:57:08.359067917 CEST	21	51273	118.45.244.181	192.168.2.16
May 6, 2024 04:57:08.371391058 CEST	51315	21	192.168.2.16	1.217.78.193
May 6, 2024 04:57:08.372179031 CEST	21	51250	45.87.1.166	192.168.2.16
May 6, 2024 04:57:08.376214981 CEST	2121	51267	34.128.145.40	192.168.2.16
May 6, 2024 04:57:08.377193928 CEST	2121	51312	34.128.145.40	192.168.2.16
May 6, 2024 04:57:08.377255917 CEST	51312	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:08.381933928 CEST	21	51268	34.128.145.40	192.168.2.16
May 6, 2024 04:57:08.382078886 CEST	21	51313	34.128.145.40	192.168.2.16
May 6, 2024 04:57:08.382137060 CEST	51313	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:08.393764019 CEST	21	51261	210.1.227.12	192.168.2.16
May 6, 2024 04:57:08.396136999 CEST	21	51285	101.43.67.211	192.168.2.16
May 6, 2024 04:57:08.400767088 CEST	21	51247	154.210.32.21	192.168.2.16
May 6, 2024 04:57:08.400875092 CEST	21	51247	154.210.32.21	192.168.2.16
May 6, 2024 04:57:08.400995016 CEST	51247	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:08.406287909 CEST	2121	51281	101.43.67.211	192.168.2.16
May 6, 2024 04:57:08.419023991 CEST	51249	21	192.168.2.16	216.117.162.236
May 6, 2024 04:57:08.419091940 CEST	51196	2121	192.168.2.16	103.148.249.3
May 6, 2024 04:57:08.434746027 CEST	21	51232	103.109.6.215	192.168.2.16
May 6, 2024 04:57:08.434870958 CEST	51232	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:08.435024023 CEST	51316	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:08.451026917 CEST	51135	21	192.168.2.16	14.175.222.24
May 6, 2024 04:57:08.453715086 CEST	21	51310	149.154.65.23	192.168.2.16
May 6, 2024 04:57:08.453782082 CEST	51310	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:08.462311983 CEST	2121	51093	154.197.86.15	192.168.2.16
May 6, 2024 04:57:08.462325096 CEST	21	51092	154.197.86.15	192.168.2.16
May 6, 2024 04:57:08.463583946 CEST	21	51257	87.106.26.129	192.168.2.16
May 6, 2024 04:57:08.463736057 CEST	51257	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:08.466993093 CEST	51136	2121	192.168.2.16	14.175.222.24
May 6, 2024 04:57:08.473967075 CEST	21	51237	149.154.65.23	192.168.2.16
May 6, 2024 04:57:08.474024057 CEST	51237	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:08.483639956 CEST	51317	2121	192.168.2.16	1.217.78.193
May 6, 2024 04:57:08.483793974 CEST	51318	21	192.168.2.16	13.43.141.162
May 6, 2024 04:57:08.483854055 CEST	51319	2121	192.168.2.16	13.43.141.162
May 6, 2024 04:57:08.487847090 CEST	2121	51312	34.128.145.40	192.168.2.16
May 6, 2024 04:57:08.487899065 CEST	51312	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:08.487960100 CEST	51312	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:08.488135099 CEST	51320	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:08.492223024 CEST	21	51313	34.128.145.40	192.168.2.16
May 6, 2024 04:57:08.492278099 CEST	51313	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:08.492324114 CEST	51313	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:08.492475986 CEST	51321	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:08.499013901 CEST	51125	2121	192.168.2.16	167.58.12.150
May 6, 2024 04:57:08.499043941 CEST	51100	21	192.168.2.16	123.162.147.215
May 6, 2024 04:57:08.499043941 CEST	51231	21	192.168.2.16	79.35.65.174
May 6, 2024 04:57:08.499331951 CEST	51322	21	192.168.2.16	100.34.163.198
May 6, 2024 04:57:08.509911060 CEST	21	51311	81.88.252.91	192.168.2.16
May 6, 2024 04:57:08.509984016 CEST	51311	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:08.514991999 CEST	51233	21	192.168.2.16	200.126.137.153
May 6, 2024 04:57:08.515010118 CEST	51126	21	192.168.2.16	94.174.23.203
May 6, 2024 04:57:08.515023947 CEST	51172	2121	192.168.2.16	190.75.173.166
May 6, 2024 04:57:08.515028954 CEST	51187	21	192.168.2.16	44.214.139.241
May 6, 2024 04:57:08.519993067 CEST	51127	2121	192.168.2.16	94.174.23.203
May 6, 2024 04:57:08.531021118 CEST	51234	2121	192.168.2.16	79.35.65.174
May 6, 2024 04:57:08.531258106 CEST	51323	2121	192.168.2.16	100.34.163.198
May 6, 2024 04:57:08.546997070 CEST	51188	2121	192.168.2.16	44.214.139.241
May 6, 2024 04:57:08.547000885 CEST	51128	21	192.168.2.16	61.137.243.218
May 6, 2024 04:57:08.563075066 CEST	50986	21	192.168.2.16	109.205.180.149
May 6, 2024 04:57:08.563247919 CEST	51324	21	192.168.2.16	109.205.180.149
May 6, 2024 04:57:08.579016924 CEST	51236	2121	192.168.2.16	200.126.137.153
May 6, 2024 04:57:08.595025063 CEST	51166	2121	192.168.2.16	217.153.42.210
May 6, 2024 04:57:08.597702980 CEST	2121	51320	34.128.145.40	192.168.2.16
May 6, 2024 04:57:08.597764969 CEST	51320	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:08.601957083 CEST	21	51321	34.128.145.40	192.168.2.16
May 6, 2024 04:57:08.602010012 CEST	51321	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:08.611314058 CEST	51325	21	192.168.2.16	79.45.206.243
May 6, 2024 04:57:08.649087906 CEST	21	51187	44.214.139.241	192.168.2.16
May 6, 2024 04:57:08.659028053 CEST	51253	2121	192.168.2.16	79.154.32.225
May 6, 2024 04:57:08.675014019 CEST	51162	2121	192.168.2.16	94.43.212.205
May 6, 2024 04:57:08.675236940 CEST	51326	2121	192.168.2.16	79.45.206.243
May 6, 2024 04:57:08.675237894 CEST	51133	21	192.168.2.16	85.23.25.24
May 6, 2024 04:57:08.675240993 CEST	51132	2121	192.168.2.16	61.137.243.218
May 6, 2024 04:57:08.681308031 CEST	2121	51188	44.214.139.241	192.168.2.16
May 6, 2024 04:57:08.690011978 CEST	51134	2121	192.168.2.16	85.23.25.24
May 6, 2024 04:57:08.691921949 CEST	21	51257	87.106.26.129	192.168.2.16
May 6, 2024 04:57:08.692087889 CEST	21	51257	87.106.26.129	192.168.2.16
May 6, 2024 04:57:08.692231894 CEST	51257	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:08.705342054 CEST	51327	21	192.168.2.16	65.128.47.237
May 6, 2024 04:57:08.707362890 CEST	2121	51320	34.128.145.40	192.168.2.16
May 6, 2024 04:57:08.707415104 CEST	51320	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:08.707478046 CEST	51320	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:08.707617998 CEST	51328	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:08.709423065 CEST	21	51198	103.148.249.3	192.168.2.16
May 6, 2024 04:57:08.712786913 CEST	21	51321	34.128.145.40	192.168.2.16
May 6, 2024 04:57:08.712838888 CEST	51321	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:08.712898970 CEST	51321	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:08.713074923 CEST	51329	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:08.713170052 CEST	21	51310	149.154.65.23	192.168.2.16
May 6, 2024 04:57:08.713305950 CEST	51310	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:08.715655088 CEST	2121	51172	190.75.173.166	192.168.2.16
May 6, 2024 04:57:08.737297058 CEST	51330	2121	192.168.2.16	65.128.47.237
May 6, 2024 04:57:08.740878105 CEST	21	51231	79.35.65.174	192.168.2.16
May 6, 2024 04:57:08.749180079 CEST	21	51247	154.210.32.21	192.168.2.16
May 6, 2024 04:57:08.749288082 CEST	51247	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:08.749428034 CEST	51331	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:08.750000954 CEST	21	51247	154.210.32.21	192.168.2.16
May 6, 2024 04:57:08.750049114 CEST	51247	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:08.758913040 CEST	21	51233	200.126.137.153	192.168.2.16
May 6, 2024 04:57:08.778172970 CEST	2121	51234	79.35.65.174	192.168.2.16
May 6, 2024 04:57:08.785482883 CEST	21	51311	81.88.252.91	192.168.2.16
May 6, 2024 04:57:08.785614014 CEST	51311	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:08.785882950 CEST	21	51316	103.109.6.215	192.168.2.16
May 6, 2024 04:57:08.785948038 CEST	51316	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:08.788135052 CEST	2121	51317	1.217.78.193	192.168.2.16
May 6, 2024 04:57:08.792490959 CEST	21	51232	103.109.6.215	192.168.2.16
May 6, 2024 04:57:08.792503119 CEST	21	51232	103.109.6.215	192.168.2.16
May 6, 2024 04:57:08.792546988 CEST	51232	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:08.797183990 CEST	21	51324	109.205.180.149	192.168.2.16
May 6, 2024 04:57:08.797240973 CEST	51324	21	192.168.2.16	109.205.180.149
May 6, 2024 04:57:08.800296068 CEST	2121	51196	103.148.249.3	192.168.2.16
May 6, 2024 04:57:08.801012993 CEST	51305	21	192.168.2.16	174.124.220.86
May 6, 2024 04:57:08.817014933 CEST	51313	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:08.817030907 CEST	51312	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:08.817262888 CEST	2121	51328	34.128.145.40	192.168.2.16
May 6, 2024 04:57:08.817274094 CEST	2121	51320	34.128.145.40	192.168.2.16
May 6, 2024 04:57:08.817327023 CEST	51328	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:08.822237015 CEST	21	51329	34.128.145.40	192.168.2.16
May 6, 2024 04:57:08.822293043 CEST	51329	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:08.822365046 CEST	21	51321	34.128.145.40	192.168.2.16
May 6, 2024 04:57:08.833009005 CEST	51137	21	192.168.2.16	76.137.75.49
May 6, 2024 04:57:08.833064079 CEST	51138	2121	192.168.2.16	76.137.75.49
May 6, 2024 04:57:08.835489035 CEST	21	50986	109.205.180.149	192.168.2.16
May 6, 2024 04:57:08.836304903 CEST	2121	51236	200.126.137.153	192.168.2.16
May 6, 2024 04:57:08.850965977 CEST	21	51135	14.175.222.24	192.168.2.16
May 6, 2024 04:57:08.853224039 CEST	2121	51166	217.153.42.210	192.168.2.16
May 6, 2024 04:57:08.859096050 CEST	2121	51136	14.175.222.24	192.168.2.16
May 6, 2024 04:57:08.865003109 CEST	51273	21	192.168.2.16	118.45.244.181
May 6, 2024 04:57:08.865998983 CEST	51274	2121	192.168.2.16	118.45.244.181
May 6, 2024 04:57:08.890919924 CEST	21	51100	123.162.147.215	192.168.2.16
May 6, 2024 04:57:08.897042036 CEST	51261	21	192.168.2.16	210.1.227.12
May 6, 2024 04:57:08.897059917 CEST	51285	21	192.168.2.16	101.43.67.211
May 6, 2024 04:57:08.912275076 CEST	51332	21	192.168.2.16	38.158.75.27
May 6, 2024 04:57:08.915422916 CEST	51281	2121	192.168.2.16	101.43.67.211
May 6, 2024 04:57:08.920577049 CEST	21	51257	87.106.26.129	192.168.2.16
May 6, 2024 04:57:08.920732021 CEST	51257	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:08.921013117 CEST	51333	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:08.928016901 CEST	51256	21	192.168.2.16	87.95.172.48
May 6, 2024 04:57:08.928183079 CEST	21	51313	34.128.145.40	192.168.2.16
May 6, 2024 04:57:08.928476095 CEST	51334	2121	192.168.2.16	38.158.75.27
May 6, 2024 04:57:08.929055929 CEST	2121	51312	34.128.145.40	192.168.2.16
May 6, 2024 04:57:08.933119059 CEST	21	51329	34.128.145.40	192.168.2.16
May 6, 2024 04:57:08.933171988 CEST	51329	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:08.933229923 CEST	51329	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:08.933401108 CEST	51335	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:08.934017897 CEST	2121	51328	34.128.145.40	192.168.2.16
May 6, 2024 04:57:08.934081078 CEST	51328	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:08.934137106 CEST	51328	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:08.934242010 CEST	51336	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:08.969531059 CEST	21	51310	149.154.65.23	192.168.2.16
May 6, 2024 04:57:08.969734907 CEST	21	51310	149.154.65.23	192.168.2.16
May 6, 2024 04:57:08.969887018 CEST	51310	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:08.970160007 CEST	2121	51162	94.43.212.205	192.168.2.16
May 6, 2024 04:57:08.996670008 CEST	21	51305	174.124.220.86	192.168.2.16
May 6, 2024 04:57:09.023412943 CEST	51337	21	192.168.2.16	84.30.79.204
May 6, 2024 04:57:09.031991959 CEST	51258	2121	192.168.2.16	87.95.172.48
May 6, 2024 04:57:09.032907009 CEST	21	51324	109.205.180.149	192.168.2.16
May 6, 2024 04:57:09.033037901 CEST	51324	21	192.168.2.16	109.205.180.149
May 6, 2024 04:57:09.042885065 CEST	21	51335	34.128.145.40	192.168.2.16
May 6, 2024 04:57:09.042956114 CEST	51335	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:09.043278933 CEST	2121	51328	34.128.145.40	192.168.2.16
May 6, 2024 04:57:09.043386936 CEST	2121	51336	34.128.145.40	192.168.2.16
May 6, 2024 04:57:09.043576956 CEST	51336	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:09.044567108 CEST	21	51329	34.128.145.40	192.168.2.16
May 6, 2024 04:57:09.046000957 CEST	51263	21	192.168.2.16	114.206.121.118
May 6, 2024 04:57:09.051620960 CEST	21	51311	81.88.252.91	192.168.2.16
May 6, 2024 04:57:09.051749945 CEST	51311	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:09.054003954 CEST	51259	21	192.168.2.16	121.23.57.57
May 6, 2024 04:57:09.054004908 CEST	51260	2121	192.168.2.16	121.23.57.57
May 6, 2024 04:57:09.054032087 CEST	51264	2121	192.168.2.16	91.48.32.252
May 6, 2024 04:57:09.054033041 CEST	51262	2121	192.168.2.16	210.1.227.12
May 6, 2024 04:57:09.054034948 CEST	51265	21	192.168.2.16	91.48.32.252
May 6, 2024 04:57:09.054092884 CEST	51266	2121	192.168.2.16	114.206.121.118
May 6, 2024 04:57:09.054466009 CEST	51338	2121	192.168.2.16	84.30.79.204
May 6, 2024 04:57:09.070004940 CEST	51276	2121	192.168.2.16	188.115.100.134
May 6, 2024 04:57:09.070005894 CEST	51270	2121	192.168.2.16	222.221.40.171
May 6, 2024 04:57:09.070023060 CEST	51269	21	192.168.2.16	222.221.40.171
May 6, 2024 04:57:09.070030928 CEST	51279	21	192.168.2.16	187.246.238.3
May 6, 2024 04:57:09.070033073 CEST	51272	2121	192.168.2.16	24.192.177.91
May 6, 2024 04:57:09.070033073 CEST	51284	2121	192.168.2.16	84.180.28.91
May 6, 2024 04:57:09.070035934 CEST	51277	21	192.168.2.16	20.194.157.24
May 6, 2024 04:57:09.070036888 CEST	51280	21	192.168.2.16	78.141.106.170
May 6, 2024 04:57:09.070038080 CEST	51275	21	192.168.2.16	188.115.100.134
May 6, 2024 04:57:09.070396900 CEST	51288	2121	192.168.2.16	88.7.80.68
May 6, 2024 04:57:09.070396900 CEST	51286	21	192.168.2.16	88.7.80.68
May 6, 2024 04:57:09.070398092 CEST	51283	21	192.168.2.16	84.180.28.91
May 6, 2024 04:57:09.070398092 CEST	51289	21	192.168.2.16	123.57.30.154
May 6, 2024 04:57:09.070399046 CEST	51287	2121	192.168.2.16	187.246.238.3
May 6, 2024 04:57:09.070400953 CEST	51271	21	192.168.2.16	24.192.177.91
May 6, 2024 04:57:09.070400953 CEST	51278	2121	192.168.2.16	20.194.157.24
May 6, 2024 04:57:09.070400953 CEST	51282	2121	192.168.2.16	78.141.106.170
May 6, 2024 04:57:09.070400953 CEST	51290	2121	192.168.2.16	123.57.30.154
May 6, 2024 04:57:09.070400953 CEST	51339	21	192.168.2.16	118.48.230.67
May 6, 2024 04:57:09.085635900 CEST	21	51247	154.210.32.21	192.168.2.16
May 6, 2024 04:57:09.086016893 CEST	51291	21	192.168.2.16	85.16.179.135
May 6, 2024 04:57:09.086020947 CEST	51292	2121	192.168.2.16	85.16.179.135
May 6, 2024 04:57:09.086036921 CEST	51294	21	192.168.2.16	94.9.224.211
May 6, 2024 04:57:09.086036921 CEST	51293	21	192.168.2.16	1.254.113.197
May 6, 2024 04:57:09.086036921 CEST	51297	2121	192.168.2.16	188.4.106.112
May 6, 2024 04:57:09.086039066 CEST	51295	2121	192.168.2.16	94.9.224.211
May 6, 2024 04:57:09.096879005 CEST	21	51331	154.210.32.21	192.168.2.16
May 6, 2024 04:57:09.096934080 CEST	51331	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:09.100996017 CEST	51304	2121	192.168.2.16	211.117.230.153
May 6, 2024 04:57:09.101012945 CEST	51306	2121	192.168.2.16	174.124.220.86
May 6, 2024 04:57:09.101016045 CEST	51301	21	192.168.2.16	121.196.14.246
May 6, 2024 04:57:09.101016045 CEST	51296	2121	192.168.2.16	1.254.113.197
May 6, 2024 04:57:09.101016045 CEST	51298	21	192.168.2.16	188.4.106.112
May 6, 2024 04:57:09.101147890 CEST	51299	21	192.168.2.16	182.230.41.250
May 6, 2024 04:57:09.101149082 CEST	51302	2121	192.168.2.16	121.196.14.246
May 6, 2024 04:57:09.101147890 CEST	51307	21	192.168.2.16	98.250.86.24
May 6, 2024 04:57:09.106000900 CEST	51300	2121	192.168.2.16	182.230.41.250
May 6, 2024 04:57:09.106013060 CEST	51303	21	192.168.2.16	211.117.230.153
May 6, 2024 04:57:09.137005091 CEST	21	51316	103.109.6.215	192.168.2.16
May 6, 2024 04:57:09.137121916 CEST	51316	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:09.149100065 CEST	21	51333	87.106.26.129	192.168.2.16
May 6, 2024 04:57:09.149152994 CEST	51333	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:09.150677919 CEST	21	51257	87.106.26.129	192.168.2.16
May 6, 2024 04:57:09.150727034 CEST	51257	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:09.152856112 CEST	2121	51336	34.128.145.40	192.168.2.16
May 6, 2024 04:57:09.152909040 CEST	51336	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:09.152964115 CEST	51336	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:09.153151989 CEST	51340	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:09.154262066 CEST	21	51335	34.128.145.40	192.168.2.16
May 6, 2024 04:57:09.154308081 CEST	51335	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:09.154371977 CEST	51335	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:09.154541016 CEST	51341	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:09.164020061 CEST	51187	21	192.168.2.16	44.214.139.241
May 6, 2024 04:57:09.164335012 CEST	51342	2121	192.168.2.16	118.48.230.67
May 6, 2024 04:57:09.164444923 CEST	51343	21	192.168.2.16	212.187.48.111
May 6, 2024 04:57:09.169055939 CEST	2121	51274	118.45.244.181	192.168.2.16
May 6, 2024 04:57:09.170008898 CEST	21	51273	118.45.244.181	192.168.2.16
May 6, 2024 04:57:09.178997040 CEST	51308	2121	192.168.2.16	98.250.86.24
May 6, 2024 04:57:09.179006100 CEST	51309	21	192.168.2.16	181.139.185.112
May 6, 2024 04:57:09.179282904 CEST	51344	2121	192.168.2.16	212.187.48.111
May 6, 2024 04:57:09.195019960 CEST	51188	2121	192.168.2.16	44.214.139.241
May 6, 2024 04:57:09.195075989 CEST	51151	21	192.168.2.16	69.254.36.116
May 6, 2024 04:57:09.211019993 CEST	51198	21	192.168.2.16	103.148.249.3
May 6, 2024 04:57:09.226598024 CEST	21	51310	149.154.65.23	192.168.2.16
May 6, 2024 04:57:09.226763010 CEST	51310	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:09.227015972 CEST	51153	21	192.168.2.16	98.247.226.140
May 6, 2024 04:57:09.227016926 CEST	51152	2121	192.168.2.16	69.254.36.116
May 6, 2024 04:57:09.227025032 CEST	51154	2121	192.168.2.16	98.247.226.140
May 6, 2024 04:57:09.227032900 CEST	51172	2121	192.168.2.16	190.75.173.166
May 6, 2024 04:57:09.227174044 CEST	51345	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:09.227238894 CEST	51346	21	192.168.2.16	73.205.168.52
May 6, 2024 04:57:09.239144087 CEST	21	51285	101.43.67.211	192.168.2.16
May 6, 2024 04:57:09.243221998 CEST	51155	21	192.168.2.16	116.36.57.71
May 6, 2024 04:57:09.245145082 CEST	51231	21	192.168.2.16	79.35.65.174
May 6, 2024 04:57:09.253825903 CEST	21	51261	210.1.227.12	192.168.2.16
May 6, 2024 04:57:09.258029938 CEST	51156	2121	192.168.2.16	116.36.57.71
May 6, 2024 04:57:09.258033037 CEST	51157	21	192.168.2.16	34.136.121.14
May 6, 2024 04:57:09.262156010 CEST	2121	51336	34.128.145.40	192.168.2.16
May 6, 2024 04:57:09.262736082 CEST	2121	51340	34.128.145.40	192.168.2.16
May 6, 2024 04:57:09.262801886 CEST	51340	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:09.264143944 CEST	21	51341	34.128.145.40	192.168.2.16
May 6, 2024 04:57:09.264203072 CEST	51341	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:09.264689922 CEST	21	51335	34.128.145.40	192.168.2.16
May 6, 2024 04:57:09.265275955 CEST	2121	51281	101.43.67.211	192.168.2.16
May 6, 2024 04:57:09.266381979 CEST	21	51324	109.205.180.149	192.168.2.16
May 6, 2024 04:57:09.266494036 CEST	21	51324	109.205.180.149	192.168.2.16
May 6, 2024 04:57:09.266617060 CEST	51324	21	192.168.2.16	109.205.180.149
May 6, 2024 04:57:09.274003029 CEST	51233	21	192.168.2.16	200.126.137.153
May 6, 2024 04:57:09.274003983 CEST	51160	2121	192.168.2.16	91.11.138.10
May 6, 2024 04:57:09.274019003 CEST	51158	21	192.168.2.16	91.11.138.10
May 6, 2024 04:57:09.274019957 CEST	51161	21	192.168.2.16	94.43.212.205
May 6, 2024 04:57:09.274122953 CEST	51159	2121	192.168.2.16	34.136.121.14
May 6, 2024 04:57:09.289993048 CEST	51234	2121	192.168.2.16	79.35.65.174
May 6, 2024 04:57:09.290261984 CEST	51347	2121	192.168.2.16	73.205.168.52
May 6, 2024 04:57:09.290261984 CEST	51317	2121	192.168.2.16	1.217.78.193
May 6, 2024 04:57:09.298430920 CEST	21	51187	44.214.139.241	192.168.2.16
May 6, 2024 04:57:09.306046963 CEST	51163	21	192.168.2.16	217.153.42.210
May 6, 2024 04:57:09.306050062 CEST	51196	2121	192.168.2.16	103.148.249.3
May 6, 2024 04:57:09.306248903 CEST	51348	21	192.168.2.16	223.243.254.224
May 6, 2024 04:57:09.322212934 CEST	51349	2121	192.168.2.16	223.243.254.224
May 6, 2024 04:57:09.329251051 CEST	2121	51188	44.214.139.241	192.168.2.16
May 6, 2024 04:57:09.337996960 CEST	51167	21	192.168.2.16	212.114.3.239
May 6, 2024 04:57:09.338016033 CEST	51314	2121	192.168.2.16	181.139.185.112
May 6, 2024 04:57:09.338018894 CEST	51236	2121	192.168.2.16	200.126.137.153
May 6, 2024 04:57:09.339427948 CEST	51168	2121	192.168.2.16	212.114.3.239
May 6, 2024 04:57:09.346110106 CEST	21	51311	81.88.252.91	192.168.2.16
May 6, 2024 04:57:09.346246958 CEST	51311	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:09.346437931 CEST	51350	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:09.347995043 CEST	21	51311	81.88.252.91	192.168.2.16
May 6, 2024 04:57:09.354027987 CEST	51135	21	192.168.2.16	14.175.222.24
May 6, 2024 04:57:09.354028940 CEST	51166	2121	192.168.2.16	217.153.42.210
May 6, 2024 04:57:09.354163885 CEST	51351	21	192.168.2.16	116.46.240.106
May 6, 2024 04:57:09.368994951 CEST	51136	2121	192.168.2.16	14.175.222.24
May 6, 2024 04:57:09.372525930 CEST	2121	51340	34.128.145.40	192.168.2.16
May 6, 2024 04:57:09.372581005 CEST	51340	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:09.372657061 CEST	51340	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:09.372837067 CEST	51352	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:09.378870010 CEST	21	51341	34.128.145.40	192.168.2.16
May 6, 2024 04:57:09.378915071 CEST	51341	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:09.378958941 CEST	51341	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:09.379105091 CEST	51353	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:09.384439945 CEST	21	51339	118.48.230.67	192.168.2.16
May 6, 2024 04:57:09.385001898 CEST	51315	21	192.168.2.16	1.217.78.193
May 6, 2024 04:57:09.385003090 CEST	51170	2121	192.168.2.16	92.100.110.146
May 6, 2024 04:57:09.385014057 CEST	51169	21	192.168.2.16	92.100.110.146
May 6, 2024 04:57:09.400763988 CEST	21	51333	87.106.26.129	192.168.2.16
May 6, 2024 04:57:09.401014090 CEST	51333	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:09.401151896 CEST	51173	21	192.168.2.16	138.68.253.24
May 6, 2024 04:57:09.401154041 CEST	51171	21	192.168.2.16	190.75.173.166
May 6, 2024 04:57:09.427136898 CEST	2121	51172	190.75.173.166	192.168.2.16
May 6, 2024 04:57:09.433022022 CEST	51175	21	192.168.2.16	39.79.68.120
May 6, 2024 04:57:09.433022976 CEST	51174	2121	192.168.2.16	138.68.253.24
May 6, 2024 04:57:09.446533918 CEST	21	51331	154.210.32.21	192.168.2.16
May 6, 2024 04:57:09.446702957 CEST	51331	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:09.449001074 CEST	51176	2121	192.168.2.16	39.79.68.120
May 6, 2024 04:57:09.449265003 CEST	51354	2121	192.168.2.16	116.46.240.106
May 6, 2024 04:57:09.464999914 CEST	51177	21	192.168.2.16	110.251.67.124
May 6, 2024 04:57:09.478044033 CEST	2121	51342	118.48.230.67	192.168.2.16
May 6, 2024 04:57:09.481002092 CEST	51178	2121	192.168.2.16	110.251.67.124
May 6, 2024 04:57:09.481004953 CEST	51162	2121	192.168.2.16	94.43.212.205
May 6, 2024 04:57:09.482265949 CEST	2121	51340	34.128.145.40	192.168.2.16
May 6, 2024 04:57:09.482873917 CEST	21	51310	149.154.65.23	192.168.2.16
May 6, 2024 04:57:09.482925892 CEST	51310	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:09.483290911 CEST	2121	51352	34.128.145.40	192.168.2.16
May 6, 2024 04:57:09.483350992 CEST	51352	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:09.486072063 CEST	21	51231	79.35.65.174	192.168.2.16
May 6, 2024 04:57:09.487966061 CEST	21	51316	103.109.6.215	192.168.2.16
May 6, 2024 04:57:09.488075972 CEST	51316	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:09.488312960 CEST	21	51353	34.128.145.40	192.168.2.16
May 6, 2024 04:57:09.488373041 CEST	51353	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:09.488455057 CEST	21	51341	34.128.145.40	192.168.2.16
May 6, 2024 04:57:09.488605022 CEST	21	51345	149.154.65.23	192.168.2.16
May 6, 2024 04:57:09.488662004 CEST	51345	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:09.496999025 CEST	51318	21	192.168.2.16	13.43.141.162
May 6, 2024 04:57:09.497020006 CEST	51319	2121	192.168.2.16	13.43.141.162
May 6, 2024 04:57:09.497020006 CEST	51305	21	192.168.2.16	174.124.220.86
May 6, 2024 04:57:09.497334003 CEST	51355	21	192.168.2.16	174.59.40.113
May 6, 2024 04:57:09.513000011 CEST	51180	2121	192.168.2.16	147.185.154.210
May 6, 2024 04:57:09.513000965 CEST	51179	21	192.168.2.16	147.185.154.210
May 6, 2024 04:57:09.513252020 CEST	51322	21	192.168.2.16	100.34.163.198
May 6, 2024 04:57:09.513297081 CEST	51356	2121	192.168.2.16	174.59.40.113
May 6, 2024 04:57:09.516958952 CEST	21	51233	200.126.137.153	192.168.2.16
May 6, 2024 04:57:09.529126883 CEST	51182	21	192.168.2.16	172.247.137.215
May 6, 2024 04:57:09.537028074 CEST	2121	51234	79.35.65.174	192.168.2.16
May 6, 2024 04:57:09.539819956 CEST	21	51324	109.205.180.149	192.168.2.16
May 6, 2024 04:57:09.545011997 CEST	51323	2121	192.168.2.16	100.34.163.198
May 6, 2024 04:57:09.560272932 CEST	21	50986	109.205.180.149	192.168.2.16
May 6, 2024 04:57:09.560332060 CEST	50986	21	192.168.2.16	109.205.180.149
May 6, 2024 04:57:09.560379028 CEST	21	50986	109.205.180.149	192.168.2.16
May 6, 2024 04:57:09.560430050 CEST	50986	21	192.168.2.16	109.205.180.149
May 6, 2024 04:57:09.561002016 CEST	51184	2121	192.168.2.16	172.247.137.215
May 6, 2024 04:57:09.561285019 CEST	21	50986	109.205.180.149	192.168.2.16
May 6, 2024 04:57:09.561331987 CEST	50986	21	192.168.2.16	109.205.180.149
May 6, 2024 04:57:09.565399885 CEST	21	51198	103.148.249.3	192.168.2.16
May 6, 2024 04:57:09.577034950 CEST	51185	21	192.168.2.16	112.228.87.214
May 6, 2024 04:57:09.577217102 CEST	51357	21	192.168.2.16	84.25.8.36
May 6, 2024 04:57:09.593020916 CEST	51186	2121	192.168.2.16	112.228.87.214
May 6, 2024 04:57:09.594482899 CEST	2121	51236	200.126.137.153	192.168.2.16
May 6, 2024 04:57:09.594554901 CEST	2121	51352	34.128.145.40	192.168.2.16
May 6, 2024 04:57:09.594605923 CEST	51352	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:09.594655991 CEST	51352	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:09.594821930 CEST	51358	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:09.594841003 CEST	2121	51317	1.217.78.193	192.168.2.16
May 6, 2024 04:57:09.597620010 CEST	21	51353	34.128.145.40	192.168.2.16
May 6, 2024 04:57:09.597675085 CEST	51353	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:09.597776890 CEST	51353	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:09.597974062 CEST	51359	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:09.611051083 CEST	21	51350	81.88.252.91	192.168.2.16
May 6, 2024 04:57:09.611119032 CEST	51350	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:09.612220049 CEST	2121	51166	217.153.42.210	192.168.2.16
May 6, 2024 04:57:09.615655899 CEST	21	51311	81.88.252.91	192.168.2.16
May 6, 2024 04:57:09.625014067 CEST	51189	21	192.168.2.16	78.189.216.244
May 6, 2024 04:57:09.625014067 CEST	51325	21	192.168.2.16	79.45.206.243
May 6, 2024 04:57:09.625269890 CEST	51360	2121	192.168.2.16	84.25.8.36
May 6, 2024 04:57:09.629156113 CEST	21	51333	87.106.26.129	192.168.2.16
May 6, 2024 04:57:09.629364967 CEST	21	51333	87.106.26.129	192.168.2.16
May 6, 2024 04:57:09.629503965 CEST	51333	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:09.641000986 CEST	51192	2121	192.168.2.16	73.19.158.94
May 6, 2024 04:57:09.641001940 CEST	51191	2121	192.168.2.16	78.189.216.244
May 6, 2024 04:57:09.641020060 CEST	51193	21	192.168.2.16	68.10.23.248
May 6, 2024 04:57:09.641021013 CEST	51194	2121	192.168.2.16	68.10.23.248
May 6, 2024 04:57:09.641021013 CEST	51190	21	192.168.2.16	73.19.158.94
May 6, 2024 04:57:09.657016993 CEST	51195	2121	192.168.2.16	78.48.173.211
May 6, 2024 04:57:09.657077074 CEST	51197	21	192.168.2.16	78.48.173.211
May 6, 2024 04:57:09.662765026 CEST	21	51355	174.59.40.113	192.168.2.16
May 6, 2024 04:57:09.673000097 CEST	51200	2121	192.168.2.16	142.39.230.26
May 6, 2024 04:57:09.673018932 CEST	51273	21	192.168.2.16	118.45.244.181
May 6, 2024 04:57:09.673019886 CEST	51274	2121	192.168.2.16	118.45.244.181
May 6, 2024 04:57:09.673074961 CEST	51201	21	192.168.2.16	81.242.190.250
May 6, 2024 04:57:09.673077106 CEST	51199	21	192.168.2.16	142.39.230.26
May 6, 2024 04:57:09.676238060 CEST	2121	51356	174.59.40.113	192.168.2.16
May 6, 2024 04:57:09.679097891 CEST	2121	51349	223.243.254.224	192.168.2.16
May 6, 2024 04:57:09.687257051 CEST	2121	51196	103.148.249.3	192.168.2.16
May 6, 2024 04:57:09.689002991 CEST	51202	2121	192.168.2.16	81.242.190.250
May 6, 2024 04:57:09.689003944 CEST	51326	2121	192.168.2.16	79.45.206.243
May 6, 2024 04:57:09.689018965 CEST	51203	21	192.168.2.16	87.161.17.71
May 6, 2024 04:57:09.692604065 CEST	21	51305	174.124.220.86	192.168.2.16
May 6, 2024 04:57:09.704384089 CEST	2121	51352	34.128.145.40	192.168.2.16
May 6, 2024 04:57:09.704423904 CEST	2121	51358	34.128.145.40	192.168.2.16
May 6, 2024 04:57:09.704490900 CEST	51358	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:09.704998016 CEST	51204	2121	192.168.2.16	87.161.17.71
May 6, 2024 04:57:09.704999924 CEST	51206	2121	192.168.2.16	91.68.87.212
May 6, 2024 04:57:09.705017090 CEST	51205	21	192.168.2.16	91.68.87.212
May 6, 2024 04:57:09.705152035 CEST	51327	21	192.168.2.16	65.128.47.237
May 6, 2024 04:57:09.706990004 CEST	21	51353	34.128.145.40	192.168.2.16
May 6, 2024 04:57:09.707530975 CEST	21	51359	34.128.145.40	192.168.2.16
May 6, 2024 04:57:09.707587957 CEST	51359	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:09.737020969 CEST	51207	21	192.168.2.16	211.58.118.61
May 6, 2024 04:57:09.737055063 CEST	51330	2121	192.168.2.16	65.128.47.237
May 6, 2024 04:57:09.753060102 CEST	51285	21	192.168.2.16	101.43.67.211
May 6, 2024 04:57:09.753107071 CEST	51210	2121	192.168.2.16	211.58.118.61
May 6, 2024 04:57:09.753154993 CEST	51211	21	192.168.2.16	120.29.254.249
May 6, 2024 04:57:09.754873037 CEST	21	51135	14.175.222.24	192.168.2.16
May 6, 2024 04:57:09.755274057 CEST	51361	21	192.168.2.16	47.151.217.109
May 6, 2024 04:57:09.762908936 CEST	2121	51136	14.175.222.24	192.168.2.16
May 6, 2024 04:57:09.763310909 CEST	51362	2121	192.168.2.16	47.151.217.109
May 6, 2024 04:57:09.769010067 CEST	51261	21	192.168.2.16	210.1.227.12
May 6, 2024 04:57:09.769021988 CEST	51281	2121	192.168.2.16	101.43.67.211
May 6, 2024 04:57:09.769030094 CEST	51213	21	192.168.2.16	154.37.158.121
May 6, 2024 04:57:09.769047976 CEST	51212	2121	192.168.2.16	120.29.254.249
May 6, 2024 04:57:09.776148081 CEST	2121	51162	94.43.212.205	192.168.2.16
May 6, 2024 04:57:09.785048008 CEST	51214	2121	192.168.2.16	154.37.158.121
May 6, 2024 04:57:09.785235882 CEST	51363	21	192.168.2.16	14.46.231.66
May 6, 2024 04:57:09.794187069 CEST	21	51331	154.210.32.21	192.168.2.16
May 6, 2024 04:57:09.794294119 CEST	21	51331	154.210.32.21	192.168.2.16
May 6, 2024 04:57:09.794434071 CEST	51331	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:09.795645952 CEST	21	51345	149.154.65.23	192.168.2.16
May 6, 2024 04:57:09.795770884 CEST	51345	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:09.801001072 CEST	51215	21	192.168.2.16	212.125.22.162
May 6, 2024 04:57:09.801254034 CEST	51364	2121	192.168.2.16	14.46.231.66
May 6, 2024 04:57:09.814203024 CEST	2121	51358	34.128.145.40	192.168.2.16
May 6, 2024 04:57:09.814256907 CEST	51358	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:09.814331055 CEST	51358	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:09.814483881 CEST	51365	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:09.817131042 CEST	21	51359	34.128.145.40	192.168.2.16
May 6, 2024 04:57:09.817182064 CEST	51359	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:09.817272902 CEST	51359	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:09.817483902 CEST	51366	21	192.168.2.16	180.246.40.42
May 6, 2024 04:57:09.817528963 CEST	51367	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:09.840261936 CEST	21	51316	103.109.6.215	192.168.2.16
May 6, 2024 04:57:09.840392113 CEST	51316	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:09.840549946 CEST	51368	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:09.848017931 CEST	51216	2121	192.168.2.16	212.125.22.162
May 6, 2024 04:57:09.857932091 CEST	21	51333	87.106.26.129	192.168.2.16
May 6, 2024 04:57:09.858076096 CEST	51333	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:09.858303070 CEST	51369	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:09.880033016 CEST	51217	21	192.168.2.16	193.35.147.121
May 6, 2024 04:57:09.882811069 CEST	21	51350	81.88.252.91	192.168.2.16
May 6, 2024 04:57:09.882946014 CEST	51350	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:09.896002054 CEST	51339	21	192.168.2.16	118.48.230.67
May 6, 2024 04:57:09.896075010 CEST	51218	2121	192.168.2.16	193.35.147.121
May 6, 2024 04:57:09.896312952 CEST	51370	2121	192.168.2.16	180.246.40.42
May 6, 2024 04:57:09.896333933 CEST	51371	21	192.168.2.16	112.255.85.35
May 6, 2024 04:57:09.912051916 CEST	51220	21	192.168.2.16	187.224.253.249
May 6, 2024 04:57:09.914805889 CEST	51219	21	192.168.2.16	189.174.73.79
May 6, 2024 04:57:09.915599108 CEST	51332	21	192.168.2.16	38.158.75.27
May 6, 2024 04:57:09.915602922 CEST	51221	2121	192.168.2.16	189.174.73.79
May 6, 2024 04:57:09.923904896 CEST	2121	51358	34.128.145.40	192.168.2.16
May 6, 2024 04:57:09.924209118 CEST	2121	51365	34.128.145.40	192.168.2.16
May 6, 2024 04:57:09.924277067 CEST	51365	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:09.927118063 CEST	21	51367	34.128.145.40	192.168.2.16
May 6, 2024 04:57:09.927181959 CEST	51367	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:09.927694082 CEST	21	51359	34.128.145.40	192.168.2.16
May 6, 2024 04:57:09.928021908 CEST	51334	2121	192.168.2.16	38.158.75.27
May 6, 2024 04:57:09.944026947 CEST	51222	2121	192.168.2.16	187.224.253.249
May 6, 2024 04:57:09.974509954 CEST	2121	51274	118.45.244.181	192.168.2.16
May 6, 2024 04:57:09.976497889 CEST	21	51273	118.45.244.181	192.168.2.16
May 6, 2024 04:57:09.992027044 CEST	51231	21	192.168.2.16	79.35.65.174
May 6, 2024 04:57:09.992029905 CEST	51342	2121	192.168.2.16	118.48.230.67
May 6, 2024 04:57:09.992053032 CEST	51225	21	192.168.2.16	2.137.219.108
May 6, 2024 04:57:09.992054939 CEST	51226	2121	192.168.2.16	2.137.219.108
May 6, 2024 04:57:10.002084970 CEST	21	51141	193.124.183.222	192.168.2.16
May 6, 2024 04:57:10.002264023 CEST	51141	21	192.168.2.16	193.124.183.222
May 6, 2024 04:57:10.002536058 CEST	51372	21	192.168.2.16	193.124.183.222
May 6, 2024 04:57:10.008074999 CEST	51227	21	192.168.2.16	73.228.123.129
May 6, 2024 04:57:10.024043083 CEST	51228	2121	192.168.2.16	73.228.123.129
May 6, 2024 04:57:10.024048090 CEST	51230	21	192.168.2.16	73.226.181.60
May 6, 2024 04:57:10.024051905 CEST	51233	21	192.168.2.16	200.126.137.153
May 6, 2024 04:57:10.024051905 CEST	51229	2121	192.168.2.16	73.226.181.60
May 6, 2024 04:57:10.024053097 CEST	51337	21	192.168.2.16	84.30.79.204
May 6, 2024 04:57:10.034292936 CEST	2121	51365	34.128.145.40	192.168.2.16
May 6, 2024 04:57:10.034352064 CEST	51365	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:10.034451962 CEST	51365	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:10.034683943 CEST	51373	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:10.036907911 CEST	21	51367	34.128.145.40	192.168.2.16
May 6, 2024 04:57:10.036986113 CEST	51367	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:10.037041903 CEST	51367	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:10.037230015 CEST	51374	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:10.040066957 CEST	51234	2121	192.168.2.16	79.35.65.174
May 6, 2024 04:57:10.055022955 CEST	51338	2121	192.168.2.16	84.30.79.204
May 6, 2024 04:57:10.055214882 CEST	51375	2121	192.168.2.16	112.255.85.35
May 6, 2024 04:57:10.057456970 CEST	21	51345	149.154.65.23	192.168.2.16
May 6, 2024 04:57:10.057558060 CEST	21	51345	149.154.65.23	192.168.2.16
May 6, 2024 04:57:10.057720900 CEST	51345	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:10.070024967 CEST	51198	21	192.168.2.16	103.148.249.3
May 6, 2024 04:57:10.086409092 CEST	21	51369	87.106.26.129	192.168.2.16
May 6, 2024 04:57:10.086488008 CEST	51369	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:10.088062048 CEST	21	51333	87.106.26.129	192.168.2.16
May 6, 2024 04:57:10.088124990 CEST	51333	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:10.092951059 CEST	21	51285	101.43.67.211	192.168.2.16
May 6, 2024 04:57:10.101110935 CEST	51236	2121	192.168.2.16	200.126.137.153
May 6, 2024 04:57:10.101119995 CEST	51317	2121	192.168.2.16	1.217.78.193
May 6, 2024 04:57:10.101464033 CEST	51376	21	192.168.2.16	174.108.248.173
May 6, 2024 04:57:10.118895054 CEST	2121	51281	101.43.67.211	192.168.2.16
May 6, 2024 04:57:10.123363018 CEST	21	51261	210.1.227.12	192.168.2.16
May 6, 2024 04:57:10.144450903 CEST	2121	51365	34.128.145.40	192.168.2.16
May 6, 2024 04:57:10.144535065 CEST	2121	51373	34.128.145.40	192.168.2.16
May 6, 2024 04:57:10.144606113 CEST	51373	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:10.145136118 CEST	21	51331	154.210.32.21	192.168.2.16
May 6, 2024 04:57:10.145275116 CEST	51331	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:10.145472050 CEST	51377	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:10.146001101 CEST	21	51331	154.210.32.21	192.168.2.16
May 6, 2024 04:57:10.146060944 CEST	51331	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:10.146548986 CEST	21	51367	34.128.145.40	192.168.2.16
May 6, 2024 04:57:10.147653103 CEST	21	51374	34.128.145.40	192.168.2.16
May 6, 2024 04:57:10.147725105 CEST	51374	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:10.165034056 CEST	51355	21	192.168.2.16	174.59.40.113
May 6, 2024 04:57:10.165137053 CEST	51343	21	192.168.2.16	212.187.48.111
May 6, 2024 04:57:10.165257931 CEST	51378	2121	192.168.2.16	174.108.248.173
May 6, 2024 04:57:10.181071043 CEST	51356	2121	192.168.2.16	174.59.40.113
May 6, 2024 04:57:10.182815075 CEST	21	51350	81.88.252.91	192.168.2.16
May 6, 2024 04:57:10.182998896 CEST	51350	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:10.186007977 CEST	51344	2121	192.168.2.16	212.187.48.111
May 6, 2024 04:57:10.188611031 CEST	51349	2121	192.168.2.16	223.243.254.224
May 6, 2024 04:57:10.188646078 CEST	21	51368	103.109.6.215	192.168.2.16
May 6, 2024 04:57:10.188719034 CEST	51368	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:10.191179037 CEST	21	51316	103.109.6.215	192.168.2.16
May 6, 2024 04:57:10.191231012 CEST	21	51316	103.109.6.215	192.168.2.16
May 6, 2024 04:57:10.191282034 CEST	51316	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:10.197021008 CEST	51196	2121	192.168.2.16	103.148.249.3
May 6, 2024 04:57:10.197047949 CEST	51305	21	192.168.2.16	174.124.220.86
May 6, 2024 04:57:10.204322100 CEST	21	51339	118.48.230.67	192.168.2.16
May 6, 2024 04:57:10.228030920 CEST	51346	21	192.168.2.16	73.205.168.52
May 6, 2024 04:57:10.228313923 CEST	51379	21	192.168.2.16	89.110.64.96
May 6, 2024 04:57:10.232841969 CEST	21	51231	79.35.65.174	192.168.2.16
May 6, 2024 04:57:10.244024992 CEST	51242	21	192.168.2.16	173.173.202.168
May 6, 2024 04:57:10.244026899 CEST	51241	2121	192.168.2.16	173.173.202.168
May 6, 2024 04:57:10.244389057 CEST	51380	2121	192.168.2.16	89.110.64.96
May 6, 2024 04:57:10.254331112 CEST	2121	51373	34.128.145.40	192.168.2.16
May 6, 2024 04:57:10.254391909 CEST	51373	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:10.254447937 CEST	51373	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:10.254602909 CEST	51381	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:10.258222103 CEST	21	51374	34.128.145.40	192.168.2.16
May 6, 2024 04:57:10.258275032 CEST	51374	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:10.258317947 CEST	51374	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:10.258444071 CEST	51382	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:10.260463953 CEST	51383	21	192.168.2.16	125.229.45.40
May 6, 2024 04:57:10.266870975 CEST	21	51233	200.126.137.153	192.168.2.16
May 6, 2024 04:57:10.267167091 CEST	51384	2121	192.168.2.16	125.229.45.40
May 6, 2024 04:57:10.271802902 CEST	21	51372	193.124.183.222	192.168.2.16
May 6, 2024 04:57:10.271892071 CEST	51372	21	192.168.2.16	193.124.183.222
May 6, 2024 04:57:10.276496887 CEST	21	51141	193.124.183.222	192.168.2.16
May 6, 2024 04:57:10.276552916 CEST	51141	21	192.168.2.16	193.124.183.222
May 6, 2024 04:57:10.287278891 CEST	2121	51234	79.35.65.174	192.168.2.16
May 6, 2024 04:57:10.292006016 CEST	51244	2121	192.168.2.16	112.153.92.123
May 6, 2024 04:57:10.292022943 CEST	51347	2121	192.168.2.16	73.205.168.52
May 6, 2024 04:57:10.292180061 CEST	51243	21	192.168.2.16	112.153.92.123
May 6, 2024 04:57:10.292232037 CEST	51385	21	192.168.2.16	112.208.5.59
May 6, 2024 04:57:10.307430983 CEST	2121	51342	118.48.230.67	192.168.2.16
May 6, 2024 04:57:10.308022976 CEST	51348	21	192.168.2.16	223.243.254.224
May 6, 2024 04:57:10.308443069 CEST	51386	2121	192.168.2.16	112.208.5.59
May 6, 2024 04:57:10.308542013 CEST	51387	21	192.168.2.16	36.63.36.238
May 6, 2024 04:57:10.308558941 CEST	51388	2121	192.168.2.16	36.63.36.238
May 6, 2024 04:57:10.321888924 CEST	21	51345	149.154.65.23	192.168.2.16
May 6, 2024 04:57:10.322031975 CEST	51345	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:10.322237968 CEST	51389	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:10.324229956 CEST	51390	21	192.168.2.16	217.208.152.117
May 6, 2024 04:57:10.332062006 CEST	21	51355	174.59.40.113	192.168.2.16
May 6, 2024 04:57:10.338155031 CEST	21	51369	87.106.26.129	192.168.2.16
May 6, 2024 04:57:10.338315010 CEST	51369	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:10.340717077 CEST	51391	2121	192.168.2.16	217.208.152.117
May 6, 2024 04:57:10.340845108 CEST	51392	21	192.168.2.16	81.158.159.97
May 6, 2024 04:57:10.340926886 CEST	51393	2121	192.168.2.16	81.158.159.97
May 6, 2024 04:57:10.340950012 CEST	51394	21	192.168.2.16	27.78.235.112
May 6, 2024 04:57:10.345088959 CEST	2121	51356	174.59.40.113	192.168.2.16
May 6, 2024 04:57:10.355005980 CEST	51245	21	192.168.2.16	79.154.32.225
May 6, 2024 04:57:10.355005980 CEST	51351	21	192.168.2.16	116.46.240.106
May 6, 2024 04:57:10.358457088 CEST	2121	51236	200.126.137.153	192.168.2.16
May 6, 2024 04:57:10.364064932 CEST	2121	51381	34.128.145.40	192.168.2.16
May 6, 2024 04:57:10.364075899 CEST	2121	51373	34.128.145.40	192.168.2.16
May 6, 2024 04:57:10.364145041 CEST	51381	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:10.367934942 CEST	21	51374	34.128.145.40	192.168.2.16
May 6, 2024 04:57:10.368289948 CEST	21	51382	34.128.145.40	192.168.2.16
May 6, 2024 04:57:10.368354082 CEST	51382	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:10.370433092 CEST	51395	2121	192.168.2.16	27.78.235.112
May 6, 2024 04:57:10.392597914 CEST	21	51305	174.124.220.86	192.168.2.16
May 6, 2024 04:57:10.406929970 CEST	2121	51317	1.217.78.193	192.168.2.16
May 6, 2024 04:57:10.427333117 CEST	21	51198	103.148.249.3	192.168.2.16
May 6, 2024 04:57:10.434036970 CEST	51249	21	192.168.2.16	216.117.162.236
May 6, 2024 04:57:10.450006008 CEST	51354	2121	192.168.2.16	116.46.240.106
May 6, 2024 04:57:10.450352907 CEST	51396	21	192.168.2.16	99.237.117.46
May 6, 2024 04:57:10.450692892 CEST	21	51379	89.110.64.96	192.168.2.16
May 6, 2024 04:57:10.453314066 CEST	21	51350	81.88.252.91	192.168.2.16
May 6, 2024 04:57:10.453569889 CEST	21	51350	81.88.252.91	192.168.2.16
May 6, 2024 04:57:10.453576088 CEST	51350	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:10.453753948 CEST	51397	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:10.463098049 CEST	2121	51380	89.110.64.96	192.168.2.16
May 6, 2024 04:57:10.473639965 CEST	2121	51381	34.128.145.40	192.168.2.16
May 6, 2024 04:57:10.473711014 CEST	51381	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:10.473793983 CEST	51381	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:10.474018097 CEST	51398	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:10.478082895 CEST	21	51382	34.128.145.40	192.168.2.16
May 6, 2024 04:57:10.478138924 CEST	51382	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:10.478205919 CEST	51382	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:10.478384018 CEST	51399	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:10.482038975 CEST	51273	21	192.168.2.16	118.45.244.181
May 6, 2024 04:57:10.482391119 CEST	51400	2121	192.168.2.16	99.237.117.46
May 6, 2024 04:57:10.484996080 CEST	51274	2121	192.168.2.16	118.45.244.181
May 6, 2024 04:57:10.492732048 CEST	21	51331	154.210.32.21	192.168.2.16
May 6, 2024 04:57:10.495765924 CEST	21	51377	154.210.32.21	192.168.2.16
May 6, 2024 04:57:10.495836020 CEST	51377	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:10.498194933 CEST	51401	21	192.168.2.16	155.97.178.94
May 6, 2024 04:57:10.514216900 CEST	51402	2121	192.168.2.16	155.97.178.94
May 6, 2024 04:57:10.530281067 CEST	51403	21	192.168.2.16	70.177.21.82
May 6, 2024 04:57:10.537951946 CEST	21	51368	103.109.6.215	192.168.2.16
May 6, 2024 04:57:10.538115978 CEST	51368	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:10.544832945 CEST	21	51372	193.124.183.222	192.168.2.16
May 6, 2024 04:57:10.544997931 CEST	51372	21	192.168.2.16	193.124.183.222
May 6, 2024 04:57:10.546205997 CEST	2121	51349	223.243.254.224	192.168.2.16
May 6, 2024 04:57:10.558809996 CEST	21	51383	125.229.45.40	192.168.2.16
May 6, 2024 04:57:10.567327023 CEST	21	51369	87.106.26.129	192.168.2.16
May 6, 2024 04:57:10.567634106 CEST	21	51369	87.106.26.129	192.168.2.16
May 6, 2024 04:57:10.567806005 CEST	51369	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:10.573167086 CEST	2121	51384	125.229.45.40	192.168.2.16
May 6, 2024 04:57:10.579359055 CEST	2121	51196	103.148.249.3	192.168.2.16
May 6, 2024 04:57:10.581994057 CEST	51357	21	192.168.2.16	84.25.8.36
May 6, 2024 04:57:10.584218025 CEST	2121	51381	34.128.145.40	192.168.2.16
May 6, 2024 04:57:10.584515095 CEST	21	51345	149.154.65.23	192.168.2.16
May 6, 2024 04:57:10.584568977 CEST	51345	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:10.585376978 CEST	2121	51398	34.128.145.40	192.168.2.16
May 6, 2024 04:57:10.585470915 CEST	51398	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:10.588470936 CEST	21	51389	149.154.65.23	192.168.2.16
May 6, 2024 04:57:10.588557959 CEST	51389	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:10.588619947 CEST	21	51399	34.128.145.40	192.168.2.16
May 6, 2024 04:57:10.588674068 CEST	51399	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:10.588763952 CEST	21	51382	34.128.145.40	192.168.2.16
May 6, 2024 04:57:10.593022108 CEST	51285	21	192.168.2.16	101.43.67.211
May 6, 2024 04:57:10.593280077 CEST	51404	2121	192.168.2.16	70.177.21.82
May 6, 2024 04:57:10.625010967 CEST	51281	2121	192.168.2.16	101.43.67.211
May 6, 2024 04:57:10.625032902 CEST	51261	21	192.168.2.16	210.1.227.12
May 6, 2024 04:57:10.625032902 CEST	51360	2121	192.168.2.16	84.25.8.36
May 6, 2024 04:57:10.673001051 CEST	51253	2121	192.168.2.16	79.154.32.225
May 6, 2024 04:57:10.673377991 CEST	51405	21	192.168.2.16	69.251.149.18
May 6, 2024 04:57:10.673502922 CEST	51406	2121	192.168.2.16	69.251.149.18
May 6, 2024 04:57:10.678317070 CEST	2121	51402	155.97.178.94	192.168.2.16
May 6, 2024 04:57:10.689218044 CEST	51407	21	192.168.2.16	66.198.245.58
May 6, 2024 04:57:10.695838928 CEST	2121	51398	34.128.145.40	192.168.2.16
May 6, 2024 04:57:10.695894957 CEST	51398	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:10.695965052 CEST	51398	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:10.696149111 CEST	51408	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:10.697804928 CEST	21	51399	34.128.145.40	192.168.2.16
May 6, 2024 04:57:10.697861910 CEST	51399	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:10.697901964 CEST	51399	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:10.698028088 CEST	51409	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:10.705014944 CEST	51339	21	192.168.2.16	118.48.230.67
May 6, 2024 04:57:10.714212894 CEST	21	51350	81.88.252.91	192.168.2.16
May 6, 2024 04:57:10.719604969 CEST	21	51397	81.88.252.91	192.168.2.16
May 6, 2024 04:57:10.719682932 CEST	51397	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:10.769036055 CEST	51361	21	192.168.2.16	47.151.217.109
May 6, 2024 04:57:10.769038916 CEST	51362	2121	192.168.2.16	47.151.217.109
May 6, 2024 04:57:10.787086964 CEST	21	51273	118.45.244.181	192.168.2.16
May 6, 2024 04:57:10.787676096 CEST	2121	51274	118.45.244.181	192.168.2.16
May 6, 2024 04:57:10.797192097 CEST	21	51369	87.106.26.129	192.168.2.16
May 6, 2024 04:57:10.797348022 CEST	51369	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:10.797595024 CEST	51410	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:10.800020933 CEST	51363	21	192.168.2.16	14.46.231.66
May 6, 2024 04:57:10.806541920 CEST	2121	51398	34.128.145.40	192.168.2.16
May 6, 2024 04:57:10.807512045 CEST	2121	51408	34.128.145.40	192.168.2.16
May 6, 2024 04:57:10.807573080 CEST	51408	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:10.808475018 CEST	21	51409	34.128.145.40	192.168.2.16
May 6, 2024 04:57:10.808535099 CEST	51409	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:10.808778048 CEST	21	51399	34.128.145.40	192.168.2.16
May 6, 2024 04:57:10.814018011 CEST	21	51372	193.124.183.222	192.168.2.16
May 6, 2024 04:57:10.814086914 CEST	21	51372	193.124.183.222	192.168.2.16
May 6, 2024 04:57:10.814254045 CEST	51372	21	192.168.2.16	193.124.183.222
May 6, 2024 04:57:10.816003084 CEST	51364	2121	192.168.2.16	14.46.231.66
May 6, 2024 04:57:10.816241026 CEST	51342	2121	192.168.2.16	118.48.230.67
May 6, 2024 04:57:10.832010984 CEST	51366	21	192.168.2.16	180.246.40.42
May 6, 2024 04:57:10.832098007 CEST	51355	21	192.168.2.16	174.59.40.113
May 6, 2024 04:57:10.832493067 CEST	51411	2121	192.168.2.16	66.198.245.58
May 6, 2024 04:57:10.832565069 CEST	51412	21	192.168.2.16	118.221.92.29
May 6, 2024 04:57:10.844604969 CEST	21	51407	66.198.245.58	192.168.2.16
May 6, 2024 04:57:10.844667912 CEST	51407	21	192.168.2.16	66.198.245.58
May 6, 2024 04:57:10.847805977 CEST	21	51377	154.210.32.21	192.168.2.16
May 6, 2024 04:57:10.847946882 CEST	51377	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:10.848006964 CEST	51356	2121	192.168.2.16	174.59.40.113
May 6, 2024 04:57:10.856849909 CEST	21	51389	149.154.65.23	192.168.2.16
May 6, 2024 04:57:10.856960058 CEST	51389	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:10.886193991 CEST	21	51368	103.109.6.215	192.168.2.16
May 6, 2024 04:57:10.886312008 CEST	51368	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:10.896018982 CEST	51305	21	192.168.2.16	174.124.220.86
May 6, 2024 04:57:10.896032095 CEST	51371	21	192.168.2.16	112.255.85.35
May 6, 2024 04:57:10.896037102 CEST	51370	2121	192.168.2.16	180.246.40.42
May 6, 2024 04:57:10.912036896 CEST	51317	2121	192.168.2.16	1.217.78.193
May 6, 2024 04:57:10.918071985 CEST	2121	51408	34.128.145.40	192.168.2.16
May 6, 2024 04:57:10.918128967 CEST	51408	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:10.918164968 CEST	21	51409	34.128.145.40	192.168.2.16
May 6, 2024 04:57:10.918220997 CEST	51409	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:10.918232918 CEST	51408	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:10.918343067 CEST	51409	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:10.918490887 CEST	51413	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:10.918520927 CEST	51414	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:10.928028107 CEST	51256	21	192.168.2.16	87.95.172.48
May 6, 2024 04:57:10.932806969 CEST	21	51285	101.43.67.211	192.168.2.16
May 6, 2024 04:57:10.960031986 CEST	51379	21	192.168.2.16	89.110.64.96
May 6, 2024 04:57:10.974783897 CEST	2121	51281	101.43.67.211	192.168.2.16
May 6, 2024 04:57:10.976026058 CEST	51380	2121	192.168.2.16	89.110.64.96
May 6, 2024 04:57:10.979286909 CEST	21	51261	210.1.227.12	192.168.2.16
May 6, 2024 04:57:10.988020897 CEST	2121	51411	66.198.245.58	192.168.2.16
May 6, 2024 04:57:10.989778042 CEST	21	51397	81.88.252.91	192.168.2.16
May 6, 2024 04:57:10.989929914 CEST	51397	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:10.995022058 CEST	21	51355	174.59.40.113	192.168.2.16
May 6, 2024 04:57:11.001090050 CEST	21	51407	66.198.245.58	192.168.2.16
May 6, 2024 04:57:11.001193047 CEST	51407	21	192.168.2.16	66.198.245.58
May 6, 2024 04:57:11.001472950 CEST	51415	2121	192.168.2.16	118.221.92.29
May 6, 2024 04:57:11.013904095 CEST	2121	51356	174.59.40.113	192.168.2.16
May 6, 2024 04:57:11.014785051 CEST	21	51339	118.48.230.67	192.168.2.16
May 6, 2024 04:57:11.021457911 CEST	21	51410	87.106.26.129	192.168.2.16
May 6, 2024 04:57:11.021527052 CEST	51410	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:11.027386904 CEST	21	51369	87.106.26.129	192.168.2.16
May 6, 2024 04:57:11.027441025 CEST	51369	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:11.027827024 CEST	2121	51408	34.128.145.40	192.168.2.16
May 6, 2024 04:57:11.027853966 CEST	21	51409	34.128.145.40	192.168.2.16
May 6, 2024 04:57:11.028575897 CEST	21	51414	34.128.145.40	192.168.2.16
May 6, 2024 04:57:11.028633118 CEST	51414	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:11.028810978 CEST	2121	51413	34.128.145.40	192.168.2.16
May 6, 2024 04:57:11.028865099 CEST	51413	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:11.040024996 CEST	51258	2121	192.168.2.16	87.95.172.48
May 6, 2024 04:57:11.056026936 CEST	51263	21	192.168.2.16	114.206.121.118
May 6, 2024 04:57:11.056026936 CEST	51260	2121	192.168.2.16	121.23.57.57
May 6, 2024 04:57:11.056026936 CEST	51259	21	192.168.2.16	121.23.57.57
May 6, 2024 04:57:11.056044102 CEST	51264	2121	192.168.2.16	91.48.32.252
May 6, 2024 04:57:11.056049109 CEST	51349	2121	192.168.2.16	223.243.254.224
May 6, 2024 04:57:11.056049109 CEST	51265	21	192.168.2.16	91.48.32.252
May 6, 2024 04:57:11.056062937 CEST	51262	2121	192.168.2.16	210.1.227.12
May 6, 2024 04:57:11.056113958 CEST	51375	2121	192.168.2.16	112.255.85.35
May 6, 2024 04:57:11.056117058 CEST	51266	2121	192.168.2.16	114.206.121.118
May 6, 2024 04:57:11.072036028 CEST	51269	21	192.168.2.16	222.221.40.171
May 6, 2024 04:57:11.072037935 CEST	51276	2121	192.168.2.16	188.115.100.134
May 6, 2024 04:57:11.072037935 CEST	51270	2121	192.168.2.16	222.221.40.171
May 6, 2024 04:57:11.072051048 CEST	51280	21	192.168.2.16	78.141.106.170
May 6, 2024 04:57:11.072058916 CEST	51272	2121	192.168.2.16	24.192.177.91
May 6, 2024 04:57:11.072058916 CEST	51284	2121	192.168.2.16	84.180.28.91
May 6, 2024 04:57:11.072062969 CEST	51271	21	192.168.2.16	24.192.177.91
May 6, 2024 04:57:11.072062969 CEST	51282	2121	192.168.2.16	78.141.106.170
May 6, 2024 04:57:11.072063923 CEST	51279	21	192.168.2.16	187.246.238.3
May 6, 2024 04:57:11.072063923 CEST	51286	21	192.168.2.16	88.7.80.68
May 6, 2024 04:57:11.072066069 CEST	51278	2121	192.168.2.16	20.194.157.24
May 6, 2024 04:57:11.072066069 CEST	51275	21	192.168.2.16	188.115.100.134
May 6, 2024 04:57:11.072874069 CEST	51288	2121	192.168.2.16	88.7.80.68
May 6, 2024 04:57:11.072875023 CEST	51287	2121	192.168.2.16	187.246.238.3
May 6, 2024 04:57:11.072875023 CEST	51290	2121	192.168.2.16	123.57.30.154
May 6, 2024 04:57:11.072875977 CEST	51277	21	192.168.2.16	20.194.157.24
May 6, 2024 04:57:11.072876930 CEST	51283	21	192.168.2.16	84.180.28.91
May 6, 2024 04:57:11.072876930 CEST	51289	21	192.168.2.16	123.57.30.154
May 6, 2024 04:57:11.072947025 CEST	51383	21	192.168.2.16	125.229.45.40
May 6, 2024 04:57:11.088017941 CEST	51295	2121	192.168.2.16	94.9.224.211
May 6, 2024 04:57:11.088020086 CEST	51292	2121	192.168.2.16	85.16.179.135
May 6, 2024 04:57:11.088032007 CEST	51293	21	192.168.2.16	1.254.113.197
May 6, 2024 04:57:11.088032007 CEST	51297	2121	192.168.2.16	188.4.106.112
May 6, 2024 04:57:11.091319084 CEST	21	51305	174.124.220.86	192.168.2.16
May 6, 2024 04:57:11.095081091 CEST	51384	2121	192.168.2.16	125.229.45.40
May 6, 2024 04:57:11.095089912 CEST	51291	21	192.168.2.16	85.16.179.135
May 6, 2024 04:57:11.095123053 CEST	51294	21	192.168.2.16	94.9.224.211
May 6, 2024 04:57:11.104001045 CEST	51304	2121	192.168.2.16	211.117.230.153
May 6, 2024 04:57:11.104003906 CEST	51306	2121	192.168.2.16	174.124.220.86
May 6, 2024 04:57:11.104029894 CEST	51296	2121	192.168.2.16	1.254.113.197
May 6, 2024 04:57:11.104034901 CEST	51376	21	192.168.2.16	174.108.248.173
May 6, 2024 04:57:11.104034901 CEST	51301	21	192.168.2.16	121.196.14.246
May 6, 2024 04:57:11.104041100 CEST	51299	21	192.168.2.16	182.230.41.250
May 6, 2024 04:57:11.104041100 CEST	51307	21	192.168.2.16	98.250.86.24
May 6, 2024 04:57:11.104048967 CEST	51298	21	192.168.2.16	188.4.106.112
May 6, 2024 04:57:11.104072094 CEST	51143	21	192.168.2.16	168.220.94.137
May 6, 2024 04:57:11.104073048 CEST	51302	2121	192.168.2.16	121.196.14.246
May 6, 2024 04:57:11.104322910 CEST	51144	2121	192.168.2.16	168.220.94.137
May 6, 2024 04:57:11.104562998 CEST	51416	21	192.168.2.16	168.220.94.137
May 6, 2024 04:57:11.104609013 CEST	51417	21	192.168.2.16	82.4.29.4
May 6, 2024 04:57:11.104675055 CEST	51418	2121	192.168.2.16	168.220.94.137
May 6, 2024 04:57:11.122071028 CEST	21	51389	149.154.65.23	192.168.2.16
May 6, 2024 04:57:11.122153997 CEST	21	51389	149.154.65.23	192.168.2.16
May 6, 2024 04:57:11.122298956 CEST	51389	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:11.122627020 CEST	51300	2121	192.168.2.16	182.230.41.250
May 6, 2024 04:57:11.122637033 CEST	51303	21	192.168.2.16	211.117.230.153
May 6, 2024 04:57:11.125633955 CEST	21	51372	193.124.183.222	192.168.2.16
May 6, 2024 04:57:11.128089905 CEST	2121	51342	118.48.230.67	192.168.2.16
May 6, 2024 04:57:11.139261007 CEST	2121	51413	34.128.145.40	192.168.2.16
May 6, 2024 04:57:11.139318943 CEST	51413	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:11.139372110 CEST	51413	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:11.139539003 CEST	51419	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:11.139552116 CEST	21	51414	34.128.145.40	192.168.2.16
May 6, 2024 04:57:11.139600992 CEST	51414	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:11.139650106 CEST	51414	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:11.139801025 CEST	51420	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:11.156810999 CEST	21	51407	66.198.245.58	192.168.2.16
May 6, 2024 04:57:11.156903982 CEST	51407	21	192.168.2.16	66.198.245.58
May 6, 2024 04:57:11.157083988 CEST	21	51407	66.198.245.58	192.168.2.16
May 6, 2024 04:57:11.157134056 CEST	51407	21	192.168.2.16	66.198.245.58
May 6, 2024 04:57:11.168282032 CEST	51378	2121	192.168.2.16	174.108.248.173
May 6, 2024 04:57:11.168452024 CEST	51421	2121	192.168.2.16	82.4.29.4
May 6, 2024 04:57:11.181669950 CEST	21	51379	89.110.64.96	192.168.2.16
May 6, 2024 04:57:11.184037924 CEST	51308	2121	192.168.2.16	98.250.86.24
May 6, 2024 04:57:11.184041023 CEST	51402	2121	192.168.2.16	155.97.178.94
May 6, 2024 04:57:11.184572935 CEST	51309	21	192.168.2.16	181.139.185.112
May 6, 2024 04:57:11.194930077 CEST	2121	51380	89.110.64.96	192.168.2.16
May 6, 2024 04:57:11.198276043 CEST	21	51377	154.210.32.21	192.168.2.16
May 6, 2024 04:57:11.198533058 CEST	21	51377	154.210.32.21	192.168.2.16
May 6, 2024 04:57:11.198637962 CEST	51377	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:11.200445890 CEST	51422	21	192.168.2.16	46.23.195.239
May 6, 2024 04:57:11.205910921 CEST	21	51250	45.87.1.166	192.168.2.16
May 6, 2024 04:57:11.206007957 CEST	51250	21	192.168.2.16	45.87.1.166
May 6, 2024 04:57:11.206150055 CEST	51423	21	192.168.2.16	45.87.1.166
May 6, 2024 04:57:11.213681936 CEST	21	51416	168.220.94.137	192.168.2.16
May 6, 2024 04:57:11.213757992 CEST	51416	21	192.168.2.16	168.220.94.137
May 6, 2024 04:57:11.213834047 CEST	2121	51418	168.220.94.137	192.168.2.16
May 6, 2024 04:57:11.213891983 CEST	51418	2121	192.168.2.16	168.220.94.137
May 6, 2024 04:57:11.216521025 CEST	51424	2121	192.168.2.16	46.23.195.239
May 6, 2024 04:57:11.216608047 CEST	51425	21	192.168.2.16	45.45.25.148
May 6, 2024 04:57:11.216687918 CEST	2121	51317	1.217.78.193	192.168.2.16
May 6, 2024 04:57:11.216694117 CEST	51426	2121	192.168.2.16	45.45.25.148
May 6, 2024 04:57:11.220969915 CEST	21	51143	168.220.94.137	192.168.2.16
May 6, 2024 04:57:11.220984936 CEST	2121	51144	168.220.94.137	192.168.2.16
May 6, 2024 04:57:11.232263088 CEST	51427	21	192.168.2.16	73.2.130.98
May 6, 2024 04:57:11.235662937 CEST	21	51368	103.109.6.215	192.168.2.16
May 6, 2024 04:57:11.235769033 CEST	51368	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:11.235882998 CEST	51428	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:11.248660088 CEST	51429	2121	192.168.2.16	73.2.130.98
May 6, 2024 04:57:11.248774052 CEST	51430	2121	192.168.2.16	176.82.250.73
May 6, 2024 04:57:11.248836040 CEST	21	51414	34.128.145.40	192.168.2.16
May 6, 2024 04:57:11.248864889 CEST	2121	51413	34.128.145.40	192.168.2.16
May 6, 2024 04:57:11.248871088 CEST	51431	2121	192.168.2.16	18.65.22.127
May 6, 2024 04:57:11.248872995 CEST	51432	21	192.168.2.16	18.65.22.127
May 6, 2024 04:57:11.249042034 CEST	51433	21	192.168.2.16	176.82.250.73
May 6, 2024 04:57:11.249160051 CEST	2121	51419	34.128.145.40	192.168.2.16
May 6, 2024 04:57:11.249227047 CEST	51419	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:11.249392986 CEST	21	51420	34.128.145.40	192.168.2.16
May 6, 2024 04:57:11.249454021 CEST	51420	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:11.250144958 CEST	21	51397	81.88.252.91	192.168.2.16
May 6, 2024 04:57:11.250267029 CEST	51397	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:11.269263029 CEST	21	51410	87.106.26.129	192.168.2.16
May 6, 2024 04:57:11.269469976 CEST	51410	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:11.280618906 CEST	51434	21	192.168.2.16	193.198.33.9
May 6, 2024 04:57:11.296070099 CEST	51385	21	192.168.2.16	112.208.5.59
May 6, 2024 04:57:11.296071053 CEST	51274	2121	192.168.2.16	118.45.244.181
May 6, 2024 04:57:11.296072960 CEST	51273	21	192.168.2.16	118.45.244.181
May 6, 2024 04:57:11.312011003 CEST	51386	2121	192.168.2.16	112.208.5.59
May 6, 2024 04:57:11.312026024 CEST	51387	21	192.168.2.16	36.63.36.238
May 6, 2024 04:57:11.312047958 CEST	51388	2121	192.168.2.16	36.63.36.238
May 6, 2024 04:57:11.312530041 CEST	51435	21	192.168.2.16	180.123.143.207
May 6, 2024 04:57:11.312601089 CEST	51436	2121	192.168.2.16	193.198.33.9
May 6, 2024 04:57:11.328035116 CEST	51390	21	192.168.2.16	217.208.152.117
May 6, 2024 04:57:11.344012022 CEST	51314	2121	192.168.2.16	181.139.185.112
May 6, 2024 04:57:11.344039917 CEST	51392	21	192.168.2.16	81.158.159.97
May 6, 2024 04:57:11.344043016 CEST	51394	21	192.168.2.16	27.78.235.112
May 6, 2024 04:57:11.344043016 CEST	51391	2121	192.168.2.16	217.208.152.117
May 6, 2024 04:57:11.345149040 CEST	51393	2121	192.168.2.16	81.158.159.97
May 6, 2024 04:57:11.348510027 CEST	2121	51402	155.97.178.94	192.168.2.16
May 6, 2024 04:57:11.358973980 CEST	2121	51419	34.128.145.40	192.168.2.16
May 6, 2024 04:57:11.359035969 CEST	51419	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:11.359133959 CEST	51419	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:11.359138012 CEST	21	51420	34.128.145.40	192.168.2.16
May 6, 2024 04:57:11.359195948 CEST	51420	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:11.359270096 CEST	51420	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:11.359509945 CEST	51437	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:11.359586000 CEST	51438	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:11.360513926 CEST	51439	2121	192.168.2.16	180.123.143.207
May 6, 2024 04:57:11.360635996 CEST	51440	21	192.168.2.16	74.79.122.119
May 6, 2024 04:57:11.370022058 CEST	21	51383	125.229.45.40	192.168.2.16
May 6, 2024 04:57:11.376091003 CEST	51395	2121	192.168.2.16	27.78.235.112
May 6, 2024 04:57:11.376681089 CEST	51441	2121	192.168.2.16	74.79.122.119
May 6, 2024 04:57:11.376837015 CEST	51442	21	192.168.2.16	116.2.98.51
May 6, 2024 04:57:11.388259888 CEST	21	51389	149.154.65.23	192.168.2.16
May 6, 2024 04:57:11.388391018 CEST	51389	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:11.388566017 CEST	51443	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:11.392014980 CEST	51315	21	192.168.2.16	1.217.78.193
May 6, 2024 04:57:11.400228024 CEST	2121	51384	125.229.45.40	192.168.2.16
May 6, 2024 04:57:11.408404112 CEST	51444	2121	192.168.2.16	116.2.98.51
May 6, 2024 04:57:11.408555984 CEST	51445	21	192.168.2.16	93.205.138.193
May 6, 2024 04:57:11.412776947 CEST	2121	51349	223.243.254.224	192.168.2.16
May 6, 2024 04:57:11.423352957 CEST	51446	2121	192.168.2.16	93.205.138.193
May 6, 2024 04:57:11.431976080 CEST	21	51423	45.87.1.166	192.168.2.16
May 6, 2024 04:57:11.432065010 CEST	51423	21	192.168.2.16	45.87.1.166
May 6, 2024 04:57:11.436117887 CEST	21	51250	45.87.1.166	192.168.2.16
May 6, 2024 04:57:11.436178923 CEST	51250	21	192.168.2.16	45.87.1.166
May 6, 2024 04:57:11.439053059 CEST	51285	21	192.168.2.16	101.43.67.211
May 6, 2024 04:57:11.439225912 CEST	51447	21	192.168.2.16	156.232.143.236
May 6, 2024 04:57:11.455111027 CEST	51396	21	192.168.2.16	99.237.117.46
May 6, 2024 04:57:11.455435038 CEST	51448	2121	192.168.2.16	156.232.143.236
May 6, 2024 04:57:11.468869925 CEST	2121	51419	34.128.145.40	192.168.2.16
May 6, 2024 04:57:11.468913078 CEST	21	51420	34.128.145.40	192.168.2.16
May 6, 2024 04:57:11.469744921 CEST	2121	51438	34.128.145.40	192.168.2.16
May 6, 2024 04:57:11.469816923 CEST	51438	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:11.469948053 CEST	21	51437	34.128.145.40	192.168.2.16
May 6, 2024 04:57:11.470031023 CEST	51437	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:11.487019062 CEST	51281	2121	192.168.2.16	101.43.67.211
May 6, 2024 04:57:11.487041950 CEST	51261	21	192.168.2.16	210.1.227.12
May 6, 2024 04:57:11.487561941 CEST	51449	21	192.168.2.16	117.63.5.92
May 6, 2024 04:57:11.487564087 CEST	51400	2121	192.168.2.16	99.237.117.46
May 6, 2024 04:57:11.487607002 CEST	51450	2121	192.168.2.16	117.63.5.92
May 6, 2024 04:57:11.493331909 CEST	21	51410	87.106.26.129	192.168.2.16
May 6, 2024 04:57:11.493558884 CEST	21	51410	87.106.26.129	192.168.2.16
May 6, 2024 04:57:11.493721962 CEST	51410	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:11.503041983 CEST	51411	2121	192.168.2.16	66.198.245.58
May 6, 2024 04:57:11.503042936 CEST	51355	21	192.168.2.16	174.59.40.113
May 6, 2024 04:57:11.503062010 CEST	51319	2121	192.168.2.16	13.43.141.162
May 6, 2024 04:57:11.503062010 CEST	51401	21	192.168.2.16	155.97.178.94
May 6, 2024 04:57:11.503063917 CEST	51318	21	192.168.2.16	13.43.141.162
May 6, 2024 04:57:11.503364086 CEST	51451	21	192.168.2.16	38.152.212.74
May 6, 2024 04:57:11.519035101 CEST	51322	21	192.168.2.16	100.34.163.198
May 6, 2024 04:57:11.519036055 CEST	51356	2121	192.168.2.16	174.59.40.113
May 6, 2024 04:57:11.519172907 CEST	51339	21	192.168.2.16	118.48.230.67
May 6, 2024 04:57:11.525671005 CEST	21	51397	81.88.252.91	192.168.2.16
May 6, 2024 04:57:11.525688887 CEST	21	51397	81.88.252.91	192.168.2.16
May 6, 2024 04:57:11.526063919 CEST	51452	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:11.526114941 CEST	21	51434	193.198.33.9	192.168.2.16
May 6, 2024 04:57:11.532116890 CEST	21	51433	176.82.250.73	192.168.2.16
May 6, 2024 04:57:11.532157898 CEST	2121	51430	176.82.250.73	192.168.2.16
May 6, 2024 04:57:11.535094976 CEST	51403	21	192.168.2.16	70.177.21.82
May 6, 2024 04:57:11.535348892 CEST	51453	2121	192.168.2.16	38.152.212.74
May 6, 2024 04:57:11.550014973 CEST	51323	2121	192.168.2.16	100.34.163.198
May 6, 2024 04:57:11.550318956 CEST	51454	21	192.168.2.16	45.194.50.79
May 6, 2024 04:57:11.557784081 CEST	2121	51436	193.198.33.9	192.168.2.16
May 6, 2024 04:57:11.559706926 CEST	21	51377	154.210.32.21	192.168.2.16
May 6, 2024 04:57:11.559844017 CEST	51377	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:11.559995890 CEST	51455	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:11.560518026 CEST	21	51377	154.210.32.21	192.168.2.16
May 6, 2024 04:57:11.560571909 CEST	51377	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:11.566240072 CEST	51456	2121	192.168.2.16	45.194.50.79
May 6, 2024 04:57:11.579967022 CEST	2121	51438	34.128.145.40	192.168.2.16
May 6, 2024 04:57:11.580032110 CEST	51438	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:11.580142975 CEST	51438	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:11.580367088 CEST	51457	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:11.580538034 CEST	21	51437	34.128.145.40	192.168.2.16
May 6, 2024 04:57:11.580602884 CEST	51437	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:11.580667019 CEST	51437	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:11.580826044 CEST	51458	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:11.584012985 CEST	21	51368	103.109.6.215	192.168.2.16
May 6, 2024 04:57:11.584022999 CEST	21	51368	103.109.6.215	192.168.2.16
May 6, 2024 04:57:11.584074020 CEST	51368	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:11.598042011 CEST	51404	2121	192.168.2.16	70.177.21.82
May 6, 2024 04:57:11.598507881 CEST	51459	21	192.168.2.16	65.35.98.88
May 6, 2024 04:57:11.599042892 CEST	2121	51274	118.45.244.181	192.168.2.16
May 6, 2024 04:57:11.601023912 CEST	21	51273	118.45.244.181	192.168.2.16
May 6, 2024 04:57:11.602051973 CEST	51460	2121	192.168.2.16	65.35.98.88
May 6, 2024 04:57:11.604515076 CEST	21	51428	103.109.6.215	192.168.2.16
May 6, 2024 04:57:11.604594946 CEST	51428	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:11.614475012 CEST	51461	21	192.168.2.16	109.250.140.249
May 6, 2024 04:57:11.614564896 CEST	51462	2121	192.168.2.16	109.250.140.249
May 6, 2024 04:57:11.614650011 CEST	51463	21	192.168.2.16	85.251.40.131
May 6, 2024 04:57:11.614686012 CEST	51464	2121	192.168.2.16	85.251.40.131
May 6, 2024 04:57:11.630040884 CEST	51342	2121	192.168.2.16	118.48.230.67
May 6, 2024 04:57:11.630043030 CEST	51325	21	192.168.2.16	79.45.206.243
May 6, 2024 04:57:11.630409956 CEST	51465	21	192.168.2.16	190.178.4.55
May 6, 2024 04:57:11.630465031 CEST	51466	2121	192.168.2.16	190.178.4.55
May 6, 2024 04:57:11.643554926 CEST	21	51443	149.154.65.23	192.168.2.16
May 6, 2024 04:57:11.643654108 CEST	51443	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:11.646462917 CEST	51467	2121	192.168.2.16	212.241.99.117
May 6, 2024 04:57:11.646522999 CEST	51468	21	192.168.2.16	212.241.99.117
May 6, 2024 04:57:11.654680014 CEST	21	51389	149.154.65.23	192.168.2.16
May 6, 2024 04:57:11.654742956 CEST	51389	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:11.659636021 CEST	2121	51411	66.198.245.58	192.168.2.16
May 6, 2024 04:57:11.660144091 CEST	21	51423	45.87.1.166	192.168.2.16
May 6, 2024 04:57:11.660254955 CEST	51423	21	192.168.2.16	45.87.1.166
May 6, 2024 04:57:11.662542105 CEST	51470	21	192.168.2.16	52.242.72.10
May 6, 2024 04:57:11.662611961 CEST	51471	2121	192.168.2.16	183.100.135.223
May 6, 2024 04:57:11.662614107 CEST	51469	21	192.168.2.16	183.100.135.223
May 6, 2024 04:57:11.667654037 CEST	21	51355	174.59.40.113	192.168.2.16
May 6, 2024 04:57:11.678011894 CEST	51405	21	192.168.2.16	69.251.149.18
May 6, 2024 04:57:11.678065062 CEST	51406	2121	192.168.2.16	69.251.149.18
May 6, 2024 04:57:11.678489923 CEST	51472	21	192.168.2.16	113.22.156.85
May 6, 2024 04:57:11.678548098 CEST	51473	2121	192.168.2.16	52.242.72.10
May 6, 2024 04:57:11.685620070 CEST	2121	51356	174.59.40.113	192.168.2.16
May 6, 2024 04:57:11.689357996 CEST	2121	51438	34.128.145.40	192.168.2.16
May 6, 2024 04:57:11.689917088 CEST	2121	51457	34.128.145.40	192.168.2.16
May 6, 2024 04:57:11.689996004 CEST	51457	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:11.690138102 CEST	21	51437	34.128.145.40	192.168.2.16
May 6, 2024 04:57:11.690325975 CEST	21	51458	34.128.145.40	192.168.2.16
May 6, 2024 04:57:11.690428972 CEST	51458	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:11.694009066 CEST	51379	21	192.168.2.16	89.110.64.96
May 6, 2024 04:57:11.694094896 CEST	51326	2121	192.168.2.16	79.45.206.243
May 6, 2024 04:57:11.694448948 CEST	51474	2121	192.168.2.16	113.22.156.85
May 6, 2024 04:57:11.694576025 CEST	51475	21	192.168.2.16	34.123.190.8
May 6, 2024 04:57:11.694680929 CEST	51476	2121	192.168.2.16	34.123.190.8
May 6, 2024 04:57:11.710033894 CEST	51380	2121	192.168.2.16	89.110.64.96
May 6, 2024 04:57:11.710221052 CEST	51327	21	192.168.2.16	65.128.47.237
May 6, 2024 04:57:11.718957901 CEST	21	51410	87.106.26.129	192.168.2.16
May 6, 2024 04:57:11.719285011 CEST	51410	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:11.719424009 CEST	51477	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:11.726072073 CEST	51142	21	192.168.2.16	188.214.156.147
May 6, 2024 04:57:11.726229906 CEST	51317	2121	192.168.2.16	1.217.78.193
May 6, 2024 04:57:11.726437092 CEST	51478	21	192.168.2.16	67.22.63.31
May 6, 2024 04:57:11.726500988 CEST	51479	21	192.168.2.16	188.214.156.147
May 6, 2024 04:57:11.727042913 CEST	2121	51439	180.123.143.207	192.168.2.16
May 6, 2024 04:57:11.742125988 CEST	51330	2121	192.168.2.16	65.128.47.237
May 6, 2024 04:57:11.742286921 CEST	51480	2121	192.168.2.16	67.22.63.31
May 6, 2024 04:57:11.758585930 CEST	51481	21	192.168.2.16	172.77.243.169
May 6, 2024 04:57:11.761251926 CEST	21	51447	156.232.143.236	192.168.2.16
May 6, 2024 04:57:11.774491072 CEST	51482	2121	192.168.2.16	172.77.243.169
May 6, 2024 04:57:11.774528980 CEST	51483	21	192.168.2.16	79.105.143.96
May 6, 2024 04:57:11.780256987 CEST	21	51285	101.43.67.211	192.168.2.16
May 6, 2024 04:57:11.790630102 CEST	51484	21	192.168.2.16	180.248.225.69
May 6, 2024 04:57:11.790730000 CEST	51485	2121	192.168.2.16	79.105.143.96
May 6, 2024 04:57:11.797344923 CEST	21	51452	81.88.252.91	192.168.2.16
May 6, 2024 04:57:11.797425032 CEST	51452	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:11.799828053 CEST	2121	51457	34.128.145.40	192.168.2.16
May 6, 2024 04:57:11.799889088 CEST	51457	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:11.799967051 CEST	51457	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:11.800184011 CEST	51486	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:11.800220013 CEST	21	51458	34.128.145.40	192.168.2.16
May 6, 2024 04:57:11.800286055 CEST	51458	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:11.800334930 CEST	51458	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:11.800499916 CEST	51487	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:11.806353092 CEST	51488	2121	192.168.2.16	180.248.225.69
May 6, 2024 04:57:11.829421043 CEST	21	51339	118.48.230.67	192.168.2.16
May 6, 2024 04:57:11.831290007 CEST	2121	51450	117.63.5.92	192.168.2.16
May 6, 2024 04:57:11.837722063 CEST	2121	51281	101.43.67.211	192.168.2.16
May 6, 2024 04:57:11.838032007 CEST	51412	21	192.168.2.16	118.221.92.29
May 6, 2024 04:57:11.838159084 CEST	51489	21	192.168.2.16	68.110.215.70
May 6, 2024 04:57:11.842199087 CEST	21	51261	210.1.227.12	192.168.2.16
May 6, 2024 04:57:11.853035927 CEST	51402	2121	192.168.2.16	155.97.178.94
May 6, 2024 04:57:11.853507996 CEST	51490	2121	192.168.2.16	68.110.215.70
May 6, 2024 04:57:11.853509903 CEST	51491	21	192.168.2.16	187.146.33.65
May 6, 2024 04:57:11.869350910 CEST	51492	2121	192.168.2.16	187.146.33.65
May 6, 2024 04:57:11.884129047 CEST	21	51423	45.87.1.166	192.168.2.16
May 6, 2024 04:57:11.884402990 CEST	21	51423	45.87.1.166	192.168.2.16
May 6, 2024 04:57:11.884521961 CEST	51423	21	192.168.2.16	45.87.1.166
May 6, 2024 04:57:11.885094881 CEST	51383	21	192.168.2.16	125.229.45.40
May 6, 2024 04:57:11.885380030 CEST	51493	21	192.168.2.16	104.40.217.229
May 6, 2024 04:57:11.900466919 CEST	21	51443	149.154.65.23	192.168.2.16
May 6, 2024 04:57:11.900624990 CEST	51443	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:11.901191950 CEST	51384	2121	192.168.2.16	125.229.45.40
May 6, 2024 04:57:11.901582956 CEST	51494	2121	192.168.2.16	104.40.217.229
May 6, 2024 04:57:11.901621103 CEST	51495	21	192.168.2.16	90.208.144.81
May 6, 2024 04:57:11.901684999 CEST	51496	2121	192.168.2.16	90.208.144.81
May 6, 2024 04:57:11.907809973 CEST	21	51455	154.210.32.21	192.168.2.16
May 6, 2024 04:57:11.907881975 CEST	51455	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:11.909432888 CEST	2121	51457	34.128.145.40	192.168.2.16
May 6, 2024 04:57:11.909701109 CEST	2121	51486	34.128.145.40	192.168.2.16
May 6, 2024 04:57:11.909759045 CEST	51486	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:11.909820080 CEST	21	51458	34.128.145.40	192.168.2.16
May 6, 2024 04:57:11.910511971 CEST	21	51377	154.210.32.21	192.168.2.16
May 6, 2024 04:57:11.910907030 CEST	21	51487	34.128.145.40	192.168.2.16
May 6, 2024 04:57:11.910978079 CEST	51487	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:11.915585041 CEST	21	51379	89.110.64.96	192.168.2.16
May 6, 2024 04:57:11.926008940 CEST	51349	2121	192.168.2.16	223.243.254.224
May 6, 2024 04:57:11.926018953 CEST	51332	21	192.168.2.16	38.158.75.27
May 6, 2024 04:57:11.928791046 CEST	2121	51380	89.110.64.96	192.168.2.16
May 6, 2024 04:57:11.933006048 CEST	51334	2121	192.168.2.16	38.158.75.27
May 6, 2024 04:57:11.933450937 CEST	51497	21	192.168.2.16	169.148.152.113
May 6, 2024 04:57:11.942342997 CEST	2121	51342	118.48.230.67	192.168.2.16
May 6, 2024 04:57:11.943280935 CEST	21	51477	87.106.26.129	192.168.2.16
May 6, 2024 04:57:11.943351984 CEST	51477	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:11.945139885 CEST	21	51410	87.106.26.129	192.168.2.16
May 6, 2024 04:57:11.945194960 CEST	51410	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:11.965044975 CEST	2121	51471	183.100.135.223	192.168.2.16
May 6, 2024 04:57:11.971661091 CEST	21	51469	183.100.135.223	192.168.2.16
May 6, 2024 04:57:11.974139929 CEST	21	51428	103.109.6.215	192.168.2.16
May 6, 2024 04:57:11.974272013 CEST	51428	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:11.975511074 CEST	21	51479	188.214.156.147	192.168.2.16
May 6, 2024 04:57:11.975588083 CEST	51479	21	192.168.2.16	188.214.156.147
May 6, 2024 04:57:11.981570005 CEST	51498	2121	192.168.2.16	169.148.152.113
May 6, 2024 04:57:11.981658936 CEST	51499	21	192.168.2.16	18.25.129.238
May 6, 2024 04:57:11.997435093 CEST	51500	2121	192.168.2.16	18.25.129.238
May 6, 2024 04:57:11.997488022 CEST	51501	21	192.168.2.16	67.209.52.183
May 6, 2024 04:57:12.013026953 CEST	51415	2121	192.168.2.16	118.221.92.29
May 6, 2024 04:57:12.013350010 CEST	51502	2121	192.168.2.16	67.209.52.183
May 6, 2024 04:57:12.013436079 CEST	51503	21	192.168.2.16	182.138.136.210
May 6, 2024 04:57:12.015563965 CEST	21	51142	188.214.156.147	192.168.2.16
May 6, 2024 04:57:12.016951084 CEST	2121	51402	155.97.178.94	192.168.2.16
May 6, 2024 04:57:12.019359112 CEST	2121	51486	34.128.145.40	192.168.2.16
May 6, 2024 04:57:12.019423962 CEST	51486	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:12.019489050 CEST	51486	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:12.019678116 CEST	51504	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:12.021476030 CEST	21	51487	34.128.145.40	192.168.2.16
May 6, 2024 04:57:12.021533012 CEST	51487	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:12.021600008 CEST	51487	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:12.021779060 CEST	51505	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:12.029014111 CEST	51337	21	192.168.2.16	84.30.79.204
May 6, 2024 04:57:12.031095028 CEST	2121	51317	1.217.78.193	192.168.2.16
May 6, 2024 04:57:12.031128883 CEST	51434	21	192.168.2.16	193.198.33.9
May 6, 2024 04:57:12.031336069 CEST	51506	2121	192.168.2.16	182.138.136.210
May 6, 2024 04:57:12.045036077 CEST	51430	2121	192.168.2.16	176.82.250.73
May 6, 2024 04:57:12.045037985 CEST	51433	21	192.168.2.16	176.82.250.73
May 6, 2024 04:57:12.061049938 CEST	51338	2121	192.168.2.16	84.30.79.204
May 6, 2024 04:57:12.061053991 CEST	51436	2121	192.168.2.16	193.198.33.9
May 6, 2024 04:57:12.071137905 CEST	21	51452	81.88.252.91	192.168.2.16
May 6, 2024 04:57:12.071294069 CEST	51452	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:12.108124018 CEST	51417	21	192.168.2.16	82.4.29.4
May 6, 2024 04:57:12.130228043 CEST	2121	51486	34.128.145.40	192.168.2.16
May 6, 2024 04:57:12.131189108 CEST	2121	51504	34.128.145.40	192.168.2.16
May 6, 2024 04:57:12.131256104 CEST	51504	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:12.132436991 CEST	21	51505	34.128.145.40	192.168.2.16
May 6, 2024 04:57:12.132502079 CEST	51505	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:12.150605917 CEST	21	51423	45.87.1.166	192.168.2.16
May 6, 2024 04:57:12.156039000 CEST	21	51443	149.154.65.23	192.168.2.16
May 6, 2024 04:57:12.156054020 CEST	21	51443	149.154.65.23	192.168.2.16
May 6, 2024 04:57:12.156228065 CEST	51443	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:12.172025919 CEST	51411	2121	192.168.2.16	66.198.245.58
May 6, 2024 04:57:12.172116995 CEST	51343	21	192.168.2.16	212.187.48.111
May 6, 2024 04:57:12.172116995 CEST	51355	21	192.168.2.16	174.59.40.113
May 6, 2024 04:57:12.172116995 CEST	51421	2121	192.168.2.16	82.4.29.4
May 6, 2024 04:57:12.178958893 CEST	2121	51488	180.248.225.69	192.168.2.16
May 6, 2024 04:57:12.185920954 CEST	21	51383	125.229.45.40	192.168.2.16
May 6, 2024 04:57:12.188034058 CEST	51356	2121	192.168.2.16	174.59.40.113
May 6, 2024 04:57:12.188038111 CEST	51344	2121	192.168.2.16	212.187.48.111
May 6, 2024 04:57:12.190608978 CEST	21	51477	87.106.26.129	192.168.2.16
May 6, 2024 04:57:12.191024065 CEST	51477	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:12.204026937 CEST	51422	21	192.168.2.16	46.23.195.239
May 6, 2024 04:57:12.208168030 CEST	2121	51384	125.229.45.40	192.168.2.16
May 6, 2024 04:57:12.211450100 CEST	21	51501	67.209.52.183	192.168.2.16
May 6, 2024 04:57:12.220038891 CEST	51425	21	192.168.2.16	45.45.25.148
May 6, 2024 04:57:12.220038891 CEST	51424	2121	192.168.2.16	46.23.195.239
May 6, 2024 04:57:12.223222017 CEST	51426	2121	192.168.2.16	45.45.25.148
May 6, 2024 04:57:12.226725101 CEST	21	51479	188.214.156.147	192.168.2.16
May 6, 2024 04:57:12.226918936 CEST	51479	21	192.168.2.16	188.214.156.147
May 6, 2024 04:57:12.228259087 CEST	2121	51502	67.209.52.183	192.168.2.16
May 6, 2024 04:57:12.236021042 CEST	51439	2121	192.168.2.16	180.123.143.207
May 6, 2024 04:57:12.236114025 CEST	51427	21	192.168.2.16	73.2.130.98
May 6, 2024 04:57:12.236124039 CEST	51346	21	192.168.2.16	73.205.168.52
May 6, 2024 04:57:12.236530066 CEST	51507	21	192.168.2.16	121.164.250.185
May 6, 2024 04:57:12.236633062 CEST	51508	2121	192.168.2.16	121.164.250.185
May 6, 2024 04:57:12.241692066 CEST	2121	51504	34.128.145.40	192.168.2.16
May 6, 2024 04:57:12.241753101 CEST	51504	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:12.241832018 CEST	51504	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:12.242054939 CEST	51509	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:12.242074013 CEST	21	51505	34.128.145.40	192.168.2.16
May 6, 2024 04:57:12.242136002 CEST	51505	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:12.242187977 CEST	51505	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:12.242345095 CEST	51510	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:12.252007008 CEST	51429	2121	192.168.2.16	73.2.130.98
May 6, 2024 04:57:12.252029896 CEST	51431	2121	192.168.2.16	18.65.22.127
May 6, 2024 04:57:12.255172968 CEST	51432	21	192.168.2.16	18.65.22.127
May 6, 2024 04:57:12.257222891 CEST	21	51455	154.210.32.21	192.168.2.16
May 6, 2024 04:57:12.257359028 CEST	51455	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:12.268019915 CEST	51447	21	192.168.2.16	156.232.143.236
May 6, 2024 04:57:12.276513100 CEST	21	51434	193.198.33.9	192.168.2.16
May 6, 2024 04:57:12.282640934 CEST	2121	51349	223.243.254.224	192.168.2.16
May 6, 2024 04:57:12.284416914 CEST	51511	21	192.168.2.16	114.69.228.54
May 6, 2024 04:57:12.284682035 CEST	51512	2121	192.168.2.16	114.69.228.54
May 6, 2024 04:57:12.288830996 CEST	21	51497	169.148.152.113	192.168.2.16
May 6, 2024 04:57:12.300051928 CEST	51347	2121	192.168.2.16	73.205.168.52
May 6, 2024 04:57:12.306287050 CEST	2121	51436	193.198.33.9	192.168.2.16
May 6, 2024 04:57:12.316034079 CEST	51435	21	192.168.2.16	180.123.143.207
May 6, 2024 04:57:12.316351891 CEST	51348	21	192.168.2.16	223.243.254.224
May 6, 2024 04:57:12.329615116 CEST	2121	51411	66.198.245.58	192.168.2.16
May 6, 2024 04:57:12.331902027 CEST	2121	51430	176.82.250.73	192.168.2.16
May 6, 2024 04:57:12.331916094 CEST	21	51433	176.82.250.73	192.168.2.16
May 6, 2024 04:57:12.332037926 CEST	51339	21	192.168.2.16	118.48.230.67
May 6, 2024 04:57:12.332882881 CEST	51450	2121	192.168.2.16	117.63.5.92
May 6, 2024 04:57:12.336587906 CEST	2121	51498	169.148.152.113	192.168.2.16
May 6, 2024 04:57:12.340265989 CEST	21	51355	174.59.40.113	192.168.2.16
May 6, 2024 04:57:12.340756893 CEST	51513	21	192.168.2.16	46.158.210.29
May 6, 2024 04:57:12.342828035 CEST	21	51428	103.109.6.215	192.168.2.16
May 6, 2024 04:57:12.343075991 CEST	51428	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:12.343511105 CEST	21	51452	81.88.252.91	192.168.2.16
May 6, 2024 04:57:12.343648911 CEST	51452	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:12.348037004 CEST	51487	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:12.348308086 CEST	51514	2121	192.168.2.16	46.158.210.29
May 6, 2024 04:57:12.353662968 CEST	2121	51504	34.128.145.40	192.168.2.16
May 6, 2024 04:57:12.353777885 CEST	2121	51356	174.59.40.113	192.168.2.16
May 6, 2024 04:57:12.353939056 CEST	2121	51509	34.128.145.40	192.168.2.16
May 6, 2024 04:57:12.354020119 CEST	51509	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:12.354341984 CEST	21	51510	34.128.145.40	192.168.2.16
May 6, 2024 04:57:12.354408979 CEST	51510	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:12.364036083 CEST	51440	21	192.168.2.16	74.79.122.119
May 6, 2024 04:57:12.364049911 CEST	51351	21	192.168.2.16	116.46.240.106
May 6, 2024 04:57:12.364489079 CEST	51515	21	192.168.2.16	101.69.59.74
May 6, 2024 04:57:12.380045891 CEST	51441	2121	192.168.2.16	74.79.122.119
May 6, 2024 04:57:12.382793903 CEST	51442	21	192.168.2.16	116.2.98.51
May 6, 2024 04:57:12.388120890 CEST	21	51503	182.138.136.210	192.168.2.16
May 6, 2024 04:57:12.397612095 CEST	2121	51506	182.138.136.210	192.168.2.16
May 6, 2024 04:57:12.412034988 CEST	51444	2121	192.168.2.16	116.2.98.51
May 6, 2024 04:57:12.412034988 CEST	51445	21	192.168.2.16	93.205.138.193
May 6, 2024 04:57:12.412297010 CEST	51516	21	192.168.2.16	216.117.162.236
May 6, 2024 04:57:12.412888050 CEST	21	51443	149.154.65.23	192.168.2.16
May 6, 2024 04:57:12.413033962 CEST	51443	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:12.413239002 CEST	51517	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:12.415947914 CEST	21	51477	87.106.26.129	192.168.2.16
May 6, 2024 04:57:12.416074991 CEST	21	51477	87.106.26.129	192.168.2.16
May 6, 2024 04:57:12.416250944 CEST	51477	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:12.428042889 CEST	51379	21	192.168.2.16	89.110.64.96
May 6, 2024 04:57:12.431343079 CEST	51446	2121	192.168.2.16	93.205.138.193
May 6, 2024 04:57:12.444034100 CEST	51342	2121	192.168.2.16	118.48.230.67
May 6, 2024 04:57:12.444042921 CEST	51380	2121	192.168.2.16	89.110.64.96
May 6, 2024 04:57:12.457618952 CEST	21	51487	34.128.145.40	192.168.2.16
May 6, 2024 04:57:12.460014105 CEST	51354	2121	192.168.2.16	116.46.240.106
May 6, 2024 04:57:12.460303068 CEST	51448	2121	192.168.2.16	156.232.143.236
May 6, 2024 04:57:12.463330030 CEST	2121	51509	34.128.145.40	192.168.2.16
May 6, 2024 04:57:12.463391066 CEST	51509	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:12.463479996 CEST	51509	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:12.463701963 CEST	51518	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:12.465358973 CEST	21	51510	34.128.145.40	192.168.2.16
May 6, 2024 04:57:12.465423107 CEST	51510	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:12.465476036 CEST	51510	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:12.465626001 CEST	51519	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:12.476006985 CEST	51471	2121	192.168.2.16	183.100.135.223
May 6, 2024 04:57:12.476037025 CEST	51469	21	192.168.2.16	183.100.135.223
May 6, 2024 04:57:12.477618933 CEST	21	51479	188.214.156.147	192.168.2.16
May 6, 2024 04:57:12.477745056 CEST	21	51479	188.214.156.147	192.168.2.16
May 6, 2024 04:57:12.477916956 CEST	51479	21	192.168.2.16	188.214.156.147
May 6, 2024 04:57:12.492027044 CEST	51449	21	192.168.2.16	117.63.5.92
May 6, 2024 04:57:12.508039951 CEST	51451	21	192.168.2.16	38.152.212.74
May 6, 2024 04:57:12.524033070 CEST	51402	2121	192.168.2.16	155.97.178.94
May 6, 2024 04:57:12.540105104 CEST	51453	2121	192.168.2.16	38.152.212.74
May 6, 2024 04:57:12.559247017 CEST	51454	21	192.168.2.16	45.194.50.79
May 6, 2024 04:57:12.572016001 CEST	51456	2121	192.168.2.16	45.194.50.79
May 6, 2024 04:57:12.573311090 CEST	2121	51518	34.128.145.40	192.168.2.16
May 6, 2024 04:57:12.573342085 CEST	51505	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:12.573376894 CEST	51518	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:12.573453903 CEST	2121	51509	34.128.145.40	192.168.2.16
May 6, 2024 04:57:12.575037956 CEST	21	51510	34.128.145.40	192.168.2.16
May 6, 2024 04:57:12.576005936 CEST	21	51519	34.128.145.40	192.168.2.16
May 6, 2024 04:57:12.576072931 CEST	51519	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:12.588017941 CEST	51357	21	192.168.2.16	84.25.8.36
May 6, 2024 04:57:12.590936899 CEST	21	51447	156.232.143.236	192.168.2.16
May 6, 2024 04:57:12.601602077 CEST	2121	51439	180.123.143.207	192.168.2.16
May 6, 2024 04:57:12.604029894 CEST	51460	2121	192.168.2.16	65.35.98.88
May 6, 2024 04:57:12.604031086 CEST	51459	21	192.168.2.16	65.35.98.88
May 6, 2024 04:57:12.608023882 CEST	21	51455	154.210.32.21	192.168.2.16
May 6, 2024 04:57:12.608035088 CEST	21	51455	154.210.32.21	192.168.2.16
May 6, 2024 04:57:12.608167887 CEST	51455	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:12.620018959 CEST	51461	21	192.168.2.16	109.250.140.249
May 6, 2024 04:57:12.620034933 CEST	51464	2121	192.168.2.16	85.251.40.131
May 6, 2024 04:57:12.620035887 CEST	51463	21	192.168.2.16	85.251.40.131
May 6, 2024 04:57:12.620112896 CEST	51462	2121	192.168.2.16	109.250.140.249
May 6, 2024 04:57:12.622520924 CEST	21	51452	81.88.252.91	192.168.2.16
May 6, 2024 04:57:12.622534037 CEST	21	51452	81.88.252.91	192.168.2.16
May 6, 2024 04:57:12.623655081 CEST	51520	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:12.634095907 CEST	21	51511	114.69.228.54	192.168.2.16
May 6, 2024 04:57:12.636017084 CEST	51466	2121	192.168.2.16	190.178.4.55
May 6, 2024 04:57:12.638408899 CEST	2121	51512	114.69.228.54	192.168.2.16
May 6, 2024 04:57:12.640005112 CEST	51360	2121	192.168.2.16	84.25.8.36
May 6, 2024 04:57:12.640563011 CEST	21	51477	87.106.26.129	192.168.2.16
May 6, 2024 04:57:12.640594959 CEST	51465	21	192.168.2.16	190.178.4.55
May 6, 2024 04:57:12.640700102 CEST	51477	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:12.640923977 CEST	51521	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:12.644072056 CEST	21	51339	118.48.230.67	192.168.2.16
May 6, 2024 04:57:12.644413948 CEST	51522	2121	192.168.2.16	101.69.59.74
May 6, 2024 04:57:12.649734974 CEST	21	51379	89.110.64.96	192.168.2.16
May 6, 2024 04:57:12.652009964 CEST	51468	21	192.168.2.16	212.241.99.117
May 6, 2024 04:57:12.652028084 CEST	51467	2121	192.168.2.16	212.241.99.117
May 6, 2024 04:57:12.662868977 CEST	2121	51380	89.110.64.96	192.168.2.16
May 6, 2024 04:57:12.667269945 CEST	21	51443	149.154.65.23	192.168.2.16
May 6, 2024 04:57:12.667325974 CEST	51443	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:12.668030977 CEST	51470	21	192.168.2.16	52.242.72.10
May 6, 2024 04:57:12.668283939 CEST	51523	21	192.168.2.16	35.238.176.156
May 6, 2024 04:57:12.675837994 CEST	2121	51450	117.63.5.92	192.168.2.16
May 6, 2024 04:57:12.682913065 CEST	21	51505	34.128.145.40	192.168.2.16
May 6, 2024 04:57:12.684025049 CEST	51472	21	192.168.2.16	113.22.156.85
May 6, 2024 04:57:12.684027910 CEST	21	51517	149.154.65.23	192.168.2.16
May 6, 2024 04:57:12.684056044 CEST	51473	2121	192.168.2.16	52.242.72.10
May 6, 2024 04:57:12.684088945 CEST	51517	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:12.684827089 CEST	2121	51518	34.128.145.40	192.168.2.16
May 6, 2024 04:57:12.684878111 CEST	51518	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:12.684942007 CEST	51518	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:12.685100079 CEST	51524	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:12.686466932 CEST	21	51519	34.128.145.40	192.168.2.16
May 6, 2024 04:57:12.686516047 CEST	51519	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:12.686558962 CEST	51519	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:12.686666965 CEST	51525	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:12.688040018 CEST	2121	51402	155.97.178.94	192.168.2.16
May 6, 2024 04:57:12.692002058 CEST	51488	2121	192.168.2.16	180.248.225.69
May 6, 2024 04:57:12.700016022 CEST	51474	2121	192.168.2.16	113.22.156.85
May 6, 2024 04:57:12.700017929 CEST	51383	21	192.168.2.16	125.229.45.40
May 6, 2024 04:57:12.702322006 CEST	51475	21	192.168.2.16	34.123.190.8
May 6, 2024 04:57:12.702322006 CEST	51476	2121	192.168.2.16	34.123.190.8
May 6, 2024 04:57:12.713104010 CEST	21	51428	103.109.6.215	192.168.2.16
May 6, 2024 04:57:12.713234901 CEST	51428	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:12.713406086 CEST	51526	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:12.716003895 CEST	51384	2121	192.168.2.16	125.229.45.40
May 6, 2024 04:57:12.716016054 CEST	51501	21	192.168.2.16	67.209.52.183
May 6, 2024 04:57:12.726963043 CEST	21	51479	188.214.156.147	192.168.2.16
May 6, 2024 04:57:12.732011080 CEST	51502	2121	192.168.2.16	67.209.52.183
May 6, 2024 04:57:12.732026100 CEST	51478	21	192.168.2.16	67.22.63.31
May 6, 2024 04:57:12.748034954 CEST	51480	2121	192.168.2.16	67.22.63.31
May 6, 2024 04:57:12.752533913 CEST	2121	51342	118.48.230.67	192.168.2.16
May 6, 2024 04:57:12.764213085 CEST	51481	21	192.168.2.16	172.77.243.169
May 6, 2024 04:57:12.764380932 CEST	51527	2121	192.168.2.16	35.238.176.156
May 6, 2024 04:57:12.776972055 CEST	2121	51471	183.100.135.223	192.168.2.16
May 6, 2024 04:57:12.779011011 CEST	51361	21	192.168.2.16	47.151.217.109
May 6, 2024 04:57:12.779011965 CEST	51362	2121	192.168.2.16	47.151.217.109
May 6, 2024 04:57:12.779026031 CEST	51482	2121	192.168.2.16	172.77.243.169
May 6, 2024 04:57:12.779023886 CEST	51434	21	192.168.2.16	193.198.33.9
May 6, 2024 04:57:12.779040098 CEST	51483	21	192.168.2.16	79.105.143.96
May 6, 2024 04:57:12.783610106 CEST	21	51469	183.100.135.223	192.168.2.16
May 6, 2024 04:57:12.794634104 CEST	2121	51518	34.128.145.40	192.168.2.16
May 6, 2024 04:57:12.794760942 CEST	2121	51524	34.128.145.40	192.168.2.16
May 6, 2024 04:57:12.794826031 CEST	51524	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:12.795032024 CEST	51349	2121	192.168.2.16	223.243.254.224
May 6, 2024 04:57:12.795046091 CEST	51484	21	192.168.2.16	180.248.225.69
May 6, 2024 04:57:12.795046091 CEST	51497	21	192.168.2.16	169.148.152.113
May 6, 2024 04:57:12.795136929 CEST	51485	2121	192.168.2.16	79.105.143.96
May 6, 2024 04:57:12.796273947 CEST	21	51525	34.128.145.40	192.168.2.16
May 6, 2024 04:57:12.796336889 CEST	51525	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:12.811026096 CEST	51363	21	192.168.2.16	14.46.231.66
May 6, 2024 04:57:12.811113119 CEST	51436	2121	192.168.2.16	193.198.33.9
May 6, 2024 04:57:12.827009916 CEST	51364	2121	192.168.2.16	14.46.231.66
May 6, 2024 04:57:12.843009949 CEST	51366	21	192.168.2.16	180.246.40.42
May 6, 2024 04:57:12.843010902 CEST	51411	2121	192.168.2.16	66.198.245.58
May 6, 2024 04:57:12.843022108 CEST	51433	21	192.168.2.16	176.82.250.73
May 6, 2024 04:57:12.843023062 CEST	51430	2121	192.168.2.16	176.82.250.73
May 6, 2024 04:57:12.843031883 CEST	51498	2121	192.168.2.16	169.148.152.113
May 6, 2024 04:57:12.843084097 CEST	51489	21	192.168.2.16	68.110.215.70
May 6, 2024 04:57:12.864006042 CEST	51490	2121	192.168.2.16	68.110.215.70
May 6, 2024 04:57:12.864798069 CEST	21	51521	87.106.26.129	192.168.2.16
May 6, 2024 04:57:12.864826918 CEST	51491	21	192.168.2.16	187.146.33.65
May 6, 2024 04:57:12.864856005 CEST	51521	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:12.868177891 CEST	21	51477	87.106.26.129	192.168.2.16
May 6, 2024 04:57:12.868227005 CEST	51477	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:12.875036001 CEST	51492	2121	192.168.2.16	187.146.33.65
May 6, 2024 04:57:12.887116909 CEST	21	51520	81.88.252.91	192.168.2.16
May 6, 2024 04:57:12.887178898 CEST	51520	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:12.891047001 CEST	51493	21	192.168.2.16	104.40.217.229
May 6, 2024 04:57:12.891108036 CEST	51503	21	192.168.2.16	182.138.136.210
May 6, 2024 04:57:12.904521942 CEST	2121	51524	34.128.145.40	192.168.2.16
May 6, 2024 04:57:12.904572010 CEST	51524	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:12.904628992 CEST	51524	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:12.904791117 CEST	51528	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:12.905956030 CEST	21	51525	34.128.145.40	192.168.2.16
May 6, 2024 04:57:12.906013012 CEST	51525	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:12.906060934 CEST	51525	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:12.906213999 CEST	51529	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:12.907007933 CEST	51370	2121	192.168.2.16	180.246.40.42
May 6, 2024 04:57:12.907023907 CEST	51506	2121	192.168.2.16	182.138.136.210
May 6, 2024 04:57:12.907023907 CEST	51371	21	192.168.2.16	112.255.85.35
May 6, 2024 04:57:12.907025099 CEST	51496	2121	192.168.2.16	90.208.144.81
May 6, 2024 04:57:12.907028913 CEST	51495	21	192.168.2.16	90.208.144.81
May 6, 2024 04:57:12.907151937 CEST	51494	2121	192.168.2.16	104.40.217.229
May 6, 2024 04:57:12.931247950 CEST	21	51501	67.209.52.183	192.168.2.16
May 6, 2024 04:57:12.939415932 CEST	51530	21	192.168.2.16	91.239.170.127
May 6, 2024 04:57:12.946973085 CEST	2121	51502	67.209.52.183	192.168.2.16
May 6, 2024 04:57:12.959038973 CEST	21	51517	149.154.65.23	192.168.2.16
May 6, 2024 04:57:12.961219072 CEST	21	51455	154.210.32.21	192.168.2.16
May 6, 2024 04:57:12.962050915 CEST	21	51455	154.210.32.21	192.168.2.16
May 6, 2024 04:57:12.962095976 CEST	51455	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:12.963438034 CEST	51517	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:12.963541985 CEST	51455	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:12.963741064 CEST	51531	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:12.987032890 CEST	51499	21	192.168.2.16	18.25.129.238
May 6, 2024 04:57:12.997976065 CEST	21	51383	125.229.45.40	192.168.2.16
May 6, 2024 04:57:12.998605013 CEST	2121	51411	66.198.245.58	192.168.2.16
May 6, 2024 04:57:13.003010988 CEST	51500	2121	192.168.2.16	18.25.129.238
May 6, 2024 04:57:13.014266968 CEST	2121	51524	34.128.145.40	192.168.2.16
May 6, 2024 04:57:13.014345884 CEST	2121	51528	34.128.145.40	192.168.2.16
May 6, 2024 04:57:13.014409065 CEST	51528	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:13.015616894 CEST	21	51525	34.128.145.40	192.168.2.16
May 6, 2024 04:57:13.015894890 CEST	21	51529	34.128.145.40	192.168.2.16
May 6, 2024 04:57:13.015950918 CEST	51529	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:13.019007921 CEST	51519	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:13.020262003 CEST	2121	51384	125.229.45.40	192.168.2.16
May 6, 2024 04:57:13.024388075 CEST	21	51434	193.198.33.9	192.168.2.16
May 6, 2024 04:57:13.035453081 CEST	51532	2121	192.168.2.16	91.239.170.127
May 6, 2024 04:57:13.052114964 CEST	51533	21	192.168.2.16	61.146.76.16
May 6, 2024 04:57:13.052181959 CEST	51534	2121	192.168.2.16	61.146.76.16
May 6, 2024 04:57:13.052309036 CEST	51535	21	192.168.2.16	203.145.222.4
May 6, 2024 04:57:13.052330971 CEST	51536	2121	192.168.2.16	203.145.222.4
May 6, 2024 04:57:13.052540064 CEST	51537	21	192.168.2.16	79.194.140.62
May 6, 2024 04:57:13.052572012 CEST	51538	2121	192.168.2.16	79.194.140.62
May 6, 2024 04:57:13.052648067 CEST	51539	21	192.168.2.16	99.235.199.144
May 6, 2024 04:57:13.056296110 CEST	2121	51436	193.198.33.9	192.168.2.16
May 6, 2024 04:57:13.064975023 CEST	2121	51488	180.248.225.69	192.168.2.16
May 6, 2024 04:57:13.067055941 CEST	51375	2121	192.168.2.16	112.255.85.35
May 6, 2024 04:57:13.068262100 CEST	51540	2121	192.168.2.16	99.235.199.144
May 6, 2024 04:57:13.068325043 CEST	51542	2121	192.168.2.16	195.189.108.133
May 6, 2024 04:57:13.068342924 CEST	51541	21	192.168.2.16	195.189.108.133
May 6, 2024 04:57:13.068388939 CEST	51543	21	192.168.2.16	98.26.186.53
May 6, 2024 04:57:13.068470955 CEST	51544	2121	192.168.2.16	98.26.186.53
May 6, 2024 04:57:13.068538904 CEST	51545	21	192.168.2.16	209.161.168.105
May 6, 2024 04:57:13.068624020 CEST	51546	21	192.168.2.16	65.102.143.231
May 6, 2024 04:57:13.068766117 CEST	51548	2121	192.168.2.16	123.183.172.77
May 6, 2024 04:57:13.068833113 CEST	51549	21	192.168.2.16	52.129.50.165
May 6, 2024 04:57:13.068928003 CEST	51551	2121	192.168.2.16	52.129.50.165
May 6, 2024 04:57:13.068970919 CEST	51552	2121	192.168.2.16	47.40.202.110
May 6, 2024 04:57:13.069000959 CEST	51553	2121	192.168.2.16	209.161.168.105
May 6, 2024 04:57:13.069055080 CEST	51554	21	192.168.2.16	123.183.172.77
May 6, 2024 04:57:13.069056034 CEST	51547	2121	192.168.2.16	65.102.143.231
May 6, 2024 04:57:13.069077969 CEST	51550	21	192.168.2.16	47.40.202.110
May 6, 2024 04:57:13.081783056 CEST	21	51428	103.109.6.215	192.168.2.16
May 6, 2024 04:57:13.082026005 CEST	21	51428	103.109.6.215	192.168.2.16
May 6, 2024 04:57:13.082076073 CEST	51428	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:13.083436012 CEST	51555	21	192.168.2.16	64.254.141.113
May 6, 2024 04:57:13.083484888 CEST	51556	2121	192.168.2.16	64.254.141.113
May 6, 2024 04:57:13.083544970 CEST	51557	21	192.168.2.16	96.35.35.206
May 6, 2024 04:57:13.086973906 CEST	21	51526	103.109.6.215	192.168.2.16
May 6, 2024 04:57:13.087038040 CEST	51526	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:13.099016905 CEST	51447	21	192.168.2.16	156.232.143.236
May 6, 2024 04:57:13.099934101 CEST	51558	21	192.168.2.16	73.145.39.184
May 6, 2024 04:57:13.100022078 CEST	51559	2121	192.168.2.16	73.145.39.184
May 6, 2024 04:57:13.100054979 CEST	51560	2121	192.168.2.16	96.35.35.206
May 6, 2024 04:57:13.100120068 CEST	51561	21	192.168.2.16	50.30.20.59
May 6, 2024 04:57:13.100203991 CEST	51562	2121	192.168.2.16	50.30.20.59
May 6, 2024 04:57:13.100205898 CEST	51563	21	192.168.2.16	69.39.105.156
May 6, 2024 04:57:13.100282907 CEST	51564	21	192.168.2.16	73.149.255.163
May 6, 2024 04:57:13.100348949 CEST	51565	2121	192.168.2.16	69.39.105.156
May 6, 2024 04:57:13.100424051 CEST	51566	2121	192.168.2.16	73.149.255.163
May 6, 2024 04:57:13.100460052 CEST	51567	21	192.168.2.16	182.68.212.71
May 6, 2024 04:57:13.112045050 CEST	21	51521	87.106.26.129	192.168.2.16
May 6, 2024 04:57:13.112185001 CEST	51521	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:13.115022898 CEST	51439	2121	192.168.2.16	180.123.143.207
May 6, 2024 04:57:13.115024090 CEST	51376	21	192.168.2.16	174.108.248.173
May 6, 2024 04:57:13.115602016 CEST	51568	2121	192.168.2.16	182.68.212.71
May 6, 2024 04:57:13.115700006 CEST	51569	21	192.168.2.16	73.46.255.118
May 6, 2024 04:57:13.115798950 CEST	51570	2121	192.168.2.16	73.46.255.118
May 6, 2024 04:57:13.115799904 CEST	51571	21	192.168.2.16	58.52.70.249
May 6, 2024 04:57:13.115828991 CEST	51572	2121	192.168.2.16	58.52.70.249
May 6, 2024 04:57:13.115904093 CEST	51573	21	192.168.2.16	163.43.209.53
May 6, 2024 04:57:13.124075890 CEST	2121	51528	34.128.145.40	192.168.2.16
May 6, 2024 04:57:13.124126911 CEST	51528	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:13.124176979 CEST	51528	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:13.124341965 CEST	51574	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:13.125644922 CEST	21	51529	34.128.145.40	192.168.2.16
May 6, 2024 04:57:13.125699043 CEST	51529	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:13.125741005 CEST	51529	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:13.125869036 CEST	51575	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:13.129395008 CEST	21	51519	34.128.145.40	192.168.2.16
May 6, 2024 04:57:13.141871929 CEST	21	51433	176.82.250.73	192.168.2.16
May 6, 2024 04:57:13.141884089 CEST	2121	51430	176.82.250.73	192.168.2.16
May 6, 2024 04:57:13.147018909 CEST	51511	21	192.168.2.16	114.69.228.54
May 6, 2024 04:57:13.147027016 CEST	51512	2121	192.168.2.16	114.69.228.54
May 6, 2024 04:57:13.150435925 CEST	21	51497	169.148.152.113	192.168.2.16
May 6, 2024 04:57:13.151657104 CEST	2121	51349	223.243.254.224	192.168.2.16
May 6, 2024 04:57:13.156133890 CEST	21	51520	81.88.252.91	192.168.2.16
May 6, 2024 04:57:13.156244993 CEST	51520	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:13.163007975 CEST	51379	21	192.168.2.16	89.110.64.96
May 6, 2024 04:57:13.163007975 CEST	51380	2121	192.168.2.16	89.110.64.96
May 6, 2024 04:57:13.163414955 CEST	51576	2121	192.168.2.16	163.43.209.53
May 6, 2024 04:57:13.179044962 CEST	51378	2121	192.168.2.16	174.108.248.173
May 6, 2024 04:57:13.179045916 CEST	51450	2121	192.168.2.16	117.63.5.92
May 6, 2024 04:57:13.179362059 CEST	51577	21	192.168.2.16	41.182.148.1
May 6, 2024 04:57:13.179514885 CEST	51578	2121	192.168.2.16	41.182.148.1
May 6, 2024 04:57:13.186585903 CEST	21	51530	91.239.170.127	192.168.2.16
May 6, 2024 04:57:13.195424080 CEST	51402	2121	192.168.2.16	155.97.178.94
May 6, 2024 04:57:13.198169947 CEST	2121	51498	169.148.152.113	192.168.2.16
May 6, 2024 04:57:13.233800888 CEST	2121	51528	34.128.145.40	192.168.2.16
May 6, 2024 04:57:13.233836889 CEST	2121	51574	34.128.145.40	192.168.2.16
May 6, 2024 04:57:13.233891964 CEST	51574	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:13.234865904 CEST	21	51517	149.154.65.23	192.168.2.16
May 6, 2024 04:57:13.234878063 CEST	21	51517	149.154.65.23	192.168.2.16
May 6, 2024 04:57:13.234997988 CEST	51517	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:13.235256910 CEST	21	51529	34.128.145.40	192.168.2.16
May 6, 2024 04:57:13.236341953 CEST	21	51575	34.128.145.40	192.168.2.16
May 6, 2024 04:57:13.236397982 CEST	51575	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:13.243046045 CEST	51507	21	192.168.2.16	121.164.250.185
May 6, 2024 04:57:13.243048906 CEST	51508	2121	192.168.2.16	121.164.250.185
May 6, 2024 04:57:13.265616894 CEST	21	51503	182.138.136.210	192.168.2.16
May 6, 2024 04:57:13.273588896 CEST	2121	51506	182.138.136.210	192.168.2.16
May 6, 2024 04:57:13.279788017 CEST	2121	51532	91.239.170.127	192.168.2.16
May 6, 2024 04:57:13.290023088 CEST	51469	21	192.168.2.16	183.100.135.223
May 6, 2024 04:57:13.290549040 CEST	2121	51553	209.161.168.105	192.168.2.16
May 6, 2024 04:57:13.292241096 CEST	51471	2121	192.168.2.16	183.100.135.223
May 6, 2024 04:57:13.300147057 CEST	21	51545	209.161.168.105	192.168.2.16
May 6, 2024 04:57:13.305896997 CEST	21	51561	50.30.20.59	192.168.2.16
May 6, 2024 04:57:13.305907965 CEST	2121	51562	50.30.20.59	192.168.2.16
May 6, 2024 04:57:13.306056023 CEST	51385	21	192.168.2.16	112.208.5.59
May 6, 2024 04:57:13.306267977 CEST	21	51531	154.210.32.21	192.168.2.16
May 6, 2024 04:57:13.306344986 CEST	51531	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:13.312402964 CEST	21	51455	154.210.32.21	192.168.2.16
May 6, 2024 04:57:13.322017908 CEST	51386	2121	192.168.2.16	112.208.5.59
May 6, 2024 04:57:13.322017908 CEST	51388	2121	192.168.2.16	36.63.36.238
May 6, 2024 04:57:13.322999954 CEST	51387	21	192.168.2.16	36.63.36.238
May 6, 2024 04:57:13.330598116 CEST	2121	51418	168.220.94.137	192.168.2.16
May 6, 2024 04:57:13.330612898 CEST	21	51416	168.220.94.137	192.168.2.16
May 6, 2024 04:57:13.330647945 CEST	51418	2121	192.168.2.16	168.220.94.137
May 6, 2024 04:57:13.330667973 CEST	51416	21	192.168.2.16	168.220.94.137
May 6, 2024 04:57:13.336046934 CEST	21	51521	87.106.26.129	192.168.2.16
May 6, 2024 04:57:13.336215019 CEST	21	51521	87.106.26.129	192.168.2.16
May 6, 2024 04:57:13.336383104 CEST	51521	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:13.338041067 CEST	51390	21	192.168.2.16	217.208.152.117
May 6, 2024 04:57:13.338257074 CEST	51579	21	192.168.2.16	98.109.162.88
May 6, 2024 04:57:13.345115900 CEST	2121	51574	34.128.145.40	192.168.2.16
May 6, 2024 04:57:13.345164061 CEST	51574	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:13.345237017 CEST	51574	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:13.345421076 CEST	51580	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:13.347337961 CEST	21	51575	34.128.145.40	192.168.2.16
May 6, 2024 04:57:13.347385883 CEST	51575	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:13.347467899 CEST	51575	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:13.347680092 CEST	51581	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:13.354013920 CEST	51514	2121	192.168.2.16	46.158.210.29
May 6, 2024 04:57:13.354013920 CEST	51393	2121	192.168.2.16	81.158.159.97
May 6, 2024 04:57:13.354016066 CEST	51391	2121	192.168.2.16	217.208.152.117
May 6, 2024 04:57:13.354074001 CEST	51513	21	192.168.2.16	46.158.210.29
May 6, 2024 04:57:13.354082108 CEST	51392	21	192.168.2.16	81.158.159.97
May 6, 2024 04:57:13.354084015 CEST	51394	21	192.168.2.16	27.78.235.112
May 6, 2024 04:57:13.360280037 CEST	2121	51402	155.97.178.94	192.168.2.16
May 6, 2024 04:57:13.360625982 CEST	51582	2121	192.168.2.16	98.109.162.88
May 6, 2024 04:57:13.365823030 CEST	2121	51542	195.189.108.133	192.168.2.16
May 6, 2024 04:57:13.370026112 CEST	51515	21	192.168.2.16	101.69.59.74
May 6, 2024 04:57:13.370201111 CEST	21	51541	195.189.108.133	192.168.2.16
May 6, 2024 04:57:13.383117914 CEST	2121	51380	89.110.64.96	192.168.2.16
May 6, 2024 04:57:13.386022091 CEST	51395	2121	192.168.2.16	27.78.235.112
May 6, 2024 04:57:13.386112928 CEST	21	51379	89.110.64.96	192.168.2.16
May 6, 2024 04:57:13.386586905 CEST	51583	21	192.168.2.16	220.88.86.106
May 6, 2024 04:57:13.386677027 CEST	51584	2121	192.168.2.16	220.88.86.106
May 6, 2024 04:57:13.401271105 CEST	51585	21	192.168.2.16	73.171.120.83
May 6, 2024 04:57:13.416018963 CEST	51516	21	192.168.2.16	216.117.162.236
May 6, 2024 04:57:13.425458908 CEST	21	51447	156.232.143.236	192.168.2.16
May 6, 2024 04:57:13.428472042 CEST	21	51520	81.88.252.91	192.168.2.16
May 6, 2024 04:57:13.428595066 CEST	51520	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:13.432013035 CEST	51501	21	192.168.2.16	67.209.52.183
May 6, 2024 04:57:13.433969975 CEST	2121	51144	168.220.94.137	192.168.2.16
May 6, 2024 04:57:13.433983088 CEST	21	51143	168.220.94.137	192.168.2.16
May 6, 2024 04:57:13.434019089 CEST	51144	2121	192.168.2.16	168.220.94.137
May 6, 2024 04:57:13.434035063 CEST	51143	21	192.168.2.16	168.220.94.137
May 6, 2024 04:57:13.447031021 CEST	51502	2121	192.168.2.16	67.209.52.183
May 6, 2024 04:57:13.458671093 CEST	2121	51574	34.128.145.40	192.168.2.16
May 6, 2024 04:57:13.459119081 CEST	2121	51580	34.128.145.40	192.168.2.16
May 6, 2024 04:57:13.459176064 CEST	51580	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:13.459291935 CEST	21	51581	34.128.145.40	192.168.2.16
May 6, 2024 04:57:13.459347010 CEST	51581	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:13.459589958 CEST	21	51575	34.128.145.40	192.168.2.16
May 6, 2024 04:57:13.463027000 CEST	51396	21	192.168.2.16	99.237.117.46
May 6, 2024 04:57:13.463676929 CEST	21	51526	103.109.6.215	192.168.2.16
May 6, 2024 04:57:13.463795900 CEST	51526	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:13.483143091 CEST	2121	51439	180.123.143.207	192.168.2.16
May 6, 2024 04:57:13.487879038 CEST	2121	51572	58.52.70.249	192.168.2.16
May 6, 2024 04:57:13.495038986 CEST	51400	2121	192.168.2.16	99.237.117.46
May 6, 2024 04:57:13.495606899 CEST	51586	2121	192.168.2.16	73.171.120.83
May 6, 2024 04:57:13.495707989 CEST	51587	21	192.168.2.16	112.163.253.29
May 6, 2024 04:57:13.496808052 CEST	21	51511	114.69.228.54	192.168.2.16
May 6, 2024 04:57:13.500854969 CEST	2121	51512	114.69.228.54	192.168.2.16
May 6, 2024 04:57:13.506726027 CEST	21	51517	149.154.65.23	192.168.2.16
May 6, 2024 04:57:13.506851912 CEST	51517	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:13.507039070 CEST	51588	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:13.511008978 CEST	51383	21	192.168.2.16	125.229.45.40
May 6, 2024 04:57:13.511034966 CEST	51401	21	192.168.2.16	155.97.178.94
May 6, 2024 04:57:13.511037111 CEST	51411	2121	192.168.2.16	66.198.245.58
May 6, 2024 04:57:13.511230946 CEST	51589	2121	192.168.2.16	112.163.253.29
May 6, 2024 04:57:13.521925926 CEST	2121	51450	117.63.5.92	192.168.2.16
May 6, 2024 04:57:13.527025938 CEST	51384	2121	192.168.2.16	125.229.45.40
May 6, 2024 04:57:13.527026892 CEST	51434	21	192.168.2.16	193.198.33.9
May 6, 2024 04:57:13.543035030 CEST	51403	21	192.168.2.16	70.177.21.82
May 6, 2024 04:57:13.543216944 CEST	51590	21	192.168.2.16	194.107.235.26
May 6, 2024 04:57:13.560934067 CEST	21	51521	87.106.26.129	192.168.2.16
May 6, 2024 04:57:13.560967922 CEST	51436	2121	192.168.2.16	193.198.33.9
May 6, 2024 04:57:13.561127901 CEST	51521	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:13.561367035 CEST	51591	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:13.568553925 CEST	21	51581	34.128.145.40	192.168.2.16
May 6, 2024 04:57:13.568612099 CEST	51581	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:13.568655014 CEST	51581	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:13.568790913 CEST	51592	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:13.569542885 CEST	2121	51580	34.128.145.40	192.168.2.16
May 6, 2024 04:57:13.569602013 CEST	51580	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:13.569652081 CEST	51580	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:13.569804907 CEST	51593	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:13.575007915 CEST	51488	2121	192.168.2.16	180.248.225.69
May 6, 2024 04:57:13.581656933 CEST	21	51324	109.205.180.149	192.168.2.16
May 6, 2024 04:57:13.581762075 CEST	51324	21	192.168.2.16	109.205.180.149
May 6, 2024 04:57:13.581871986 CEST	51594	21	192.168.2.16	109.205.180.149
May 6, 2024 04:57:13.592398882 CEST	2121	51471	183.100.135.223	192.168.2.16
May 6, 2024 04:57:13.597639084 CEST	21	51469	183.100.135.223	192.168.2.16
May 6, 2024 04:57:13.605036974 CEST	51404	2121	192.168.2.16	70.177.21.82
May 6, 2024 04:57:13.621289015 CEST	51595	2121	192.168.2.16	194.107.235.26
May 6, 2024 04:57:13.645922899 CEST	21	51501	67.209.52.183	192.168.2.16
May 6, 2024 04:57:13.649096966 CEST	21	51531	154.210.32.21	192.168.2.16
May 6, 2024 04:57:13.649275064 CEST	51531	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:13.653012037 CEST	51430	2121	192.168.2.16	176.82.250.73
May 6, 2024 04:57:13.653012991 CEST	51522	2121	192.168.2.16	101.69.59.74
May 6, 2024 04:57:13.653028965 CEST	51497	21	192.168.2.16	169.148.152.113
May 6, 2024 04:57:13.653029919 CEST	51433	21	192.168.2.16	176.82.250.73
May 6, 2024 04:57:13.662041903 CEST	2121	51502	67.209.52.183	192.168.2.16
May 6, 2024 04:57:13.666614056 CEST	2121	51411	66.198.245.58	192.168.2.16
May 6, 2024 04:57:13.669023991 CEST	51523	21	192.168.2.16	35.238.176.156
May 6, 2024 04:57:13.678442955 CEST	21	51592	34.128.145.40	192.168.2.16
May 6, 2024 04:57:13.678508997 CEST	51592	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:13.678666115 CEST	21	51581	34.128.145.40	192.168.2.16
May 6, 2024 04:57:13.679182053 CEST	2121	51580	34.128.145.40	192.168.2.16
May 6, 2024 04:57:13.679367065 CEST	2121	51593	34.128.145.40	192.168.2.16
May 6, 2024 04:57:13.679420948 CEST	51593	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:13.685004950 CEST	51406	2121	192.168.2.16	69.251.149.18
May 6, 2024 04:57:13.685030937 CEST	51405	21	192.168.2.16	69.251.149.18
May 6, 2024 04:57:13.685403109 CEST	51596	21	192.168.2.16	113.18.36.66
May 6, 2024 04:57:13.685503006 CEST	51597	2121	192.168.2.16	113.18.36.66
May 6, 2024 04:57:13.707004070 CEST	51530	21	192.168.2.16	91.239.170.127
May 6, 2024 04:57:13.707014084 CEST	51498	2121	192.168.2.16	169.148.152.113
May 6, 2024 04:57:13.709393024 CEST	21	51520	81.88.252.91	192.168.2.16
May 6, 2024 04:57:13.709407091 CEST	21	51520	81.88.252.91	192.168.2.16
May 6, 2024 04:57:13.709688902 CEST	51598	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:13.717391968 CEST	51599	21	192.168.2.16	88.205.119.27
May 6, 2024 04:57:13.749296904 CEST	51600	2121	192.168.2.16	88.205.119.27
May 6, 2024 04:57:13.765225887 CEST	51527	2121	192.168.2.16	35.238.176.156
May 6, 2024 04:57:13.772229910 CEST	21	51588	149.154.65.23	192.168.2.16
May 6, 2024 04:57:13.772295952 CEST	51588	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:13.772818089 CEST	21	51434	193.198.33.9	192.168.2.16
May 6, 2024 04:57:13.778211117 CEST	21	51517	149.154.65.23	192.168.2.16
May 6, 2024 04:57:13.778260946 CEST	51517	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:13.781009912 CEST	51503	21	192.168.2.16	182.138.136.210
May 6, 2024 04:57:13.781018972 CEST	51532	2121	192.168.2.16	91.239.170.127
May 6, 2024 04:57:13.781043053 CEST	51506	2121	192.168.2.16	182.138.136.210
May 6, 2024 04:57:13.786835909 CEST	21	51521	87.106.26.129	192.168.2.16
May 6, 2024 04:57:13.786890030 CEST	51521	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:13.788252115 CEST	21	51592	34.128.145.40	192.168.2.16
May 6, 2024 04:57:13.788306952 CEST	51592	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:13.788360119 CEST	51592	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:13.788495064 CEST	51601	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:13.789544106 CEST	21	51591	87.106.26.129	192.168.2.16
May 6, 2024 04:57:13.789602995 CEST	51591	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:13.792917013 CEST	2121	51593	34.128.145.40	192.168.2.16
May 6, 2024 04:57:13.792968988 CEST	51593	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:13.793035984 CEST	51593	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:13.793199062 CEST	51602	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:13.797033072 CEST	51553	2121	192.168.2.16	209.161.168.105
May 6, 2024 04:57:13.806158066 CEST	2121	51436	193.198.33.9	192.168.2.16
May 6, 2024 04:57:13.808743000 CEST	21	51594	109.205.180.149	192.168.2.16
May 6, 2024 04:57:13.808805943 CEST	51594	21	192.168.2.16	109.205.180.149
May 6, 2024 04:57:13.809883118 CEST	21	51383	125.229.45.40	192.168.2.16
May 6, 2024 04:57:13.813024998 CEST	51561	21	192.168.2.16	50.30.20.59
May 6, 2024 04:57:13.813029051 CEST	51562	2121	192.168.2.16	50.30.20.59
May 6, 2024 04:57:13.813029051 CEST	51545	21	192.168.2.16	209.161.168.105
May 6, 2024 04:57:13.815222979 CEST	21	51324	109.205.180.149	192.168.2.16
May 6, 2024 04:57:13.815274000 CEST	51324	21	192.168.2.16	109.205.180.149
May 6, 2024 04:57:13.815994978 CEST	21	51324	109.205.180.149	192.168.2.16
May 6, 2024 04:57:13.816041946 CEST	51324	21	192.168.2.16	109.205.180.149
May 6, 2024 04:57:13.829411030 CEST	51603	21	192.168.2.16	8.143.241.182
May 6, 2024 04:57:13.832186937 CEST	2121	51384	125.229.45.40	192.168.2.16
May 6, 2024 04:57:13.837380886 CEST	21	51526	103.109.6.215	192.168.2.16
May 6, 2024 04:57:13.837486029 CEST	51526	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:13.845025063 CEST	51412	21	192.168.2.16	118.221.92.29
May 6, 2024 04:57:13.845176935 CEST	51604	2121	192.168.2.16	8.143.241.182
May 6, 2024 04:57:13.847225904 CEST	21	51142	188.214.156.147	192.168.2.16
May 6, 2024 04:57:13.847273111 CEST	21	51142	188.214.156.147	192.168.2.16
May 6, 2024 04:57:13.847279072 CEST	51142	21	192.168.2.16	188.214.156.147
May 6, 2024 04:57:13.847311020 CEST	51142	21	192.168.2.16	188.214.156.147
May 6, 2024 04:57:13.848093987 CEST	21	51142	188.214.156.147	192.168.2.16
May 6, 2024 04:57:13.848136902 CEST	51142	21	192.168.2.16	188.214.156.147
May 6, 2024 04:57:13.877006054 CEST	51541	21	192.168.2.16	195.189.108.133
May 6, 2024 04:57:13.877024889 CEST	51542	2121	192.168.2.16	195.189.108.133
May 6, 2024 04:57:13.898473024 CEST	21	51601	34.128.145.40	192.168.2.16
May 6, 2024 04:57:13.898550034 CEST	51601	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:13.898835897 CEST	21	51592	34.128.145.40	192.168.2.16
May 6, 2024 04:57:13.902565956 CEST	2121	51593	34.128.145.40	192.168.2.16
May 6, 2024 04:57:13.903474092 CEST	2121	51602	34.128.145.40	192.168.2.16
May 6, 2024 04:57:13.903527021 CEST	51602	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:13.925219059 CEST	51605	21	192.168.2.16	90.202.49.17
May 6, 2024 04:57:13.932214975 CEST	21	51433	176.82.250.73	192.168.2.16
May 6, 2024 04:57:13.932657003 CEST	2121	51430	176.82.250.73	192.168.2.16
May 6, 2024 04:57:13.941010952 CEST	51447	21	192.168.2.16	156.232.143.236
May 6, 2024 04:57:13.941262960 CEST	51606	2121	192.168.2.16	90.202.49.17
May 6, 2024 04:57:13.948163986 CEST	2121	51488	180.248.225.69	192.168.2.16
May 6, 2024 04:57:13.955823898 CEST	21	51530	91.239.170.127	192.168.2.16
May 6, 2024 04:57:13.974890947 CEST	21	51598	81.88.252.91	192.168.2.16
May 6, 2024 04:57:13.974963903 CEST	51598	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:13.989017963 CEST	51439	2121	192.168.2.16	180.123.143.207
May 6, 2024 04:57:13.989041090 CEST	51572	2121	192.168.2.16	58.52.70.249
May 6, 2024 04:57:13.990555048 CEST	21	51531	154.210.32.21	192.168.2.16
May 6, 2024 04:57:13.990694046 CEST	21	51531	154.210.32.21	192.168.2.16
May 6, 2024 04:57:13.990819931 CEST	51531	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:14.004009008 CEST	51511	21	192.168.2.16	114.69.228.54
May 6, 2024 04:57:14.004033089 CEST	51512	2121	192.168.2.16	114.69.228.54
May 6, 2024 04:57:14.007967949 CEST	21	51561	50.30.20.59	192.168.2.16
May 6, 2024 04:57:14.008223057 CEST	2121	51562	50.30.20.59	192.168.2.16
May 6, 2024 04:57:14.008579969 CEST	21	51497	169.148.152.113	192.168.2.16
May 6, 2024 04:57:14.008686066 CEST	21	51601	34.128.145.40	192.168.2.16
May 6, 2024 04:57:14.008744955 CEST	51601	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:14.008794069 CEST	51601	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:14.009008884 CEST	51607	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:14.013870001 CEST	2121	51602	34.128.145.40	192.168.2.16
May 6, 2024 04:57:14.013914108 CEST	51602	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:14.014031887 CEST	51602	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:14.014292955 CEST	51608	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:14.019570112 CEST	2121	51553	209.161.168.105	192.168.2.16
May 6, 2024 04:57:14.020020962 CEST	51415	2121	192.168.2.16	118.221.92.29
May 6, 2024 04:57:14.025324106 CEST	2121	51532	91.239.170.127	192.168.2.16
May 6, 2024 04:57:14.036011934 CEST	51450	2121	192.168.2.16	117.63.5.92
May 6, 2024 04:57:14.036319971 CEST	51609	21	192.168.2.16	189.177.239.66
May 6, 2024 04:57:14.037208080 CEST	21	51594	109.205.180.149	192.168.2.16
May 6, 2024 04:57:14.037344933 CEST	51594	21	192.168.2.16	109.205.180.149
May 6, 2024 04:57:14.040590048 CEST	21	51588	149.154.65.23	192.168.2.16
May 6, 2024 04:57:14.040709972 CEST	51588	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:14.041258097 CEST	21	51591	87.106.26.129	192.168.2.16
May 6, 2024 04:57:14.041404009 CEST	51591	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:14.050688028 CEST	21	51545	209.161.168.105	192.168.2.16
May 6, 2024 04:57:14.052007914 CEST	51539	21	192.168.2.16	99.235.199.144
May 6, 2024 04:57:14.052201986 CEST	51537	21	192.168.2.16	79.194.140.62
May 6, 2024 04:57:14.062230110 CEST	2121	51498	169.148.152.113	192.168.2.16
May 6, 2024 04:57:14.067008018 CEST	51538	2121	192.168.2.16	79.194.140.62
May 6, 2024 04:57:14.067022085 CEST	51534	2121	192.168.2.16	61.146.76.16
May 6, 2024 04:57:14.067022085 CEST	51535	21	192.168.2.16	203.145.222.4
May 6, 2024 04:57:14.067029953 CEST	51533	21	192.168.2.16	61.146.76.16
May 6, 2024 04:57:14.067039013 CEST	51536	2121	192.168.2.16	203.145.222.4
May 6, 2024 04:57:14.067270994 CEST	51610	2121	192.168.2.16	189.177.239.66
May 6, 2024 04:57:14.083019018 CEST	51543	21	192.168.2.16	98.26.186.53
May 6, 2024 04:57:14.083033085 CEST	51551	2121	192.168.2.16	52.129.50.165
May 6, 2024 04:57:14.083034039 CEST	51552	2121	192.168.2.16	47.40.202.110
May 6, 2024 04:57:14.083034992 CEST	51540	2121	192.168.2.16	99.235.199.144
May 6, 2024 04:57:14.083034992 CEST	51550	21	192.168.2.16	47.40.202.110
May 6, 2024 04:57:14.083041906 CEST	51548	2121	192.168.2.16	123.183.172.77
May 6, 2024 04:57:14.083051920 CEST	51544	2121	192.168.2.16	98.26.186.53
May 6, 2024 04:57:14.083055019 CEST	51555	21	192.168.2.16	64.254.141.113
May 6, 2024 04:57:14.083054066 CEST	51549	21	192.168.2.16	52.129.50.165
May 6, 2024 04:57:14.083055973 CEST	51554	21	192.168.2.16	123.183.172.77
May 6, 2024 04:57:14.083055019 CEST	51546	21	192.168.2.16	65.102.143.231
May 6, 2024 04:57:14.083065987 CEST	51556	2121	192.168.2.16	64.254.141.113
May 6, 2024 04:57:14.083066940 CEST	51547	2121	192.168.2.16	65.102.143.231
May 6, 2024 04:57:14.083076000 CEST	51557	21	192.168.2.16	96.35.35.206
May 6, 2024 04:57:14.099035025 CEST	51469	21	192.168.2.16	183.100.135.223
May 6, 2024 04:57:14.100330114 CEST	51471	2121	192.168.2.16	183.100.135.223
May 6, 2024 04:57:14.114032030 CEST	51566	2121	192.168.2.16	73.149.255.163
May 6, 2024 04:57:14.114037037 CEST	51559	2121	192.168.2.16	73.145.39.184
May 6, 2024 04:57:14.114037991 CEST	51560	2121	192.168.2.16	96.35.35.206
May 6, 2024 04:57:14.114053011 CEST	51417	21	192.168.2.16	82.4.29.4
May 6, 2024 04:57:14.114053011 CEST	51563	21	192.168.2.16	69.39.105.156
May 6, 2024 04:57:14.114058971 CEST	51565	2121	192.168.2.16	69.39.105.156
May 6, 2024 04:57:14.114058971 CEST	51558	21	192.168.2.16	73.145.39.184
May 6, 2024 04:57:14.114567041 CEST	51564	21	192.168.2.16	73.149.255.163
May 6, 2024 04:57:14.114567995 CEST	51567	21	192.168.2.16	182.68.212.71
May 6, 2024 04:57:14.118015051 CEST	21	51601	34.128.145.40	192.168.2.16
May 6, 2024 04:57:14.118196011 CEST	21	51607	34.128.145.40	192.168.2.16
May 6, 2024 04:57:14.118266106 CEST	51607	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:14.123500109 CEST	2121	51602	34.128.145.40	192.168.2.16
May 6, 2024 04:57:14.130008936 CEST	51571	21	192.168.2.16	58.52.70.249
May 6, 2024 04:57:14.130028963 CEST	51568	2121	192.168.2.16	182.68.212.71
May 6, 2024 04:57:14.130031109 CEST	51569	21	192.168.2.16	73.46.255.118
May 6, 2024 04:57:14.130033970 CEST	51573	21	192.168.2.16	163.43.209.53
May 6, 2024 04:57:14.131035089 CEST	51570	2121	192.168.2.16	73.46.255.118
May 6, 2024 04:57:14.132502079 CEST	2121	51608	34.128.145.40	192.168.2.16
May 6, 2024 04:57:14.132560015 CEST	51608	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:14.146039963 CEST	51501	21	192.168.2.16	67.209.52.183
May 6, 2024 04:57:14.147371054 CEST	2121	51506	182.138.136.210	192.168.2.16
May 6, 2024 04:57:14.155869007 CEST	21	51503	182.138.136.210	192.168.2.16
May 6, 2024 04:57:14.173100948 CEST	2121	51542	195.189.108.133	192.168.2.16
May 6, 2024 04:57:14.177015066 CEST	51576	2121	192.168.2.16	163.43.209.53
May 6, 2024 04:57:14.177016020 CEST	51502	2121	192.168.2.16	67.209.52.183
May 6, 2024 04:57:14.177145958 CEST	51421	2121	192.168.2.16	82.4.29.4
May 6, 2024 04:57:14.177438021 CEST	51611	21	192.168.2.16	179.136.14.176
May 6, 2024 04:57:14.177683115 CEST	21	51541	195.189.108.133	192.168.2.16
May 6, 2024 04:57:14.193006039 CEST	51578	2121	192.168.2.16	41.182.148.1
May 6, 2024 04:57:14.193027020 CEST	51577	21	192.168.2.16	41.182.148.1
May 6, 2024 04:57:14.193233013 CEST	51612	2121	192.168.2.16	179.136.14.176
May 6, 2024 04:57:14.209024906 CEST	51422	21	192.168.2.16	46.23.195.239
May 6, 2024 04:57:14.213489056 CEST	21	51526	103.109.6.215	192.168.2.16
May 6, 2024 04:57:14.213612080 CEST	51526	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:14.213756084 CEST	51613	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:14.225023031 CEST	51424	2121	192.168.2.16	46.23.195.239
May 6, 2024 04:57:14.225143909 CEST	51425	21	192.168.2.16	45.45.25.148
May 6, 2024 04:57:14.227915049 CEST	21	51607	34.128.145.40	192.168.2.16
May 6, 2024 04:57:14.227974892 CEST	51607	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:14.228075027 CEST	51607	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:14.228307009 CEST	51614	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:14.232656002 CEST	21	51372	193.124.183.222	192.168.2.16
May 6, 2024 04:57:14.232794046 CEST	51372	21	192.168.2.16	193.124.183.222
May 6, 2024 04:57:14.233009100 CEST	51615	21	192.168.2.16	193.124.183.222
May 6, 2024 04:57:14.236018896 CEST	51426	2121	192.168.2.16	45.45.25.148
May 6, 2024 04:57:14.237142086 CEST	51427	21	192.168.2.16	73.2.130.98
May 6, 2024 04:57:14.237823963 CEST	21	51549	52.129.50.165	192.168.2.16
May 6, 2024 04:57:14.237901926 CEST	2121	51551	52.129.50.165	192.168.2.16
May 6, 2024 04:57:14.241213083 CEST	51616	21	192.168.2.16	154.195.192.8
May 6, 2024 04:57:14.243019104 CEST	2121	51608	34.128.145.40	192.168.2.16
May 6, 2024 04:57:14.243067026 CEST	51608	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:14.243124008 CEST	51608	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:14.243278980 CEST	51617	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:14.248337984 CEST	21	51598	81.88.252.91	192.168.2.16
May 6, 2024 04:57:14.248511076 CEST	51598	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:14.257033110 CEST	51429	2121	192.168.2.16	73.2.130.98
May 6, 2024 04:57:14.257035971 CEST	51431	2121	192.168.2.16	18.65.22.127
May 6, 2024 04:57:14.257237911 CEST	51432	21	192.168.2.16	18.65.22.127
May 6, 2024 04:57:14.262762070 CEST	21	51447	156.232.143.236	192.168.2.16
May 6, 2024 04:57:14.263832092 CEST	21	51594	109.205.180.149	192.168.2.16
May 6, 2024 04:57:14.263955116 CEST	21	51594	109.205.180.149	192.168.2.16
May 6, 2024 04:57:14.264065027 CEST	51594	21	192.168.2.16	109.205.180.149
May 6, 2024 04:57:14.270056963 CEST	21	51591	87.106.26.129	192.168.2.16
May 6, 2024 04:57:14.270205975 CEST	21	51591	87.106.26.129	192.168.2.16
May 6, 2024 04:57:14.270329952 CEST	51591	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:14.273255110 CEST	51434	21	192.168.2.16	193.198.33.9
May 6, 2024 04:57:14.305279970 CEST	51618	2121	192.168.2.16	154.195.192.8
May 6, 2024 04:57:14.306613922 CEST	21	51588	149.154.65.23	192.168.2.16
May 6, 2024 04:57:14.306673050 CEST	21	51588	149.154.65.23	192.168.2.16
May 6, 2024 04:57:14.306840897 CEST	51588	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:14.320015907 CEST	51436	2121	192.168.2.16	193.198.33.9
May 6, 2024 04:57:14.320024967 CEST	51435	21	192.168.2.16	180.123.143.207
May 6, 2024 04:57:14.320369005 CEST	51619	21	192.168.2.16	72.218.134.108
May 6, 2024 04:57:14.320503950 CEST	2121	51144	168.220.94.137	192.168.2.16
May 6, 2024 04:57:14.320564985 CEST	51144	2121	192.168.2.16	168.220.94.137
May 6, 2024 04:57:14.338623047 CEST	21	51607	34.128.145.40	192.168.2.16
May 6, 2024 04:57:14.339016914 CEST	21	51614	34.128.145.40	192.168.2.16
May 6, 2024 04:57:14.339077950 CEST	51614	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:14.340409994 CEST	21	51531	154.210.32.21	192.168.2.16
May 6, 2024 04:57:14.340519905 CEST	51531	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:14.340688944 CEST	51620	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:14.341015100 CEST	21	51531	154.210.32.21	192.168.2.16
May 6, 2024 04:57:14.341062069 CEST	51531	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:14.351037025 CEST	51579	21	192.168.2.16	98.109.162.88
May 6, 2024 04:57:14.353027105 CEST	2121	51608	34.128.145.40	192.168.2.16
May 6, 2024 04:57:14.353446960 CEST	2121	51617	34.128.145.40	192.168.2.16
May 6, 2024 04:57:14.353506088 CEST	51617	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:14.353609085 CEST	21	51511	114.69.228.54	192.168.2.16
May 6, 2024 04:57:14.357739925 CEST	2121	51512	114.69.228.54	192.168.2.16
May 6, 2024 04:57:14.361212969 CEST	2121	51572	58.52.70.249	192.168.2.16
May 6, 2024 04:57:14.362206936 CEST	2121	51439	180.123.143.207	192.168.2.16
May 6, 2024 04:57:14.364346981 CEST	21	51501	67.209.52.183	192.168.2.16
May 6, 2024 04:57:14.367007017 CEST	51440	21	192.168.2.16	74.79.122.119
May 6, 2024 04:57:14.367026091 CEST	51582	2121	192.168.2.16	98.109.162.88
May 6, 2024 04:57:14.367249012 CEST	51621	2121	192.168.2.16	72.218.134.108
May 6, 2024 04:57:14.378966093 CEST	2121	51450	117.63.5.92	192.168.2.16
May 6, 2024 04:57:14.383030891 CEST	51441	2121	192.168.2.16	74.79.122.119
May 6, 2024 04:57:14.384784937 CEST	51442	21	192.168.2.16	116.2.98.51
May 6, 2024 04:57:14.392141104 CEST	2121	51502	67.209.52.183	192.168.2.16
May 6, 2024 04:57:14.399009943 CEST	51584	2121	192.168.2.16	220.88.86.106
May 6, 2024 04:57:14.399030924 CEST	51583	21	192.168.2.16	220.88.86.106
May 6, 2024 04:57:14.400896072 CEST	2121	51471	183.100.135.223	192.168.2.16
May 6, 2024 04:57:14.406421900 CEST	21	51469	183.100.135.223	192.168.2.16
May 6, 2024 04:57:14.415024996 CEST	51444	2121	192.168.2.16	116.2.98.51
May 6, 2024 04:57:14.415044069 CEST	51585	21	192.168.2.16	73.171.120.83
May 6, 2024 04:57:14.415044069 CEST	51445	21	192.168.2.16	93.205.138.193
May 6, 2024 04:57:14.431030035 CEST	51446	2121	192.168.2.16	93.205.138.193
May 6, 2024 04:57:14.447017908 CEST	51433	21	192.168.2.16	176.82.250.73
May 6, 2024 04:57:14.447019100 CEST	51430	2121	192.168.2.16	176.82.250.73
May 6, 2024 04:57:14.449870110 CEST	21	51614	34.128.145.40	192.168.2.16
May 6, 2024 04:57:14.449923038 CEST	51614	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:14.450025082 CEST	51614	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:14.450213909 CEST	51622	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:14.463023901 CEST	51488	2121	192.168.2.16	180.248.225.69
May 6, 2024 04:57:14.463031054 CEST	51530	21	192.168.2.16	91.239.170.127
May 6, 2024 04:57:14.463031054 CEST	51448	2121	192.168.2.16	156.232.143.236
May 6, 2024 04:57:14.463304996 CEST	51623	21	192.168.2.16	88.92.223.56
May 6, 2024 04:57:14.463687897 CEST	2121	51617	34.128.145.40	192.168.2.16
May 6, 2024 04:57:14.463747025 CEST	51617	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:14.463810921 CEST	51617	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:14.463972092 CEST	51624	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:14.495007038 CEST	51586	2121	192.168.2.16	73.171.120.83
May 6, 2024 04:57:14.495027065 CEST	51449	21	192.168.2.16	117.63.5.92
May 6, 2024 04:57:14.498867989 CEST	21	51591	87.106.26.129	192.168.2.16
May 6, 2024 04:57:14.499011993 CEST	51591	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:14.499228954 CEST	51625	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:14.500946999 CEST	21	51615	193.124.183.222	192.168.2.16
May 6, 2024 04:57:14.501022100 CEST	51615	21	192.168.2.16	193.124.183.222
May 6, 2024 04:57:14.502744913 CEST	21	51372	193.124.183.222	192.168.2.16
May 6, 2024 04:57:14.502794981 CEST	51372	21	192.168.2.16	193.124.183.222
May 6, 2024 04:57:14.511029959 CEST	51562	2121	192.168.2.16	50.30.20.59
May 6, 2024 04:57:14.511040926 CEST	51561	21	192.168.2.16	50.30.20.59
May 6, 2024 04:57:14.511042118 CEST	51587	21	192.168.2.16	112.163.253.29
May 6, 2024 04:57:14.511042118 CEST	51497	21	192.168.2.16	169.148.152.113
May 6, 2024 04:57:14.511120081 CEST	51589	2121	192.168.2.16	112.163.253.29
May 6, 2024 04:57:14.511121988 CEST	51451	21	192.168.2.16	38.152.212.74
May 6, 2024 04:57:14.518647909 CEST	21	51434	193.198.33.9	192.168.2.16
May 6, 2024 04:57:14.526988983 CEST	21	51598	81.88.252.91	192.168.2.16
May 6, 2024 04:57:14.527024984 CEST	51553	2121	192.168.2.16	209.161.168.105
May 6, 2024 04:57:14.527025938 CEST	51532	2121	192.168.2.16	91.239.170.127
May 6, 2024 04:57:14.527093887 CEST	51598	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:14.530241966 CEST	21	51594	109.205.180.149	192.168.2.16
May 6, 2024 04:57:14.543024063 CEST	51453	2121	192.168.2.16	38.152.212.74
May 6, 2024 04:57:14.543207884 CEST	51626	2121	192.168.2.16	88.92.223.56
May 6, 2024 04:57:14.543210030 CEST	51590	21	192.168.2.16	194.107.235.26
May 6, 2024 04:57:14.559024096 CEST	51545	21	192.168.2.16	209.161.168.105
May 6, 2024 04:57:14.559025049 CEST	51454	21	192.168.2.16	45.194.50.79
May 6, 2024 04:57:14.559863091 CEST	21	51622	34.128.145.40	192.168.2.16
May 6, 2024 04:57:14.559926033 CEST	51622	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:14.560452938 CEST	21	51614	34.128.145.40	192.168.2.16
May 6, 2024 04:57:14.565233946 CEST	2121	51436	193.198.33.9	192.168.2.16
May 6, 2024 04:57:14.573142052 CEST	2121	51624	34.128.145.40	192.168.2.16
May 6, 2024 04:57:14.573198080 CEST	51624	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:14.573393106 CEST	21	51588	149.154.65.23	192.168.2.16
May 6, 2024 04:57:14.573513985 CEST	51588	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:14.573662043 CEST	2121	51617	34.128.145.40	192.168.2.16
May 6, 2024 04:57:14.573704958 CEST	51627	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:14.575007915 CEST	51456	2121	192.168.2.16	45.194.50.79
May 6, 2024 04:57:14.575009108 CEST	51498	2121	192.168.2.16	169.148.152.113
May 6, 2024 04:57:14.575237989 CEST	51628	21	192.168.2.16	122.46.200.144
May 6, 2024 04:57:14.587021112 CEST	21	51526	103.109.6.215	192.168.2.16
May 6, 2024 04:57:14.587074041 CEST	21	51526	103.109.6.215	192.168.2.16
May 6, 2024 04:57:14.587116003 CEST	51526	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:14.588114023 CEST	21	51613	103.109.6.215	192.168.2.16
May 6, 2024 04:57:14.588172913 CEST	51613	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:14.589459896 CEST	21	51616	154.195.192.8	192.168.2.16
May 6, 2024 04:57:14.591202021 CEST	51629	2121	192.168.2.16	122.46.200.144
May 6, 2024 04:57:14.607024908 CEST	51459	21	192.168.2.16	65.35.98.88
May 6, 2024 04:57:14.607029915 CEST	51460	2121	192.168.2.16	65.35.98.88
May 6, 2024 04:57:14.623019934 CEST	51464	2121	192.168.2.16	85.251.40.131
May 6, 2024 04:57:14.623023987 CEST	51461	21	192.168.2.16	109.250.140.249
May 6, 2024 04:57:14.623035908 CEST	51463	21	192.168.2.16	85.251.40.131
May 6, 2024 04:57:14.623037100 CEST	51595	2121	192.168.2.16	194.107.235.26
May 6, 2024 04:57:14.623039007 CEST	51462	2121	192.168.2.16	109.250.140.249
May 6, 2024 04:57:14.632725954 CEST	21	51143	168.220.94.137	192.168.2.16
May 6, 2024 04:57:14.632771969 CEST	51143	21	192.168.2.16	168.220.94.137
May 6, 2024 04:57:14.639065027 CEST	51466	2121	192.168.2.16	190.178.4.55
May 6, 2024 04:57:14.639210939 CEST	51630	21	192.168.2.16	85.216.208.3
May 6, 2024 04:57:14.655018091 CEST	51465	21	192.168.2.16	190.178.4.55
May 6, 2024 04:57:14.655034065 CEST	51468	21	192.168.2.16	212.241.99.117
May 6, 2024 04:57:14.655040026 CEST	51506	2121	192.168.2.16	182.138.136.210
May 6, 2024 04:57:14.655047894 CEST	51467	2121	192.168.2.16	212.241.99.117
May 6, 2024 04:57:14.669591904 CEST	21	51622	34.128.145.40	192.168.2.16
May 6, 2024 04:57:14.669646978 CEST	51622	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:14.669717073 CEST	51622	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:14.669895887 CEST	51631	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:14.671009064 CEST	51503	21	192.168.2.16	182.138.136.210
May 6, 2024 04:57:14.671020985 CEST	51470	21	192.168.2.16	52.242.72.10
May 6, 2024 04:57:14.676007032 CEST	51542	2121	192.168.2.16	195.189.108.133
May 6, 2024 04:57:14.676449060 CEST	21	51620	154.210.32.21	192.168.2.16
May 6, 2024 04:57:14.676513910 CEST	51620	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:14.682805061 CEST	2121	51624	34.128.145.40	192.168.2.16
May 6, 2024 04:57:14.682816982 CEST	21	51531	154.210.32.21	192.168.2.16
May 6, 2024 04:57:14.682852030 CEST	51624	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:14.682951927 CEST	51624	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:14.683150053 CEST	51632	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:14.687031984 CEST	51541	21	192.168.2.16	195.189.108.133
May 6, 2024 04:57:14.687032938 CEST	51472	21	192.168.2.16	113.22.156.85
May 6, 2024 04:57:14.687052965 CEST	51596	21	192.168.2.16	113.18.36.66
May 6, 2024 04:57:14.687053919 CEST	51473	2121	192.168.2.16	52.242.72.10
May 6, 2024 04:57:14.687053919 CEST	51597	2121	192.168.2.16	113.18.36.66
May 6, 2024 04:57:14.702816963 CEST	21	51561	50.30.20.59	192.168.2.16
May 6, 2024 04:57:14.703010082 CEST	51474	2121	192.168.2.16	113.22.156.85
May 6, 2024 04:57:14.703023911 CEST	51476	2121	192.168.2.16	34.123.190.8
May 6, 2024 04:57:14.703027010 CEST	51475	21	192.168.2.16	34.123.190.8
May 6, 2024 04:57:14.703279018 CEST	2121	51562	50.30.20.59	192.168.2.16
May 6, 2024 04:57:14.710191965 CEST	21	51530	91.239.170.127	192.168.2.16
May 6, 2024 04:57:14.719027042 CEST	51599	21	192.168.2.16	88.205.119.27
May 6, 2024 04:57:14.722996950 CEST	21	51625	87.106.26.129	192.168.2.16
May 6, 2024 04:57:14.723053932 CEST	51625	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:14.729177952 CEST	21	51591	87.106.26.129	192.168.2.16
May 6, 2024 04:57:14.729227066 CEST	51591	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:14.732284069 CEST	2121	51430	176.82.250.73	192.168.2.16
May 6, 2024 04:57:14.732296944 CEST	21	51433	176.82.250.73	192.168.2.16
May 6, 2024 04:57:14.732609987 CEST	51633	2121	192.168.2.16	85.216.208.3
May 6, 2024 04:57:14.735023022 CEST	51478	21	192.168.2.16	67.22.63.31
May 6, 2024 04:57:14.749998093 CEST	2121	51553	209.161.168.105	192.168.2.16
May 6, 2024 04:57:14.751008987 CEST	51551	2121	192.168.2.16	52.129.50.165
May 6, 2024 04:57:14.751019955 CEST	51480	2121	192.168.2.16	67.22.63.31
May 6, 2024 04:57:14.751035929 CEST	51600	2121	192.168.2.16	88.205.119.27
May 6, 2024 04:57:14.751035929 CEST	51549	21	192.168.2.16	52.129.50.165
May 6, 2024 04:57:14.751301050 CEST	51634	21	192.168.2.16	36.82.82.72
May 6, 2024 04:57:14.767225027 CEST	51447	21	192.168.2.16	156.232.143.236
May 6, 2024 04:57:14.767642975 CEST	51635	21	192.168.2.16	121.61.136.59
May 6, 2024 04:57:14.767644882 CEST	51481	21	192.168.2.16	172.77.243.169
May 6, 2024 04:57:14.767679930 CEST	51636	2121	192.168.2.16	36.82.82.72
May 6, 2024 04:57:14.770349979 CEST	21	51615	193.124.183.222	192.168.2.16
May 6, 2024 04:57:14.770508051 CEST	51615	21	192.168.2.16	193.124.183.222
May 6, 2024 04:57:14.771162987 CEST	2121	51532	91.239.170.127	192.168.2.16
May 6, 2024 04:57:14.780041933 CEST	21	51622	34.128.145.40	192.168.2.16
May 6, 2024 04:57:14.780082941 CEST	21	51631	34.128.145.40	192.168.2.16
May 6, 2024 04:57:14.780145884 CEST	51631	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:14.783029079 CEST	51482	2121	192.168.2.16	172.77.243.169
May 6, 2024 04:57:14.783051968 CEST	51483	21	192.168.2.16	79.105.143.96
May 6, 2024 04:57:14.792166948 CEST	2121	51624	34.128.145.40	192.168.2.16
May 6, 2024 04:57:14.793564081 CEST	2121	51632	34.128.145.40	192.168.2.16
May 6, 2024 04:57:14.793617964 CEST	51632	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:14.799038887 CEST	51484	21	192.168.2.16	180.248.225.69
May 6, 2024 04:57:14.799228907 CEST	51637	2121	192.168.2.16	121.61.136.59
May 6, 2024 04:57:14.799230099 CEST	51485	2121	192.168.2.16	79.105.143.96
May 6, 2024 04:57:14.812340975 CEST	21	51545	209.161.168.105	192.168.2.16
May 6, 2024 04:57:14.813098907 CEST	21	51598	81.88.252.91	192.168.2.16
May 6, 2024 04:57:14.813110113 CEST	21	51598	81.88.252.91	192.168.2.16
May 6, 2024 04:57:14.813391924 CEST	51638	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:14.815248966 CEST	51639	21	192.168.2.16	88.94.222.163
May 6, 2024 04:57:14.831028938 CEST	51603	21	192.168.2.16	8.143.241.182
May 6, 2024 04:57:14.831347942 CEST	51640	2121	192.168.2.16	88.94.222.163
May 6, 2024 04:57:14.836185932 CEST	2121	51488	180.248.225.69	192.168.2.16
May 6, 2024 04:57:14.839627981 CEST	21	51588	149.154.65.23	192.168.2.16
May 6, 2024 04:57:14.839679956 CEST	51588	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:14.842578888 CEST	21	51627	149.154.65.23	192.168.2.16
May 6, 2024 04:57:14.842639923 CEST	51627	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:14.846008062 CEST	51489	21	192.168.2.16	68.110.215.70
May 6, 2024 04:57:14.846028090 CEST	51604	2121	192.168.2.16	8.143.241.182
May 6, 2024 04:57:14.862008095 CEST	51511	21	192.168.2.16	114.69.228.54
May 6, 2024 04:57:14.862020016 CEST	51572	2121	192.168.2.16	58.52.70.249
May 6, 2024 04:57:14.862025976 CEST	51512	2121	192.168.2.16	114.69.228.54
May 6, 2024 04:57:14.862025976 CEST	51439	2121	192.168.2.16	180.123.143.207
May 6, 2024 04:57:14.866502047 CEST	21	51497	169.148.152.113	192.168.2.16
May 6, 2024 04:57:14.877011061 CEST	51490	2121	192.168.2.16	68.110.215.70
May 6, 2024 04:57:14.877027035 CEST	51492	2121	192.168.2.16	187.146.33.65
May 6, 2024 04:57:14.877028942 CEST	51501	21	192.168.2.16	67.209.52.183
May 6, 2024 04:57:14.877033949 CEST	51491	21	192.168.2.16	187.146.33.65
May 6, 2024 04:57:14.890249014 CEST	21	51631	34.128.145.40	192.168.2.16
May 6, 2024 04:57:14.890300035 CEST	51631	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:14.890347004 CEST	51631	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:14.890485048 CEST	51641	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:14.893014908 CEST	51450	2121	192.168.2.16	117.63.5.92
May 6, 2024 04:57:14.893022060 CEST	51502	2121	192.168.2.16	67.209.52.183
May 6, 2024 04:57:14.893146992 CEST	51493	21	192.168.2.16	104.40.217.229
May 6, 2024 04:57:14.904150963 CEST	2121	51632	34.128.145.40	192.168.2.16
May 6, 2024 04:57:14.904187918 CEST	51632	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:14.904263020 CEST	51632	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:14.904417992 CEST	51642	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:14.909010887 CEST	51471	2121	192.168.2.16	183.100.135.223
May 6, 2024 04:57:14.909029007 CEST	51495	21	192.168.2.16	90.208.144.81
May 6, 2024 04:57:14.909030914 CEST	51494	2121	192.168.2.16	104.40.217.229
May 6, 2024 04:57:14.909034014 CEST	51496	2121	192.168.2.16	90.208.144.81
May 6, 2024 04:57:14.909034014 CEST	51469	21	192.168.2.16	183.100.135.223
May 6, 2024 04:57:14.909357071 CEST	51643	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:14.911581993 CEST	51644	2121	192.168.2.16	101.43.249.26
May 6, 2024 04:57:14.923841000 CEST	2121	51551	52.129.50.165	192.168.2.16
May 6, 2024 04:57:14.923855066 CEST	21	51549	52.129.50.165	192.168.2.16
May 6, 2024 04:57:14.925009012 CEST	51605	21	192.168.2.16	90.202.49.17
May 6, 2024 04:57:14.929990053 CEST	2121	51498	169.148.152.113	192.168.2.16
May 6, 2024 04:57:14.955012083 CEST	51606	2121	192.168.2.16	90.202.49.17
May 6, 2024 04:57:14.962692976 CEST	21	51613	103.109.6.215	192.168.2.16
May 6, 2024 04:57:14.962821007 CEST	51613	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:14.970279932 CEST	21	51625	87.106.26.129	192.168.2.16
May 6, 2024 04:57:14.970431089 CEST	51625	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:14.972062111 CEST	2121	51542	195.189.108.133	192.168.2.16
May 6, 2024 04:57:14.987942934 CEST	21	51541	195.189.108.133	192.168.2.16
May 6, 2024 04:57:15.000117064 CEST	21	51631	34.128.145.40	192.168.2.16
May 6, 2024 04:57:15.000211954 CEST	21	51641	34.128.145.40	192.168.2.16
May 6, 2024 04:57:15.000274897 CEST	51641	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:15.002033949 CEST	51499	21	192.168.2.16	18.25.129.238
May 6, 2024 04:57:15.013014078 CEST	21	51620	154.210.32.21	192.168.2.16
May 6, 2024 04:57:15.013159037 CEST	51620	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:15.013618946 CEST	2121	51642	34.128.145.40	192.168.2.16
May 6, 2024 04:57:15.013669968 CEST	51642	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:15.013804913 CEST	2121	51632	34.128.145.40	192.168.2.16
May 6, 2024 04:57:15.018009901 CEST	51500	2121	192.168.2.16	18.25.129.238
May 6, 2024 04:57:15.021843910 CEST	2121	51506	182.138.136.210	192.168.2.16
May 6, 2024 04:57:15.038289070 CEST	21	51615	193.124.183.222	192.168.2.16
May 6, 2024 04:57:15.038300037 CEST	21	51615	193.124.183.222	192.168.2.16
May 6, 2024 04:57:15.038470984 CEST	51615	21	192.168.2.16	193.124.183.222
May 6, 2024 04:57:15.046646118 CEST	21	51503	182.138.136.210	192.168.2.16
May 6, 2024 04:57:15.050013065 CEST	51609	21	192.168.2.16	189.177.239.66
May 6, 2024 04:57:15.061139107 CEST	21	51423	45.87.1.166	192.168.2.16
May 6, 2024 04:57:15.061269045 CEST	51423	21	192.168.2.16	45.87.1.166
May 6, 2024 04:57:15.061440945 CEST	51645	21	192.168.2.16	45.87.1.166
May 6, 2024 04:57:15.066176891 CEST	51646	21	192.168.2.16	8.222.191.52
May 6, 2024 04:57:15.082012892 CEST	51610	2121	192.168.2.16	189.177.239.66
May 6, 2024 04:57:15.084062099 CEST	21	51638	81.88.252.91	192.168.2.16
May 6, 2024 04:57:15.084127903 CEST	51638	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:15.089452028 CEST	21	51447	156.232.143.236	192.168.2.16
May 6, 2024 04:57:15.092417002 CEST	21	51501	67.209.52.183	192.168.2.16
May 6, 2024 04:57:15.098006964 CEST	51616	21	192.168.2.16	154.195.192.8
May 6, 2024 04:57:15.110424042 CEST	21	51641	34.128.145.40	192.168.2.16
May 6, 2024 04:57:15.110474110 CEST	51641	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:15.110515118 CEST	51641	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:15.110644102 CEST	51647	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:15.110878944 CEST	2121	51502	67.209.52.183	192.168.2.16
May 6, 2024 04:57:15.114453077 CEST	51648	2121	192.168.2.16	8.222.191.52
May 6, 2024 04:57:15.114557028 CEST	51649	21	192.168.2.16	90.193.49.18
May 6, 2024 04:57:15.114609957 CEST	51650	2121	192.168.2.16	90.193.49.18
May 6, 2024 04:57:15.115181923 CEST	21	51627	149.154.65.23	192.168.2.16
May 6, 2024 04:57:15.115303993 CEST	51627	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:15.124305010 CEST	2121	51642	34.128.145.40	192.168.2.16
May 6, 2024 04:57:15.124360085 CEST	51642	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:15.124433041 CEST	51642	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:15.124614954 CEST	51651	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:15.129312038 CEST	51652	21	192.168.2.16	73.103.134.120
May 6, 2024 04:57:15.177246094 CEST	51653	2121	192.168.2.16	73.103.134.120
May 6, 2024 04:57:15.193022966 CEST	51612	2121	192.168.2.16	179.136.14.176
May 6, 2024 04:57:15.193030119 CEST	51611	21	192.168.2.16	179.136.14.176
May 6, 2024 04:57:15.194159031 CEST	21	51625	87.106.26.129	192.168.2.16
May 6, 2024 04:57:15.194364071 CEST	21	51625	87.106.26.129	192.168.2.16
May 6, 2024 04:57:15.194541931 CEST	51625	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:15.209011078 CEST	51561	21	192.168.2.16	50.30.20.59
May 6, 2024 04:57:15.209012985 CEST	51562	2121	192.168.2.16	50.30.20.59
May 6, 2024 04:57:15.209547997 CEST	2121	51471	183.100.135.223	192.168.2.16
May 6, 2024 04:57:15.211733103 CEST	21	51511	114.69.228.54	192.168.2.16
May 6, 2024 04:57:15.215825081 CEST	2121	51512	114.69.228.54	192.168.2.16
May 6, 2024 04:57:15.217385054 CEST	21	51469	183.100.135.223	192.168.2.16
May 6, 2024 04:57:15.221307993 CEST	21	51647	34.128.145.40	192.168.2.16
May 6, 2024 04:57:15.221318960 CEST	21	51641	34.128.145.40	192.168.2.16
May 6, 2024 04:57:15.221370935 CEST	51647	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:15.225014925 CEST	51530	21	192.168.2.16	91.239.170.127
May 6, 2024 04:57:15.225312948 CEST	51654	21	192.168.2.16	20.115.110.1
May 6, 2024 04:57:15.234247923 CEST	2121	51572	58.52.70.249	192.168.2.16
May 6, 2024 04:57:15.234369040 CEST	2121	51642	34.128.145.40	192.168.2.16
May 6, 2024 04:57:15.235058069 CEST	2121	51439	180.123.143.207	192.168.2.16
May 6, 2024 04:57:15.235239983 CEST	2121	51651	34.128.145.40	192.168.2.16
May 6, 2024 04:57:15.235295057 CEST	51651	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:15.235841990 CEST	2121	51450	117.63.5.92	192.168.2.16
May 6, 2024 04:57:15.241189957 CEST	51655	2121	192.168.2.16	20.115.110.1
May 6, 2024 04:57:15.256015062 CEST	51508	2121	192.168.2.16	121.164.250.185
May 6, 2024 04:57:15.256028891 CEST	51507	21	192.168.2.16	121.164.250.185
May 6, 2024 04:57:15.256237984 CEST	51553	2121	192.168.2.16	209.161.168.105
May 6, 2024 04:57:15.256297112 CEST	51656	21	192.168.2.16	213.143.14.170
May 6, 2024 04:57:15.256402969 CEST	51657	2121	192.168.2.16	213.143.14.170
May 6, 2024 04:57:15.257886887 CEST	21	51643	101.43.249.26	192.168.2.16
May 6, 2024 04:57:15.257949114 CEST	51643	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:15.272037983 CEST	51532	2121	192.168.2.16	91.239.170.127
May 6, 2024 04:57:15.289099932 CEST	21	51423	45.87.1.166	192.168.2.16
May 6, 2024 04:57:15.289156914 CEST	51423	21	192.168.2.16	45.87.1.166
May 6, 2024 04:57:15.291719913 CEST	21	51645	45.87.1.166	192.168.2.16
May 6, 2024 04:57:15.293653965 CEST	51645	21	192.168.2.16	45.87.1.166
May 6, 2024 04:57:15.303251028 CEST	51658	21	192.168.2.16	107.128.213.231
May 6, 2024 04:57:15.319031954 CEST	51618	2121	192.168.2.16	154.195.192.8
May 6, 2024 04:57:15.319039106 CEST	51545	21	192.168.2.16	209.161.168.105
May 6, 2024 04:57:15.319365978 CEST	51659	2121	192.168.2.16	107.128.213.231
May 6, 2024 04:57:15.319555044 CEST	51660	21	192.168.2.16	92.205.10.177
May 6, 2024 04:57:15.319794893 CEST	51661	2121	192.168.2.16	92.205.10.177
May 6, 2024 04:57:15.331526041 CEST	21	51647	34.128.145.40	192.168.2.16
May 6, 2024 04:57:15.331585884 CEST	51647	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:15.331645012 CEST	51647	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:15.331811905 CEST	51662	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:15.335015059 CEST	51619	21	192.168.2.16	72.218.134.108
May 6, 2024 04:57:15.335365057 CEST	51663	21	192.168.2.16	83.35.96.239
May 6, 2024 04:57:15.338885069 CEST	21	51613	103.109.6.215	192.168.2.16
May 6, 2024 04:57:15.339034081 CEST	51613	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:15.344944954 CEST	2121	51651	34.128.145.40	192.168.2.16
May 6, 2024 04:57:15.345009089 CEST	51651	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:15.345093012 CEST	51651	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:15.345256090 CEST	51664	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:15.351035118 CEST	51488	2121	192.168.2.16	180.248.225.69
May 6, 2024 04:57:15.351675034 CEST	51665	2121	192.168.2.16	83.35.96.239
May 6, 2024 04:57:15.351768970 CEST	51666	21	192.168.2.16	172.226.116.129
May 6, 2024 04:57:15.351877928 CEST	51667	2121	192.168.2.16	172.226.116.129
May 6, 2024 04:57:15.352039099 CEST	51668	21	192.168.2.16	14.36.176.217
May 6, 2024 04:57:15.352041006 CEST	21	51620	154.210.32.21	192.168.2.16
May 6, 2024 04:57:15.352055073 CEST	21	51620	154.210.32.21	192.168.2.16
May 6, 2024 04:57:15.352066994 CEST	21	51615	193.124.183.222	192.168.2.16
May 6, 2024 04:57:15.352236032 CEST	51620	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:15.365737915 CEST	21	51638	81.88.252.91	192.168.2.16
May 6, 2024 04:57:15.365859032 CEST	51638	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:15.367017031 CEST	51514	2121	192.168.2.16	46.158.210.29
May 6, 2024 04:57:15.367017984 CEST	51513	21	192.168.2.16	46.158.210.29
May 6, 2024 04:57:15.367023945 CEST	51621	2121	192.168.2.16	72.218.134.108
May 6, 2024 04:57:15.367023945 CEST	51497	21	192.168.2.16	169.148.152.113
May 6, 2024 04:57:15.383048058 CEST	51515	21	192.168.2.16	101.69.59.74
May 6, 2024 04:57:15.383447886 CEST	51669	2121	192.168.2.16	14.36.176.217
May 6, 2024 04:57:15.385441065 CEST	21	51627	149.154.65.23	192.168.2.16
May 6, 2024 04:57:15.385576010 CEST	21	51627	149.154.65.23	192.168.2.16
May 6, 2024 04:57:15.385739088 CEST	51627	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:15.403501034 CEST	21	51561	50.30.20.59	192.168.2.16
May 6, 2024 04:57:15.403844118 CEST	2121	51562	50.30.20.59	192.168.2.16
May 6, 2024 04:57:15.418715954 CEST	21	51625	87.106.26.129	192.168.2.16
May 6, 2024 04:57:15.418831110 CEST	51625	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:15.419064045 CEST	51670	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:15.430017948 CEST	51516	21	192.168.2.16	216.117.162.236
May 6, 2024 04:57:15.431220055 CEST	51549	21	192.168.2.16	52.129.50.165
May 6, 2024 04:57:15.436013937 CEST	51551	2121	192.168.2.16	52.129.50.165
May 6, 2024 04:57:15.437242985 CEST	51498	2121	192.168.2.16	169.148.152.113
May 6, 2024 04:57:15.442728996 CEST	21	51662	34.128.145.40	192.168.2.16
May 6, 2024 04:57:15.442786932 CEST	51662	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:15.443283081 CEST	21	51647	34.128.145.40	192.168.2.16
May 6, 2024 04:57:15.447112083 CEST	21	51616	154.195.192.8	192.168.2.16
May 6, 2024 04:57:15.456207991 CEST	2121	51651	34.128.145.40	192.168.2.16
May 6, 2024 04:57:15.456219912 CEST	2121	51664	34.128.145.40	192.168.2.16
May 6, 2024 04:57:15.456280947 CEST	51664	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:15.462420940 CEST	51671	21	192.168.2.16	90.209.246.134
May 6, 2024 04:57:15.474886894 CEST	21	51530	91.239.170.127	192.168.2.16
May 6, 2024 04:57:15.477319956 CEST	2121	51553	209.161.168.105	192.168.2.16
May 6, 2024 04:57:15.478010893 CEST	51542	2121	192.168.2.16	195.189.108.133
May 6, 2024 04:57:15.478032112 CEST	51623	21	192.168.2.16	88.92.223.56
May 6, 2024 04:57:15.494080067 CEST	51541	21	192.168.2.16	195.189.108.133
May 6, 2024 04:57:15.494463921 CEST	51672	2121	192.168.2.16	90.209.246.134
May 6, 2024 04:57:15.510287046 CEST	51673	21	192.168.2.16	47.41.13.129
May 6, 2024 04:57:15.516320944 CEST	2121	51532	91.239.170.127	192.168.2.16
May 6, 2024 04:57:15.526041031 CEST	51506	2121	192.168.2.16	182.138.136.210
May 6, 2024 04:57:15.530378103 CEST	21	51645	45.87.1.166	192.168.2.16
May 6, 2024 04:57:15.530513048 CEST	51645	21	192.168.2.16	45.87.1.166
May 6, 2024 04:57:15.542315960 CEST	51674	2121	192.168.2.16	47.41.13.129
May 6, 2024 04:57:15.547311068 CEST	21	51660	92.205.10.177	192.168.2.16
May 6, 2024 04:57:15.547380924 CEST	51660	21	192.168.2.16	92.205.10.177
May 6, 2024 04:57:15.551275969 CEST	21	51545	209.161.168.105	192.168.2.16
May 6, 2024 04:57:15.555706978 CEST	21	51662	34.128.145.40	192.168.2.16
May 6, 2024 04:57:15.555762053 CEST	51662	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:15.555800915 CEST	51662	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:15.555928946 CEST	51675	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:15.558012962 CEST	51503	21	192.168.2.16	182.138.136.210
May 6, 2024 04:57:15.564639091 CEST	21	51666	172.226.116.129	192.168.2.16
May 6, 2024 04:57:15.564728975 CEST	2121	51667	172.226.116.129	192.168.2.16
May 6, 2024 04:57:15.566009998 CEST	2121	51664	34.128.145.40	192.168.2.16
May 6, 2024 04:57:15.566060066 CEST	51664	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:15.566128016 CEST	51664	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:15.566303015 CEST	51676	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:15.567011118 CEST	51626	2121	192.168.2.16	88.92.223.56
May 6, 2024 04:57:15.590010881 CEST	51628	21	192.168.2.16	122.46.200.144
May 6, 2024 04:57:15.602214098 CEST	21	51549	52.129.50.165	192.168.2.16
May 6, 2024 04:57:15.602291107 CEST	2121	51551	52.129.50.165	192.168.2.16
May 6, 2024 04:57:15.606009960 CEST	51629	2121	192.168.2.16	122.46.200.144
May 6, 2024 04:57:15.606268883 CEST	51677	21	192.168.2.16	169.148.72.205
May 6, 2024 04:57:15.607074022 CEST	21	51643	101.43.249.26	192.168.2.16
May 6, 2024 04:57:15.607156038 CEST	51643	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:15.607292891 CEST	51678	2121	192.168.2.16	169.148.72.205
May 6, 2024 04:57:15.644484997 CEST	21	51625	87.106.26.129	192.168.2.16
May 6, 2024 04:57:15.644532919 CEST	51625	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:15.647403955 CEST	21	51670	87.106.26.129	192.168.2.16
May 6, 2024 04:57:15.647470951 CEST	51670	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:15.649477005 CEST	21	51638	81.88.252.91	192.168.2.16
May 6, 2024 04:57:15.649585962 CEST	51638	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:15.654004097 CEST	51522	2121	192.168.2.16	101.69.59.74
May 6, 2024 04:57:15.654031038 CEST	51630	21	192.168.2.16	85.216.208.3
May 6, 2024 04:57:15.658113956 CEST	21	51627	149.154.65.23	192.168.2.16
May 6, 2024 04:57:15.658272982 CEST	51627	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:15.658497095 CEST	51679	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:15.659101009 CEST	21	51668	14.36.176.217	192.168.2.16
May 6, 2024 04:57:15.665620089 CEST	21	51675	34.128.145.40	192.168.2.16
May 6, 2024 04:57:15.665692091 CEST	51675	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:15.666167974 CEST	21	51662	34.128.145.40	192.168.2.16
May 6, 2024 04:57:15.670043945 CEST	51523	21	192.168.2.16	35.238.176.156
May 6, 2024 04:57:15.675746918 CEST	2121	51676	34.128.145.40	192.168.2.16
May 6, 2024 04:57:15.675806046 CEST	51676	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:15.676933050 CEST	2121	51664	34.128.145.40	192.168.2.16
May 6, 2024 04:57:15.686398029 CEST	51680	21	192.168.2.16	27.78.248.53
May 6, 2024 04:57:15.686495066 CEST	51681	2121	192.168.2.16	27.78.248.53
May 6, 2024 04:57:15.689237118 CEST	21	51620	154.210.32.21	192.168.2.16
May 6, 2024 04:57:15.689352036 CEST	51620	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:15.689476967 CEST	51682	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:15.689935923 CEST	21	51620	154.210.32.21	192.168.2.16
May 6, 2024 04:57:15.689996958 CEST	51620	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:15.692168951 CEST	2121	51669	14.36.176.217	192.168.2.16
May 6, 2024 04:57:15.714684010 CEST	21	51613	103.109.6.215	192.168.2.16
May 6, 2024 04:57:15.714798927 CEST	51613	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:15.714925051 CEST	51683	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:15.718008995 CEST	51512	2121	192.168.2.16	114.69.228.54
May 6, 2024 04:57:15.718023062 CEST	51511	21	192.168.2.16	114.69.228.54
May 6, 2024 04:57:15.722465992 CEST	21	51497	169.148.152.113	192.168.2.16
May 6, 2024 04:57:15.724112988 CEST	2121	51488	180.248.225.69	192.168.2.16
May 6, 2024 04:57:15.734029055 CEST	51572	2121	192.168.2.16	58.52.70.249
May 6, 2024 04:57:15.734030008 CEST	51633	2121	192.168.2.16	85.216.208.3
May 6, 2024 04:57:15.734322071 CEST	51684	21	192.168.2.16	23.43.184.151
May 6, 2024 04:57:15.749206066 CEST	51685	2121	192.168.2.16	23.43.184.151
May 6, 2024 04:57:15.760966063 CEST	21	51645	45.87.1.166	192.168.2.16
May 6, 2024 04:57:15.761080027 CEST	21	51645	45.87.1.166	192.168.2.16
May 6, 2024 04:57:15.761198044 CEST	51645	21	192.168.2.16	45.87.1.166
May 6, 2024 04:57:15.764018059 CEST	51634	21	192.168.2.16	36.82.82.72
May 6, 2024 04:57:15.773770094 CEST	2121	51542	195.189.108.133	192.168.2.16
May 6, 2024 04:57:15.776231050 CEST	21	51660	92.205.10.177	192.168.2.16
May 6, 2024 04:57:15.776292086 CEST	21	51675	34.128.145.40	192.168.2.16
May 6, 2024 04:57:15.776314974 CEST	51660	21	192.168.2.16	92.205.10.177
May 6, 2024 04:57:15.776333094 CEST	51675	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:15.776407003 CEST	51675	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:15.776570082 CEST	51686	21	192.168.2.16	190.202.3.2
May 6, 2024 04:57:15.776611090 CEST	51687	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:15.779021025 CEST	51636	2121	192.168.2.16	36.82.82.72
May 6, 2024 04:57:15.779038906 CEST	51527	2121	192.168.2.16	35.238.176.156
May 6, 2024 04:57:15.779038906 CEST	51635	21	192.168.2.16	121.61.136.59
May 6, 2024 04:57:15.785046101 CEST	2121	51676	34.128.145.40	192.168.2.16
May 6, 2024 04:57:15.785108089 CEST	51676	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:15.785177946 CEST	51676	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:15.785343885 CEST	51688	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:15.792376041 CEST	2121	51498	169.148.152.113	192.168.2.16
May 6, 2024 04:57:15.794513941 CEST	21	51541	195.189.108.133	192.168.2.16
May 6, 2024 04:57:15.810024977 CEST	51637	2121	192.168.2.16	121.61.136.59
May 6, 2024 04:57:15.810267925 CEST	51689	2121	192.168.2.16	190.202.3.2
May 6, 2024 04:57:15.826030016 CEST	51639	21	192.168.2.16	88.94.222.163
May 6, 2024 04:57:15.842011929 CEST	51640	2121	192.168.2.16	88.94.222.163
May 6, 2024 04:57:15.842324972 CEST	51690	21	192.168.2.16	103.89.19.212
May 6, 2024 04:57:15.886145115 CEST	21	51675	34.128.145.40	192.168.2.16
May 6, 2024 04:57:15.886159897 CEST	21	51687	34.128.145.40	192.168.2.16
May 6, 2024 04:57:15.886233091 CEST	51687	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:15.892663002 CEST	2121	51506	182.138.136.210	192.168.2.16
May 6, 2024 04:57:15.894293070 CEST	2121	51676	34.128.145.40	192.168.2.16
May 6, 2024 04:57:15.894810915 CEST	2121	51688	34.128.145.40	192.168.2.16
May 6, 2024 04:57:15.894861937 CEST	51688	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:15.899801016 CEST	21	51670	87.106.26.129	192.168.2.16
May 6, 2024 04:57:15.899919987 CEST	51670	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:15.906014919 CEST	51562	2121	192.168.2.16	50.30.20.59
May 6, 2024 04:57:15.906033993 CEST	51561	21	192.168.2.16	50.30.20.59
May 6, 2024 04:57:15.906204939 CEST	51691	2121	192.168.2.16	103.89.19.212
May 6, 2024 04:57:15.918261051 CEST	21	51679	149.154.65.23	192.168.2.16
May 6, 2024 04:57:15.918318987 CEST	51679	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:15.922009945 CEST	51644	2121	192.168.2.16	101.43.249.26
May 6, 2024 04:57:15.927819014 CEST	21	51627	149.154.65.23	192.168.2.16
May 6, 2024 04:57:15.927874088 CEST	51627	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:15.932423115 CEST	21	51638	81.88.252.91	192.168.2.16
May 6, 2024 04:57:15.932435989 CEST	21	51638	81.88.252.91	192.168.2.16
May 6, 2024 04:57:15.932648897 CEST	21	51503	182.138.136.210	192.168.2.16
May 6, 2024 04:57:15.932766914 CEST	51692	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:15.933017015 CEST	51693	21	192.168.2.16	161.184.10.74
May 6, 2024 04:57:15.954031944 CEST	51616	21	192.168.2.16	154.195.192.8
May 6, 2024 04:57:15.955754995 CEST	21	51643	101.43.249.26	192.168.2.16
May 6, 2024 04:57:15.955766916 CEST	21	51643	101.43.249.26	192.168.2.16
May 6, 2024 04:57:15.955815077 CEST	51643	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:15.963593006 CEST	2121	51689	190.202.3.2	192.168.2.16
May 6, 2024 04:57:15.986041069 CEST	51553	2121	192.168.2.16	209.161.168.105
May 6, 2024 04:57:15.986042023 CEST	51530	21	192.168.2.16	91.239.170.127
May 6, 2024 04:57:15.995884895 CEST	21	51687	34.128.145.40	192.168.2.16
May 6, 2024 04:57:15.995954990 CEST	51687	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:15.996002913 CEST	51687	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:15.996201992 CEST	51694	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:16.002362967 CEST	51695	2121	192.168.2.16	161.184.10.74
May 6, 2024 04:57:16.004082918 CEST	21	51660	92.205.10.177	192.168.2.16
May 6, 2024 04:57:16.004137993 CEST	51660	21	192.168.2.16	92.205.10.177
May 6, 2024 04:57:16.004331112 CEST	2121	51688	34.128.145.40	192.168.2.16
May 6, 2024 04:57:16.004395008 CEST	51688	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:16.004461050 CEST	51688	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:16.004645109 CEST	51696	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:16.004905939 CEST	21	51660	92.205.10.177	192.168.2.16
May 6, 2024 04:57:16.004946947 CEST	51660	21	192.168.2.16	92.205.10.177
May 6, 2024 04:57:16.018035889 CEST	51532	2121	192.168.2.16	91.239.170.127
May 6, 2024 04:57:16.025036097 CEST	21	51620	154.210.32.21	192.168.2.16
May 6, 2024 04:57:16.034651041 CEST	21	51645	45.87.1.166	192.168.2.16
May 6, 2024 04:57:16.046627045 CEST	21	51682	154.210.32.21	192.168.2.16
May 6, 2024 04:57:16.046688080 CEST	51682	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:16.065015078 CEST	51539	21	192.168.2.16	99.235.199.144
May 6, 2024 04:57:16.065016031 CEST	51537	21	192.168.2.16	79.194.140.62
May 6, 2024 04:57:16.065035105 CEST	51666	21	192.168.2.16	172.226.116.129
May 6, 2024 04:57:16.065037966 CEST	51545	21	192.168.2.16	209.161.168.105
May 6, 2024 04:57:16.065094948 CEST	51667	2121	192.168.2.16	172.226.116.129
May 6, 2024 04:57:16.067635059 CEST	21	51511	114.69.228.54	192.168.2.16
May 6, 2024 04:57:16.067981005 CEST	51697	21	192.168.2.16	88.26.151.114
May 6, 2024 04:57:16.071852922 CEST	2121	51512	114.69.228.54	192.168.2.16
May 6, 2024 04:57:16.072230101 CEST	51698	2121	192.168.2.16	88.26.151.114
May 6, 2024 04:57:16.081012011 CEST	51534	2121	192.168.2.16	61.146.76.16
May 6, 2024 04:57:16.081013918 CEST	51646	21	192.168.2.16	8.222.191.52
May 6, 2024 04:57:16.081027031 CEST	51538	2121	192.168.2.16	79.194.140.62
May 6, 2024 04:57:16.081027031 CEST	51535	21	192.168.2.16	203.145.222.4
May 6, 2024 04:57:16.081031084 CEST	51533	21	192.168.2.16	61.146.76.16
May 6, 2024 04:57:16.081032038 CEST	51536	2121	192.168.2.16	203.145.222.4
May 6, 2024 04:57:16.088907957 CEST	21	51683	103.109.6.215	192.168.2.16
May 6, 2024 04:57:16.088968039 CEST	51683	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:16.089138031 CEST	21	51613	103.109.6.215	192.168.2.16
May 6, 2024 04:57:16.089181900 CEST	21	51613	103.109.6.215	192.168.2.16
May 6, 2024 04:57:16.089229107 CEST	51613	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:16.090599060 CEST	21	51561	50.30.20.59	192.168.2.16
May 6, 2024 04:57:16.090956926 CEST	51699	21	192.168.2.16	177.10.207.84
May 6, 2024 04:57:16.090959072 CEST	2121	51562	50.30.20.59	192.168.2.16
May 6, 2024 04:57:16.091212988 CEST	51700	2121	192.168.2.16	177.10.207.84
May 6, 2024 04:57:16.097006083 CEST	51543	21	192.168.2.16	98.26.186.53
May 6, 2024 04:57:16.097008944 CEST	51544	2121	192.168.2.16	98.26.186.53
May 6, 2024 04:57:16.097018003 CEST	51552	2121	192.168.2.16	47.40.202.110
May 6, 2024 04:57:16.097018957 CEST	51546	21	192.168.2.16	65.102.143.231
May 6, 2024 04:57:16.097037077 CEST	51548	2121	192.168.2.16	123.183.172.77
May 6, 2024 04:57:16.097037077 CEST	51555	21	192.168.2.16	64.254.141.113
May 6, 2024 04:57:16.097037077 CEST	51557	21	192.168.2.16	96.35.35.206
May 6, 2024 04:57:16.097038031 CEST	51540	2121	192.168.2.16	99.235.199.144
May 6, 2024 04:57:16.097038031 CEST	51550	21	192.168.2.16	47.40.202.110
May 6, 2024 04:57:16.097047091 CEST	51554	21	192.168.2.16	123.183.172.77
May 6, 2024 04:57:16.097048044 CEST	51547	2121	192.168.2.16	65.102.143.231
May 6, 2024 04:57:16.097050905 CEST	51556	2121	192.168.2.16	64.254.141.113
May 6, 2024 04:57:16.105624914 CEST	21	51687	34.128.145.40	192.168.2.16
May 6, 2024 04:57:16.105792046 CEST	21	51694	34.128.145.40	192.168.2.16
May 6, 2024 04:57:16.105864048 CEST	51694	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:16.106134892 CEST	2121	51572	58.52.70.249	192.168.2.16
May 6, 2024 04:57:16.113029957 CEST	51551	2121	192.168.2.16	52.129.50.165
May 6, 2024 04:57:16.113030910 CEST	51549	21	192.168.2.16	52.129.50.165
May 6, 2024 04:57:16.113584042 CEST	51701	21	192.168.2.16	13.226.99.231
May 6, 2024 04:57:16.113955975 CEST	2121	51688	34.128.145.40	192.168.2.16
May 6, 2024 04:57:16.114288092 CEST	2121	51696	34.128.145.40	192.168.2.16
May 6, 2024 04:57:16.114347935 CEST	51696	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:16.128289938 CEST	21	51670	87.106.26.129	192.168.2.16
May 6, 2024 04:57:16.128432035 CEST	21	51670	87.106.26.129	192.168.2.16
May 6, 2024 04:57:16.128979921 CEST	51670	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:16.129024982 CEST	51558	21	192.168.2.16	73.145.39.184
May 6, 2024 04:57:16.129024982 CEST	51566	2121	192.168.2.16	73.149.255.163
May 6, 2024 04:57:16.129040003 CEST	51652	21	192.168.2.16	73.103.134.120
May 6, 2024 04:57:16.129040956 CEST	51567	21	192.168.2.16	182.68.212.71
May 6, 2024 04:57:16.129041910 CEST	51559	2121	192.168.2.16	73.145.39.184
May 6, 2024 04:57:16.129044056 CEST	51564	21	192.168.2.16	73.149.255.163
May 6, 2024 04:57:16.129055023 CEST	51648	2121	192.168.2.16	8.222.191.52
May 6, 2024 04:57:16.129055977 CEST	51563	21	192.168.2.16	69.39.105.156
May 6, 2024 04:57:16.129060030 CEST	51560	2121	192.168.2.16	96.35.35.206
May 6, 2024 04:57:16.129060030 CEST	51649	21	192.168.2.16	90.193.49.18
May 6, 2024 04:57:16.129062891 CEST	51565	2121	192.168.2.16	69.39.105.156
May 6, 2024 04:57:16.129157066 CEST	51650	2121	192.168.2.16	90.193.49.18
May 6, 2024 04:57:16.145009995 CEST	51568	2121	192.168.2.16	182.68.212.71
May 6, 2024 04:57:16.145024061 CEST	51570	2121	192.168.2.16	73.46.255.118
May 6, 2024 04:57:16.145028114 CEST	51569	21	192.168.2.16	73.46.255.118
May 6, 2024 04:57:16.145448923 CEST	51571	21	192.168.2.16	58.52.70.249
May 6, 2024 04:57:16.145495892 CEST	51573	21	192.168.2.16	163.43.209.53
May 6, 2024 04:57:16.160051107 CEST	51668	21	192.168.2.16	14.36.176.217
May 6, 2024 04:57:16.175312996 CEST	51702	2121	192.168.2.16	13.226.99.231
May 6, 2024 04:57:16.182249069 CEST	21	51679	149.154.65.23	192.168.2.16
May 6, 2024 04:57:16.182403088 CEST	51679	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:16.191030025 CEST	51576	2121	192.168.2.16	163.43.209.53
May 6, 2024 04:57:16.191534042 CEST	51653	2121	192.168.2.16	73.103.134.120
May 6, 2024 04:57:16.199101925 CEST	21	51692	81.88.252.91	192.168.2.16
May 6, 2024 04:57:16.199223995 CEST	51692	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:16.207012892 CEST	51669	2121	192.168.2.16	14.36.176.217
May 6, 2024 04:57:16.207029104 CEST	51577	21	192.168.2.16	41.182.148.1
May 6, 2024 04:57:16.207047939 CEST	51578	2121	192.168.2.16	41.182.148.1
May 6, 2024 04:57:16.207293034 CEST	51703	21	192.168.2.16	39.115.181.20
May 6, 2024 04:57:16.210586071 CEST	2121	51553	209.161.168.105	192.168.2.16
May 6, 2024 04:57:16.215923071 CEST	21	51694	34.128.145.40	192.168.2.16
May 6, 2024 04:57:16.216005087 CEST	51694	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:16.216074944 CEST	51694	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:16.216244936 CEST	51704	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:16.223094940 CEST	51418	2121	192.168.2.16	168.220.94.137
May 6, 2024 04:57:16.223295927 CEST	51416	21	192.168.2.16	168.220.94.137
May 6, 2024 04:57:16.223767042 CEST	51705	21	192.168.2.16	168.220.94.137
May 6, 2024 04:57:16.223926067 CEST	51706	2121	192.168.2.16	168.220.94.137
May 6, 2024 04:57:16.223973989 CEST	51707	2121	192.168.2.16	39.115.181.20
May 6, 2024 04:57:16.224009037 CEST	2121	51696	34.128.145.40	192.168.2.16
May 6, 2024 04:57:16.224081039 CEST	51708	21	192.168.2.16	82.66.179.187
May 6, 2024 04:57:16.224111080 CEST	51696	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:16.224152088 CEST	51709	2121	192.168.2.16	82.66.179.187
May 6, 2024 04:57:16.224154949 CEST	51696	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:16.224181890 CEST	51710	21	192.168.2.16	112.182.156.166
May 6, 2024 04:57:16.224272966 CEST	51711	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:16.233179092 CEST	21	51530	91.239.170.127	192.168.2.16
May 6, 2024 04:57:16.238256931 CEST	51712	2121	192.168.2.16	112.182.156.166
May 6, 2024 04:57:16.238385916 CEST	51654	21	192.168.2.16	20.115.110.1
May 6, 2024 04:57:16.254029989 CEST	51655	2121	192.168.2.16	20.115.110.1
May 6, 2024 04:57:16.254533052 CEST	51713	21	192.168.2.16	137.118.249.75
May 6, 2024 04:57:16.254762888 CEST	51715	2121	192.168.2.16	138.59.232.213
May 6, 2024 04:57:16.254769087 CEST	51714	21	192.168.2.16	138.59.232.213
May 6, 2024 04:57:16.254793882 CEST	51716	2121	192.168.2.16	137.118.249.75
May 6, 2024 04:57:16.262217045 CEST	2121	51532	91.239.170.127	192.168.2.16
May 6, 2024 04:57:16.270009995 CEST	51656	21	192.168.2.16	213.143.14.170
May 6, 2024 04:57:16.270179987 CEST	51657	2121	192.168.2.16	213.143.14.170
May 6, 2024 04:57:16.277231932 CEST	21	51549	52.129.50.165	192.168.2.16
May 6, 2024 04:57:16.277290106 CEST	2121	51551	52.129.50.165	192.168.2.16
May 6, 2024 04:57:16.277637005 CEST	51717	21	192.168.2.16	68.32.220.155
May 6, 2024 04:57:16.277831078 CEST	51718	2121	192.168.2.16	68.32.220.155
May 6, 2024 04:57:16.278172970 CEST	21	51666	172.226.116.129	192.168.2.16
May 6, 2024 04:57:16.278186083 CEST	2121	51667	172.226.116.129	192.168.2.16
May 6, 2024 04:57:16.286039114 CEST	51542	2121	192.168.2.16	195.189.108.133
May 6, 2024 04:57:16.286324024 CEST	51719	21	192.168.2.16	118.42.106.96
May 6, 2024 04:57:16.296794891 CEST	21	51545	209.161.168.105	192.168.2.16
May 6, 2024 04:57:16.301814079 CEST	21	51616	154.195.192.8	192.168.2.16
May 6, 2024 04:57:16.302339077 CEST	51541	21	192.168.2.16	195.189.108.133
May 6, 2024 04:57:16.317032099 CEST	51658	21	192.168.2.16	107.128.213.231
May 6, 2024 04:57:16.317395926 CEST	51720	2121	192.168.2.16	118.42.106.96
May 6, 2024 04:57:16.317481995 CEST	51721	21	192.168.2.16	176.253.152.232
May 6, 2024 04:57:16.325730085 CEST	21	51694	34.128.145.40	192.168.2.16
May 6, 2024 04:57:16.326267004 CEST	21	51704	34.128.145.40	192.168.2.16
May 6, 2024 04:57:16.326464891 CEST	51704	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:16.332911015 CEST	21	51705	168.220.94.137	192.168.2.16
May 6, 2024 04:57:16.333022118 CEST	2121	51706	168.220.94.137	192.168.2.16
May 6, 2024 04:57:16.333049059 CEST	51661	2121	192.168.2.16	92.205.10.177
May 6, 2024 04:57:16.333095074 CEST	51705	21	192.168.2.16	168.220.94.137
May 6, 2024 04:57:16.333152056 CEST	51659	2121	192.168.2.16	107.128.213.231
May 6, 2024 04:57:16.333153963 CEST	51706	2121	192.168.2.16	168.220.94.137
May 6, 2024 04:57:16.333560944 CEST	21	51416	168.220.94.137	192.168.2.16
May 6, 2024 04:57:16.333585978 CEST	2121	51418	168.220.94.137	192.168.2.16
May 6, 2024 04:57:16.333811998 CEST	2121	51711	34.128.145.40	192.168.2.16
May 6, 2024 04:57:16.333928108 CEST	51711	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:16.334567070 CEST	2121	51696	34.128.145.40	192.168.2.16
May 6, 2024 04:57:16.336148024 CEST	2121	51700	177.10.207.84	192.168.2.16
May 6, 2024 04:57:16.349086046 CEST	51663	21	192.168.2.16	83.35.96.239
May 6, 2024 04:57:16.358325958 CEST	21	51670	87.106.26.129	192.168.2.16
May 6, 2024 04:57:16.358477116 CEST	51670	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:16.358737946 CEST	51722	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:16.365039110 CEST	51665	2121	192.168.2.16	83.35.96.239
May 6, 2024 04:57:16.365041018 CEST	51579	21	192.168.2.16	98.109.162.88
May 6, 2024 04:57:16.365351915 CEST	51723	2121	192.168.2.16	176.253.152.232
May 6, 2024 04:57:16.381016016 CEST	51582	2121	192.168.2.16	98.109.162.88
May 6, 2024 04:57:16.381429911 CEST	51724	21	192.168.2.16	72.73.124.217
May 6, 2024 04:57:16.381558895 CEST	51725	2121	192.168.2.16	72.73.124.217
May 6, 2024 04:57:16.405414104 CEST	21	51682	154.210.32.21	192.168.2.16
May 6, 2024 04:57:16.405566931 CEST	51682	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:16.413024902 CEST	51583	21	192.168.2.16	220.88.86.106
May 6, 2024 04:57:16.413045883 CEST	51584	2121	192.168.2.16	220.88.86.106
May 6, 2024 04:57:16.413542032 CEST	51726	2121	192.168.2.16	113.231.45.221
May 6, 2024 04:57:16.413578033 CEST	51727	21	192.168.2.16	113.231.45.221
May 6, 2024 04:57:16.429037094 CEST	51585	21	192.168.2.16	73.171.120.83
May 6, 2024 04:57:16.429363012 CEST	51728	21	192.168.2.16	20.22.149.231
May 6, 2024 04:57:16.436640024 CEST	21	51704	34.128.145.40	192.168.2.16
May 6, 2024 04:57:16.436718941 CEST	51704	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:16.436758995 CEST	51704	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:16.436919928 CEST	51729	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:16.442358971 CEST	21	51679	149.154.65.23	192.168.2.16
May 6, 2024 04:57:16.442441940 CEST	21	51679	149.154.65.23	192.168.2.16
May 6, 2024 04:57:16.442691088 CEST	51679	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:16.444329023 CEST	2121	51711	34.128.145.40	192.168.2.16
May 6, 2024 04:57:16.444392920 CEST	51711	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:16.444458008 CEST	51711	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:16.444622993 CEST	51730	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:16.461195946 CEST	51731	2121	192.168.2.16	20.22.149.231
May 6, 2024 04:57:16.463092089 CEST	21	51683	103.109.6.215	192.168.2.16
May 6, 2024 04:57:16.463195086 CEST	51683	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:16.471263885 CEST	21	51668	14.36.176.217	192.168.2.16
May 6, 2024 04:57:16.472516060 CEST	21	51692	81.88.252.91	192.168.2.16
May 6, 2024 04:57:16.472640991 CEST	51692	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:16.477015972 CEST	51671	21	192.168.2.16	90.209.246.134
May 6, 2024 04:57:16.477027893 CEST	51689	2121	192.168.2.16	190.202.3.2
May 6, 2024 04:57:16.485007048 CEST	21	51714	138.59.232.213	192.168.2.16
May 6, 2024 04:57:16.485625982 CEST	2121	51715	138.59.232.213	192.168.2.16
May 6, 2024 04:57:16.493324041 CEST	51732	21	192.168.2.16	90.209.109.67
May 6, 2024 04:57:16.509015083 CEST	51586	2121	192.168.2.16	73.171.120.83
May 6, 2024 04:57:16.509036064 CEST	51672	2121	192.168.2.16	90.209.246.134
May 6, 2024 04:57:16.509407043 CEST	51733	2121	192.168.2.16	90.209.109.67
May 6, 2024 04:57:16.515839100 CEST	2121	51669	14.36.176.217	192.168.2.16
May 6, 2024 04:57:16.525033951 CEST	51673	21	192.168.2.16	47.41.13.129
May 6, 2024 04:57:16.525046110 CEST	51587	21	192.168.2.16	112.163.253.29
May 6, 2024 04:57:16.525048018 CEST	51589	2121	192.168.2.16	112.163.253.29
May 6, 2024 04:57:16.531773090 CEST	21	51710	112.182.156.166	192.168.2.16
May 6, 2024 04:57:16.541373014 CEST	51734	21	192.168.2.16	79.25.181.60
May 6, 2024 04:57:16.542210102 CEST	2121	51712	112.182.156.166	192.168.2.16
May 6, 2024 04:57:16.546094894 CEST	21	51704	34.128.145.40	192.168.2.16
May 6, 2024 04:57:16.546565056 CEST	21	51729	34.128.145.40	192.168.2.16
May 6, 2024 04:57:16.546633959 CEST	51729	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:16.553833961 CEST	2121	51730	34.128.145.40	192.168.2.16
May 6, 2024 04:57:16.554210901 CEST	2121	51711	34.128.145.40	192.168.2.16
May 6, 2024 04:57:16.554280043 CEST	51730	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:16.557013035 CEST	51674	2121	192.168.2.16	47.41.13.129
May 6, 2024 04:57:16.557039022 CEST	51590	21	192.168.2.16	194.107.235.26
May 6, 2024 04:57:16.557297945 CEST	51735	2121	192.168.2.16	79.25.181.60
May 6, 2024 04:57:16.573188066 CEST	51736	21	192.168.2.16	84.168.33.40
May 6, 2024 04:57:16.581939936 CEST	2121	51542	195.189.108.133	192.168.2.16
May 6, 2024 04:57:16.587086916 CEST	21	51722	87.106.26.129	192.168.2.16
May 6, 2024 04:57:16.587151051 CEST	51722	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:16.589534044 CEST	21	51670	87.106.26.129	192.168.2.16
May 6, 2024 04:57:16.589745045 CEST	51670	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:16.590754986 CEST	21	51719	118.42.106.96	192.168.2.16
May 6, 2024 04:57:16.603125095 CEST	21	51541	195.189.108.133	192.168.2.16
May 6, 2024 04:57:16.605568886 CEST	51737	2121	192.168.2.16	84.168.33.40
May 6, 2024 04:57:16.605623960 CEST	51738	21	192.168.2.16	83.135.77.42
May 6, 2024 04:57:16.605709076 CEST	51739	2121	192.168.2.16	83.135.77.42
May 6, 2024 04:57:16.620578051 CEST	2121	51720	118.42.106.96	192.168.2.16
May 6, 2024 04:57:16.621020079 CEST	51572	2121	192.168.2.16	58.52.70.249
May 6, 2024 04:57:16.621021986 CEST	51677	21	192.168.2.16	169.148.72.205
May 6, 2024 04:57:16.621119022 CEST	51678	2121	192.168.2.16	169.148.72.205
May 6, 2024 04:57:16.621685982 CEST	51740	21	192.168.2.16	106.194.230.187
May 6, 2024 04:57:16.621738911 CEST	51741	2121	192.168.2.16	106.194.230.187
May 6, 2024 04:57:16.621867895 CEST	51742	21	192.168.2.16	86.154.161.253
May 6, 2024 04:57:16.621905088 CEST	51743	2121	192.168.2.16	86.154.161.253
May 6, 2024 04:57:16.621912003 CEST	51744	21	192.168.2.16	20.51.81.10
May 6, 2024 04:57:16.630727053 CEST	2121	51689	190.202.3.2	192.168.2.16
May 6, 2024 04:57:16.637012005 CEST	51595	2121	192.168.2.16	194.107.235.26
May 6, 2024 04:57:16.637327909 CEST	51745	2121	192.168.2.16	20.51.81.10
May 6, 2024 04:57:16.637346983 CEST	51746	21	192.168.2.16	200.102.4.135
May 6, 2024 04:57:16.653296947 CEST	51747	2121	192.168.2.16	200.102.4.135
May 6, 2024 04:57:16.653378963 CEST	51748	21	192.168.2.16	200.203.158.14
May 6, 2024 04:57:16.657125950 CEST	21	51729	34.128.145.40	192.168.2.16
May 6, 2024 04:57:16.657188892 CEST	51729	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:16.657232046 CEST	51729	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:16.657352924 CEST	51749	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:16.663574934 CEST	2121	51730	34.128.145.40	192.168.2.16
May 6, 2024 04:57:16.664454937 CEST	51730	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:16.664516926 CEST	51730	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:16.664684057 CEST	51750	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:16.669212103 CEST	51751	2121	192.168.2.16	200.203.158.14
May 6, 2024 04:57:16.685342073 CEST	51752	21	192.168.2.16	91.216.54.11
May 6, 2024 04:57:16.685363054 CEST	51753	2121	192.168.2.16	91.216.54.11
May 6, 2024 04:57:16.701041937 CEST	51680	21	192.168.2.16	27.78.248.53
May 6, 2024 04:57:16.701149940 CEST	51596	21	192.168.2.16	113.18.36.66
May 6, 2024 04:57:16.701519966 CEST	51754	21	192.168.2.16	119.109.126.41
May 6, 2024 04:57:16.701534986 CEST	51755	2121	192.168.2.16	119.109.126.41
May 6, 2024 04:57:16.701567888 CEST	51756	21	192.168.2.16	180.165.128.30
May 6, 2024 04:57:16.702522993 CEST	51681	2121	192.168.2.16	27.78.248.53
May 6, 2024 04:57:16.703392029 CEST	21	51679	149.154.65.23	192.168.2.16
May 6, 2024 04:57:16.703425884 CEST	51597	2121	192.168.2.16	113.18.36.66
May 6, 2024 04:57:16.704754114 CEST	51679	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:16.705152988 CEST	51757	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:16.733125925 CEST	51599	21	192.168.2.16	88.205.119.27
May 6, 2024 04:57:16.733237982 CEST	51758	2121	192.168.2.16	180.165.128.30
May 6, 2024 04:57:16.749007940 CEST	51684	21	192.168.2.16	23.43.184.151
May 6, 2024 04:57:16.749357939 CEST	51759	21	192.168.2.16	181.128.99.130
May 6, 2024 04:57:16.756108046 CEST	21	51692	81.88.252.91	192.168.2.16
May 6, 2024 04:57:16.756241083 CEST	51692	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:16.762768030 CEST	21	51682	154.210.32.21	192.168.2.16
May 6, 2024 04:57:16.762778997 CEST	21	51682	154.210.32.21	192.168.2.16
May 6, 2024 04:57:16.762888908 CEST	51682	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:16.764012098 CEST	51685	2121	192.168.2.16	23.43.184.151
May 6, 2024 04:57:16.764039993 CEST	51600	2121	192.168.2.16	88.205.119.27
May 6, 2024 04:57:16.764420033 CEST	51760	2121	192.168.2.16	181.128.99.130
May 6, 2024 04:57:16.767734051 CEST	21	51729	34.128.145.40	192.168.2.16
May 6, 2024 04:57:16.767803907 CEST	21	51749	34.128.145.40	192.168.2.16
May 6, 2024 04:57:16.769195080 CEST	51749	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:16.774280071 CEST	2121	51750	34.128.145.40	192.168.2.16
May 6, 2024 04:57:16.774342060 CEST	51750	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:16.780039072 CEST	51667	2121	192.168.2.16	172.226.116.129
May 6, 2024 04:57:16.780056953 CEST	51686	21	192.168.2.16	190.202.3.2
May 6, 2024 04:57:16.780440092 CEST	51666	21	192.168.2.16	172.226.116.129
May 6, 2024 04:57:16.780441999 CEST	51761	2121	192.168.2.16	68.207.200.104
May 6, 2024 04:57:16.780476093 CEST	51762	21	192.168.2.16	68.207.200.104
May 6, 2024 04:57:16.796406984 CEST	51763	2121	192.168.2.16	182.112.110.53
May 6, 2024 04:57:16.796430111 CEST	51764	21	192.168.2.16	182.112.110.53
May 6, 2024 04:57:16.811044931 CEST	51616	21	192.168.2.16	154.195.192.8
May 6, 2024 04:57:16.837095022 CEST	21	51683	103.109.6.215	192.168.2.16
May 6, 2024 04:57:16.837220907 CEST	51683	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:16.838922977 CEST	21	51722	87.106.26.129	192.168.2.16
May 6, 2024 04:57:16.839112043 CEST	51722	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:16.843014002 CEST	51603	21	192.168.2.16	8.143.241.182
May 6, 2024 04:57:16.843095064 CEST	51700	2121	192.168.2.16	177.10.207.84
May 6, 2024 04:57:16.843111038 CEST	51690	21	192.168.2.16	103.89.19.212
May 6, 2024 04:57:16.843280077 CEST	51765	21	192.168.2.16	87.7.194.124
May 6, 2024 04:57:16.858007908 CEST	51604	2121	192.168.2.16	8.143.241.182
May 6, 2024 04:57:16.858360052 CEST	51766	21	192.168.2.16	43.202.248.251
May 6, 2024 04:57:16.858392954 CEST	51767	2121	192.168.2.16	87.7.194.124
May 6, 2024 04:57:16.874212027 CEST	51768	2121	192.168.2.16	43.202.248.251
May 6, 2024 04:57:16.879834890 CEST	21	51749	34.128.145.40	192.168.2.16
May 6, 2024 04:57:16.879992962 CEST	51749	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:16.879992962 CEST	51749	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:16.880162001 CEST	51769	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:16.883980036 CEST	2121	51750	34.128.145.40	192.168.2.16
May 6, 2024 04:57:16.884030104 CEST	51750	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:16.884107113 CEST	51750	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:16.884222031 CEST	51770	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:16.890234947 CEST	51771	21	192.168.2.16	185.99.89.43
May 6, 2024 04:57:16.906030893 CEST	51691	2121	192.168.2.16	103.89.19.212
May 6, 2024 04:57:16.906677008 CEST	51772	2121	192.168.2.16	185.99.89.43
May 6, 2024 04:57:16.906739950 CEST	51773	21	192.168.2.16	50.159.242.121
May 6, 2024 04:57:16.906765938 CEST	51774	2121	192.168.2.16	50.159.242.121
May 6, 2024 04:57:16.926604033 CEST	2121	51753	91.216.54.11	192.168.2.16
May 6, 2024 04:57:16.928864002 CEST	21	51752	91.216.54.11	192.168.2.16
May 6, 2024 04:57:16.938051939 CEST	51605	21	192.168.2.16	90.202.49.17
May 6, 2024 04:57:16.938055038 CEST	51693	21	192.168.2.16	161.184.10.74
May 6, 2024 04:57:16.964771032 CEST	21	51679	149.154.65.23	192.168.2.16
May 6, 2024 04:57:16.965173006 CEST	51679	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:16.970014095 CEST	51606	2121	192.168.2.16	90.202.49.17
May 6, 2024 04:57:16.970133066 CEST	21	51757	149.154.65.23	192.168.2.16
May 6, 2024 04:57:16.970191956 CEST	51757	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:16.986035109 CEST	51714	21	192.168.2.16	138.59.232.213
May 6, 2024 04:57:16.986037016 CEST	51668	21	192.168.2.16	14.36.176.217
May 6, 2024 04:57:16.986310959 CEST	51775	21	192.168.2.16	118.51.54.18
May 6, 2024 04:57:16.986311913 CEST	51730	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:16.989804029 CEST	21	51769	34.128.145.40	192.168.2.16
May 6, 2024 04:57:16.989870071 CEST	51769	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:16.992990971 CEST	2121	51667	172.226.116.129	192.168.2.16
May 6, 2024 04:57:16.993365049 CEST	2121	51572	58.52.70.249	192.168.2.16
May 6, 2024 04:57:16.993376017 CEST	21	51666	172.226.116.129	192.168.2.16
May 6, 2024 04:57:16.993690968 CEST	2121	51750	34.128.145.40	192.168.2.16
May 6, 2024 04:57:16.993798971 CEST	2121	51770	34.128.145.40	192.168.2.16
May 6, 2024 04:57:16.993860960 CEST	51770	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:17.001014948 CEST	51715	2121	192.168.2.16	138.59.232.213
May 6, 2024 04:57:17.001274109 CEST	51776	2121	192.168.2.16	118.51.54.18
May 6, 2024 04:57:17.017028093 CEST	51695	2121	192.168.2.16	161.184.10.74
May 6, 2024 04:57:17.017220974 CEST	51669	2121	192.168.2.16	14.36.176.217
May 6, 2024 04:57:17.017221928 CEST	51777	21	192.168.2.16	223.231.204.62
May 6, 2024 04:57:17.033046007 CEST	51710	21	192.168.2.16	112.182.156.166
May 6, 2024 04:57:17.043970108 CEST	21	51692	81.88.252.91	192.168.2.16
May 6, 2024 04:57:17.043981075 CEST	21	51692	81.88.252.91	192.168.2.16
May 6, 2024 04:57:17.044301033 CEST	51778	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:17.049040079 CEST	51712	2121	192.168.2.16	112.182.156.166
May 6, 2024 04:57:17.051251888 CEST	2121	51755	119.109.126.41	192.168.2.16
May 6, 2024 04:57:17.059638977 CEST	21	51756	180.165.128.30	192.168.2.16
May 6, 2024 04:57:17.065006971 CEST	51609	21	192.168.2.16	189.177.239.66
May 6, 2024 04:57:17.067395926 CEST	21	51722	87.106.26.129	192.168.2.16
May 6, 2024 04:57:17.067588091 CEST	21	51722	87.106.26.129	192.168.2.16
May 6, 2024 04:57:17.067734957 CEST	51722	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:17.072745085 CEST	2121	51758	180.165.128.30	192.168.2.16
May 6, 2024 04:57:17.073388100 CEST	21	51754	119.109.126.41	192.168.2.16
May 6, 2024 04:57:17.081012964 CEST	51697	21	192.168.2.16	88.26.151.114
May 6, 2024 04:57:17.081037045 CEST	51698	2121	192.168.2.16	88.26.151.114
May 6, 2024 04:57:17.090213060 CEST	2121	51700	177.10.207.84	192.168.2.16
May 6, 2024 04:57:17.095484018 CEST	2121	51730	34.128.145.40	192.168.2.16
May 6, 2024 04:57:17.097013950 CEST	51699	21	192.168.2.16	177.10.207.84
May 6, 2024 04:57:17.097016096 CEST	51610	2121	192.168.2.16	189.177.239.66
May 6, 2024 04:57:17.097095013 CEST	51719	21	192.168.2.16	118.42.106.96
May 6, 2024 04:57:17.099548101 CEST	21	51769	34.128.145.40	192.168.2.16
May 6, 2024 04:57:17.099602938 CEST	51769	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:17.099664927 CEST	51769	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:17.099828005 CEST	51779	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:17.103651047 CEST	2121	51770	34.128.145.40	192.168.2.16
May 6, 2024 04:57:17.103698969 CEST	51770	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:17.103754997 CEST	51770	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:17.103925943 CEST	51780	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:17.124627113 CEST	21	51682	154.210.32.21	192.168.2.16
May 6, 2024 04:57:17.124741077 CEST	51682	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:17.124865055 CEST	51781	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:17.125322104 CEST	21	51682	154.210.32.21	192.168.2.16
May 6, 2024 04:57:17.125375032 CEST	51682	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:17.128021002 CEST	51701	21	192.168.2.16	13.226.99.231
May 6, 2024 04:57:17.128036022 CEST	51720	2121	192.168.2.16	118.42.106.96
May 6, 2024 04:57:17.144012928 CEST	51689	2121	192.168.2.16	190.202.3.2
May 6, 2024 04:57:17.159070969 CEST	21	51616	154.195.192.8	192.168.2.16
May 6, 2024 04:57:17.161475897 CEST	21	51766	43.202.248.251	192.168.2.16
May 6, 2024 04:57:17.176038027 CEST	51702	2121	192.168.2.16	13.226.99.231
May 6, 2024 04:57:17.189068079 CEST	2121	51768	43.202.248.251	192.168.2.16
May 6, 2024 04:57:17.208031893 CEST	51612	2121	192.168.2.16	179.136.14.176
May 6, 2024 04:57:17.208033085 CEST	51611	21	192.168.2.16	179.136.14.176
May 6, 2024 04:57:17.209135056 CEST	51749	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:17.209136963 CEST	51703	21	192.168.2.16	39.115.181.20
May 6, 2024 04:57:17.209405899 CEST	21	51769	34.128.145.40	192.168.2.16
May 6, 2024 04:57:17.209539890 CEST	21	51779	34.128.145.40	192.168.2.16
May 6, 2024 04:57:17.209659100 CEST	51779	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:17.212481976 CEST	21	51683	103.109.6.215	192.168.2.16
May 6, 2024 04:57:17.212583065 CEST	51683	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:17.212721109 CEST	51782	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:17.213634968 CEST	2121	51780	34.128.145.40	192.168.2.16
May 6, 2024 04:57:17.213681936 CEST	51780	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:17.214214087 CEST	2121	51770	34.128.145.40	192.168.2.16
May 6, 2024 04:57:17.216465950 CEST	21	51714	138.59.232.213	192.168.2.16
May 6, 2024 04:57:17.235517979 CEST	2121	51715	138.59.232.213	192.168.2.16
May 6, 2024 04:57:17.238013029 CEST	51709	2121	192.168.2.16	82.66.179.187
May 6, 2024 04:57:17.238033056 CEST	51707	2121	192.168.2.16	39.115.181.20
May 6, 2024 04:57:17.238440037 CEST	51708	21	192.168.2.16	82.66.179.187
May 6, 2024 04:57:17.238444090 CEST	51783	2121	192.168.2.16	223.231.204.62
May 6, 2024 04:57:17.238491058 CEST	21	51757	149.154.65.23	192.168.2.16
May 6, 2024 04:57:17.238497019 CEST	51784	21	192.168.2.16	82.76.47.225
May 6, 2024 04:57:17.238636971 CEST	51757	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:17.269032955 CEST	51713	21	192.168.2.16	137.118.249.75
May 6, 2024 04:57:17.269059896 CEST	51716	2121	192.168.2.16	137.118.249.75
May 6, 2024 04:57:17.285028934 CEST	51717	21	192.168.2.16	68.32.220.155
May 6, 2024 04:57:17.285052061 CEST	51718	2121	192.168.2.16	68.32.220.155
May 6, 2024 04:57:17.294090033 CEST	21	51668	14.36.176.217	192.168.2.16
May 6, 2024 04:57:17.296387911 CEST	21	51722	87.106.26.129	192.168.2.16
May 6, 2024 04:57:17.296539068 CEST	51722	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:17.296772003 CEST	51785	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:17.296955109 CEST	2121	51689	190.202.3.2	192.168.2.16
May 6, 2024 04:57:17.304342031 CEST	21	51778	81.88.252.91	192.168.2.16
May 6, 2024 04:57:17.304406881 CEST	51778	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:17.320045948 CEST	21	51749	34.128.145.40	192.168.2.16
May 6, 2024 04:57:17.320076942 CEST	21	51779	34.128.145.40	192.168.2.16
May 6, 2024 04:57:17.320131063 CEST	51779	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:17.320207119 CEST	51779	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:17.320362091 CEST	51786	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:17.323858023 CEST	2121	51780	34.128.145.40	192.168.2.16
May 6, 2024 04:57:17.323909044 CEST	51780	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:17.323966026 CEST	51780	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:17.324095011 CEST	51787	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:17.325938940 CEST	2121	51669	14.36.176.217	192.168.2.16
May 6, 2024 04:57:17.332032919 CEST	51618	2121	192.168.2.16	154.195.192.8
May 6, 2024 04:57:17.332036018 CEST	51721	21	192.168.2.16	176.253.152.232
May 6, 2024 04:57:17.340240955 CEST	21	51710	112.182.156.166	192.168.2.16
May 6, 2024 04:57:17.348032951 CEST	51619	21	192.168.2.16	72.218.134.108
May 6, 2024 04:57:17.348272085 CEST	51788	2121	192.168.2.16	82.76.47.225
May 6, 2024 04:57:17.354103088 CEST	2121	51712	112.182.156.166	192.168.2.16
May 6, 2024 04:57:17.363301992 CEST	51789	21	192.168.2.16	220.163.109.166
May 6, 2024 04:57:17.379028082 CEST	51621	2121	192.168.2.16	72.218.134.108
May 6, 2024 04:57:17.379033089 CEST	51723	2121	192.168.2.16	176.253.152.232
May 6, 2024 04:57:17.379492044 CEST	51790	2121	192.168.2.16	220.163.109.166
May 6, 2024 04:57:17.395015955 CEST	51725	2121	192.168.2.16	72.73.124.217
May 6, 2024 04:57:17.395034075 CEST	51724	21	192.168.2.16	72.73.124.217
May 6, 2024 04:57:17.401343107 CEST	21	51719	118.42.106.96	192.168.2.16
May 6, 2024 04:57:17.427031994 CEST	51727	21	192.168.2.16	113.231.45.221
May 6, 2024 04:57:17.427243948 CEST	51791	21	192.168.2.16	216.117.162.236
May 6, 2024 04:57:17.429811954 CEST	21	51779	34.128.145.40	192.168.2.16
May 6, 2024 04:57:17.429828882 CEST	21	51786	34.128.145.40	192.168.2.16
May 6, 2024 04:57:17.429889917 CEST	51786	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:17.433649063 CEST	2121	51720	118.42.106.96	192.168.2.16
May 6, 2024 04:57:17.434243917 CEST	2121	51780	34.128.145.40	192.168.2.16
May 6, 2024 04:57:17.434410095 CEST	2121	51787	34.128.145.40	192.168.2.16
May 6, 2024 04:57:17.434463978 CEST	51787	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:17.442009926 CEST	51726	2121	192.168.2.16	113.231.45.221
May 6, 2024 04:57:17.443039894 CEST	51752	21	192.168.2.16	91.216.54.11
May 6, 2024 04:57:17.443041086 CEST	51753	2121	192.168.2.16	91.216.54.11
May 6, 2024 04:57:17.443042040 CEST	51728	21	192.168.2.16	20.22.149.231
May 6, 2024 04:57:17.465612888 CEST	21	51781	154.210.32.21	192.168.2.16
May 6, 2024 04:57:17.465677023 CEST	51781	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:17.475013018 CEST	51731	2121	192.168.2.16	20.22.149.231
May 6, 2024 04:57:17.482664108 CEST	21	51682	154.210.32.21	192.168.2.16
May 6, 2024 04:57:17.491031885 CEST	51623	21	192.168.2.16	88.92.223.56
May 6, 2024 04:57:17.491066933 CEST	51479	21	192.168.2.16	188.214.156.147
May 6, 2024 04:57:17.491291046 CEST	51792	21	192.168.2.16	188.214.156.147
May 6, 2024 04:57:17.503608942 CEST	21	51757	149.154.65.23	192.168.2.16
May 6, 2024 04:57:17.503700972 CEST	21	51757	149.154.65.23	192.168.2.16
May 6, 2024 04:57:17.503846884 CEST	51757	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:17.507026911 CEST	51732	21	192.168.2.16	90.209.109.67
May 6, 2024 04:57:17.507034063 CEST	51666	21	192.168.2.16	172.226.116.129
May 6, 2024 04:57:17.507042885 CEST	51667	2121	192.168.2.16	172.226.116.129
May 6, 2024 04:57:17.523011923 CEST	51733	2121	192.168.2.16	90.209.109.67
May 6, 2024 04:57:17.524995089 CEST	21	51785	87.106.26.129	192.168.2.16
May 6, 2024 04:57:17.525053024 CEST	51785	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:17.526820898 CEST	21	51722	87.106.26.129	192.168.2.16
May 6, 2024 04:57:17.526876926 CEST	51722	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:17.539458990 CEST	21	51786	34.128.145.40	192.168.2.16
May 6, 2024 04:57:17.539515018 CEST	51786	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:17.539594889 CEST	51786	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:17.539784908 CEST	51793	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:17.544198036 CEST	2121	51787	34.128.145.40	192.168.2.16
May 6, 2024 04:57:17.544250011 CEST	51787	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:17.544296026 CEST	51787	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:17.544425964 CEST	51794	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:17.554028988 CEST	51755	2121	192.168.2.16	119.109.126.41
May 6, 2024 04:57:17.554045916 CEST	51734	21	192.168.2.16	79.25.181.60
May 6, 2024 04:57:17.570023060 CEST	51626	2121	192.168.2.16	88.92.223.56
May 6, 2024 04:57:17.570048094 CEST	51735	2121	192.168.2.16	79.25.181.60
May 6, 2024 04:57:17.571950912 CEST	51756	21	192.168.2.16	180.165.128.30
May 6, 2024 04:57:17.577821970 CEST	21	51778	81.88.252.91	192.168.2.16
May 6, 2024 04:57:17.577950001 CEST	51778	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:17.584320068 CEST	21	51782	103.109.6.215	192.168.2.16
May 6, 2024 04:57:17.584392071 CEST	51782	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:17.586010933 CEST	51754	21	192.168.2.16	119.109.126.41
May 6, 2024 04:57:17.586035013 CEST	51736	21	192.168.2.16	84.168.33.40
May 6, 2024 04:57:17.586035967 CEST	51758	2121	192.168.2.16	180.165.128.30
May 6, 2024 04:57:17.586433887 CEST	21	51683	103.109.6.215	192.168.2.16
May 6, 2024 04:57:17.586450100 CEST	21	51683	103.109.6.215	192.168.2.16
May 6, 2024 04:57:17.586494923 CEST	51683	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:17.601891041 CEST	2121	51788	82.76.47.225	192.168.2.16
May 6, 2024 04:57:17.602015018 CEST	51628	21	192.168.2.16	122.46.200.144
May 6, 2024 04:57:17.602020025 CEST	51700	2121	192.168.2.16	177.10.207.84
May 6, 2024 04:57:17.618014097 CEST	51737	2121	192.168.2.16	84.168.33.40
May 6, 2024 04:57:17.618030071 CEST	51629	2121	192.168.2.16	122.46.200.144
May 6, 2024 04:57:17.618033886 CEST	51738	21	192.168.2.16	83.135.77.42
May 6, 2024 04:57:17.618037939 CEST	51739	2121	192.168.2.16	83.135.77.42
May 6, 2024 04:57:17.634020090 CEST	51743	2121	192.168.2.16	86.154.161.253
May 6, 2024 04:57:17.634022951 CEST	51742	21	192.168.2.16	86.154.161.253
May 6, 2024 04:57:17.634042978 CEST	51744	21	192.168.2.16	20.51.81.10
May 6, 2024 04:57:17.634046078 CEST	51740	21	192.168.2.16	106.194.230.187
May 6, 2024 04:57:17.634068012 CEST	51741	2121	192.168.2.16	106.194.230.187
May 6, 2024 04:57:17.649027109 CEST	21	51793	34.128.145.40	192.168.2.16
May 6, 2024 04:57:17.649092913 CEST	51793	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:17.649956942 CEST	21	51786	34.128.145.40	192.168.2.16
May 6, 2024 04:57:17.650043964 CEST	51746	21	192.168.2.16	200.102.4.135
May 6, 2024 04:57:17.650068998 CEST	51745	2121	192.168.2.16	20.51.81.10
May 6, 2024 04:57:17.650255919 CEST	51795	21	192.168.2.16	36.35.222.12
May 6, 2024 04:57:17.654015064 CEST	2121	51794	34.128.145.40	192.168.2.16
May 6, 2024 04:57:17.654090881 CEST	51794	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:17.654706001 CEST	2121	51787	34.128.145.40	192.168.2.16
May 6, 2024 04:57:17.666014910 CEST	51748	21	192.168.2.16	200.203.158.14
May 6, 2024 04:57:17.666018963 CEST	51747	2121	192.168.2.16	200.102.4.135
May 6, 2024 04:57:17.666030884 CEST	51630	21	192.168.2.16	85.216.208.3
May 6, 2024 04:57:17.668247938 CEST	51766	21	192.168.2.16	43.202.248.251
May 6, 2024 04:57:17.674009085 CEST	51616	21	192.168.2.16	154.195.192.8
May 6, 2024 04:57:17.682033062 CEST	51751	2121	192.168.2.16	200.203.158.14
May 6, 2024 04:57:17.682318926 CEST	51796	2121	192.168.2.16	36.35.222.12
May 6, 2024 04:57:17.685262918 CEST	2121	51753	91.216.54.11	192.168.2.16
May 6, 2024 04:57:17.687542915 CEST	21	51752	91.216.54.11	192.168.2.16
May 6, 2024 04:57:17.698033094 CEST	51768	2121	192.168.2.16	43.202.248.251
May 6, 2024 04:57:17.719974041 CEST	21	51666	172.226.116.129	192.168.2.16
May 6, 2024 04:57:17.719993114 CEST	2121	51667	172.226.116.129	192.168.2.16
May 6, 2024 04:57:17.730056047 CEST	51714	21	192.168.2.16	138.59.232.213
May 6, 2024 04:57:17.732856989 CEST	21	51792	188.214.156.147	192.168.2.16
May 6, 2024 04:57:17.732929945 CEST	51792	21	192.168.2.16	188.214.156.147
May 6, 2024 04:57:17.745035887 CEST	51715	2121	192.168.2.16	138.59.232.213
May 6, 2024 04:57:17.745040894 CEST	51633	2121	192.168.2.16	85.216.208.3
May 6, 2024 04:57:17.745043039 CEST	21	51789	220.163.109.166	192.168.2.16
May 6, 2024 04:57:17.747854948 CEST	2121	51790	220.163.109.166	192.168.2.16
May 6, 2024 04:57:17.759016991 CEST	21	51793	34.128.145.40	192.168.2.16
May 6, 2024 04:57:17.759073019 CEST	51793	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:17.759174109 CEST	51793	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:17.759391069 CEST	51797	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:17.761010885 CEST	51759	21	192.168.2.16	181.128.99.130
May 6, 2024 04:57:17.763727903 CEST	2121	51794	34.128.145.40	192.168.2.16
May 6, 2024 04:57:17.763782024 CEST	51794	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:17.763850927 CEST	51794	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:17.763952971 CEST	51798	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:17.769532919 CEST	21	51757	149.154.65.23	192.168.2.16
May 6, 2024 04:57:17.769689083 CEST	51757	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:17.769958019 CEST	51799	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:17.776541948 CEST	21	51785	87.106.26.129	192.168.2.16
May 6, 2024 04:57:17.776679993 CEST	51785	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:17.777010918 CEST	51760	2121	192.168.2.16	181.128.99.130
May 6, 2024 04:57:17.777057886 CEST	51634	21	192.168.2.16	36.82.82.72
May 6, 2024 04:57:17.777278900 CEST	51800	21	192.168.2.16	119.13.89.196
May 6, 2024 04:57:17.783716917 CEST	21	51479	188.214.156.147	192.168.2.16
May 6, 2024 04:57:17.793034077 CEST	51636	2121	192.168.2.16	36.82.82.72
May 6, 2024 04:57:17.793035030 CEST	51635	21	192.168.2.16	121.61.136.59
May 6, 2024 04:57:17.793037891 CEST	51762	21	192.168.2.16	68.207.200.104
May 6, 2024 04:57:17.793133974 CEST	51761	2121	192.168.2.16	68.207.200.104
May 6, 2024 04:57:17.807620049 CEST	21	51781	154.210.32.21	192.168.2.16
May 6, 2024 04:57:17.807765961 CEST	51781	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:17.809010983 CEST	51689	2121	192.168.2.16	190.202.3.2
May 6, 2024 04:57:17.809010983 CEST	51764	21	192.168.2.16	182.112.110.53
May 6, 2024 04:57:17.809032917 CEST	51763	2121	192.168.2.16	182.112.110.53
May 6, 2024 04:57:17.809053898 CEST	51668	21	192.168.2.16	14.36.176.217
May 6, 2024 04:57:17.825006962 CEST	51637	2121	192.168.2.16	121.61.136.59
May 6, 2024 04:57:17.832009077 CEST	51669	2121	192.168.2.16	14.36.176.217
May 6, 2024 04:57:17.841012955 CEST	51639	21	192.168.2.16	88.94.222.163
May 6, 2024 04:57:17.841033936 CEST	51710	21	192.168.2.16	112.182.156.166
May 6, 2024 04:57:17.847333908 CEST	2121	51700	177.10.207.84	192.168.2.16
May 6, 2024 04:57:17.847919941 CEST	21	51778	81.88.252.91	192.168.2.16
May 6, 2024 04:57:17.848031044 CEST	51778	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:17.857013941 CEST	51765	21	192.168.2.16	87.7.194.124
May 6, 2024 04:57:17.857038975 CEST	51640	2121	192.168.2.16	88.94.222.163
May 6, 2024 04:57:17.864023924 CEST	51712	2121	192.168.2.16	112.182.156.166
May 6, 2024 04:57:17.868300915 CEST	21	51793	34.128.145.40	192.168.2.16
May 6, 2024 04:57:17.869515896 CEST	21	51797	34.128.145.40	192.168.2.16
May 6, 2024 04:57:17.869580030 CEST	51797	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:17.873018980 CEST	51767	2121	192.168.2.16	87.7.194.124
May 6, 2024 04:57:17.873188972 CEST	2121	51798	34.128.145.40	192.168.2.16
May 6, 2024 04:57:17.873246908 CEST	51798	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:17.873327971 CEST	2121	51794	34.128.145.40	192.168.2.16
May 6, 2024 04:57:17.903614998 CEST	2121	51755	119.109.126.41	192.168.2.16
May 6, 2024 04:57:17.905014992 CEST	51771	21	192.168.2.16	185.99.89.43
May 6, 2024 04:57:17.905050993 CEST	51719	21	192.168.2.16	118.42.106.96
May 6, 2024 04:57:17.921016932 CEST	51774	2121	192.168.2.16	50.159.242.121
May 6, 2024 04:57:17.921017885 CEST	51773	21	192.168.2.16	50.159.242.121
May 6, 2024 04:57:17.921039104 CEST	51772	2121	192.168.2.16	185.99.89.43
May 6, 2024 04:57:17.926227093 CEST	2121	51758	180.165.128.30	192.168.2.16
May 6, 2024 04:57:17.929610968 CEST	21	51756	180.165.128.30	192.168.2.16
May 6, 2024 04:57:17.937017918 CEST	51644	2121	192.168.2.16	101.43.249.26
May 6, 2024 04:57:17.937027931 CEST	51720	2121	192.168.2.16	118.42.106.96
May 6, 2024 04:57:17.956032991 CEST	21	51782	103.109.6.215	192.168.2.16
May 6, 2024 04:57:17.956160069 CEST	51782	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:17.957956076 CEST	21	51754	119.109.126.41	192.168.2.16
May 6, 2024 04:57:17.960072994 CEST	21	51714	138.59.232.213	192.168.2.16
May 6, 2024 04:57:17.962852001 CEST	2121	51689	190.202.3.2	192.168.2.16
May 6, 2024 04:57:17.971703053 CEST	21	51766	43.202.248.251	192.168.2.16
May 6, 2024 04:57:17.976361036 CEST	21	51792	188.214.156.147	192.168.2.16
May 6, 2024 04:57:17.976547003 CEST	51792	21	192.168.2.16	188.214.156.147
May 6, 2024 04:57:17.979948044 CEST	21	51797	34.128.145.40	192.168.2.16
May 6, 2024 04:57:17.980011940 CEST	51797	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:17.980070114 CEST	51797	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:17.980240107 CEST	51801	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:17.983273983 CEST	2121	51798	34.128.145.40	192.168.2.16
May 6, 2024 04:57:17.983319998 CEST	51798	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:17.983387947 CEST	51798	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:17.983573914 CEST	51802	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:17.990483999 CEST	2121	51715	138.59.232.213	192.168.2.16
May 6, 2024 04:57:18.001019955 CEST	51775	21	192.168.2.16	118.51.54.18
May 6, 2024 04:57:18.001148939 CEST	51776	2121	192.168.2.16	118.51.54.18
May 6, 2024 04:57:18.004757881 CEST	21	51785	87.106.26.129	192.168.2.16
May 6, 2024 04:57:18.004957914 CEST	21	51785	87.106.26.129	192.168.2.16
May 6, 2024 04:57:18.005091906 CEST	51785	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:18.012851954 CEST	2121	51768	43.202.248.251	192.168.2.16
May 6, 2024 04:57:18.021683931 CEST	21	51616	154.195.192.8	192.168.2.16
May 6, 2024 04:57:18.029033899 CEST	21	51799	149.154.65.23	192.168.2.16
May 6, 2024 04:57:18.029099941 CEST	51799	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:18.032016039 CEST	51777	21	192.168.2.16	223.231.204.62
May 6, 2024 04:57:18.032212019 CEST	51803	2121	192.168.2.16	119.13.89.196
May 6, 2024 04:57:18.034671068 CEST	21	51757	149.154.65.23	192.168.2.16
May 6, 2024 04:57:18.034720898 CEST	51757	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:18.063822985 CEST	51804	21	192.168.2.16	27.206.175.232
May 6, 2024 04:57:18.063882113 CEST	51805	2121	192.168.2.16	27.206.175.232
May 6, 2024 04:57:18.063920975 CEST	51806	21	192.168.2.16	189.146.87.206
May 6, 2024 04:57:18.064110041 CEST	51807	2121	192.168.2.16	121.173.105.252
May 6, 2024 04:57:18.064126015 CEST	51809	2121	192.168.2.16	189.146.87.206
May 6, 2024 04:57:18.064173937 CEST	51808	21	192.168.2.16	121.173.105.252
May 6, 2024 04:57:18.065148115 CEST	51810	21	192.168.2.16	220.122.177.179
May 6, 2024 04:57:18.079967976 CEST	51811	2121	192.168.2.16	220.122.177.179
May 6, 2024 04:57:18.080070972 CEST	51812	2121	192.168.2.16	180.227.59.4
May 6, 2024 04:57:18.080125093 CEST	51813	21	192.168.2.16	188.38.141.31
May 6, 2024 04:57:18.080148935 CEST	51814	21	192.168.2.16	180.227.59.4
May 6, 2024 04:57:18.080177069 CEST	51815	2121	192.168.2.16	188.38.141.31
May 6, 2024 04:57:18.080435038 CEST	51817	2121	192.168.2.16	94.237.11.200
May 6, 2024 04:57:18.080446959 CEST	51819	2121	192.168.2.16	75.206.217.214
May 6, 2024 04:57:18.080482960 CEST	51818	21	192.168.2.16	75.206.217.214
May 6, 2024 04:57:18.080487967 CEST	51816	21	192.168.2.16	94.237.11.200
May 6, 2024 04:57:18.089307070 CEST	21	51797	34.128.145.40	192.168.2.16
May 6, 2024 04:57:18.089767933 CEST	21	51801	34.128.145.40	192.168.2.16
May 6, 2024 04:57:18.089835882 CEST	51801	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:18.092509985 CEST	2121	51798	34.128.145.40	192.168.2.16
May 6, 2024 04:57:18.093048096 CEST	2121	51802	34.128.145.40	192.168.2.16
May 6, 2024 04:57:18.093106031 CEST	51802	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:18.095025063 CEST	51646	21	192.168.2.16	8.222.191.52
May 6, 2024 04:57:18.095469952 CEST	51820	21	192.168.2.16	122.252.221.135
May 6, 2024 04:57:18.095519066 CEST	51821	2121	192.168.2.16	122.252.221.135
May 6, 2024 04:57:18.095561981 CEST	51822	21	192.168.2.16	129.143.58.210
May 6, 2024 04:57:18.111054897 CEST	51788	2121	192.168.2.16	82.76.47.225
May 6, 2024 04:57:18.111834049 CEST	51823	2121	192.168.2.16	129.143.58.210
May 6, 2024 04:57:18.111890078 CEST	51824	21	192.168.2.16	80.201.1.45
May 6, 2024 04:57:18.111957073 CEST	51825	2121	192.168.2.16	219.156.232.19
May 6, 2024 04:57:18.111968994 CEST	51826	2121	192.168.2.16	80.201.1.45
May 6, 2024 04:57:18.112085104 CEST	51827	21	192.168.2.16	219.156.232.19
May 6, 2024 04:57:18.112159967 CEST	51828	21	192.168.2.16	104.173.136.54
May 6, 2024 04:57:18.112226963 CEST	51829	2121	192.168.2.16	104.173.136.54
May 6, 2024 04:57:18.112298012 CEST	51830	21	192.168.2.16	1.252.255.100
May 6, 2024 04:57:18.116792917 CEST	21	51668	14.36.176.217	192.168.2.16
May 6, 2024 04:57:18.121423960 CEST	21	51778	81.88.252.91	192.168.2.16
May 6, 2024 04:57:18.121433973 CEST	21	51778	81.88.252.91	192.168.2.16
May 6, 2024 04:57:18.121675968 CEST	51831	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:18.127582073 CEST	51832	2121	192.168.2.16	1.252.255.100
May 6, 2024 04:57:18.127623081 CEST	51833	21	192.168.2.16	23.45.140.199
May 6, 2024 04:57:18.127669096 CEST	51834	21	192.168.2.16	178.203.118.173
May 6, 2024 04:57:18.127692938 CEST	51835	2121	192.168.2.16	23.45.140.199
May 6, 2024 04:57:18.127737999 CEST	51836	2121	192.168.2.16	178.203.118.173
May 6, 2024 04:57:18.140909910 CEST	2121	51669	14.36.176.217	192.168.2.16
May 6, 2024 04:57:18.143017054 CEST	51648	2121	192.168.2.16	8.222.191.52
May 6, 2024 04:57:18.143019915 CEST	51652	21	192.168.2.16	73.103.134.120
May 6, 2024 04:57:18.143030882 CEST	51650	2121	192.168.2.16	90.193.49.18
May 6, 2024 04:57:18.143034935 CEST	51649	21	192.168.2.16	90.193.49.18
May 6, 2024 04:57:18.147897005 CEST	21	51781	154.210.32.21	192.168.2.16
May 6, 2024 04:57:18.148003101 CEST	21	51781	154.210.32.21	192.168.2.16
May 6, 2024 04:57:18.148108959 CEST	51781	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:18.148446083 CEST	21	51710	112.182.156.166	192.168.2.16
May 6, 2024 04:57:18.167855024 CEST	2121	51712	112.182.156.166	192.168.2.16
May 6, 2024 04:57:18.175379038 CEST	51837	21	192.168.2.16	220.116.111.28
May 6, 2024 04:57:18.191047907 CEST	51752	21	192.168.2.16	91.216.54.11
May 6, 2024 04:57:18.191051006 CEST	51753	2121	192.168.2.16	91.216.54.11
May 6, 2024 04:57:18.191294909 CEST	51653	2121	192.168.2.16	73.103.134.120
May 6, 2024 04:57:18.191442013 CEST	51838	2121	192.168.2.16	220.116.111.28
May 6, 2024 04:57:18.191473007 CEST	51839	21	192.168.2.16	113.169.215.158
May 6, 2024 04:57:18.199743032 CEST	21	51801	34.128.145.40	192.168.2.16
May 6, 2024 04:57:18.199820995 CEST	51801	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:18.199862003 CEST	51801	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:18.199995041 CEST	51840	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:18.203167915 CEST	2121	51802	34.128.145.40	192.168.2.16
May 6, 2024 04:57:18.203217983 CEST	51802	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:18.203305960 CEST	51802	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:18.203486919 CEST	51841	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:18.209506035 CEST	21	51719	118.42.106.96	192.168.2.16
May 6, 2024 04:57:18.218110085 CEST	21	51792	188.214.156.147	192.168.2.16
May 6, 2024 04:57:18.218244076 CEST	21	51792	188.214.156.147	192.168.2.16
May 6, 2024 04:57:18.218403101 CEST	51792	21	192.168.2.16	188.214.156.147
May 6, 2024 04:57:18.223015070 CEST	51667	2121	192.168.2.16	172.226.116.129
May 6, 2024 04:57:18.223016977 CEST	51666	21	192.168.2.16	172.226.116.129
May 6, 2024 04:57:18.234211922 CEST	21	51785	87.106.26.129	192.168.2.16
May 6, 2024 04:57:18.234338045 CEST	51785	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:18.234550953 CEST	51842	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:18.239029884 CEST	51784	21	192.168.2.16	82.76.47.225
May 6, 2024 04:57:18.239031076 CEST	51783	2121	192.168.2.16	223.231.204.62
May 6, 2024 04:57:18.239032030 CEST	51654	21	192.168.2.16	20.115.110.1
May 6, 2024 04:57:18.240288019 CEST	2121	51720	118.42.106.96	192.168.2.16
May 6, 2024 04:57:18.254013062 CEST	51790	2121	192.168.2.16	220.163.109.166
May 6, 2024 04:57:18.254014015 CEST	51789	21	192.168.2.16	220.163.109.166
May 6, 2024 04:57:18.258531094 CEST	2121	51809	189.146.87.206	192.168.2.16
May 6, 2024 04:57:18.269042969 CEST	51655	2121	192.168.2.16	20.115.110.1
May 6, 2024 04:57:18.285017967 CEST	51657	2121	192.168.2.16	213.143.14.170
May 6, 2024 04:57:18.285108089 CEST	51656	21	192.168.2.16	213.143.14.170
May 6, 2024 04:57:18.293111086 CEST	21	51799	149.154.65.23	192.168.2.16
May 6, 2024 04:57:18.293270111 CEST	51799	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:18.309597969 CEST	21	51840	34.128.145.40	192.168.2.16
May 6, 2024 04:57:18.309664011 CEST	51840	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:18.313080072 CEST	2121	51841	34.128.145.40	192.168.2.16
May 6, 2024 04:57:18.313127041 CEST	51841	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:18.313610077 CEST	2121	51802	34.128.145.40	192.168.2.16
May 6, 2024 04:57:18.317028046 CEST	51658	21	192.168.2.16	107.128.213.231
May 6, 2024 04:57:18.327642918 CEST	21	51782	103.109.6.215	192.168.2.16
May 6, 2024 04:57:18.327759981 CEST	51782	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:18.328526974 CEST	21	51822	129.143.58.210	192.168.2.16
May 6, 2024 04:57:18.344706059 CEST	2121	51823	129.143.58.210	192.168.2.16
May 6, 2024 04:57:18.348021984 CEST	51659	2121	192.168.2.16	107.128.213.231
May 6, 2024 04:57:18.348042011 CEST	51661	2121	192.168.2.16	92.205.10.177
May 6, 2024 04:57:18.348043919 CEST	51700	2121	192.168.2.16	177.10.207.84
May 6, 2024 04:57:18.348237991 CEST	51843	2121	192.168.2.16	113.169.215.158
May 6, 2024 04:57:18.364013910 CEST	51663	21	192.168.2.16	83.35.96.239
May 6, 2024 04:57:18.364327908 CEST	51844	21	192.168.2.16	98.206.119.217
May 6, 2024 04:57:18.364609003 CEST	2121	51788	82.76.47.225	192.168.2.16
May 6, 2024 04:57:18.380050898 CEST	51665	2121	192.168.2.16	83.35.96.239
May 6, 2024 04:57:18.382325888 CEST	21	51831	81.88.252.91	192.168.2.16
May 6, 2024 04:57:18.382395983 CEST	51831	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:18.393217087 CEST	2121	51812	180.227.59.4	192.168.2.16
May 6, 2024 04:57:18.395442963 CEST	51845	21	192.168.2.16	1.176.55.14
May 6, 2024 04:57:18.395488977 CEST	51846	2121	192.168.2.16	98.206.119.217
May 6, 2024 04:57:18.411040068 CEST	51755	2121	192.168.2.16	119.109.126.41
May 6, 2024 04:57:18.411329031 CEST	51847	2121	192.168.2.16	1.176.55.14
May 6, 2024 04:57:18.419375896 CEST	21	51840	34.128.145.40	192.168.2.16
May 6, 2024 04:57:18.419431925 CEST	51840	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:18.419501066 CEST	51840	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:18.419677973 CEST	51848	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:18.420932055 CEST	21	51830	1.252.255.100	192.168.2.16
May 6, 2024 04:57:18.422801018 CEST	2121	51841	34.128.145.40	192.168.2.16
May 6, 2024 04:57:18.422844887 CEST	51841	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:18.422890902 CEST	51841	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:18.423026085 CEST	51849	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:18.425704002 CEST	2121	51805	27.206.175.232	192.168.2.16
May 6, 2024 04:57:18.427017927 CEST	51758	2121	192.168.2.16	180.165.128.30
May 6, 2024 04:57:18.427036047 CEST	51791	21	192.168.2.16	216.117.162.236
May 6, 2024 04:57:18.432389975 CEST	2121	51753	91.216.54.11	192.168.2.16
May 6, 2024 04:57:18.434487104 CEST	21	51752	91.216.54.11	192.168.2.16
May 6, 2024 04:57:18.435872078 CEST	2121	51667	172.226.116.129	192.168.2.16
May 6, 2024 04:57:18.435906887 CEST	21	51666	172.226.116.129	192.168.2.16
May 6, 2024 04:57:18.436254978 CEST	51850	21	192.168.2.16	194.9.212.230
May 6, 2024 04:57:18.443036079 CEST	51756	21	192.168.2.16	180.165.128.30
May 6, 2024 04:57:18.453016996 CEST	2121	51706	168.220.94.137	192.168.2.16
May 6, 2024 04:57:18.453028917 CEST	21	51705	168.220.94.137	192.168.2.16
May 6, 2024 04:57:18.453063965 CEST	51706	2121	192.168.2.16	168.220.94.137
May 6, 2024 04:57:18.453079939 CEST	51705	21	192.168.2.16	168.220.94.137
May 6, 2024 04:57:18.458039999 CEST	51754	21	192.168.2.16	119.109.126.41
May 6, 2024 04:57:18.458301067 CEST	21	51842	87.106.26.129	192.168.2.16
May 6, 2024 04:57:18.458311081 CEST	51851	2121	192.168.2.16	194.9.212.230
May 6, 2024 04:57:18.458359003 CEST	51842	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:18.459899902 CEST	21	51792	188.214.156.147	192.168.2.16
May 6, 2024 04:57:18.461323977 CEST	21	51813	188.38.141.31	192.168.2.16
May 6, 2024 04:57:18.462759018 CEST	2121	51832	1.252.255.100	192.168.2.16
May 6, 2024 04:57:18.464621067 CEST	21	51785	87.106.26.129	192.168.2.16
May 6, 2024 04:57:18.464665890 CEST	51785	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:18.474061012 CEST	51689	2121	192.168.2.16	190.202.3.2
May 6, 2024 04:57:18.474061012 CEST	51714	21	192.168.2.16	138.59.232.213
May 6, 2024 04:57:18.474061012 CEST	51766	21	192.168.2.16	43.202.248.251
May 6, 2024 04:57:18.474111080 CEST	21	51615	193.124.183.222	192.168.2.16
May 6, 2024 04:57:18.474237919 CEST	51615	21	192.168.2.16	193.124.183.222
May 6, 2024 04:57:18.474426031 CEST	51852	21	192.168.2.16	193.124.183.222
May 6, 2024 04:57:18.492078066 CEST	21	51781	154.210.32.21	192.168.2.16
May 6, 2024 04:57:18.492198944 CEST	51781	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:18.492221117 CEST	51671	21	192.168.2.16	90.209.246.134
May 6, 2024 04:57:18.492347956 CEST	51715	2121	192.168.2.16	138.59.232.213
May 6, 2024 04:57:18.492350101 CEST	51853	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:18.492764950 CEST	21	51781	154.210.32.21	192.168.2.16
May 6, 2024 04:57:18.492815971 CEST	51781	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:18.506450891 CEST	51854	21	192.168.2.16	107.13.196.219
May 6, 2024 04:57:18.506491899 CEST	51855	2121	192.168.2.16	107.13.196.219
May 6, 2024 04:57:18.521022081 CEST	51768	2121	192.168.2.16	43.202.248.251
May 6, 2024 04:57:18.521023035 CEST	51801	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:18.521037102 CEST	51672	2121	192.168.2.16	90.209.246.134
May 6, 2024 04:57:18.521258116 CEST	51856	21	192.168.2.16	97.113.217.138
May 6, 2024 04:57:18.529062033 CEST	21	51840	34.128.145.40	192.168.2.16
May 6, 2024 04:57:18.530052900 CEST	21	51848	34.128.145.40	192.168.2.16
May 6, 2024 04:57:18.530109882 CEST	51848	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:18.532516956 CEST	2121	51849	34.128.145.40	192.168.2.16
May 6, 2024 04:57:18.532571077 CEST	51849	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:18.533297062 CEST	2121	51841	34.128.145.40	192.168.2.16
May 6, 2024 04:57:18.537038088 CEST	51673	21	192.168.2.16	47.41.13.129
May 6, 2024 04:57:18.552078009 CEST	2121	51815	188.38.141.31	192.168.2.16
May 6, 2024 04:57:18.552261114 CEST	21	51799	149.154.65.23	192.168.2.16
May 6, 2024 04:57:18.552517891 CEST	21	51799	149.154.65.23	192.168.2.16
May 6, 2024 04:57:18.552674055 CEST	51799	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:18.553265095 CEST	51857	2121	192.168.2.16	97.113.217.138
May 6, 2024 04:57:18.569031000 CEST	51674	2121	192.168.2.16	47.41.13.129
May 6, 2024 04:57:18.577630997 CEST	2121	51418	168.220.94.137	192.168.2.16
May 6, 2024 04:57:18.577642918 CEST	21	51416	168.220.94.137	192.168.2.16
May 6, 2024 04:57:18.577668905 CEST	51418	2121	192.168.2.16	168.220.94.137
May 6, 2024 04:57:18.577696085 CEST	51416	21	192.168.2.16	168.220.94.137
May 6, 2024 04:57:18.593081951 CEST	2121	51700	177.10.207.84	192.168.2.16
May 6, 2024 04:57:18.617033005 CEST	51668	21	192.168.2.16	14.36.176.217
May 6, 2024 04:57:18.622059107 CEST	2121	51790	220.163.109.166	192.168.2.16
May 6, 2024 04:57:18.628432989 CEST	2121	51689	190.202.3.2	192.168.2.16
May 6, 2024 04:57:18.628796101 CEST	51858	21	192.168.2.16	84.236.146.251
May 6, 2024 04:57:18.630598068 CEST	21	51801	34.128.145.40	192.168.2.16
May 6, 2024 04:57:18.633013964 CEST	51678	2121	192.168.2.16	169.148.72.205
May 6, 2024 04:57:18.633022070 CEST	51677	21	192.168.2.16	169.148.72.205
May 6, 2024 04:57:18.633305073 CEST	51859	2121	192.168.2.16	84.236.146.251
May 6, 2024 04:57:18.634254932 CEST	21	51789	220.163.109.166	192.168.2.16
May 6, 2024 04:57:18.640542984 CEST	21	51848	34.128.145.40	192.168.2.16
May 6, 2024 04:57:18.640614986 CEST	51848	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:18.640669107 CEST	51848	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:18.640847921 CEST	51860	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:18.644912004 CEST	2121	51849	34.128.145.40	192.168.2.16
May 6, 2024 04:57:18.644963026 CEST	51849	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:18.645071030 CEST	51849	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:18.645250082 CEST	51861	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:18.649027109 CEST	51669	2121	192.168.2.16	14.36.176.217
May 6, 2024 04:57:18.649239063 CEST	51710	21	192.168.2.16	112.182.156.166
May 6, 2024 04:57:18.651549101 CEST	21	51831	81.88.252.91	192.168.2.16
May 6, 2024 04:57:18.651664019 CEST	51831	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:18.676012993 CEST	51795	21	192.168.2.16	36.35.222.12
May 6, 2024 04:57:18.681016922 CEST	51712	2121	192.168.2.16	112.182.156.166
May 6, 2024 04:57:18.697016954 CEST	51796	2121	192.168.2.16	36.35.222.12
May 6, 2024 04:57:18.697302103 CEST	51862	21	192.168.2.16	31.221.69.145
May 6, 2024 04:57:18.697407007 CEST	51863	2121	192.168.2.16	31.221.69.145
May 6, 2024 04:57:18.701869011 CEST	21	51782	103.109.6.215	192.168.2.16
May 6, 2024 04:57:18.701970100 CEST	51782	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:18.702090979 CEST	51864	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:18.706518888 CEST	21	51714	138.59.232.213	192.168.2.16
May 6, 2024 04:57:18.707855940 CEST	21	51842	87.106.26.129	192.168.2.16
May 6, 2024 04:57:18.708004951 CEST	51842	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:18.713015079 CEST	51680	21	192.168.2.16	27.78.248.53
May 6, 2024 04:57:18.713017941 CEST	51681	2121	192.168.2.16	27.78.248.53
May 6, 2024 04:57:18.713150024 CEST	51719	21	192.168.2.16	118.42.106.96
May 6, 2024 04:57:18.724528074 CEST	2121	51715	138.59.232.213	192.168.2.16
May 6, 2024 04:57:18.729434967 CEST	51865	21	192.168.2.16	116.10.99.206
May 6, 2024 04:57:18.739600897 CEST	21	51852	193.124.183.222	192.168.2.16
May 6, 2024 04:57:18.739667892 CEST	51852	21	192.168.2.16	193.124.183.222
May 6, 2024 04:57:18.742290020 CEST	21	51615	193.124.183.222	192.168.2.16
May 6, 2024 04:57:18.742342949 CEST	51615	21	192.168.2.16	193.124.183.222
May 6, 2024 04:57:18.745033979 CEST	51720	2121	192.168.2.16	118.42.106.96
May 6, 2024 04:57:18.750070095 CEST	21	51860	34.128.145.40	192.168.2.16
May 6, 2024 04:57:18.750128984 CEST	51860	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:18.750180006 CEST	21	51848	34.128.145.40	192.168.2.16
May 6, 2024 04:57:18.754468918 CEST	2121	51849	34.128.145.40	192.168.2.16
May 6, 2024 04:57:18.754759073 CEST	2121	51861	34.128.145.40	192.168.2.16
May 6, 2024 04:57:18.754811049 CEST	51861	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:18.760730982 CEST	2121	51755	119.109.126.41	192.168.2.16
May 6, 2024 04:57:18.761028051 CEST	51809	2121	192.168.2.16	189.146.87.206
May 6, 2024 04:57:18.761030912 CEST	51684	21	192.168.2.16	23.43.184.151
May 6, 2024 04:57:18.761305094 CEST	51866	2121	192.168.2.16	116.10.99.206
May 6, 2024 04:57:18.767163992 CEST	2121	51758	180.165.128.30	192.168.2.16
May 6, 2024 04:57:18.776022911 CEST	51685	2121	192.168.2.16	23.43.184.151
May 6, 2024 04:57:18.778537035 CEST	21	51766	43.202.248.251	192.168.2.16
May 6, 2024 04:57:18.792020082 CEST	51800	21	192.168.2.16	119.13.89.196
May 6, 2024 04:57:18.792031050 CEST	51686	21	192.168.2.16	190.202.3.2
May 6, 2024 04:57:18.801424026 CEST	21	51756	180.165.128.30	192.168.2.16
May 6, 2024 04:57:18.812402010 CEST	21	51799	149.154.65.23	192.168.2.16
May 6, 2024 04:57:18.812561989 CEST	51799	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:18.812808990 CEST	51867	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:18.830323935 CEST	21	51754	119.109.126.41	192.168.2.16
May 6, 2024 04:57:18.833256960 CEST	21	51781	154.210.32.21	192.168.2.16
May 6, 2024 04:57:18.835675001 CEST	21	51853	154.210.32.21	192.168.2.16
May 6, 2024 04:57:18.835741043 CEST	51853	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:18.836371899 CEST	2121	51768	43.202.248.251	192.168.2.16
May 6, 2024 04:57:18.840025902 CEST	51822	21	192.168.2.16	129.143.58.210
May 6, 2024 04:57:18.840291977 CEST	51868	21	192.168.2.16	211.244.180.175
May 6, 2024 04:57:18.856045008 CEST	51823	2121	192.168.2.16	129.143.58.210
May 6, 2024 04:57:18.856049061 CEST	51690	21	192.168.2.16	103.89.19.212
May 6, 2024 04:57:18.856236935 CEST	51869	2121	192.168.2.16	211.244.180.175
May 6, 2024 04:57:18.860119104 CEST	21	51860	34.128.145.40	192.168.2.16
May 6, 2024 04:57:18.860189915 CEST	51860	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:18.860295057 CEST	51860	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:18.860490084 CEST	51870	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:18.864653111 CEST	2121	51861	34.128.145.40	192.168.2.16
May 6, 2024 04:57:18.864702940 CEST	51861	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:18.864746094 CEST	51861	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:18.864865065 CEST	51871	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:18.872046947 CEST	51788	2121	192.168.2.16	82.76.47.225
May 6, 2024 04:57:18.904052019 CEST	51812	2121	192.168.2.16	180.227.59.4
May 6, 2024 04:57:18.919959068 CEST	21	51831	81.88.252.91	192.168.2.16
May 6, 2024 04:57:18.920016050 CEST	51691	2121	192.168.2.16	103.89.19.212
May 6, 2024 04:57:18.920128107 CEST	51831	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:18.924274921 CEST	21	51668	14.36.176.217	192.168.2.16
May 6, 2024 04:57:18.931729078 CEST	21	51842	87.106.26.129	192.168.2.16
May 6, 2024 04:57:18.931938887 CEST	21	51842	87.106.26.129	192.168.2.16
May 6, 2024 04:57:18.932084084 CEST	51842	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:18.936022997 CEST	51830	21	192.168.2.16	1.252.255.100
May 6, 2024 04:57:18.936045885 CEST	51753	2121	192.168.2.16	91.216.54.11
May 6, 2024 04:57:18.936045885 CEST	51752	21	192.168.2.16	91.216.54.11
May 6, 2024 04:57:18.936047077 CEST	51805	2121	192.168.2.16	27.206.175.232
May 6, 2024 04:57:18.936387062 CEST	51872	2121	192.168.2.16	14.85.220.138
May 6, 2024 04:57:18.936419964 CEST	51873	21	192.168.2.16	14.85.220.138
May 6, 2024 04:57:18.952016115 CEST	51693	21	192.168.2.16	161.184.10.74
May 6, 2024 04:57:18.952194929 CEST	51874	21	192.168.2.16	116.97.62.160
May 6, 2024 04:57:18.956482887 CEST	21	51710	112.182.156.166	192.168.2.16
May 6, 2024 04:57:18.956640959 CEST	2121	51809	189.146.87.206	192.168.2.16
May 6, 2024 04:57:18.957917929 CEST	2121	51669	14.36.176.217	192.168.2.16
May 6, 2024 04:57:18.968013048 CEST	51813	21	192.168.2.16	188.38.141.31
May 6, 2024 04:57:18.968038082 CEST	51832	2121	192.168.2.16	1.252.255.100
May 6, 2024 04:57:18.968338013 CEST	51875	2121	192.168.2.16	116.97.62.160
May 6, 2024 04:57:18.969753981 CEST	21	51870	34.128.145.40	192.168.2.16
May 6, 2024 04:57:18.969819069 CEST	51870	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:18.970669031 CEST	21	51860	34.128.145.40	192.168.2.16
May 6, 2024 04:57:18.974489927 CEST	2121	51861	34.128.145.40	192.168.2.16
May 6, 2024 04:57:18.974621058 CEST	2121	51871	34.128.145.40	192.168.2.16
May 6, 2024 04:57:18.974687099 CEST	51871	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:18.984867096 CEST	2121	51712	112.182.156.166	192.168.2.16
May 6, 2024 04:57:19.005445004 CEST	21	51852	193.124.183.222	192.168.2.16
May 6, 2024 04:57:19.005588055 CEST	51852	21	192.168.2.16	193.124.183.222
May 6, 2024 04:57:19.017286062 CEST	21	51719	118.42.106.96	192.168.2.16
May 6, 2024 04:57:19.032018900 CEST	51695	2121	192.168.2.16	161.184.10.74
May 6, 2024 04:57:19.032037973 CEST	51803	2121	192.168.2.16	119.13.89.196
May 6, 2024 04:57:19.047529936 CEST	2121	51720	118.42.106.96	192.168.2.16
May 6, 2024 04:57:19.048345089 CEST	51876	21	192.168.2.16	211.217.212.254
May 6, 2024 04:57:19.054421902 CEST	21	51479	188.214.156.147	192.168.2.16
May 6, 2024 04:57:19.054481030 CEST	51479	21	192.168.2.16	188.214.156.147
May 6, 2024 04:57:19.054483891 CEST	21	51479	188.214.156.147	192.168.2.16
May 6, 2024 04:57:19.054528952 CEST	51479	21	192.168.2.16	188.214.156.147
May 6, 2024 04:57:19.055882931 CEST	21	51479	188.214.156.147	192.168.2.16
May 6, 2024 04:57:19.055931091 CEST	51479	21	192.168.2.16	188.214.156.147
May 6, 2024 04:57:19.056720018 CEST	21	51864	103.109.6.215	192.168.2.16
May 6, 2024 04:57:19.056776047 CEST	51864	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:19.063052893 CEST	51815	2121	192.168.2.16	188.38.141.31
May 6, 2024 04:57:19.063124895 CEST	51806	21	192.168.2.16	189.146.87.206
May 6, 2024 04:57:19.063236952 CEST	51804	21	192.168.2.16	27.206.175.232
May 6, 2024 04:57:19.071427107 CEST	21	51799	149.154.65.23	192.168.2.16
May 6, 2024 04:57:19.071476936 CEST	51799	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:19.072716951 CEST	21	51822	129.143.58.210	192.168.2.16
May 6, 2024 04:57:19.073357105 CEST	21	51782	103.109.6.215	192.168.2.16
May 6, 2024 04:57:19.073415995 CEST	21	51782	103.109.6.215	192.168.2.16
May 6, 2024 04:57:19.073462963 CEST	51782	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:19.078447104 CEST	21	51867	149.154.65.23	192.168.2.16
May 6, 2024 04:57:19.078511000 CEST	51867	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:19.079021931 CEST	51807	2121	192.168.2.16	121.173.105.252
May 6, 2024 04:57:19.079024076 CEST	51808	21	192.168.2.16	121.173.105.252
May 6, 2024 04:57:19.079309940 CEST	51810	21	192.168.2.16	220.122.177.179
May 6, 2024 04:57:19.079310894 CEST	51811	2121	192.168.2.16	220.122.177.179
May 6, 2024 04:57:19.079312086 CEST	51877	2121	192.168.2.16	211.217.212.254
May 6, 2024 04:57:19.079972982 CEST	21	51870	34.128.145.40	192.168.2.16
May 6, 2024 04:57:19.080029964 CEST	51870	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:19.080071926 CEST	51870	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:19.080198050 CEST	51878	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:19.084264994 CEST	2121	51871	34.128.145.40	192.168.2.16
May 6, 2024 04:57:19.084309101 CEST	51871	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:19.084388971 CEST	51871	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:19.084589958 CEST	51879	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:19.088829994 CEST	2121	51823	129.143.58.210	192.168.2.16
May 6, 2024 04:57:19.095024109 CEST	51818	21	192.168.2.16	75.206.217.214
May 6, 2024 04:57:19.095025063 CEST	51700	2121	192.168.2.16	177.10.207.84
May 6, 2024 04:57:19.095026970 CEST	51698	2121	192.168.2.16	88.26.151.114
May 6, 2024 04:57:19.095045090 CEST	51814	21	192.168.2.16	180.227.59.4
May 6, 2024 04:57:19.095046997 CEST	51817	2121	192.168.2.16	94.237.11.200
May 6, 2024 04:57:19.095047951 CEST	51821	2121	192.168.2.16	122.252.221.135
May 6, 2024 04:57:19.095052004 CEST	51816	21	192.168.2.16	94.237.11.200
May 6, 2024 04:57:19.095052958 CEST	51697	21	192.168.2.16	88.26.151.114
May 6, 2024 04:57:19.095473051 CEST	51819	2121	192.168.2.16	75.206.217.214
May 6, 2024 04:57:19.110021114 CEST	51699	21	192.168.2.16	177.10.207.84
May 6, 2024 04:57:19.110024929 CEST	51820	21	192.168.2.16	122.252.221.135
May 6, 2024 04:57:19.126014948 CEST	51827	21	192.168.2.16	219.156.232.19
May 6, 2024 04:57:19.126022100 CEST	51824	21	192.168.2.16	80.201.1.45
May 6, 2024 04:57:19.126022100 CEST	51828	21	192.168.2.16	104.173.136.54
May 6, 2024 04:57:19.126024008 CEST	51829	2121	192.168.2.16	104.173.136.54
May 6, 2024 04:57:19.126029968 CEST	51825	2121	192.168.2.16	219.156.232.19
May 6, 2024 04:57:19.126034021 CEST	51826	2121	192.168.2.16	80.201.1.45
May 6, 2024 04:57:19.126039982 CEST	51790	2121	192.168.2.16	220.163.109.166
May 6, 2024 04:57:19.126358032 CEST	2121	51788	82.76.47.225	192.168.2.16
May 6, 2024 04:57:19.142024040 CEST	51833	21	192.168.2.16	23.45.140.199
May 6, 2024 04:57:19.142035007 CEST	51835	2121	192.168.2.16	23.45.140.199
May 6, 2024 04:57:19.142038107 CEST	51789	21	192.168.2.16	220.163.109.166
May 6, 2024 04:57:19.142038107 CEST	51834	21	192.168.2.16	178.203.118.173
May 6, 2024 04:57:19.143039942 CEST	51701	21	192.168.2.16	13.226.99.231
May 6, 2024 04:57:19.143039942 CEST	51836	2121	192.168.2.16	178.203.118.173
May 6, 2024 04:57:19.157207012 CEST	21	51842	87.106.26.129	192.168.2.16
May 6, 2024 04:57:19.157341003 CEST	51842	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:19.157561064 CEST	51880	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:19.161844969 CEST	21	51645	45.87.1.166	192.168.2.16
May 6, 2024 04:57:19.161961079 CEST	51645	21	192.168.2.16	45.87.1.166
May 6, 2024 04:57:19.162115097 CEST	51881	21	192.168.2.16	45.87.1.166
May 6, 2024 04:57:19.177398920 CEST	2121	51753	91.216.54.11	192.168.2.16
May 6, 2024 04:57:19.179667950 CEST	21	51752	91.216.54.11	192.168.2.16
May 6, 2024 04:57:19.180361986 CEST	21	51853	154.210.32.21	192.168.2.16
May 6, 2024 04:57:19.180502892 CEST	51853	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:19.189217091 CEST	21	51870	34.128.145.40	192.168.2.16
May 6, 2024 04:57:19.189801931 CEST	21	51878	34.128.145.40	192.168.2.16
May 6, 2024 04:57:19.189867020 CEST	51878	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:19.190017939 CEST	51837	21	192.168.2.16	220.116.111.28
May 6, 2024 04:57:19.190033913 CEST	51702	2121	192.168.2.16	13.226.99.231
May 6, 2024 04:57:19.193927050 CEST	2121	51871	34.128.145.40	192.168.2.16
May 6, 2024 04:57:19.194133997 CEST	2121	51879	34.128.145.40	192.168.2.16
May 6, 2024 04:57:19.194188118 CEST	51879	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:19.194293976 CEST	21	51831	81.88.252.91	192.168.2.16
May 6, 2024 04:57:19.194304943 CEST	21	51831	81.88.252.91	192.168.2.16
May 6, 2024 04:57:19.195398092 CEST	51882	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:19.195503950 CEST	51883	21	192.168.2.16	151.227.143.24
May 6, 2024 04:57:19.206021070 CEST	51838	2121	192.168.2.16	220.116.111.28
May 6, 2024 04:57:19.206022024 CEST	51839	21	192.168.2.16	113.169.215.158
May 6, 2024 04:57:19.206362963 CEST	51884	2121	192.168.2.16	151.227.143.24
May 6, 2024 04:57:19.217859030 CEST	2121	51812	180.227.59.4	192.168.2.16
May 6, 2024 04:57:19.222013950 CEST	51714	21	192.168.2.16	138.59.232.213
May 6, 2024 04:57:19.222038984 CEST	51703	21	192.168.2.16	39.115.181.20
May 6, 2024 04:57:19.238019943 CEST	51715	2121	192.168.2.16	138.59.232.213
May 6, 2024 04:57:19.238034964 CEST	51709	2121	192.168.2.16	82.66.179.187
May 6, 2024 04:57:19.238048077 CEST	51707	2121	192.168.2.16	39.115.181.20
May 6, 2024 04:57:19.240536928 CEST	51708	21	192.168.2.16	82.66.179.187
May 6, 2024 04:57:19.245011091 CEST	21	51830	1.252.255.100	192.168.2.16
May 6, 2024 04:57:19.269501925 CEST	21	51852	193.124.183.222	192.168.2.16
May 6, 2024 04:57:19.269546032 CEST	21	51852	193.124.183.222	192.168.2.16
May 6, 2024 04:57:19.269717932 CEST	51852	21	192.168.2.16	193.124.183.222
May 6, 2024 04:57:19.270066977 CEST	51716	2121	192.168.2.16	137.118.249.75
May 6, 2024 04:57:19.270067930 CEST	51755	2121	192.168.2.16	119.109.126.41
May 6, 2024 04:57:19.270068884 CEST	51713	21	192.168.2.16	137.118.249.75
May 6, 2024 04:57:19.270071030 CEST	51758	2121	192.168.2.16	180.165.128.30
May 6, 2024 04:57:19.270127058 CEST	51594	21	192.168.2.16	109.205.180.149
May 6, 2024 04:57:19.270297050 CEST	51885	21	192.168.2.16	109.205.180.149
May 6, 2024 04:57:19.286041021 CEST	51766	21	192.168.2.16	43.202.248.251
May 6, 2024 04:57:19.286041021 CEST	51717	21	192.168.2.16	68.32.220.155
May 6, 2024 04:57:19.286104918 CEST	51718	2121	192.168.2.16	68.32.220.155
May 6, 2024 04:57:19.297980070 CEST	2121	51805	27.206.175.232	192.168.2.16
May 6, 2024 04:57:19.299551964 CEST	21	51878	34.128.145.40	192.168.2.16
May 6, 2024 04:57:19.299607992 CEST	51878	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:19.299655914 CEST	51878	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:19.299796104 CEST	51886	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:19.302706003 CEST	2121	51832	1.252.255.100	192.168.2.16
May 6, 2024 04:57:19.304143906 CEST	2121	51879	34.128.145.40	192.168.2.16
May 6, 2024 04:57:19.304188967 CEST	51879	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:19.304250002 CEST	51879	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:19.304408073 CEST	51887	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:19.317030907 CEST	51756	21	192.168.2.16	180.165.128.30
May 6, 2024 04:57:19.317178011 CEST	51888	21	192.168.2.16	187.208.211.78
May 6, 2024 04:57:19.333033085 CEST	51721	21	192.168.2.16	176.253.152.232
May 6, 2024 04:57:19.333153009 CEST	51754	21	192.168.2.16	119.109.126.41
May 6, 2024 04:57:19.333210945 CEST	51889	2121	192.168.2.16	187.208.211.78
May 6, 2024 04:57:19.340235949 CEST	2121	51700	177.10.207.84	192.168.2.16
May 6, 2024 04:57:19.343749046 CEST	21	51813	188.38.141.31	192.168.2.16
May 6, 2024 04:57:19.347882032 CEST	21	51867	149.154.65.23	192.168.2.16
May 6, 2024 04:57:19.348018885 CEST	51867	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:19.348030090 CEST	51843	2121	192.168.2.16	113.169.215.158
May 6, 2024 04:57:19.348067045 CEST	51768	2121	192.168.2.16	43.202.248.251
May 6, 2024 04:57:19.359282017 CEST	21	51876	211.217.212.254	192.168.2.16
May 6, 2024 04:57:19.364029884 CEST	51844	21	192.168.2.16	98.206.119.217
May 6, 2024 04:57:19.364239931 CEST	51890	21	192.168.2.16	151.14.60.6
May 6, 2024 04:57:19.380213976 CEST	51891	2121	192.168.2.16	151.14.60.6
May 6, 2024 04:57:19.383081913 CEST	21	51842	87.106.26.129	192.168.2.16
May 6, 2024 04:57:19.383131027 CEST	51842	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:19.385781050 CEST	21	51880	87.106.26.129	192.168.2.16
May 6, 2024 04:57:19.385837078 CEST	51880	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:19.386029959 CEST	2121	51877	211.217.212.254	192.168.2.16
May 6, 2024 04:57:19.387260914 CEST	21	51881	45.87.1.166	192.168.2.16
May 6, 2024 04:57:19.387310028 CEST	51881	21	192.168.2.16	45.87.1.166
May 6, 2024 04:57:19.392466068 CEST	21	51645	45.87.1.166	192.168.2.16
May 6, 2024 04:57:19.392514944 CEST	51645	21	192.168.2.16	45.87.1.166
May 6, 2024 04:57:19.395011902 CEST	51723	2121	192.168.2.16	176.253.152.232
May 6, 2024 04:57:19.395019054 CEST	51846	2121	192.168.2.16	98.206.119.217
May 6, 2024 04:57:19.395020962 CEST	51725	2121	192.168.2.16	72.73.124.217
May 6, 2024 04:57:19.396037102 CEST	51724	21	192.168.2.16	72.73.124.217
May 6, 2024 04:57:19.396039009 CEST	51845	21	192.168.2.16	1.176.55.14
May 6, 2024 04:57:19.409276009 CEST	21	51878	34.128.145.40	192.168.2.16
May 6, 2024 04:57:19.409450054 CEST	21	51886	34.128.145.40	192.168.2.16
May 6, 2024 04:57:19.409512997 CEST	51886	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:19.411425114 CEST	21	51864	103.109.6.215	192.168.2.16
May 6, 2024 04:57:19.411535025 CEST	51864	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:19.414207935 CEST	2121	51879	34.128.145.40	192.168.2.16
May 6, 2024 04:57:19.414218903 CEST	2121	51887	34.128.145.40	192.168.2.16
May 6, 2024 04:57:19.414283037 CEST	51887	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:19.426022053 CEST	51847	2121	192.168.2.16	1.176.55.14
May 6, 2024 04:57:19.430584908 CEST	51727	21	192.168.2.16	113.231.45.221
May 6, 2024 04:57:19.442034006 CEST	51850	21	192.168.2.16	194.9.212.230
May 6, 2024 04:57:19.442094088 CEST	51726	2121	192.168.2.16	113.231.45.221
May 6, 2024 04:57:19.453694105 CEST	21	51714	138.59.232.213	192.168.2.16
May 6, 2024 04:57:19.457041025 CEST	51728	21	192.168.2.16	20.22.149.231
May 6, 2024 04:57:19.457079887 CEST	51710	21	192.168.2.16	112.182.156.166
May 6, 2024 04:57:19.460882902 CEST	21	51882	81.88.252.91	192.168.2.16
May 6, 2024 04:57:19.460942030 CEST	51882	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:19.468705893 CEST	2121	51715	138.59.232.213	192.168.2.16
May 6, 2024 04:57:19.473006964 CEST	51809	2121	192.168.2.16	189.146.87.206
May 6, 2024 04:57:19.473042965 CEST	51851	2121	192.168.2.16	194.9.212.230
May 6, 2024 04:57:19.473495007 CEST	51892	21	192.168.2.16	124.47.102.1
May 6, 2024 04:57:19.473506927 CEST	51893	2121	192.168.2.16	124.47.102.1
May 6, 2024 04:57:19.489031076 CEST	51712	2121	192.168.2.16	112.182.156.166
May 6, 2024 04:57:19.489156008 CEST	51731	2121	192.168.2.16	20.22.149.231
May 6, 2024 04:57:19.489268064 CEST	51894	21	192.168.2.16	2.116.162.98
May 6, 2024 04:57:19.494184971 CEST	2121	51790	220.163.109.166	192.168.2.16
May 6, 2024 04:57:19.502799988 CEST	21	51885	109.205.180.149	192.168.2.16
May 6, 2024 04:57:19.502856970 CEST	51885	21	192.168.2.16	109.205.180.149
May 6, 2024 04:57:19.519301891 CEST	21	51886	34.128.145.40	192.168.2.16
May 6, 2024 04:57:19.519370079 CEST	51886	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:19.519427061 CEST	51886	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:19.519617081 CEST	51895	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:19.521023989 CEST	51855	2121	192.168.2.16	107.13.196.219
May 6, 2024 04:57:19.521039963 CEST	51719	21	192.168.2.16	118.42.106.96
May 6, 2024 04:57:19.521042109 CEST	51854	21	192.168.2.16	107.13.196.219
May 6, 2024 04:57:19.521048069 CEST	51856	21	192.168.2.16	97.113.217.138
May 6, 2024 04:57:19.521152020 CEST	51732	21	192.168.2.16	90.209.109.67
May 6, 2024 04:57:19.522706985 CEST	21	51789	220.163.109.166	192.168.2.16
May 6, 2024 04:57:19.523139954 CEST	21	51853	154.210.32.21	192.168.2.16
May 6, 2024 04:57:19.523260117 CEST	21	51853	154.210.32.21	192.168.2.16
May 6, 2024 04:57:19.523374081 CEST	51853	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:19.524518013 CEST	2121	51887	34.128.145.40	192.168.2.16
May 6, 2024 04:57:19.524570942 CEST	51887	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:19.524620056 CEST	51887	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:19.524786949 CEST	51896	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:19.530530930 CEST	2121	51815	188.38.141.31	192.168.2.16
May 6, 2024 04:57:19.536185026 CEST	21	51594	109.205.180.149	192.168.2.16
May 6, 2024 04:57:19.537014008 CEST	51733	2121	192.168.2.16	90.209.109.67
May 6, 2024 04:57:19.553050995 CEST	51720	2121	192.168.2.16	118.42.106.96
May 6, 2024 04:57:19.553150892 CEST	51857	2121	192.168.2.16	97.113.217.138
May 6, 2024 04:57:19.553226948 CEST	51897	2121	192.168.2.16	2.116.162.98
May 6, 2024 04:57:19.569017887 CEST	51734	21	192.168.2.16	79.25.181.60
May 6, 2024 04:57:19.575356960 CEST	21	51852	193.124.183.222	192.168.2.16
May 6, 2024 04:57:19.578859091 CEST	21	51416	168.220.94.137	192.168.2.16
May 6, 2024 04:57:19.578913927 CEST	51416	21	192.168.2.16	168.220.94.137
May 6, 2024 04:57:19.585030079 CEST	51822	21	192.168.2.16	129.143.58.210
May 6, 2024 04:57:19.585047007 CEST	51735	2121	192.168.2.16	79.25.181.60
May 6, 2024 04:57:19.585330009 CEST	51898	21	192.168.2.16	1.174.94.19
May 6, 2024 04:57:19.589236975 CEST	21	51766	43.202.248.251	192.168.2.16
May 6, 2024 04:57:19.592223883 CEST	21	51594	109.205.180.149	192.168.2.16
May 6, 2024 04:57:19.592287064 CEST	51594	21	192.168.2.16	109.205.180.149
May 6, 2024 04:57:19.592312098 CEST	21	51594	109.205.180.149	192.168.2.16
May 6, 2024 04:57:19.592355967 CEST	51594	21	192.168.2.16	109.205.180.149
May 6, 2024 04:57:19.593379974 CEST	21	51594	109.205.180.149	192.168.2.16
May 6, 2024 04:57:19.593417883 CEST	51594	21	192.168.2.16	109.205.180.149
May 6, 2024 04:57:19.601047039 CEST	51736	21	192.168.2.16	84.168.33.40
May 6, 2024 04:57:19.601048946 CEST	51823	2121	192.168.2.16	129.143.58.210
May 6, 2024 04:57:19.601243019 CEST	51899	2121	192.168.2.16	1.174.94.19
May 6, 2024 04:57:19.610021114 CEST	2121	51758	180.165.128.30	192.168.2.16
May 6, 2024 04:57:19.613506079 CEST	21	51867	149.154.65.23	192.168.2.16
May 6, 2024 04:57:19.613913059 CEST	21	51867	149.154.65.23	192.168.2.16
May 6, 2024 04:57:19.614073992 CEST	51867	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:19.615633011 CEST	21	51881	45.87.1.166	192.168.2.16
May 6, 2024 04:57:19.615721941 CEST	51881	21	192.168.2.16	45.87.1.166
May 6, 2024 04:57:19.619784117 CEST	2121	51755	119.109.126.41	192.168.2.16
May 6, 2024 04:57:19.628978014 CEST	21	51886	34.128.145.40	192.168.2.16
May 6, 2024 04:57:19.629219055 CEST	21	51895	34.128.145.40	192.168.2.16
May 6, 2024 04:57:19.629287958 CEST	51895	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:19.633024931 CEST	51737	2121	192.168.2.16	84.168.33.40
May 6, 2024 04:57:19.633033991 CEST	51858	21	192.168.2.16	84.236.146.251
May 6, 2024 04:57:19.633033991 CEST	51738	21	192.168.2.16	83.135.77.42
May 6, 2024 04:57:19.633039951 CEST	51788	2121	192.168.2.16	82.76.47.225
May 6, 2024 04:57:19.633045912 CEST	51739	2121	192.168.2.16	83.135.77.42
May 6, 2024 04:57:19.633158922 CEST	51859	2121	192.168.2.16	84.236.146.251
May 6, 2024 04:57:19.634232998 CEST	2121	51887	34.128.145.40	192.168.2.16
May 6, 2024 04:57:19.635195971 CEST	2121	51896	34.128.145.40	192.168.2.16
May 6, 2024 04:57:19.635247946 CEST	51896	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:19.637867928 CEST	21	51880	87.106.26.129	192.168.2.16
May 6, 2024 04:57:19.637979031 CEST	51880	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:19.644524097 CEST	2121	51891	151.14.60.6	192.168.2.16
May 6, 2024 04:57:19.649018049 CEST	51740	21	192.168.2.16	106.194.230.187
May 6, 2024 04:57:19.649019003 CEST	51743	2121	192.168.2.16	86.154.161.253
May 6, 2024 04:57:19.649038076 CEST	51744	21	192.168.2.16	20.51.81.10
May 6, 2024 04:57:19.649041891 CEST	51742	21	192.168.2.16	86.154.161.253
May 6, 2024 04:57:19.649044037 CEST	51741	2121	192.168.2.16	106.194.230.187
May 6, 2024 04:57:19.649235964 CEST	51900	21	192.168.2.16	59.28.85.135
May 6, 2024 04:57:19.662993908 CEST	2121	51768	43.202.248.251	192.168.2.16
May 6, 2024 04:57:19.665031910 CEST	51746	21	192.168.2.16	200.102.4.135
May 6, 2024 04:57:19.665616035 CEST	51745	2121	192.168.2.16	20.51.81.10
May 6, 2024 04:57:19.665620089 CEST	51748	21	192.168.2.16	200.203.158.14
May 6, 2024 04:57:19.666579962 CEST	2121	51809	189.146.87.206	192.168.2.16
May 6, 2024 04:57:19.674942970 CEST	21	51756	180.165.128.30	192.168.2.16
May 6, 2024 04:57:19.681022882 CEST	51747	2121	192.168.2.16	200.102.4.135
May 6, 2024 04:57:19.681158066 CEST	51752	21	192.168.2.16	91.216.54.11
May 6, 2024 04:57:19.681179047 CEST	51753	2121	192.168.2.16	91.216.54.11
May 6, 2024 04:57:19.697037935 CEST	51751	2121	192.168.2.16	200.203.158.14
May 6, 2024 04:57:19.697037935 CEST	51863	2121	192.168.2.16	31.221.69.145
May 6, 2024 04:57:19.697041035 CEST	51862	21	192.168.2.16	31.221.69.145
May 6, 2024 04:57:19.705192089 CEST	21	51754	119.109.126.41	192.168.2.16
May 6, 2024 04:57:19.729021072 CEST	51812	2121	192.168.2.16	180.227.59.4
May 6, 2024 04:57:19.729047060 CEST	51865	21	192.168.2.16	116.10.99.206
May 6, 2024 04:57:19.734504938 CEST	21	51882	81.88.252.91	192.168.2.16
May 6, 2024 04:57:19.734647989 CEST	51882	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:19.738435984 CEST	21	51885	109.205.180.149	192.168.2.16
May 6, 2024 04:57:19.738603115 CEST	51885	21	192.168.2.16	109.205.180.149
May 6, 2024 04:57:19.739157915 CEST	21	51895	34.128.145.40	192.168.2.16
May 6, 2024 04:57:19.739226103 CEST	51895	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:19.739264965 CEST	51895	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:19.739439011 CEST	51901	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:19.745069027 CEST	51830	21	192.168.2.16	1.252.255.100
May 6, 2024 04:57:19.745412111 CEST	51902	2121	192.168.2.16	59.28.85.135
May 6, 2024 04:57:19.745706081 CEST	2121	51896	34.128.145.40	192.168.2.16
May 6, 2024 04:57:19.745768070 CEST	51896	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:19.745835066 CEST	51896	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:19.745980978 CEST	51903	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:19.761389017 CEST	51904	21	192.168.2.16	179.125.223.180
May 6, 2024 04:57:19.762537956 CEST	21	51892	124.47.102.1	192.168.2.16
May 6, 2024 04:57:19.764806986 CEST	21	51710	112.182.156.166	192.168.2.16
May 6, 2024 04:57:19.764847994 CEST	2121	51893	124.47.102.1	192.168.2.16
May 6, 2024 04:57:19.766069889 CEST	21	51864	103.109.6.215	192.168.2.16
May 6, 2024 04:57:19.766192913 CEST	51864	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:19.776030064 CEST	51759	21	192.168.2.16	181.128.99.130
May 6, 2024 04:57:19.776052952 CEST	51866	2121	192.168.2.16	116.10.99.206
May 6, 2024 04:57:19.776906013 CEST	51905	2121	192.168.2.16	179.125.223.180
May 6, 2024 04:57:19.776954889 CEST	51906	21	192.168.2.16	78.43.179.14
May 6, 2024 04:57:19.777152061 CEST	51907	2121	192.168.2.16	78.43.179.14
May 6, 2024 04:57:19.792052984 CEST	51760	2121	192.168.2.16	181.128.99.130
May 6, 2024 04:57:19.792620897 CEST	2121	51712	112.182.156.166	192.168.2.16
May 6, 2024 04:57:19.793055058 CEST	51908	21	192.168.2.16	109.236.45.102
May 6, 2024 04:57:19.808155060 CEST	51761	2121	192.168.2.16	68.207.200.104
May 6, 2024 04:57:19.808156013 CEST	51832	2121	192.168.2.16	1.252.255.100
May 6, 2024 04:57:19.808156013 CEST	51762	21	192.168.2.16	68.207.200.104
May 6, 2024 04:57:19.808157921 CEST	51805	2121	192.168.2.16	27.206.175.232
May 6, 2024 04:57:19.808229923 CEST	51909	2121	192.168.2.16	109.236.45.102
May 6, 2024 04:57:19.818011999 CEST	21	51822	129.143.58.210	192.168.2.16
May 6, 2024 04:57:19.822829962 CEST	2121	51418	168.220.94.137	192.168.2.16
May 6, 2024 04:57:19.822880030 CEST	51418	2121	192.168.2.16	168.220.94.137
May 6, 2024 04:57:19.824022055 CEST	51763	2121	192.168.2.16	182.112.110.53
May 6, 2024 04:57:19.824035883 CEST	51764	21	192.168.2.16	182.112.110.53
May 6, 2024 04:57:19.824281931 CEST	51910	21	192.168.2.16	23.73.111.158
May 6, 2024 04:57:19.826083899 CEST	21	51719	118.42.106.96	192.168.2.16
May 6, 2024 04:57:19.833992958 CEST	2121	51823	129.143.58.210	192.168.2.16
May 6, 2024 04:57:19.840055943 CEST	51868	21	192.168.2.16	211.244.180.175
May 6, 2024 04:57:19.840450048 CEST	51911	2121	192.168.2.16	23.73.111.158
May 6, 2024 04:57:19.840600967 CEST	51912	21	192.168.2.16	23.243.238.213
May 6, 2024 04:57:19.840729952 CEST	21	51881	45.87.1.166	192.168.2.16
May 6, 2024 04:57:19.840925932 CEST	21	51881	45.87.1.166	192.168.2.16
May 6, 2024 04:57:19.841049910 CEST	51881	21	192.168.2.16	45.87.1.166
May 6, 2024 04:57:19.848867893 CEST	21	51895	34.128.145.40	192.168.2.16
May 6, 2024 04:57:19.849160910 CEST	21	51901	34.128.145.40	192.168.2.16
May 6, 2024 04:57:19.849225998 CEST	51901	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:19.855542898 CEST	2121	51903	34.128.145.40	192.168.2.16
May 6, 2024 04:57:19.855593920 CEST	51903	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:19.856029987 CEST	51813	21	192.168.2.16	188.38.141.31
May 6, 2024 04:57:19.856147051 CEST	2121	51896	34.128.145.40	192.168.2.16
May 6, 2024 04:57:19.856177092 CEST	51869	2121	192.168.2.16	211.244.180.175
May 6, 2024 04:57:19.856875896 CEST	2121	51720	118.42.106.96	192.168.2.16
May 6, 2024 04:57:19.866188049 CEST	21	51880	87.106.26.129	192.168.2.16
May 6, 2024 04:57:19.866319895 CEST	21	51880	87.106.26.129	192.168.2.16
May 6, 2024 04:57:19.866432905 CEST	51880	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:19.870826006 CEST	21	51853	154.210.32.21	192.168.2.16
May 6, 2024 04:57:19.870927095 CEST	51853	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:19.871082067 CEST	51913	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:19.871690989 CEST	21	51853	154.210.32.21	192.168.2.16
May 6, 2024 04:57:19.871737003 CEST	51853	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:19.872018099 CEST	51765	21	192.168.2.16	87.7.194.124
May 6, 2024 04:57:19.872188091 CEST	51914	2121	192.168.2.16	23.243.238.213
May 6, 2024 04:57:19.872189045 CEST	51876	21	192.168.2.16	211.217.212.254
May 6, 2024 04:57:19.880740881 CEST	21	51867	149.154.65.23	192.168.2.16
May 6, 2024 04:57:19.880868912 CEST	51867	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:19.881074905 CEST	51915	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:19.886639118 CEST	2121	51788	82.76.47.225	192.168.2.16
May 6, 2024 04:57:19.888009071 CEST	51877	2121	192.168.2.16	211.217.212.254
May 6, 2024 04:57:19.888035059 CEST	51767	2121	192.168.2.16	87.7.194.124
May 6, 2024 04:57:19.920018911 CEST	51771	21	192.168.2.16	185.99.89.43
May 6, 2024 04:57:19.920284033 CEST	51916	21	192.168.2.16	220.73.21.145
May 6, 2024 04:57:19.922346115 CEST	2121	51753	91.216.54.11	192.168.2.16
May 6, 2024 04:57:19.924612045 CEST	21	51752	91.216.54.11	192.168.2.16
May 6, 2024 04:57:19.936023951 CEST	51774	2121	192.168.2.16	50.159.242.121
May 6, 2024 04:57:19.936038971 CEST	51873	21	192.168.2.16	14.85.220.138
May 6, 2024 04:57:19.936041117 CEST	51773	21	192.168.2.16	50.159.242.121
May 6, 2024 04:57:19.936041117 CEST	51872	2121	192.168.2.16	14.85.220.138
May 6, 2024 04:57:19.936110020 CEST	51772	2121	192.168.2.16	185.99.89.43
May 6, 2024 04:57:19.936435938 CEST	51917	2121	192.168.2.16	220.73.21.145
May 6, 2024 04:57:19.936472893 CEST	51918	21	192.168.2.16	188.244.99.55
May 6, 2024 04:57:19.952045918 CEST	51874	21	192.168.2.16	116.97.62.160
May 6, 2024 04:57:19.958955050 CEST	21	51901	34.128.145.40	192.168.2.16
May 6, 2024 04:57:19.959029913 CEST	51901	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:19.959083080 CEST	51901	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:19.959244013 CEST	51919	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:19.965156078 CEST	2121	51903	34.128.145.40	192.168.2.16
May 6, 2024 04:57:19.965205908 CEST	51903	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:19.965235949 CEST	51903	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:19.965338945 CEST	51920	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:19.968014002 CEST	51875	2121	192.168.2.16	116.97.62.160
May 6, 2024 04:57:19.971339941 CEST	21	51885	109.205.180.149	192.168.2.16
May 6, 2024 04:57:19.971451998 CEST	21	51885	109.205.180.149	192.168.2.16
May 6, 2024 04:57:19.971568108 CEST	51885	21	192.168.2.16	109.205.180.149
May 6, 2024 04:57:19.999042034 CEST	51790	2121	192.168.2.16	220.163.109.166
May 6, 2024 04:57:20.015017033 CEST	51776	2121	192.168.2.16	118.51.54.18
May 6, 2024 04:57:20.015029907 CEST	51775	21	192.168.2.16	118.51.54.18
May 6, 2024 04:57:20.019979954 CEST	21	51882	81.88.252.91	192.168.2.16
May 6, 2024 04:57:20.020091057 CEST	51882	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:20.031023979 CEST	51789	21	192.168.2.16	220.163.109.166
May 6, 2024 04:57:20.031040907 CEST	51815	2121	192.168.2.16	188.38.141.31
May 6, 2024 04:57:20.041897058 CEST	2121	51812	180.227.59.4	192.168.2.16
May 6, 2024 04:57:20.047029018 CEST	51777	21	192.168.2.16	223.231.204.62
May 6, 2024 04:57:20.053920984 CEST	21	51830	1.252.255.100	192.168.2.16
May 6, 2024 04:57:20.068430901 CEST	21	51919	34.128.145.40	192.168.2.16
May 6, 2024 04:57:20.068491936 CEST	51919	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:20.068670034 CEST	21	51901	34.128.145.40	192.168.2.16
May 6, 2024 04:57:20.075658083 CEST	2121	51920	34.128.145.40	192.168.2.16
May 6, 2024 04:57:20.075721025 CEST	51920	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:20.078253984 CEST	51921	2121	192.168.2.16	188.244.99.55
May 6, 2024 04:57:20.094050884 CEST	51766	21	192.168.2.16	43.202.248.251
May 6, 2024 04:57:20.095026970 CEST	21	51880	87.106.26.129	192.168.2.16
May 6, 2024 04:57:20.095181942 CEST	51880	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:20.095427036 CEST	51922	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:20.110044956 CEST	51758	2121	192.168.2.16	180.165.128.30
May 6, 2024 04:57:20.110398054 CEST	21	51881	45.87.1.166	192.168.2.16
May 6, 2024 04:57:20.122234106 CEST	21	51864	103.109.6.215	192.168.2.16
May 6, 2024 04:57:20.122358084 CEST	51864	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:20.122515917 CEST	51923	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:20.126049042 CEST	51755	2121	192.168.2.16	119.109.126.41
May 6, 2024 04:57:20.126494884 CEST	51924	2121	192.168.2.16	103.28.54.200
May 6, 2024 04:57:20.126511097 CEST	51925	21	192.168.2.16	103.28.54.200
May 6, 2024 04:57:20.126545906 CEST	51926	21	192.168.2.16	153.251.251.201
May 6, 2024 04:57:20.135703087 CEST	21	51915	149.154.65.23	192.168.2.16
May 6, 2024 04:57:20.135767937 CEST	51915	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:20.142257929 CEST	51927	2121	192.168.2.16	153.251.251.201
May 6, 2024 04:57:20.142867088 CEST	2121	51832	1.252.255.100	192.168.2.16
May 6, 2024 04:57:20.146481991 CEST	21	51867	149.154.65.23	192.168.2.16
May 6, 2024 04:57:20.146637917 CEST	51867	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:20.158050060 CEST	51891	2121	192.168.2.16	151.14.60.6
May 6, 2024 04:57:20.170317888 CEST	2121	51805	27.206.175.232	192.168.2.16
May 6, 2024 04:57:20.174021006 CEST	51809	2121	192.168.2.16	189.146.87.206
May 6, 2024 04:57:20.174021006 CEST	51768	2121	192.168.2.16	43.202.248.251
May 6, 2024 04:57:20.177783012 CEST	21	51919	34.128.145.40	192.168.2.16
May 6, 2024 04:57:20.177836895 CEST	51919	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:20.177886963 CEST	51919	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:20.178035975 CEST	51928	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:20.179447889 CEST	21	51876	211.217.212.254	192.168.2.16
May 6, 2024 04:57:20.186125994 CEST	2121	51920	34.128.145.40	192.168.2.16
May 6, 2024 04:57:20.186177969 CEST	51920	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:20.186245918 CEST	51920	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:20.186420918 CEST	51929	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:20.190048933 CEST	51756	21	192.168.2.16	180.165.128.30
May 6, 2024 04:57:20.190368891 CEST	51930	21	192.168.2.16	186.4.1.201
May 6, 2024 04:57:20.194933891 CEST	2121	51877	211.217.212.254	192.168.2.16
May 6, 2024 04:57:20.202353001 CEST	21	51913	154.210.32.21	192.168.2.16
May 6, 2024 04:57:20.202418089 CEST	51913	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:20.206051111 CEST	51754	21	192.168.2.16	119.109.126.41
May 6, 2024 04:57:20.206051111 CEST	51883	21	192.168.2.16	151.227.143.24
May 6, 2024 04:57:20.206132889 CEST	51884	2121	192.168.2.16	151.227.143.24
May 6, 2024 04:57:20.213700056 CEST	21	51853	154.210.32.21	192.168.2.16
May 6, 2024 04:57:20.217894077 CEST	21	51916	220.73.21.145	192.168.2.16
May 6, 2024 04:57:20.237102985 CEST	2121	51917	220.73.21.145	192.168.2.16
May 6, 2024 04:57:20.237337112 CEST	51931	2121	192.168.2.16	186.4.1.201
May 6, 2024 04:57:20.243644953 CEST	21	51885	109.205.180.149	192.168.2.16
May 6, 2024 04:57:20.253048897 CEST	51784	21	192.168.2.16	82.76.47.225
May 6, 2024 04:57:20.253053904 CEST	51783	2121	192.168.2.16	223.231.204.62
May 6, 2024 04:57:20.253284931 CEST	51932	21	192.168.2.16	181.231.57.173
May 6, 2024 04:57:20.266815901 CEST	21	51813	188.38.141.31	192.168.2.16
May 6, 2024 04:57:20.269186974 CEST	51892	21	192.168.2.16	124.47.102.1
May 6, 2024 04:57:20.269186974 CEST	51893	2121	192.168.2.16	124.47.102.1
May 6, 2024 04:57:20.269452095 CEST	51933	21	192.168.2.16	52.218.221.252
May 6, 2024 04:57:20.269512892 CEST	51934	2121	192.168.2.16	181.231.57.173
May 6, 2024 04:57:20.287609100 CEST	21	51928	34.128.145.40	192.168.2.16
May 6, 2024 04:57:20.287667036 CEST	51928	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:20.287925959 CEST	21	51919	34.128.145.40	192.168.2.16
May 6, 2024 04:57:20.295826912 CEST	2121	51920	34.128.145.40	192.168.2.16
May 6, 2024 04:57:20.296008110 CEST	2121	51929	34.128.145.40	192.168.2.16
May 6, 2024 04:57:20.296072960 CEST	51929	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:20.301047087 CEST	51903	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:20.309434891 CEST	21	51882	81.88.252.91	192.168.2.16
May 6, 2024 04:57:20.309444904 CEST	21	51882	81.88.252.91	192.168.2.16
May 6, 2024 04:57:20.309708118 CEST	51935	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:20.317300081 CEST	51936	2121	192.168.2.16	52.218.221.252
May 6, 2024 04:57:20.319227934 CEST	21	51922	87.106.26.129	192.168.2.16
May 6, 2024 04:57:20.319292068 CEST	51922	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:20.325352907 CEST	21	51880	87.106.26.129	192.168.2.16
May 6, 2024 04:57:20.325404882 CEST	51880	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:20.332034111 CEST	51888	21	192.168.2.16	187.208.211.78
May 6, 2024 04:57:20.332307100 CEST	51822	21	192.168.2.16	129.143.58.210
May 6, 2024 04:57:20.332427025 CEST	51937	21	192.168.2.16	183.134.230.186
May 6, 2024 04:57:20.332441092 CEST	51938	2121	192.168.2.16	183.134.230.186
May 6, 2024 04:57:20.348045111 CEST	51889	2121	192.168.2.16	187.208.211.78
May 6, 2024 04:57:20.348300934 CEST	51823	2121	192.168.2.16	129.143.58.210
May 6, 2024 04:57:20.348305941 CEST	51939	21	192.168.2.16	188.82.83.201
May 6, 2024 04:57:20.364023924 CEST	51890	21	192.168.2.16	151.14.60.6
May 6, 2024 04:57:20.364397049 CEST	51940	2121	192.168.2.16	188.82.83.201
May 6, 2024 04:57:20.367043972 CEST	2121	51790	220.163.109.166	192.168.2.16
May 6, 2024 04:57:20.370558977 CEST	2121	51809	189.146.87.206	192.168.2.16
May 6, 2024 04:57:20.393049955 CEST	21	51915	149.154.65.23	192.168.2.16
May 6, 2024 04:57:20.393204927 CEST	51915	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:20.395049095 CEST	51788	2121	192.168.2.16	82.76.47.225
May 6, 2024 04:57:20.397178888 CEST	21	51766	43.202.248.251	192.168.2.16
May 6, 2024 04:57:20.397274971 CEST	21	51928	34.128.145.40	192.168.2.16
May 6, 2024 04:57:20.397324085 CEST	51928	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:20.398572922 CEST	51928	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:20.398843050 CEST	51941	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:20.398952007 CEST	51942	21	192.168.2.16	166.248.168.241
May 6, 2024 04:57:20.408902884 CEST	2121	51929	34.128.145.40	192.168.2.16
May 6, 2024 04:57:20.408961058 CEST	51929	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:20.409029007 CEST	51929	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:20.409238100 CEST	51943	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:20.413068056 CEST	21	51789	220.163.109.166	192.168.2.16
May 6, 2024 04:57:20.413239002 CEST	2121	51903	34.128.145.40	192.168.2.16
May 6, 2024 04:57:20.416145086 CEST	2121	51815	188.38.141.31	192.168.2.16
May 6, 2024 04:57:20.416867971 CEST	2121	51891	151.14.60.6	192.168.2.16
May 6, 2024 04:57:20.427025080 CEST	51791	21	192.168.2.16	216.117.162.236
May 6, 2024 04:57:20.450014114 CEST	2121	51758	180.165.128.30	192.168.2.16
May 6, 2024 04:57:20.475480080 CEST	51944	2121	192.168.2.16	166.248.168.241
May 6, 2024 04:57:20.475610018 CEST	51945	21	192.168.2.16	5.68.83.14
May 6, 2024 04:57:20.475776911 CEST	2121	51755	119.109.126.41	192.168.2.16
May 6, 2024 04:57:20.477114916 CEST	21	51864	103.109.6.215	192.168.2.16
May 6, 2024 04:57:20.477696896 CEST	21	51864	103.109.6.215	192.168.2.16
May 6, 2024 04:57:20.477746010 CEST	51864	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:20.490020990 CEST	51894	21	192.168.2.16	2.116.162.98
May 6, 2024 04:57:20.490190029 CEST	51946	2121	192.168.2.16	5.68.83.14
May 6, 2024 04:57:20.491425991 CEST	2121	51768	43.202.248.251	192.168.2.16
May 6, 2024 04:57:20.494642019 CEST	21	51923	103.109.6.215	192.168.2.16
May 6, 2024 04:57:20.494704008 CEST	51923	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:20.506381035 CEST	51947	21	192.168.2.16	185.140.5.58
May 6, 2024 04:57:20.506431103 CEST	51948	2121	192.168.2.16	185.140.5.58
May 6, 2024 04:57:20.509905100 CEST	21	51928	34.128.145.40	192.168.2.16
May 6, 2024 04:57:20.510207891 CEST	21	51941	34.128.145.40	192.168.2.16
May 6, 2024 04:57:20.510271072 CEST	51941	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:20.520253897 CEST	2121	51943	34.128.145.40	192.168.2.16
May 6, 2024 04:57:20.520311117 CEST	51943	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:20.520430088 CEST	2121	51929	34.128.145.40	192.168.2.16
May 6, 2024 04:57:20.522229910 CEST	51949	21	192.168.2.16	50.244.117.45
May 6, 2024 04:57:20.536971092 CEST	21	51913	154.210.32.21	192.168.2.16
May 6, 2024 04:57:20.537229061 CEST	51913	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:20.549843073 CEST	21	51756	180.165.128.30	192.168.2.16
May 6, 2024 04:57:20.554020882 CEST	51812	2121	192.168.2.16	180.227.59.4
May 6, 2024 04:57:20.554037094 CEST	51830	21	192.168.2.16	1.252.255.100
May 6, 2024 04:57:20.554039955 CEST	51897	2121	192.168.2.16	2.116.162.98
May 6, 2024 04:57:20.554444075 CEST	51950	2121	192.168.2.16	50.244.117.45
May 6, 2024 04:57:20.564526081 CEST	2121	51893	124.47.102.1	192.168.2.16
May 6, 2024 04:57:20.565262079 CEST	21	51822	129.143.58.210	192.168.2.16
May 6, 2024 04:57:20.570223093 CEST	51951	21	192.168.2.16	68.149.222.5
May 6, 2024 04:57:20.570308924 CEST	21	51935	81.88.252.91	192.168.2.16
May 6, 2024 04:57:20.570377111 CEST	51935	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:20.572412014 CEST	21	51922	87.106.26.129	192.168.2.16
May 6, 2024 04:57:20.572556019 CEST	51922	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:20.577970028 CEST	21	51754	119.109.126.41	192.168.2.16
May 6, 2024 04:57:20.578187943 CEST	51952	2121	192.168.2.16	68.149.222.5
May 6, 2024 04:57:20.581125021 CEST	2121	51823	129.143.58.210	192.168.2.16
May 6, 2024 04:57:20.586045980 CEST	51898	21	192.168.2.16	1.174.94.19
May 6, 2024 04:57:20.602039099 CEST	51899	2121	192.168.2.16	1.174.94.19
May 6, 2024 04:57:20.613611937 CEST	21	51892	124.47.102.1	192.168.2.16
May 6, 2024 04:57:20.617398977 CEST	51953	21	192.168.2.16	83.37.116.59
May 6, 2024 04:57:20.618257046 CEST	51954	2121	192.168.2.16	83.37.116.59
May 6, 2024 04:57:20.620233059 CEST	21	51941	34.128.145.40	192.168.2.16
May 6, 2024 04:57:20.620280027 CEST	51941	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:20.620347023 CEST	51941	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:20.620517015 CEST	51955	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:20.622104883 CEST	21	51932	181.231.57.173	192.168.2.16
May 6, 2024 04:57:20.629390955 CEST	2121	51934	181.231.57.173	192.168.2.16
May 6, 2024 04:57:20.629717112 CEST	2121	51943	34.128.145.40	192.168.2.16
May 6, 2024 04:57:20.629766941 CEST	51943	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:20.629823923 CEST	51943	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:20.629973888 CEST	51956	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:20.648253918 CEST	21	51915	149.154.65.23	192.168.2.16
May 6, 2024 04:57:20.648350000 CEST	21	51915	149.154.65.23	192.168.2.16
May 6, 2024 04:57:20.648420095 CEST	2121	51788	82.76.47.225	192.168.2.16
May 6, 2024 04:57:20.648540020 CEST	51915	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:20.648757935 CEST	51957	21	192.168.2.16	175.153.71.38
May 6, 2024 04:57:20.648930073 CEST	21	51926	153.251.251.201	192.168.2.16
May 6, 2024 04:57:20.649039984 CEST	51832	2121	192.168.2.16	1.252.255.100
May 6, 2024 04:57:20.649158955 CEST	51900	21	192.168.2.16	59.28.85.135
May 6, 2024 04:57:20.670427084 CEST	2121	51927	153.251.251.201	192.168.2.16
May 6, 2024 04:57:20.681036949 CEST	51795	21	192.168.2.16	36.35.222.12
May 6, 2024 04:57:20.681155920 CEST	51805	2121	192.168.2.16	27.206.175.232
May 6, 2024 04:57:20.681157112 CEST	51876	21	192.168.2.16	211.217.212.254
May 6, 2024 04:57:20.697043896 CEST	51796	2121	192.168.2.16	36.35.222.12
May 6, 2024 04:57:20.697045088 CEST	51877	2121	192.168.2.16	211.217.212.254
May 6, 2024 04:57:20.697443962 CEST	51958	2121	192.168.2.16	175.153.71.38
May 6, 2024 04:57:20.697459936 CEST	51959	21	192.168.2.16	66.198.245.58
May 6, 2024 04:57:20.729017019 CEST	51916	21	192.168.2.16	220.73.21.145
May 6, 2024 04:57:20.729747057 CEST	21	51955	34.128.145.40	192.168.2.16
May 6, 2024 04:57:20.729799032 CEST	51955	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:20.729856014 CEST	21	51941	34.128.145.40	192.168.2.16
May 6, 2024 04:57:20.738980055 CEST	2121	51943	34.128.145.40	192.168.2.16
May 6, 2024 04:57:20.739085913 CEST	2121	51956	34.128.145.40	192.168.2.16
May 6, 2024 04:57:20.739145994 CEST	51956	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:20.745430946 CEST	51960	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:20.745455980 CEST	51917	2121	192.168.2.16	220.73.21.145
May 6, 2024 04:57:20.745723009 CEST	51902	2121	192.168.2.16	59.28.85.135
May 6, 2024 04:57:20.761174917 CEST	51904	21	192.168.2.16	179.125.223.180
May 6, 2024 04:57:20.761389017 CEST	51961	21	192.168.2.16	92.205.10.177
May 6, 2024 04:57:20.776038885 CEST	51813	21	192.168.2.16	188.38.141.31
May 6, 2024 04:57:20.776040077 CEST	51905	2121	192.168.2.16	179.125.223.180
May 6, 2024 04:57:20.776055098 CEST	51906	21	192.168.2.16	78.43.179.14
May 6, 2024 04:57:20.776057959 CEST	51907	2121	192.168.2.16	78.43.179.14
May 6, 2024 04:57:20.791246891 CEST	51962	21	192.168.2.16	47.94.164.39
May 6, 2024 04:57:20.799918890 CEST	21	51922	87.106.26.129	192.168.2.16
May 6, 2024 04:57:20.800395966 CEST	21	51922	87.106.26.129	192.168.2.16
May 6, 2024 04:57:20.800576925 CEST	51922	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:20.807025909 CEST	51800	21	192.168.2.16	119.13.89.196
May 6, 2024 04:57:20.808198929 CEST	51908	21	192.168.2.16	109.236.45.102
May 6, 2024 04:57:20.823020935 CEST	51909	2121	192.168.2.16	109.236.45.102
May 6, 2024 04:57:20.839027882 CEST	51910	21	192.168.2.16	23.73.111.158
May 6, 2024 04:57:20.839040041 CEST	21	51955	34.128.145.40	192.168.2.16
May 6, 2024 04:57:20.839092970 CEST	51955	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:20.839163065 CEST	51955	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:20.839365959 CEST	51963	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:20.848330975 CEST	2121	51956	34.128.145.40	192.168.2.16
May 6, 2024 04:57:20.848387003 CEST	51956	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:20.848429918 CEST	51956	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:20.848570108 CEST	51964	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:20.852137089 CEST	21	51935	81.88.252.91	192.168.2.16
May 6, 2024 04:57:20.852274895 CEST	51935	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:20.854027033 CEST	21	51959	66.198.245.58	192.168.2.16
May 6, 2024 04:57:20.854084015 CEST	51959	21	192.168.2.16	66.198.245.58
May 6, 2024 04:57:20.855065107 CEST	51911	2121	192.168.2.16	23.73.111.158
May 6, 2024 04:57:20.855066061 CEST	51912	21	192.168.2.16	23.243.238.213
May 6, 2024 04:57:20.855506897 CEST	51965	2121	192.168.2.16	47.94.164.39
May 6, 2024 04:57:20.863895893 CEST	21	51830	1.252.255.100	192.168.2.16
May 6, 2024 04:57:20.866354942 CEST	21	51923	103.109.6.215	192.168.2.16
May 6, 2024 04:57:20.866462946 CEST	51923	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:20.867995024 CEST	2121	51812	180.227.59.4	192.168.2.16
May 6, 2024 04:57:20.869558096 CEST	21	51913	154.210.32.21	192.168.2.16
May 6, 2024 04:57:20.869689941 CEST	21	51913	154.210.32.21	192.168.2.16
May 6, 2024 04:57:20.869793892 CEST	51913	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:20.871027946 CEST	51809	2121	192.168.2.16	189.146.87.206
May 6, 2024 04:57:20.872322083 CEST	51790	2121	192.168.2.16	220.163.109.166
May 6, 2024 04:57:20.895014048 CEST	51914	2121	192.168.2.16	23.243.238.213
May 6, 2024 04:57:20.905333042 CEST	21	51915	149.154.65.23	192.168.2.16
May 6, 2024 04:57:20.905534029 CEST	51915	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:20.905829906 CEST	51966	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:20.919024944 CEST	51789	21	192.168.2.16	220.163.109.166
May 6, 2024 04:57:20.919047117 CEST	51815	2121	192.168.2.16	188.38.141.31
May 6, 2024 04:57:20.919238091 CEST	51967	21	192.168.2.16	62.217.99.205
May 6, 2024 04:57:20.919239044 CEST	51891	2121	192.168.2.16	151.14.60.6
May 6, 2024 04:57:20.935239077 CEST	51968	2121	192.168.2.16	62.217.99.205
May 6, 2024 04:57:20.949393988 CEST	21	51955	34.128.145.40	192.168.2.16
May 6, 2024 04:57:20.950081110 CEST	21	51963	34.128.145.40	192.168.2.16
May 6, 2024 04:57:20.950141907 CEST	51963	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:20.951021910 CEST	51918	21	192.168.2.16	188.244.99.55
May 6, 2024 04:57:20.958836079 CEST	2121	51956	34.128.145.40	192.168.2.16
May 6, 2024 04:57:20.959419012 CEST	2121	51964	34.128.145.40	192.168.2.16
May 6, 2024 04:57:20.959471941 CEST	51964	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:20.983814955 CEST	2121	51832	1.252.255.100	192.168.2.16
May 6, 2024 04:57:20.986646891 CEST	21	51961	92.205.10.177	192.168.2.16
May 6, 2024 04:57:20.986706972 CEST	51961	21	192.168.2.16	92.205.10.177
May 6, 2024 04:57:20.988320112 CEST	21	51876	211.217.212.254	192.168.2.16
May 6, 2024 04:57:21.003411055 CEST	2121	51877	211.217.212.254	192.168.2.16
May 6, 2024 04:57:21.010477066 CEST	21	51959	66.198.245.58	192.168.2.16
May 6, 2024 04:57:21.010649920 CEST	51959	21	192.168.2.16	66.198.245.58
May 6, 2024 04:57:21.015312910 CEST	51969	21	192.168.2.16	64.252.171.95
May 6, 2024 04:57:21.024661064 CEST	21	51922	87.106.26.129	192.168.2.16
May 6, 2024 04:57:21.024796009 CEST	51922	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:21.025019884 CEST	51970	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:21.025665045 CEST	21	51916	220.73.21.145	192.168.2.16
May 6, 2024 04:57:21.032252073 CEST	21	51957	175.153.71.38	192.168.2.16
May 6, 2024 04:57:21.042916059 CEST	2121	51805	27.206.175.232	192.168.2.16
May 6, 2024 04:57:21.045909882 CEST	2121	51917	220.73.21.145	192.168.2.16
May 6, 2024 04:57:21.047043085 CEST	51803	2121	192.168.2.16	119.13.89.196
May 6, 2024 04:57:21.055516005 CEST	2121	51958	175.153.71.38	192.168.2.16
May 6, 2024 04:57:21.059798002 CEST	21	51963	34.128.145.40	192.168.2.16
May 6, 2024 04:57:21.059854031 CEST	51963	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:21.059910059 CEST	51963	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:21.060062885 CEST	51971	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:21.063052893 CEST	51806	21	192.168.2.16	189.146.87.206
May 6, 2024 04:57:21.068669081 CEST	2121	51809	189.146.87.206	192.168.2.16
May 6, 2024 04:57:21.069046021 CEST	51972	2121	192.168.2.16	64.252.171.95
May 6, 2024 04:57:21.069207907 CEST	2121	51964	34.128.145.40	192.168.2.16
May 6, 2024 04:57:21.069266081 CEST	51964	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:21.069307089 CEST	51964	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:21.069423914 CEST	51973	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:21.078032017 CEST	51804	21	192.168.2.16	27.206.175.232
May 6, 2024 04:57:21.078032970 CEST	51822	21	192.168.2.16	129.143.58.210
May 6, 2024 04:57:21.078464985 CEST	51921	2121	192.168.2.16	188.244.99.55
May 6, 2024 04:57:21.078465939 CEST	51893	2121	192.168.2.16	124.47.102.1
May 6, 2024 04:57:21.078465939 CEST	51974	21	192.168.2.16	93.5.142.81
May 6, 2024 04:57:21.078584909 CEST	51975	2121	192.168.2.16	93.5.142.81
May 6, 2024 04:57:21.085741997 CEST	21	51960	101.43.249.26	192.168.2.16
May 6, 2024 04:57:21.085916042 CEST	51960	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:21.094031096 CEST	51808	21	192.168.2.16	121.173.105.252
May 6, 2024 04:57:21.094041109 CEST	51807	2121	192.168.2.16	121.173.105.252
May 6, 2024 04:57:21.094043016 CEST	51811	2121	192.168.2.16	220.122.177.179
May 6, 2024 04:57:21.094326973 CEST	51810	21	192.168.2.16	220.122.177.179
May 6, 2024 04:57:21.094330072 CEST	51823	2121	192.168.2.16	129.143.58.210
May 6, 2024 04:57:21.094330072 CEST	51976	21	192.168.2.16	40.74.94.47
May 6, 2024 04:57:21.110022068 CEST	51821	2121	192.168.2.16	122.252.221.135
May 6, 2024 04:57:21.110033035 CEST	51818	21	192.168.2.16	75.206.217.214
May 6, 2024 04:57:21.110038996 CEST	51816	21	192.168.2.16	94.237.11.200
May 6, 2024 04:57:21.110038996 CEST	51820	21	192.168.2.16	122.252.221.135
May 6, 2024 04:57:21.110050917 CEST	51819	2121	192.168.2.16	75.206.217.214
May 6, 2024 04:57:21.110050917 CEST	51817	2121	192.168.2.16	94.237.11.200
May 6, 2024 04:57:21.110052109 CEST	51814	21	192.168.2.16	180.227.59.4
May 6, 2024 04:57:21.122639894 CEST	21	51935	81.88.252.91	192.168.2.16
May 6, 2024 04:57:21.122770071 CEST	51935	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:21.126025915 CEST	51892	21	192.168.2.16	124.47.102.1
May 6, 2024 04:57:21.126025915 CEST	51827	21	192.168.2.16	219.156.232.19
May 6, 2024 04:57:21.126049042 CEST	51829	2121	192.168.2.16	104.173.136.54
May 6, 2024 04:57:21.126051903 CEST	51932	21	192.168.2.16	181.231.57.173
May 6, 2024 04:57:21.126247883 CEST	51825	2121	192.168.2.16	219.156.232.19
May 6, 2024 04:57:21.126250029 CEST	51977	2121	192.168.2.16	40.74.94.47
May 6, 2024 04:57:21.126251936 CEST	51925	21	192.168.2.16	103.28.54.200
May 6, 2024 04:57:21.141025066 CEST	51824	21	192.168.2.16	80.201.1.45
May 6, 2024 04:57:21.141040087 CEST	51828	21	192.168.2.16	104.173.136.54
May 6, 2024 04:57:21.141041040 CEST	51934	2121	192.168.2.16	181.231.57.173
May 6, 2024 04:57:21.141042948 CEST	51826	2121	192.168.2.16	80.201.1.45
May 6, 2024 04:57:21.141155958 CEST	51924	2121	192.168.2.16	103.28.54.200
May 6, 2024 04:57:21.157018900 CEST	51835	2121	192.168.2.16	23.45.140.199
May 6, 2024 04:57:21.157021046 CEST	51834	21	192.168.2.16	178.203.118.173
May 6, 2024 04:57:21.157036066 CEST	51833	21	192.168.2.16	23.45.140.199
May 6, 2024 04:57:21.157037020 CEST	51836	2121	192.168.2.16	178.203.118.173
May 6, 2024 04:57:21.157037020 CEST	51926	21	192.168.2.16	153.251.251.201
May 6, 2024 04:57:21.160203934 CEST	21	51915	149.154.65.23	192.168.2.16
May 6, 2024 04:57:21.160254955 CEST	51915	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:21.160476923 CEST	21	51966	149.154.65.23	192.168.2.16
May 6, 2024 04:57:21.160536051 CEST	51966	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:21.166212082 CEST	21	51959	66.198.245.58	192.168.2.16
May 6, 2024 04:57:21.166265965 CEST	21	51959	66.198.245.58	192.168.2.16
May 6, 2024 04:57:21.166380882 CEST	51959	21	192.168.2.16	66.198.245.58
May 6, 2024 04:57:21.169513941 CEST	21	51971	34.128.145.40	192.168.2.16
May 6, 2024 04:57:21.169569969 CEST	51971	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:21.173019886 CEST	51927	2121	192.168.2.16	153.251.251.201
May 6, 2024 04:57:21.176853895 CEST	2121	51891	151.14.60.6	192.168.2.16
May 6, 2024 04:57:21.180005074 CEST	2121	51973	34.128.145.40	192.168.2.16
May 6, 2024 04:57:21.180058956 CEST	51973	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:21.187412977 CEST	21	51967	62.217.99.205	192.168.2.16
May 6, 2024 04:57:21.189393044 CEST	51978	21	192.168.2.16	186.190.195.32
May 6, 2024 04:57:21.203803062 CEST	2121	51968	62.217.99.205	192.168.2.16
May 6, 2024 04:57:21.205022097 CEST	51837	21	192.168.2.16	220.116.111.28
May 6, 2024 04:57:21.205074072 CEST	51930	21	192.168.2.16	186.4.1.201
May 6, 2024 04:57:21.211082935 CEST	21	51913	154.210.32.21	192.168.2.16
May 6, 2024 04:57:21.211196899 CEST	51913	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:21.211354017 CEST	51979	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:21.211796999 CEST	21	51913	154.210.32.21	192.168.2.16
May 6, 2024 04:57:21.211847067 CEST	51913	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:21.214176893 CEST	21	51961	92.205.10.177	192.168.2.16
May 6, 2024 04:57:21.214324951 CEST	51961	21	192.168.2.16	92.205.10.177
May 6, 2024 04:57:21.221030951 CEST	51838	2121	192.168.2.16	220.116.111.28
May 6, 2024 04:57:21.221034050 CEST	51839	21	192.168.2.16	113.169.215.158
May 6, 2024 04:57:21.221395969 CEST	51980	2121	192.168.2.16	186.190.195.32
May 6, 2024 04:57:21.236859083 CEST	21	51923	103.109.6.215	192.168.2.16
May 6, 2024 04:57:21.236979008 CEST	51923	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:21.237502098 CEST	51981	21	192.168.2.16	210.204.200.190
May 6, 2024 04:57:21.237514019 CEST	51983	21	192.168.2.16	192.34.211.79
May 6, 2024 04:57:21.237597942 CEST	51982	2121	192.168.2.16	210.204.200.190
May 6, 2024 04:57:21.240060091 CEST	2121	51790	220.163.109.166	192.168.2.16
May 6, 2024 04:57:21.242052078 CEST	21	51813	188.38.141.31	192.168.2.16
May 6, 2024 04:57:21.248816967 CEST	21	51970	87.106.26.129	192.168.2.16
May 6, 2024 04:57:21.248878956 CEST	51970	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:21.250535011 CEST	21	51922	87.106.26.129	192.168.2.16
May 6, 2024 04:57:21.250592947 CEST	51922	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:21.252047062 CEST	51931	2121	192.168.2.16	186.4.1.201
May 6, 2024 04:57:21.252248049 CEST	51984	2121	192.168.2.16	192.34.211.79
May 6, 2024 04:57:21.268471003 CEST	51985	21	192.168.2.16	34.133.60.194
May 6, 2024 04:57:21.268528938 CEST	51986	2121	192.168.2.16	34.133.60.194
May 6, 2024 04:57:21.279463053 CEST	21	51971	34.128.145.40	192.168.2.16
May 6, 2024 04:57:21.279510021 CEST	51971	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:21.279566050 CEST	51971	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:21.279699087 CEST	51987	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:21.284039974 CEST	51933	21	192.168.2.16	52.218.221.252
May 6, 2024 04:57:21.284456015 CEST	51988	21	192.168.2.16	1.199.40.186
May 6, 2024 04:57:21.284568071 CEST	51989	2121	192.168.2.16	1.199.40.186
May 6, 2024 04:57:21.290625095 CEST	2121	51973	34.128.145.40	192.168.2.16
May 6, 2024 04:57:21.290676117 CEST	51973	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:21.290733099 CEST	51973	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:21.290896893 CEST	51990	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:21.299200058 CEST	21	51789	220.163.109.166	192.168.2.16
May 6, 2024 04:57:21.311105967 CEST	21	51822	129.143.58.210	192.168.2.16
May 6, 2024 04:57:21.315279007 CEST	51991	21	192.168.2.16	79.78.95.9
May 6, 2024 04:57:21.327290058 CEST	2121	51823	129.143.58.210	192.168.2.16
May 6, 2024 04:57:21.331053972 CEST	51936	2121	192.168.2.16	52.218.221.252
May 6, 2024 04:57:21.331392050 CEST	51992	2121	192.168.2.16	79.78.95.9
May 6, 2024 04:57:21.331413984 CEST	51993	21	192.168.2.16	81.71.159.114
May 6, 2024 04:57:21.333178997 CEST	2121	51815	188.38.141.31	192.168.2.16
May 6, 2024 04:57:21.347027063 CEST	51937	21	192.168.2.16	183.134.230.186
May 6, 2024 04:57:21.347074032 CEST	51938	2121	192.168.2.16	183.134.230.186
May 6, 2024 04:57:21.347074032 CEST	51705	21	192.168.2.16	168.220.94.137
May 6, 2024 04:57:21.347162008 CEST	51706	2121	192.168.2.16	168.220.94.137
May 6, 2024 04:57:21.347579956 CEST	51994	2121	192.168.2.16	81.71.159.114
May 6, 2024 04:57:21.347707033 CEST	51995	2121	192.168.2.16	168.220.94.137
May 6, 2024 04:57:21.347733974 CEST	51996	21	192.168.2.16	168.220.94.137
May 6, 2024 04:57:21.361907959 CEST	21	51959	66.198.245.58	192.168.2.16
May 6, 2024 04:57:21.363018036 CEST	51939	21	192.168.2.16	188.82.83.201
May 6, 2024 04:57:21.363039970 CEST	51843	2121	192.168.2.16	113.169.215.158
May 6, 2024 04:57:21.371516943 CEST	2121	51893	124.47.102.1	192.168.2.16
May 6, 2024 04:57:21.379024029 CEST	51830	21	192.168.2.16	1.252.255.100
May 6, 2024 04:57:21.379040956 CEST	51940	2121	192.168.2.16	188.82.83.201
May 6, 2024 04:57:21.379041910 CEST	51812	2121	192.168.2.16	180.227.59.4
May 6, 2024 04:57:21.379179001 CEST	51844	21	192.168.2.16	98.206.119.217
May 6, 2024 04:57:21.379292965 CEST	51997	21	192.168.2.16	49.172.137.53
May 6, 2024 04:57:21.389487982 CEST	21	51971	34.128.145.40	192.168.2.16
May 6, 2024 04:57:21.390655041 CEST	21	51987	34.128.145.40	192.168.2.16
May 6, 2024 04:57:21.390716076 CEST	51987	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:21.395059109 CEST	51963	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:21.395102024 CEST	51964	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:21.395450115 CEST	51998	2121	192.168.2.16	49.172.137.53
May 6, 2024 04:57:21.395533085 CEST	51999	21	192.168.2.16	80.182.0.114
May 6, 2024 04:57:21.398042917 CEST	21	51935	81.88.252.91	192.168.2.16
May 6, 2024 04:57:21.398055077 CEST	21	51935	81.88.252.91	192.168.2.16
May 6, 2024 04:57:21.398298979 CEST	52000	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:21.400331020 CEST	2121	51973	34.128.145.40	192.168.2.16
May 6, 2024 04:57:21.400506020 CEST	2121	51990	34.128.145.40	192.168.2.16
May 6, 2024 04:57:21.400666952 CEST	51990	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:21.410023928 CEST	51846	2121	192.168.2.16	98.206.119.217
May 6, 2024 04:57:21.410039902 CEST	51845	21	192.168.2.16	1.176.55.14
May 6, 2024 04:57:21.411031961 CEST	51942	21	192.168.2.16	166.248.168.241
May 6, 2024 04:57:21.415007114 CEST	21	51892	124.47.102.1	192.168.2.16
May 6, 2024 04:57:21.417805910 CEST	21	51966	149.154.65.23	192.168.2.16
May 6, 2024 04:57:21.417979002 CEST	51966	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:21.419512987 CEST	21	51983	192.34.211.79	192.168.2.16
May 6, 2024 04:57:21.426028967 CEST	51847	2121	192.168.2.16	1.176.55.14
May 6, 2024 04:57:21.426350117 CEST	21	51960	101.43.249.26	192.168.2.16
May 6, 2024 04:57:21.426424026 CEST	52001	2121	192.168.2.16	80.182.0.114
May 6, 2024 04:57:21.426512003 CEST	51960	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:21.426589012 CEST	52002	21	192.168.2.16	71.244.204.109
May 6, 2024 04:57:21.432133913 CEST	2121	51984	192.34.211.79	192.168.2.16
May 6, 2024 04:57:21.439657927 CEST	21	51961	92.205.10.177	192.168.2.16
May 6, 2024 04:57:21.439774990 CEST	21	51961	92.205.10.177	192.168.2.16
May 6, 2024 04:57:21.439946890 CEST	51961	21	192.168.2.16	92.205.10.177
May 6, 2024 04:57:21.442045927 CEST	51850	21	192.168.2.16	194.9.212.230
May 6, 2024 04:57:21.442323923 CEST	52003	2121	192.168.2.16	71.244.204.109
May 6, 2024 04:57:21.456857920 CEST	21	51996	168.220.94.137	192.168.2.16
May 6, 2024 04:57:21.456870079 CEST	2121	51995	168.220.94.137	192.168.2.16
May 6, 2024 04:57:21.456913948 CEST	51996	21	192.168.2.16	168.220.94.137
May 6, 2024 04:57:21.456935883 CEST	2121	51706	168.220.94.137	192.168.2.16
May 6, 2024 04:57:21.456947088 CEST	51995	2121	192.168.2.16	168.220.94.137
May 6, 2024 04:57:21.457010031 CEST	21	51705	168.220.94.137	192.168.2.16
May 6, 2024 04:57:21.473048925 CEST	51851	2121	192.168.2.16	194.9.212.230
May 6, 2024 04:57:21.473442078 CEST	52004	21	192.168.2.16	218.61.185.100
May 6, 2024 04:57:21.489054918 CEST	51876	21	192.168.2.16	211.217.212.254
May 6, 2024 04:57:21.489056110 CEST	51832	2121	192.168.2.16	1.252.255.100
May 6, 2024 04:57:21.489056110 CEST	51944	2121	192.168.2.16	166.248.168.241
May 6, 2024 04:57:21.489160061 CEST	51945	21	192.168.2.16	5.68.83.14
May 6, 2024 04:57:21.496159077 CEST	21	51970	87.106.26.129	192.168.2.16
May 6, 2024 04:57:21.496352911 CEST	51970	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:21.501332045 CEST	21	51987	34.128.145.40	192.168.2.16
May 6, 2024 04:57:21.501398087 CEST	51987	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:21.501460075 CEST	51987	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:21.501621962 CEST	52005	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:21.504597902 CEST	21	51963	34.128.145.40	192.168.2.16
May 6, 2024 04:57:21.504666090 CEST	2121	51964	34.128.145.40	192.168.2.16
May 6, 2024 04:57:21.505044937 CEST	51877	2121	192.168.2.16	211.217.212.254
May 6, 2024 04:57:21.505044937 CEST	51946	2121	192.168.2.16	5.68.83.14
May 6, 2024 04:57:21.505310059 CEST	52006	2121	192.168.2.16	218.61.185.100
May 6, 2024 04:57:21.508924961 CEST	21	51926	153.251.251.201	192.168.2.16
May 6, 2024 04:57:21.510361910 CEST	2121	51990	34.128.145.40	192.168.2.16
May 6, 2024 04:57:21.510415077 CEST	51990	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:21.510467052 CEST	51990	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:21.510603905 CEST	52007	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:21.521017075 CEST	51947	21	192.168.2.16	185.140.5.58
May 6, 2024 04:57:21.521018982 CEST	51948	2121	192.168.2.16	185.140.5.58
May 6, 2024 04:57:21.521037102 CEST	51855	2121	192.168.2.16	107.13.196.219
May 6, 2024 04:57:21.521151066 CEST	51856	21	192.168.2.16	97.113.217.138
May 6, 2024 04:57:21.521389008 CEST	52008	21	192.168.2.16	114.238.78.175
May 6, 2024 04:57:21.536025047 CEST	51916	21	192.168.2.16	220.73.21.145
May 6, 2024 04:57:21.536048889 CEST	51949	21	192.168.2.16	50.244.117.45
May 6, 2024 04:57:21.536050081 CEST	51854	21	192.168.2.16	107.13.196.219
May 6, 2024 04:57:21.536051989 CEST	51957	21	192.168.2.16	175.153.71.38
May 6, 2024 04:57:21.537437916 CEST	2121	51927	153.251.251.201	192.168.2.16
May 6, 2024 04:57:21.539603949 CEST	2121	51982	210.204.200.190	192.168.2.16
May 6, 2024 04:57:21.542718887 CEST	21	51981	210.204.200.190	192.168.2.16
May 6, 2024 04:57:21.544656992 CEST	21	51913	154.210.32.21	192.168.2.16
May 6, 2024 04:57:21.552030087 CEST	51805	2121	192.168.2.16	27.206.175.232
May 6, 2024 04:57:21.552038908 CEST	51917	2121	192.168.2.16	220.73.21.145
May 6, 2024 04:57:21.552330971 CEST	52009	2121	192.168.2.16	114.238.78.175
May 6, 2024 04:57:21.554543972 CEST	21	51979	154.210.32.21	192.168.2.16
May 6, 2024 04:57:21.554604053 CEST	51979	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:21.568020105 CEST	51958	2121	192.168.2.16	175.153.71.38
May 6, 2024 04:57:21.568042040 CEST	51857	2121	192.168.2.16	97.113.217.138
May 6, 2024 04:57:21.568254948 CEST	52010	21	192.168.2.16	1.236.228.172
May 6, 2024 04:57:21.568257093 CEST	51950	2121	192.168.2.16	50.244.117.45
May 6, 2024 04:57:21.584042072 CEST	51951	21	192.168.2.16	68.149.222.5
May 6, 2024 04:57:21.584070921 CEST	51952	2121	192.168.2.16	68.149.222.5
May 6, 2024 04:57:21.584218979 CEST	52011	2121	192.168.2.16	1.236.228.172
May 6, 2024 04:57:21.608556986 CEST	21	51923	103.109.6.215	192.168.2.16
May 6, 2024 04:57:21.608680964 CEST	51923	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:21.608963966 CEST	52012	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:21.610743046 CEST	21	52005	34.128.145.40	192.168.2.16
May 6, 2024 04:57:21.610800982 CEST	52005	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:21.610985041 CEST	21	51987	34.128.145.40	192.168.2.16
May 6, 2024 04:57:21.616507053 CEST	52013	21	192.168.2.16	102.142.31.150
May 6, 2024 04:57:21.616549969 CEST	52014	2121	192.168.2.16	102.142.31.150
May 6, 2024 04:57:21.616574049 CEST	52015	21	192.168.2.16	111.196.40.107
May 6, 2024 04:57:21.619752884 CEST	2121	52007	34.128.145.40	192.168.2.16
May 6, 2024 04:57:21.619808912 CEST	52007	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:21.620012999 CEST	2121	51990	34.128.145.40	192.168.2.16
May 6, 2024 04:57:21.632025957 CEST	51954	2121	192.168.2.16	83.37.116.59
May 6, 2024 04:57:21.632040977 CEST	51953	21	192.168.2.16	83.37.116.59
May 6, 2024 04:57:21.632811069 CEST	52016	2121	192.168.2.16	111.196.40.107
May 6, 2024 04:57:21.632965088 CEST	52017	21	192.168.2.16	2.176.99.29
May 6, 2024 04:57:21.633089066 CEST	52019	21	192.168.2.16	47.188.96.248
May 6, 2024 04:57:21.633099079 CEST	52018	2121	192.168.2.16	2.176.99.29
May 6, 2024 04:57:21.633224964 CEST	52020	2121	192.168.2.16	47.188.96.248
May 6, 2024 04:57:21.648042917 CEST	51859	2121	192.168.2.16	84.236.146.251
May 6, 2024 04:57:21.648061991 CEST	51858	21	192.168.2.16	84.236.146.251
May 6, 2024 04:57:21.648305893 CEST	52021	21	192.168.2.16	73.110.68.240
May 6, 2024 04:57:21.648689032 CEST	52022	2121	192.168.2.16	73.110.68.240
May 6, 2024 04:57:21.664489985 CEST	52023	21	192.168.2.16	187.150.27.66
May 6, 2024 04:57:21.664588928 CEST	52024	2121	192.168.2.16	187.150.27.66
May 6, 2024 04:57:21.670815945 CEST	21	52000	81.88.252.91	192.168.2.16
May 6, 2024 04:57:21.670886040 CEST	52000	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:21.673003912 CEST	21	51966	149.154.65.23	192.168.2.16
May 6, 2024 04:57:21.673090935 CEST	21	51966	149.154.65.23	192.168.2.16
May 6, 2024 04:57:21.673208952 CEST	51966	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:21.680044889 CEST	51891	2121	192.168.2.16	151.14.60.6
May 6, 2024 04:57:21.680222034 CEST	52025	21	192.168.2.16	201.48.196.29
May 6, 2024 04:57:21.688952923 CEST	21	51830	1.252.255.100	192.168.2.16
May 6, 2024 04:57:21.693365097 CEST	2121	51812	180.227.59.4	192.168.2.16
May 6, 2024 04:57:21.696127892 CEST	51967	21	192.168.2.16	62.217.99.205
May 6, 2024 04:57:21.706654072 CEST	21	51961	92.205.10.177	192.168.2.16
May 6, 2024 04:57:21.712127924 CEST	51862	21	192.168.2.16	31.221.69.145
May 6, 2024 04:57:21.712147951 CEST	51968	2121	192.168.2.16	62.217.99.205
May 6, 2024 04:57:21.712147951 CEST	51863	2121	192.168.2.16	31.221.69.145
May 6, 2024 04:57:21.712419987 CEST	52026	2121	192.168.2.16	201.48.196.29
May 6, 2024 04:57:21.712457895 CEST	52027	21	192.168.2.16	203.158.39.251
May 6, 2024 04:57:21.719999075 CEST	21	52005	34.128.145.40	192.168.2.16
May 6, 2024 04:57:21.720061064 CEST	52005	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:21.720108986 CEST	52005	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:21.720150948 CEST	21	51970	87.106.26.129	192.168.2.16
May 6, 2024 04:57:21.720237017 CEST	52028	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:21.720396996 CEST	21	51970	87.106.26.129	192.168.2.16
May 6, 2024 04:57:21.720544100 CEST	51970	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:21.729262114 CEST	2121	52007	34.128.145.40	192.168.2.16
May 6, 2024 04:57:21.729311943 CEST	52007	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:21.729372025 CEST	52007	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:21.729531050 CEST	52029	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:21.744031906 CEST	51865	21	192.168.2.16	116.10.99.206
May 6, 2024 04:57:21.745171070 CEST	51813	21	192.168.2.16	188.38.141.31
May 6, 2024 04:57:21.759548903 CEST	52030	2121	192.168.2.16	203.158.39.251
May 6, 2024 04:57:21.766963959 CEST	21	51960	101.43.249.26	192.168.2.16
May 6, 2024 04:57:21.767123938 CEST	51960	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:21.767354965 CEST	52031	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:21.775398016 CEST	52032	21	192.168.2.16	187.147.9.26
May 6, 2024 04:57:21.791057110 CEST	51866	2121	192.168.2.16	116.10.99.206
May 6, 2024 04:57:21.791510105 CEST	52033	2121	192.168.2.16	187.147.9.26
May 6, 2024 04:57:21.791534901 CEST	52034	21	192.168.2.16	189.141.9.254
May 6, 2024 04:57:21.793695927 CEST	51962	21	192.168.2.16	47.94.164.39
May 6, 2024 04:57:21.796341896 CEST	21	51876	211.217.212.254	192.168.2.16
May 6, 2024 04:57:21.807418108 CEST	52035	2121	192.168.2.16	189.141.9.254
May 6, 2024 04:57:21.807480097 CEST	52036	21	192.168.2.16	102.155.18.82
May 6, 2024 04:57:21.811623096 CEST	2121	51877	211.217.212.254	192.168.2.16
May 6, 2024 04:57:21.823786974 CEST	2121	51832	1.252.255.100	192.168.2.16
May 6, 2024 04:57:21.824054003 CEST	52037	2121	192.168.2.16	102.155.18.82
May 6, 2024 04:57:21.829232931 CEST	21	52005	34.128.145.40	192.168.2.16
May 6, 2024 04:57:21.829770088 CEST	21	52028	34.128.145.40	192.168.2.16
May 6, 2024 04:57:21.829828978 CEST	52028	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:21.833672047 CEST	21	51916	220.73.21.145	192.168.2.16
May 6, 2024 04:57:21.838521957 CEST	2121	52007	34.128.145.40	192.168.2.16
May 6, 2024 04:57:21.839059114 CEST	51815	2121	192.168.2.16	188.38.141.31
May 6, 2024 04:57:21.839188099 CEST	2121	52029	34.128.145.40	192.168.2.16
May 6, 2024 04:57:21.839253902 CEST	52029	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:21.853799105 CEST	2121	51917	220.73.21.145	192.168.2.16
May 6, 2024 04:57:21.855058908 CEST	51868	21	192.168.2.16	211.244.180.175
May 6, 2024 04:57:21.855472088 CEST	52038	21	192.168.2.16	107.171.141.238
May 6, 2024 04:57:21.855473995 CEST	51965	2121	192.168.2.16	47.94.164.39
May 6, 2024 04:57:21.871047020 CEST	51869	2121	192.168.2.16	211.244.180.175
May 6, 2024 04:57:21.871263981 CEST	52039	2121	192.168.2.16	107.171.141.238
May 6, 2024 04:57:21.887028933 CEST	51893	2121	192.168.2.16	124.47.102.1
May 6, 2024 04:57:21.900042057 CEST	21	51932	181.231.57.173	192.168.2.16
May 6, 2024 04:57:21.900053978 CEST	21	51979	154.210.32.21	192.168.2.16
May 6, 2024 04:57:21.900260925 CEST	51979	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:21.903461933 CEST	52040	21	192.168.2.16	189.25.98.198
May 6, 2024 04:57:21.907349110 CEST	2121	51934	181.231.57.173	192.168.2.16
May 6, 2024 04:57:21.913386106 CEST	21	51957	175.153.71.38	192.168.2.16
May 6, 2024 04:57:21.914395094 CEST	2121	51805	27.206.175.232	192.168.2.16
May 6, 2024 04:57:21.915986061 CEST	21	52025	201.48.196.29	192.168.2.16
May 6, 2024 04:57:21.919132948 CEST	51892	21	192.168.2.16	124.47.102.1
May 6, 2024 04:57:21.919658899 CEST	52041	2121	192.168.2.16	49.13.32.58
May 6, 2024 04:57:21.919749975 CEST	52042	21	192.168.2.16	49.13.32.58
May 6, 2024 04:57:21.919758081 CEST	52043	2121	192.168.2.16	189.25.98.198
May 6, 2024 04:57:21.926829100 CEST	2121	51958	175.153.71.38	192.168.2.16
May 6, 2024 04:57:21.929527044 CEST	21	51966	149.154.65.23	192.168.2.16
May 6, 2024 04:57:21.929687023 CEST	51966	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:21.929883957 CEST	52044	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:21.935028076 CEST	51983	21	192.168.2.16	192.34.211.79
May 6, 2024 04:57:21.935312986 CEST	52045	21	192.168.2.16	118.59.230.75
May 6, 2024 04:57:21.935312986 CEST	51984	2121	192.168.2.16	192.34.211.79
May 6, 2024 04:57:21.939522982 CEST	21	52028	34.128.145.40	192.168.2.16
May 6, 2024 04:57:21.939579010 CEST	52028	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:21.939621925 CEST	52028	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:21.939757109 CEST	52046	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:21.942514896 CEST	21	52000	81.88.252.91	192.168.2.16
May 6, 2024 04:57:21.942653894 CEST	52000	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:21.944678068 CEST	21	51970	87.106.26.129	192.168.2.16
May 6, 2024 04:57:21.944794893 CEST	51970	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:21.944994926 CEST	52047	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:21.947978020 CEST	2121	52026	201.48.196.29	192.168.2.16
May 6, 2024 04:57:21.948864937 CEST	2121	52029	34.128.145.40	192.168.2.16
May 6, 2024 04:57:21.948923111 CEST	52029	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:21.948970079 CEST	52029	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:21.949100971 CEST	52048	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:21.951024055 CEST	51872	2121	192.168.2.16	14.85.220.138
May 6, 2024 04:57:21.951045990 CEST	51873	21	192.168.2.16	14.85.220.138
May 6, 2024 04:57:21.964329004 CEST	21	51967	62.217.99.205	192.168.2.16
May 6, 2024 04:57:21.967061996 CEST	51874	21	192.168.2.16	116.97.62.160
May 6, 2024 04:57:21.978858948 CEST	21	51923	103.109.6.215	192.168.2.16
May 6, 2024 04:57:21.978877068 CEST	21	51923	103.109.6.215	192.168.2.16
May 6, 2024 04:57:21.978929043 CEST	51923	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:21.979890108 CEST	21	52012	103.109.6.215	192.168.2.16
May 6, 2024 04:57:21.979964018 CEST	52012	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:21.980612993 CEST	2121	51968	62.217.99.205	192.168.2.16
May 6, 2024 04:57:21.983023882 CEST	51875	2121	192.168.2.16	116.97.62.160
May 6, 2024 04:57:21.999412060 CEST	52049	2121	192.168.2.16	118.59.230.75
May 6, 2024 04:57:22.015049934 CEST	51969	21	192.168.2.16	64.252.171.95
May 6, 2024 04:57:22.015050888 CEST	51926	21	192.168.2.16	153.251.251.201
May 6, 2024 04:57:22.015290976 CEST	52050	21	192.168.2.16	116.202.215.231
May 6, 2024 04:57:22.031202078 CEST	52051	2121	192.168.2.16	116.202.215.231
May 6, 2024 04:57:22.047048092 CEST	51982	2121	192.168.2.16	210.204.200.190
May 6, 2024 04:57:22.047049999 CEST	51927	2121	192.168.2.16	153.251.251.201
May 6, 2024 04:57:22.047051907 CEST	51981	21	192.168.2.16	210.204.200.190
May 6, 2024 04:57:22.049420118 CEST	21	52028	34.128.145.40	192.168.2.16
May 6, 2024 04:57:22.050465107 CEST	21	52046	34.128.145.40	192.168.2.16
May 6, 2024 04:57:22.050523996 CEST	52046	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:22.058619976 CEST	2121	52029	34.128.145.40	192.168.2.16
May 6, 2024 04:57:22.058682919 CEST	2121	52048	34.128.145.40	192.168.2.16
May 6, 2024 04:57:22.058738947 CEST	52048	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:22.063993931 CEST	2121	51891	151.14.60.6	192.168.2.16
May 6, 2024 04:57:22.079029083 CEST	51972	2121	192.168.2.16	64.252.171.95
May 6, 2024 04:57:22.079044104 CEST	51975	2121	192.168.2.16	93.5.142.81
May 6, 2024 04:57:22.079042912 CEST	51974	21	192.168.2.16	93.5.142.81
May 6, 2024 04:57:22.108891010 CEST	21	51960	101.43.249.26	192.168.2.16
May 6, 2024 04:57:22.108901024 CEST	21	51960	101.43.249.26	192.168.2.16
May 6, 2024 04:57:22.108966112 CEST	51960	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:22.109049082 CEST	51976	21	192.168.2.16	40.74.94.47
May 6, 2024 04:57:22.115541935 CEST	2121	51984	192.34.211.79	192.168.2.16
May 6, 2024 04:57:22.117151022 CEST	21	51983	192.34.211.79	192.168.2.16
May 6, 2024 04:57:22.129229069 CEST	21	52031	101.43.249.26	192.168.2.16
May 6, 2024 04:57:22.129301071 CEST	52031	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:22.140048981 CEST	51977	2121	192.168.2.16	40.74.94.47
May 6, 2024 04:57:22.143493891 CEST	21	52042	49.13.32.58	192.168.2.16
May 6, 2024 04:57:22.143507957 CEST	2121	52041	49.13.32.58	192.168.2.16
May 6, 2024 04:57:22.161247969 CEST	21	52046	34.128.145.40	192.168.2.16
May 6, 2024 04:57:22.161310911 CEST	52046	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:22.161377907 CEST	52046	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:22.161592960 CEST	52052	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:22.162220001 CEST	21	51813	188.38.141.31	192.168.2.16
May 6, 2024 04:57:22.171869040 CEST	2121	52048	34.128.145.40	192.168.2.16
May 6, 2024 04:57:22.171921015 CEST	52048	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:22.171974897 CEST	52048	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:22.172133923 CEST	52053	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:22.173662901 CEST	21	51970	87.106.26.129	192.168.2.16
May 6, 2024 04:57:22.173712015 CEST	51970	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:22.176464081 CEST	21	52047	87.106.26.129	192.168.2.16
May 6, 2024 04:57:22.176522970 CEST	52047	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:22.184880972 CEST	21	51966	149.154.65.23	192.168.2.16
May 6, 2024 04:57:22.184937954 CEST	51966	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:22.187510014 CEST	52054	21	192.168.2.16	31.181.24.131
May 6, 2024 04:57:22.193876982 CEST	2121	51893	124.47.102.1	192.168.2.16
May 6, 2024 04:57:22.199095964 CEST	21	52044	149.154.65.23	192.168.2.16
May 6, 2024 04:57:22.199158907 CEST	52044	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:22.203028917 CEST	51978	21	192.168.2.16	186.190.195.32
May 6, 2024 04:57:22.215931892 CEST	21	52000	81.88.252.91	192.168.2.16
May 6, 2024 04:57:22.216063023 CEST	52000	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:22.219055891 CEST	51884	2121	192.168.2.16	151.227.143.24
May 6, 2024 04:57:22.219105005 CEST	51883	21	192.168.2.16	151.227.143.24
May 6, 2024 04:57:22.228168964 CEST	21	51892	124.47.102.1	192.168.2.16
May 6, 2024 04:57:22.235023022 CEST	51980	2121	192.168.2.16	186.190.195.32
May 6, 2024 04:57:22.237588882 CEST	21	52050	116.202.215.231	192.168.2.16
May 6, 2024 04:57:22.243391991 CEST	21	51979	154.210.32.21	192.168.2.16
May 6, 2024 04:57:22.243442059 CEST	21	51979	154.210.32.21	192.168.2.16
May 6, 2024 04:57:22.243556023 CEST	51979	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:22.247663975 CEST	2121	51815	188.38.141.31	192.168.2.16
May 6, 2024 04:57:22.250737906 CEST	21	51852	193.124.183.222	192.168.2.16
May 6, 2024 04:57:22.250869036 CEST	51852	21	192.168.2.16	193.124.183.222
May 6, 2024 04:57:22.251143932 CEST	52055	21	192.168.2.16	193.124.183.222
May 6, 2024 04:57:22.251394987 CEST	52056	2121	192.168.2.16	31.181.24.131
May 6, 2024 04:57:22.251482964 CEST	52057	21	192.168.2.16	220.94.189.29
May 6, 2024 04:57:22.251563072 CEST	21	52045	118.59.230.75	192.168.2.16
May 6, 2024 04:57:22.267414093 CEST	52058	2121	192.168.2.16	220.94.189.29
May 6, 2024 04:57:22.270838976 CEST	21	52052	34.128.145.40	192.168.2.16
May 6, 2024 04:57:22.270926952 CEST	52052	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:22.270996094 CEST	21	52046	34.128.145.40	192.168.2.16
May 6, 2024 04:57:22.281527996 CEST	2121	52048	34.128.145.40	192.168.2.16
May 6, 2024 04:57:22.282578945 CEST	2121	52053	34.128.145.40	192.168.2.16
May 6, 2024 04:57:22.282639027 CEST	52053	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:22.283027887 CEST	51985	21	192.168.2.16	34.133.60.194
May 6, 2024 04:57:22.283047915 CEST	51986	2121	192.168.2.16	34.133.60.194
May 6, 2024 04:57:22.299045086 CEST	51988	21	192.168.2.16	1.199.40.186
May 6, 2024 04:57:22.299046993 CEST	51989	2121	192.168.2.16	1.199.40.186
May 6, 2024 04:57:22.299238920 CEST	51876	21	192.168.2.16	211.217.212.254
May 6, 2024 04:57:22.314032078 CEST	2121	52049	118.59.230.75	192.168.2.16
May 6, 2024 04:57:22.315052032 CEST	51877	2121	192.168.2.16	211.217.212.254
May 6, 2024 04:57:22.330029964 CEST	51991	21	192.168.2.16	79.78.95.9
May 6, 2024 04:57:22.346020937 CEST	51992	2121	192.168.2.16	79.78.95.9
May 6, 2024 04:57:22.346024036 CEST	51888	21	192.168.2.16	187.208.211.78
May 6, 2024 04:57:22.346036911 CEST	51993	21	192.168.2.16	81.71.159.114
May 6, 2024 04:57:22.346040964 CEST	51916	21	192.168.2.16	220.73.21.145
May 6, 2024 04:57:22.349744081 CEST	2121	51982	210.204.200.190	192.168.2.16
May 6, 2024 04:57:22.350822926 CEST	21	51981	210.204.200.190	192.168.2.16
May 6, 2024 04:57:22.351044893 CEST	21	52012	103.109.6.215	192.168.2.16
May 6, 2024 04:57:22.351175070 CEST	52012	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:22.362020969 CEST	51917	2121	192.168.2.16	220.73.21.145
May 6, 2024 04:57:22.362044096 CEST	51994	2121	192.168.2.16	81.71.159.114
May 6, 2024 04:57:22.362057924 CEST	51889	2121	192.168.2.16	187.208.211.78
May 6, 2024 04:57:22.362247944 CEST	2121	52037	102.155.18.82	192.168.2.16
May 6, 2024 04:57:22.365534067 CEST	21	52036	102.155.18.82	192.168.2.16
May 6, 2024 04:57:22.369025946 CEST	21	51926	153.251.251.201	192.168.2.16
May 6, 2024 04:57:22.378026962 CEST	51890	21	192.168.2.16	151.14.60.6
May 6, 2024 04:57:22.380490065 CEST	21	52052	34.128.145.40	192.168.2.16
May 6, 2024 04:57:22.380549908 CEST	52052	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:22.380613089 CEST	52052	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:22.380789995 CEST	52059	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:22.383475065 CEST	2121	51927	153.251.251.201	192.168.2.16
May 6, 2024 04:57:22.394022942 CEST	51997	21	192.168.2.16	49.172.137.53
May 6, 2024 04:57:22.398205996 CEST	2121	52053	34.128.145.40	192.168.2.16
May 6, 2024 04:57:22.398261070 CEST	52053	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:22.398333073 CEST	52053	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:22.398525000 CEST	52060	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:22.410028934 CEST	51999	21	192.168.2.16	80.182.0.114
May 6, 2024 04:57:22.410028934 CEST	51998	2121	192.168.2.16	49.172.137.53
May 6, 2024 04:57:22.410188913 CEST	51934	2121	192.168.2.16	181.231.57.173
May 6, 2024 04:57:22.412802935 CEST	51932	21	192.168.2.16	181.231.57.173
May 6, 2024 04:57:22.426059008 CEST	51957	21	192.168.2.16	175.153.71.38
May 6, 2024 04:57:22.428452015 CEST	52002	21	192.168.2.16	71.244.204.109
May 6, 2024 04:57:22.428452969 CEST	52025	21	192.168.2.16	201.48.196.29
May 6, 2024 04:57:22.432288885 CEST	21	52047	87.106.26.129	192.168.2.16
May 6, 2024 04:57:22.432482004 CEST	52047	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:22.441030025 CEST	51958	2121	192.168.2.16	175.153.71.38
May 6, 2024 04:57:22.441030025 CEST	52001	2121	192.168.2.16	80.182.0.114
May 6, 2024 04:57:22.441299915 CEST	52061	21	192.168.2.16	216.117.162.236
May 6, 2024 04:57:22.457040071 CEST	52026	2121	192.168.2.16	201.48.196.29
May 6, 2024 04:57:22.457057953 CEST	52003	2121	192.168.2.16	71.244.204.109
May 6, 2024 04:57:22.472784042 CEST	21	52044	149.154.65.23	192.168.2.16
May 6, 2024 04:57:22.472935915 CEST	52044	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:22.473018885 CEST	51967	21	192.168.2.16	62.217.99.205
May 6, 2024 04:57:22.488023996 CEST	52004	21	192.168.2.16	218.61.185.100
May 6, 2024 04:57:22.488037109 CEST	51968	2121	192.168.2.16	62.217.99.205
May 6, 2024 04:57:22.488997936 CEST	21	52031	101.43.249.26	192.168.2.16
May 6, 2024 04:57:22.489132881 CEST	52031	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:22.489809990 CEST	21	52052	34.128.145.40	192.168.2.16
May 6, 2024 04:57:22.490319967 CEST	21	52059	34.128.145.40	192.168.2.16
May 6, 2024 04:57:22.490384102 CEST	52059	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:22.500138044 CEST	21	52000	81.88.252.91	192.168.2.16
May 6, 2024 04:57:22.500169992 CEST	21	52000	81.88.252.91	192.168.2.16
May 6, 2024 04:57:22.500416040 CEST	52062	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:22.504041910 CEST	51894	21	192.168.2.16	2.116.162.98
May 6, 2024 04:57:22.507766962 CEST	2121	52060	34.128.145.40	192.168.2.16
May 6, 2024 04:57:22.507823944 CEST	52060	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:22.507977009 CEST	2121	52053	34.128.145.40	192.168.2.16
May 6, 2024 04:57:22.515722036 CEST	21	51852	193.124.183.222	192.168.2.16
May 6, 2024 04:57:22.515772104 CEST	51852	21	192.168.2.16	193.124.183.222
May 6, 2024 04:57:22.520028114 CEST	52006	2121	192.168.2.16	218.61.185.100
May 6, 2024 04:57:22.523299932 CEST	21	52055	193.124.183.222	192.168.2.16
May 6, 2024 04:57:22.523363113 CEST	52055	21	192.168.2.16	193.124.183.222
May 6, 2024 04:57:22.535023928 CEST	52008	21	192.168.2.16	114.238.78.175
May 6, 2024 04:57:22.557852030 CEST	21	52057	220.94.189.29	192.168.2.16
May 6, 2024 04:57:22.567027092 CEST	52009	2121	192.168.2.16	114.238.78.175
May 6, 2024 04:57:22.567043066 CEST	51891	2121	192.168.2.16	151.14.60.6
May 6, 2024 04:57:22.567043066 CEST	51897	2121	192.168.2.16	2.116.162.98
May 6, 2024 04:57:22.572946072 CEST	2121	52058	220.94.189.29	192.168.2.16
May 6, 2024 04:57:22.583039045 CEST	52010	21	192.168.2.16	1.236.228.172
May 6, 2024 04:57:22.595876932 CEST	21	51979	154.210.32.21	192.168.2.16
May 6, 2024 04:57:22.596003056 CEST	51979	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:22.596169949 CEST	52063	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:22.596676111 CEST	21	51979	154.210.32.21	192.168.2.16
May 6, 2024 04:57:22.596723080 CEST	51979	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:22.599026918 CEST	52011	2121	192.168.2.16	1.236.228.172
May 6, 2024 04:57:22.599037886 CEST	51898	21	192.168.2.16	1.174.94.19
May 6, 2024 04:57:22.599956036 CEST	21	52059	34.128.145.40	192.168.2.16
May 6, 2024 04:57:22.600025892 CEST	52059	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:22.600059986 CEST	52059	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:22.600169897 CEST	52064	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:22.607811928 CEST	21	51876	211.217.212.254	192.168.2.16
May 6, 2024 04:57:22.615029097 CEST	51899	2121	192.168.2.16	1.174.94.19
May 6, 2024 04:57:22.617136955 CEST	2121	52060	34.128.145.40	192.168.2.16
May 6, 2024 04:57:22.617326021 CEST	52060	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:22.617436886 CEST	52060	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:22.617640018 CEST	52065	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:22.621377945 CEST	2121	51877	211.217.212.254	192.168.2.16
May 6, 2024 04:57:22.631023884 CEST	52014	2121	192.168.2.16	102.142.31.150
May 6, 2024 04:57:22.631043911 CEST	51983	21	192.168.2.16	192.34.211.79
May 6, 2024 04:57:22.631047010 CEST	52013	21	192.168.2.16	102.142.31.150
May 6, 2024 04:57:22.631047010 CEST	51984	2121	192.168.2.16	192.34.211.79
May 6, 2024 04:57:22.631047964 CEST	52015	21	192.168.2.16	111.196.40.107
May 6, 2024 04:57:22.631479025 CEST	52066	21	192.168.2.16	178.185.67.94
May 6, 2024 04:57:22.643330097 CEST	21	51916	220.73.21.145	192.168.2.16
May 6, 2024 04:57:22.646037102 CEST	52016	2121	192.168.2.16	111.196.40.107
May 6, 2024 04:57:22.646038055 CEST	52020	2121	192.168.2.16	47.188.96.248
May 6, 2024 04:57:22.646038055 CEST	52019	21	192.168.2.16	47.188.96.248
May 6, 2024 04:57:22.646049976 CEST	52017	21	192.168.2.16	2.176.99.29
May 6, 2024 04:57:22.646050930 CEST	52041	2121	192.168.2.16	49.13.32.58
May 6, 2024 04:57:22.646051884 CEST	52042	21	192.168.2.16	49.13.32.58
May 6, 2024 04:57:22.646066904 CEST	52018	2121	192.168.2.16	2.176.99.29
May 6, 2024 04:57:22.646359921 CEST	52067	2121	192.168.2.16	178.185.67.94
May 6, 2024 04:57:22.660836935 CEST	21	52047	87.106.26.129	192.168.2.16
May 6, 2024 04:57:22.661147118 CEST	21	52047	87.106.26.129	192.168.2.16
May 6, 2024 04:57:22.661295891 CEST	52047	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:22.662028074 CEST	52022	2121	192.168.2.16	73.110.68.240
May 6, 2024 04:57:22.662039042 CEST	52021	21	192.168.2.16	73.110.68.240
May 6, 2024 04:57:22.662154913 CEST	51900	21	192.168.2.16	59.28.85.135
May 6, 2024 04:57:22.662281990 CEST	52068	21	192.168.2.16	200.11.111.246
May 6, 2024 04:57:22.662672997 CEST	2121	51917	220.73.21.145	192.168.2.16
May 6, 2024 04:57:22.664026022 CEST	21	52025	201.48.196.29	192.168.2.16
May 6, 2024 04:57:22.678024054 CEST	52023	21	192.168.2.16	187.150.27.66
May 6, 2024 04:57:22.678040028 CEST	52024	2121	192.168.2.16	187.150.27.66
May 6, 2024 04:57:22.692544937 CEST	2121	52026	201.48.196.29	192.168.2.16
May 6, 2024 04:57:22.694039106 CEST	51893	2121	192.168.2.16	124.47.102.1
May 6, 2024 04:57:22.694277048 CEST	52069	2121	192.168.2.16	200.11.111.246
May 6, 2024 04:57:22.710814953 CEST	21	52064	34.128.145.40	192.168.2.16
May 6, 2024 04:57:22.710880995 CEST	52064	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:22.720535994 CEST	21	52012	103.109.6.215	192.168.2.16
May 6, 2024 04:57:22.720654964 CEST	52012	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:22.726023912 CEST	52027	21	192.168.2.16	203.158.39.251
May 6, 2024 04:57:22.726635933 CEST	2121	52060	34.128.145.40	192.168.2.16
May 6, 2024 04:57:22.727171898 CEST	2121	52065	34.128.145.40	192.168.2.16
May 6, 2024 04:57:22.727230072 CEST	52065	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:22.741024017 CEST	52050	21	192.168.2.16	116.202.215.231
May 6, 2024 04:57:22.741024971 CEST	51892	21	192.168.2.16	124.47.102.1
May 6, 2024 04:57:22.741175890 CEST	21	51967	62.217.99.205	192.168.2.16
May 6, 2024 04:57:22.742566109 CEST	21	52044	149.154.65.23	192.168.2.16
May 6, 2024 04:57:22.742578983 CEST	21	52044	149.154.65.23	192.168.2.16
May 6, 2024 04:57:22.742723942 CEST	52044	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:22.756541014 CEST	2121	51968	62.217.99.205	192.168.2.16
May 6, 2024 04:57:22.757028103 CEST	51902	2121	192.168.2.16	59.28.85.135
May 6, 2024 04:57:22.757040024 CEST	52045	21	192.168.2.16	118.59.230.75
May 6, 2024 04:57:22.773026943 CEST	52030	2121	192.168.2.16	203.158.39.251
May 6, 2024 04:57:22.773027897 CEST	51904	21	192.168.2.16	179.125.223.180
May 6, 2024 04:57:22.773374081 CEST	21	52062	81.88.252.91	192.168.2.16
May 6, 2024 04:57:22.773437977 CEST	52062	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:22.784529924 CEST	21	51881	45.87.1.166	192.168.2.16
May 6, 2024 04:57:22.784702063 CEST	51881	21	192.168.2.16	45.87.1.166
May 6, 2024 04:57:22.784868956 CEST	52070	21	192.168.2.16	45.87.1.166
May 6, 2024 04:57:22.789040089 CEST	52032	21	192.168.2.16	187.147.9.26
May 6, 2024 04:57:22.789041996 CEST	51907	2121	192.168.2.16	78.43.179.14
May 6, 2024 04:57:22.789050102 CEST	51905	2121	192.168.2.16	179.125.223.180
May 6, 2024 04:57:22.789058924 CEST	51906	21	192.168.2.16	78.43.179.14
May 6, 2024 04:57:22.789280891 CEST	52071	21	192.168.2.16	182.16.189.156
May 6, 2024 04:57:22.796545029 CEST	21	52055	193.124.183.222	192.168.2.16
May 6, 2024 04:57:22.796700001 CEST	52055	21	192.168.2.16	193.124.183.222
May 6, 2024 04:57:22.803335905 CEST	21	51957	175.153.71.38	192.168.2.16
May 6, 2024 04:57:22.804590940 CEST	2121	51958	175.153.71.38	192.168.2.16
May 6, 2024 04:57:22.805032969 CEST	52034	21	192.168.2.16	189.141.9.254
May 6, 2024 04:57:22.805047989 CEST	52033	2121	192.168.2.16	187.147.9.26
May 6, 2024 04:57:22.811439991 CEST	2121	51984	192.34.211.79	192.168.2.16
May 6, 2024 04:57:22.813242912 CEST	21	51983	192.34.211.79	192.168.2.16
May 6, 2024 04:57:22.821029902 CEST	51908	21	192.168.2.16	109.236.45.102
May 6, 2024 04:57:22.821042061 CEST	52035	2121	192.168.2.16	189.141.9.254
May 6, 2024 04:57:22.821046114 CEST	52049	2121	192.168.2.16	118.59.230.75
May 6, 2024 04:57:22.821582079 CEST	21	52064	34.128.145.40	192.168.2.16
May 6, 2024 04:57:22.821635962 CEST	52064	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:22.821690083 CEST	52064	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:22.821839094 CEST	52072	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:22.824039936 CEST	2121	51891	151.14.60.6	192.168.2.16
May 6, 2024 04:57:22.836880922 CEST	2121	52065	34.128.145.40	192.168.2.16
May 6, 2024 04:57:22.836944103 CEST	52065	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:22.837019920 CEST	51909	2121	192.168.2.16	109.236.45.102
May 6, 2024 04:57:22.837069988 CEST	52065	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:22.837403059 CEST	52073	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:22.837414980 CEST	52074	2121	192.168.2.16	182.16.189.156
May 6, 2024 04:57:22.848752975 CEST	21	52031	101.43.249.26	192.168.2.16
May 6, 2024 04:57:22.848892927 CEST	52031	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:22.849104881 CEST	52075	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:22.853028059 CEST	51910	21	192.168.2.16	23.73.111.158
May 6, 2024 04:57:22.853040934 CEST	51981	21	192.168.2.16	210.204.200.190
May 6, 2024 04:57:22.853044987 CEST	51982	2121	192.168.2.16	210.204.200.190
May 6, 2024 04:57:22.859530926 CEST	21	52068	200.11.111.246	192.168.2.16
May 6, 2024 04:57:22.866792917 CEST	21	52042	49.13.32.58	192.168.2.16
May 6, 2024 04:57:22.866864920 CEST	2121	52041	49.13.32.58	192.168.2.16
May 6, 2024 04:57:22.869035006 CEST	52037	2121	192.168.2.16	102.155.18.82
May 6, 2024 04:57:22.869065046 CEST	51912	21	192.168.2.16	23.243.238.213
May 6, 2024 04:57:22.869065046 CEST	52036	21	192.168.2.16	102.155.18.82
May 6, 2024 04:57:22.869066954 CEST	51926	21	192.168.2.16	153.251.251.201
May 6, 2024 04:57:22.869880915 CEST	51911	2121	192.168.2.16	23.73.111.158
May 6, 2024 04:57:22.869931936 CEST	52038	21	192.168.2.16	107.171.141.238
May 6, 2024 04:57:22.885031939 CEST	52039	2121	192.168.2.16	107.171.141.238
May 6, 2024 04:57:22.885032892 CEST	51927	2121	192.168.2.16	153.251.251.201
May 6, 2024 04:57:22.889817953 CEST	21	52047	87.106.26.129	192.168.2.16
May 6, 2024 04:57:22.889946938 CEST	52047	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:22.890197992 CEST	52076	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:22.891756058 CEST	2121	52069	200.11.111.246	192.168.2.16
May 6, 2024 04:57:22.901040077 CEST	51914	2121	192.168.2.16	23.243.238.213
May 6, 2024 04:57:22.917046070 CEST	52040	21	192.168.2.16	189.25.98.198
May 6, 2024 04:57:22.931296110 CEST	21	52064	34.128.145.40	192.168.2.16
May 6, 2024 04:57:22.931500912 CEST	21	52072	34.128.145.40	192.168.2.16
May 6, 2024 04:57:22.931560040 CEST	52072	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:22.933026075 CEST	52059	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:22.933027983 CEST	52043	2121	192.168.2.16	189.25.98.198
May 6, 2024 04:57:22.939878941 CEST	21	51979	154.210.32.21	192.168.2.16
May 6, 2024 04:57:22.946141005 CEST	21	52063	154.210.32.21	192.168.2.16
May 6, 2024 04:57:22.946214914 CEST	52063	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:22.946599960 CEST	2121	52073	34.128.145.40	192.168.2.16
May 6, 2024 04:57:22.946651936 CEST	52073	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:22.947442055 CEST	2121	52065	34.128.145.40	192.168.2.16
May 6, 2024 04:57:22.963325024 CEST	21	52050	116.202.215.231	192.168.2.16
May 6, 2024 04:57:22.965116024 CEST	51918	21	192.168.2.16	188.244.99.55
May 6, 2024 04:57:22.986604929 CEST	2121	51893	124.47.102.1	192.168.2.16
May 6, 2024 04:57:22.997425079 CEST	52077	21	192.168.2.16	202.168.242.122
May 6, 2024 04:57:23.007443905 CEST	21	52070	45.87.1.166	192.168.2.16
May 6, 2024 04:57:23.007519007 CEST	52070	21	192.168.2.16	45.87.1.166
May 6, 2024 04:57:23.010183096 CEST	21	51881	45.87.1.166	192.168.2.16
May 6, 2024 04:57:23.010245085 CEST	51881	21	192.168.2.16	45.87.1.166
May 6, 2024 04:57:23.013165951 CEST	21	52044	149.154.65.23	192.168.2.16
May 6, 2024 04:57:23.013293982 CEST	52044	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:23.013411045 CEST	21	51932	181.231.57.173	192.168.2.16
May 6, 2024 04:57:23.013499975 CEST	52078	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:23.020683050 CEST	2121	51934	181.231.57.173	192.168.2.16
May 6, 2024 04:57:23.030124903 CEST	21	51892	124.47.102.1	192.168.2.16
May 6, 2024 04:57:23.041656017 CEST	21	52072	34.128.145.40	192.168.2.16
May 6, 2024 04:57:23.041750908 CEST	52072	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:23.041750908 CEST	52072	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:23.041876078 CEST	52079	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:23.042577028 CEST	21	52059	34.128.145.40	192.168.2.16
May 6, 2024 04:57:23.045047998 CEST	52051	2121	192.168.2.16	116.202.215.231
May 6, 2024 04:57:23.045372009 CEST	52080	2121	192.168.2.16	202.168.242.122
May 6, 2024 04:57:23.045465946 CEST	52081	21	192.168.2.16	75.65.200.31
May 6, 2024 04:57:23.056643009 CEST	2121	52073	34.128.145.40	192.168.2.16
May 6, 2024 04:57:23.056691885 CEST	52073	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:23.056751966 CEST	52073	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:23.056917906 CEST	52082	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:23.061043024 CEST	52057	21	192.168.2.16	220.94.189.29
May 6, 2024 04:57:23.067898035 CEST	21	52055	193.124.183.222	192.168.2.16
May 6, 2024 04:57:23.067994118 CEST	21	52055	193.124.183.222	192.168.2.16
May 6, 2024 04:57:23.068147898 CEST	52055	21	192.168.2.16	193.124.183.222
May 6, 2024 04:57:23.072418928 CEST	21	52045	118.59.230.75	192.168.2.16
May 6, 2024 04:57:23.077058077 CEST	52058	2121	192.168.2.16	220.94.189.29
May 6, 2024 04:57:23.077742100 CEST	52083	2121	192.168.2.16	75.65.200.31
May 6, 2024 04:57:23.077853918 CEST	52084	21	192.168.2.16	153.92.72.21
May 6, 2024 04:57:23.077883959 CEST	52085	2121	192.168.2.16	153.92.72.21
May 6, 2024 04:57:23.077984095 CEST	52086	21	192.168.2.16	73.242.198.212
May 6, 2024 04:57:23.078036070 CEST	52087	2121	192.168.2.16	73.242.198.212
May 6, 2024 04:57:23.080513954 CEST	21	52062	81.88.252.91	192.168.2.16
May 6, 2024 04:57:23.080646038 CEST	52062	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:23.091660023 CEST	21	52012	103.109.6.215	192.168.2.16
May 6, 2024 04:57:23.091799974 CEST	52012	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:23.091917038 CEST	52088	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:23.093024969 CEST	51921	2121	192.168.2.16	188.244.99.55
May 6, 2024 04:57:23.093641996 CEST	52089	21	192.168.2.16	179.96.133.19
May 6, 2024 04:57:23.093766928 CEST	52090	21	192.168.2.16	95.143.29.9
May 6, 2024 04:57:23.093789101 CEST	52091	2121	192.168.2.16	95.143.29.9
May 6, 2024 04:57:23.093882084 CEST	52092	2121	192.168.2.16	179.96.133.19
May 6, 2024 04:57:23.093928099 CEST	52094	2121	192.168.2.16	188.210.30.157
May 6, 2024 04:57:23.093929052 CEST	52093	21	192.168.2.16	188.210.30.157
May 6, 2024 04:57:23.109364033 CEST	52095	21	192.168.2.16	23.205.249.206
May 6, 2024 04:57:23.109394073 CEST	52096	2121	192.168.2.16	23.205.249.206
May 6, 2024 04:57:23.114001989 CEST	21	52076	87.106.26.129	192.168.2.16
May 6, 2024 04:57:23.114072084 CEST	52076	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:23.120141983 CEST	21	52047	87.106.26.129	192.168.2.16
May 6, 2024 04:57:23.120202065 CEST	52047	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:23.125682116 CEST	52097	21	192.168.2.16	59.11.131.181
May 6, 2024 04:57:23.125710011 CEST	52098	2121	192.168.2.16	59.11.131.181
May 6, 2024 04:57:23.125788927 CEST	52099	21	192.168.2.16	218.39.247.8
May 6, 2024 04:57:23.126182079 CEST	52100	2121	192.168.2.16	218.39.247.8
May 6, 2024 04:57:23.126317978 CEST	52101	21	192.168.2.16	113.226.98.39
May 6, 2024 04:57:23.126427889 CEST	52102	2121	192.168.2.16	113.226.98.39
May 6, 2024 04:57:23.135709047 CEST	2121	52049	118.59.230.75	192.168.2.16
May 6, 2024 04:57:23.141041040 CEST	51925	21	192.168.2.16	103.28.54.200
May 6, 2024 04:57:23.141078949 CEST	51924	2121	192.168.2.16	103.28.54.200
May 6, 2024 04:57:23.141607046 CEST	52103	2121	192.168.2.16	80.180.145.24
May 6, 2024 04:57:23.141658068 CEST	52104	21	192.168.2.16	80.180.145.24
May 6, 2024 04:57:23.141695976 CEST	52105	21	192.168.2.16	203.248.159.105
May 6, 2024 04:57:23.141710043 CEST	52106	2121	192.168.2.16	203.248.159.105
May 6, 2024 04:57:23.145095110 CEST	21	52071	182.16.189.156	192.168.2.16
May 6, 2024 04:57:23.145155907 CEST	52071	21	192.168.2.16	182.16.189.156
May 6, 2024 04:57:23.151432037 CEST	21	52079	34.128.145.40	192.168.2.16
May 6, 2024 04:57:23.151487112 CEST	52079	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:23.152206898 CEST	21	52072	34.128.145.40	192.168.2.16
May 6, 2024 04:57:23.155273914 CEST	2121	51982	210.204.200.190	192.168.2.16
May 6, 2024 04:57:23.157042980 CEST	51916	21	192.168.2.16	220.73.21.145
May 6, 2024 04:57:23.157381058 CEST	21	51981	210.204.200.190	192.168.2.16
May 6, 2024 04:57:23.166496038 CEST	2121	52082	34.128.145.40	192.168.2.16
May 6, 2024 04:57:23.166553020 CEST	52082	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:23.166794062 CEST	2121	52073	34.128.145.40	192.168.2.16
May 6, 2024 04:57:23.173026085 CEST	52025	21	192.168.2.16	201.48.196.29
May 6, 2024 04:57:23.173027039 CEST	51917	2121	192.168.2.16	220.73.21.145
May 6, 2024 04:57:23.189243078 CEST	52107	21	192.168.2.16	71.9.219.159
May 6, 2024 04:57:23.189260960 CEST	52054	21	192.168.2.16	31.181.24.131
May 6, 2024 04:57:23.196546078 CEST	21	52075	101.43.249.26	192.168.2.16
May 6, 2024 04:57:23.196608067 CEST	52075	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:23.202860117 CEST	2121	52074	182.16.189.156	192.168.2.16
May 6, 2024 04:57:23.202918053 CEST	52074	2121	192.168.2.16	182.16.189.156
May 6, 2024 04:57:23.204046011 CEST	52026	2121	192.168.2.16	201.48.196.29
May 6, 2024 04:57:23.204349041 CEST	52108	2121	192.168.2.16	71.9.219.159
May 6, 2024 04:57:23.204389095 CEST	52109	21	192.168.2.16	121.226.18.169
May 6, 2024 04:57:23.208950043 CEST	21	52031	101.43.249.26	192.168.2.16
May 6, 2024 04:57:23.208961964 CEST	21	51926	153.251.251.201	192.168.2.16
May 6, 2024 04:57:23.209024906 CEST	21	52031	101.43.249.26	192.168.2.16
May 6, 2024 04:57:23.209072113 CEST	52031	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:23.220047951 CEST	51930	21	192.168.2.16	186.4.1.201
May 6, 2024 04:57:23.220089912 CEST	51792	21	192.168.2.16	188.214.156.147
May 6, 2024 04:57:23.220315933 CEST	52110	21	192.168.2.16	188.214.156.147
May 6, 2024 04:57:23.237418890 CEST	2121	51927	153.251.251.201	192.168.2.16
May 6, 2024 04:57:23.237673044 CEST	21	52070	45.87.1.166	192.168.2.16
May 6, 2024 04:57:23.237782001 CEST	52070	21	192.168.2.16	45.87.1.166
May 6, 2024 04:57:23.251043081 CEST	51967	21	192.168.2.16	62.217.99.205
May 6, 2024 04:57:23.251044035 CEST	52056	2121	192.168.2.16	31.181.24.131
May 6, 2024 04:57:23.261034012 CEST	21	52079	34.128.145.40	192.168.2.16
May 6, 2024 04:57:23.261104107 CEST	52079	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:23.261137962 CEST	52079	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:23.261279106 CEST	52111	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:23.267019033 CEST	51968	2121	192.168.2.16	62.217.99.205
May 6, 2024 04:57:23.267146111 CEST	51931	2121	192.168.2.16	186.4.1.201
May 6, 2024 04:57:23.275151014 CEST	21	52078	149.154.65.23	192.168.2.16
May 6, 2024 04:57:23.275223017 CEST	52078	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:23.277920961 CEST	2121	52082	34.128.145.40	192.168.2.16
May 6, 2024 04:57:23.277976990 CEST	52082	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:23.278065920 CEST	52082	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:23.278254986 CEST	52112	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:23.283063889 CEST	21	52044	149.154.65.23	192.168.2.16
May 6, 2024 04:57:23.283114910 CEST	52044	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:23.297864914 CEST	21	52063	154.210.32.21	192.168.2.16
May 6, 2024 04:57:23.297992945 CEST	52063	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:23.299017906 CEST	51933	21	192.168.2.16	52.218.221.252
May 6, 2024 04:57:23.314032078 CEST	51984	2121	192.168.2.16	192.34.211.79
May 6, 2024 04:57:23.314033985 CEST	51958	2121	192.168.2.16	175.153.71.38
May 6, 2024 04:57:23.314034939 CEST	51957	21	192.168.2.16	175.153.71.38
May 6, 2024 04:57:23.315231085 CEST	51983	21	192.168.2.16	192.34.211.79
May 6, 2024 04:57:23.334680080 CEST	2121	52037	102.155.18.82	192.168.2.16
May 6, 2024 04:57:23.335774899 CEST	21	52036	102.155.18.82	192.168.2.16
May 6, 2024 04:57:23.345045090 CEST	51936	2121	192.168.2.16	52.218.221.252
May 6, 2024 04:57:23.352137089 CEST	21	52062	81.88.252.91	192.168.2.16
May 6, 2024 04:57:23.352271080 CEST	52062	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:23.361037016 CEST	51937	21	192.168.2.16	183.134.230.186
May 6, 2024 04:57:23.361038923 CEST	52068	21	192.168.2.16	200.11.111.246
May 6, 2024 04:57:23.361041069 CEST	51938	2121	192.168.2.16	183.134.230.186
May 6, 2024 04:57:23.361226082 CEST	52113	2121	192.168.2.16	121.226.18.169
May 6, 2024 04:57:23.361476898 CEST	21	52076	87.106.26.129	192.168.2.16
May 6, 2024 04:57:23.361623049 CEST	52076	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:23.366451979 CEST	21	52057	220.94.189.29	192.168.2.16
May 6, 2024 04:57:23.367587090 CEST	21	52077	202.168.242.122	192.168.2.16
May 6, 2024 04:57:23.367650986 CEST	52077	21	192.168.2.16	202.168.242.122
May 6, 2024 04:57:23.370536089 CEST	21	52111	34.128.145.40	192.168.2.16
May 6, 2024 04:57:23.370596886 CEST	52111	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:23.377024889 CEST	51939	21	192.168.2.16	188.82.83.201
May 6, 2024 04:57:23.377039909 CEST	52041	2121	192.168.2.16	49.13.32.58
May 6, 2024 04:57:23.377295017 CEST	52042	21	192.168.2.16	49.13.32.58
May 6, 2024 04:57:23.377408028 CEST	52114	21	192.168.2.16	130.244.25.204
May 6, 2024 04:57:23.382756948 CEST	2121	52058	220.94.189.29	192.168.2.16
May 6, 2024 04:57:23.382783890 CEST	21	52055	193.124.183.222	192.168.2.16
May 6, 2024 04:57:23.387960911 CEST	2121	52082	34.128.145.40	192.168.2.16
May 6, 2024 04:57:23.388163090 CEST	2121	52112	34.128.145.40	192.168.2.16
May 6, 2024 04:57:23.388225079 CEST	52112	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:23.393059969 CEST	51940	2121	192.168.2.16	188.82.83.201
May 6, 2024 04:57:23.393064022 CEST	52069	2121	192.168.2.16	200.11.111.246
May 6, 2024 04:57:23.408931017 CEST	21	52025	201.48.196.29	192.168.2.16
May 6, 2024 04:57:23.409558058 CEST	52115	2121	192.168.2.16	130.244.25.204
May 6, 2024 04:57:23.409584045 CEST	52116	21	192.168.2.16	91.248.29.24
May 6, 2024 04:57:23.425041914 CEST	51942	21	192.168.2.16	166.248.168.241
May 6, 2024 04:57:23.425318003 CEST	52117	2121	192.168.2.16	91.248.29.24
May 6, 2024 04:57:23.426414967 CEST	2121	52098	59.11.131.181	192.168.2.16
May 6, 2024 04:57:23.428392887 CEST	21	52097	59.11.131.181	192.168.2.16
May 6, 2024 04:57:23.432104111 CEST	2121	52080	202.168.242.122	192.168.2.16
May 6, 2024 04:57:23.437984943 CEST	2121	52100	218.39.247.8	192.168.2.16
May 6, 2024 04:57:23.439553976 CEST	2121	52026	201.48.196.29	192.168.2.16
May 6, 2024 04:57:23.441036940 CEST	52061	21	192.168.2.16	216.117.162.236
May 6, 2024 04:57:23.441365957 CEST	52118	21	192.168.2.16	118.70.87.27
May 6, 2024 04:57:23.443022013 CEST	21	52099	218.39.247.8	192.168.2.16
May 6, 2024 04:57:23.444653988 CEST	21	52088	103.109.6.215	192.168.2.16
May 6, 2024 04:57:23.444720984 CEST	52088	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:23.455207109 CEST	21	51916	220.73.21.145	192.168.2.16
May 6, 2024 04:57:23.460722923 CEST	21	52070	45.87.1.166	192.168.2.16
May 6, 2024 04:57:23.460733891 CEST	2121	52106	203.248.159.105	192.168.2.16
May 6, 2024 04:57:23.460871935 CEST	21	52070	45.87.1.166	192.168.2.16
May 6, 2024 04:57:23.461018085 CEST	52070	21	192.168.2.16	45.87.1.166
May 6, 2024 04:57:23.461815119 CEST	21	52012	103.109.6.215	192.168.2.16
May 6, 2024 04:57:23.461824894 CEST	21	52012	103.109.6.215	192.168.2.16
May 6, 2024 04:57:23.461873055 CEST	52012	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:23.469793081 CEST	21	52110	188.214.156.147	192.168.2.16
May 6, 2024 04:57:23.469861984 CEST	52110	21	192.168.2.16	188.214.156.147
May 6, 2024 04:57:23.473047972 CEST	52050	21	192.168.2.16	116.202.215.231
May 6, 2024 04:57:23.473541021 CEST	52119	2121	192.168.2.16	118.70.87.27
May 6, 2024 04:57:23.473541975 CEST	52120	21	192.168.2.16	118.53.253.160
May 6, 2024 04:57:23.474508047 CEST	2121	51917	220.73.21.145	192.168.2.16
May 6, 2024 04:57:23.474833012 CEST	52121	2121	192.168.2.16	118.53.253.160
May 6, 2024 04:57:23.480429888 CEST	21	52111	34.128.145.40	192.168.2.16
May 6, 2024 04:57:23.480485916 CEST	52111	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:23.480576038 CEST	52111	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:23.480775118 CEST	52122	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:23.494745016 CEST	2121	51984	192.34.211.79	192.168.2.16
May 6, 2024 04:57:23.497889996 CEST	21	51983	192.34.211.79	192.168.2.16
May 6, 2024 04:57:23.499747038 CEST	2121	52112	34.128.145.40	192.168.2.16
May 6, 2024 04:57:23.499809980 CEST	52112	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:23.499867916 CEST	52112	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:23.500041008 CEST	52123	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:23.502278090 CEST	21	51792	188.214.156.147	192.168.2.16
May 6, 2024 04:57:23.504069090 CEST	51944	2121	192.168.2.16	166.248.168.241
May 6, 2024 04:57:23.504125118 CEST	51945	21	192.168.2.16	5.68.83.14
May 6, 2024 04:57:23.519043922 CEST	51946	2121	192.168.2.16	5.68.83.14
May 6, 2024 04:57:23.519171000 CEST	51932	21	192.168.2.16	181.231.57.173
May 6, 2024 04:57:23.519186974 CEST	21	51967	62.217.99.205	192.168.2.16
May 6, 2024 04:57:23.519676924 CEST	52124	21	192.168.2.16	84.158.60.128
May 6, 2024 04:57:23.519771099 CEST	52125	2121	192.168.2.16	84.158.60.128
May 6, 2024 04:57:23.535031080 CEST	51947	21	192.168.2.16	185.140.5.58
May 6, 2024 04:57:23.535054922 CEST	51948	2121	192.168.2.16	185.140.5.58
May 6, 2024 04:57:23.535288095 CEST	51934	2121	192.168.2.16	181.231.57.173
May 6, 2024 04:57:23.535381079 CEST	52126	21	192.168.2.16	80.232.240.247
May 6, 2024 04:57:23.535546064 CEST	2121	51968	62.217.99.205	192.168.2.16
May 6, 2024 04:57:23.540438890 CEST	21	52078	149.154.65.23	192.168.2.16
May 6, 2024 04:57:23.540599108 CEST	52078	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:23.543823004 CEST	21	52075	101.43.249.26	192.168.2.16
May 6, 2024 04:57:23.543982983 CEST	52075	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:23.551024914 CEST	51949	21	192.168.2.16	50.244.117.45
May 6, 2024 04:57:23.558290958 CEST	21	52068	200.11.111.246	192.168.2.16
May 6, 2024 04:57:23.567284107 CEST	52127	2121	192.168.2.16	80.232.240.247
May 6, 2024 04:57:23.573000908 CEST	2121	51995	168.220.94.137	192.168.2.16
May 6, 2024 04:57:23.573014975 CEST	21	51996	168.220.94.137	192.168.2.16
May 6, 2024 04:57:23.573054075 CEST	51995	2121	192.168.2.16	168.220.94.137
May 6, 2024 04:57:23.573074102 CEST	51996	21	192.168.2.16	168.220.94.137
May 6, 2024 04:57:23.583048105 CEST	51950	2121	192.168.2.16	50.244.117.45
May 6, 2024 04:57:23.585361004 CEST	21	52076	87.106.26.129	192.168.2.16
May 6, 2024 04:57:23.585568905 CEST	21	52076	87.106.26.129	192.168.2.16
May 6, 2024 04:57:23.585722923 CEST	52076	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:23.586020947 CEST	52045	21	192.168.2.16	118.59.230.75
May 6, 2024 04:57:23.586035967 CEST	52079	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:23.589755058 CEST	21	52111	34.128.145.40	192.168.2.16
May 6, 2024 04:57:23.589931011 CEST	2121	52069	200.11.111.246	192.168.2.16
May 6, 2024 04:57:23.590089083 CEST	21	52122	34.128.145.40	192.168.2.16
May 6, 2024 04:57:23.590150118 CEST	52122	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:23.597906113 CEST	2121	52041	49.13.32.58	192.168.2.16
May 6, 2024 04:57:23.597917080 CEST	21	52042	49.13.32.58	192.168.2.16
May 6, 2024 04:57:23.599046946 CEST	51951	21	192.168.2.16	68.149.222.5
May 6, 2024 04:57:23.599050999 CEST	51952	2121	192.168.2.16	68.149.222.5
May 6, 2024 04:57:23.605762959 CEST	21	52114	130.244.25.204	192.168.2.16
May 6, 2024 04:57:23.609438896 CEST	2121	52112	34.128.145.40	192.168.2.16
May 6, 2024 04:57:23.609658957 CEST	2121	52123	34.128.145.40	192.168.2.16
May 6, 2024 04:57:23.609709024 CEST	52123	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:23.627453089 CEST	21	52062	81.88.252.91	192.168.2.16
May 6, 2024 04:57:23.627470016 CEST	21	52062	81.88.252.91	192.168.2.16
May 6, 2024 04:57:23.627751112 CEST	52128	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:23.631504059 CEST	52129	21	192.168.2.16	115.9.253.163
May 6, 2024 04:57:23.644208908 CEST	2121	52115	130.244.25.204	192.168.2.16
May 6, 2024 04:57:23.646064997 CEST	51954	2121	192.168.2.16	83.37.116.59
May 6, 2024 04:57:23.646066904 CEST	52067	2121	192.168.2.16	178.185.67.94
May 6, 2024 04:57:23.646126986 CEST	52049	2121	192.168.2.16	118.59.230.75
May 6, 2024 04:57:23.646128893 CEST	52066	21	192.168.2.16	178.185.67.94
May 6, 2024 04:57:23.646321058 CEST	52130	2121	192.168.2.16	115.9.253.163
May 6, 2024 04:57:23.646327019 CEST	51953	21	192.168.2.16	83.37.116.59
May 6, 2024 04:57:23.647428036 CEST	21	52063	154.210.32.21	192.168.2.16
May 6, 2024 04:57:23.647532940 CEST	21	52063	154.210.32.21	192.168.2.16
May 6, 2024 04:57:23.647641897 CEST	52063	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:23.662044048 CEST	51981	21	192.168.2.16	210.204.200.190
May 6, 2024 04:57:23.662045002 CEST	51982	2121	192.168.2.16	210.204.200.190
May 6, 2024 04:57:23.669015884 CEST	21	51705	168.220.94.137	192.168.2.16
May 6, 2024 04:57:23.669030905 CEST	2121	51706	168.220.94.137	192.168.2.16
May 6, 2024 04:57:23.669075012 CEST	51705	21	192.168.2.16	168.220.94.137
May 6, 2024 04:57:23.669099092 CEST	51706	2121	192.168.2.16	168.220.94.137
May 6, 2024 04:57:23.671700954 CEST	2121	51958	175.153.71.38	192.168.2.16
May 6, 2024 04:57:23.691245079 CEST	21	51957	175.153.71.38	192.168.2.16
May 6, 2024 04:57:23.692014933 CEST	2121	52113	121.226.18.169	192.168.2.16
May 6, 2024 04:57:23.695401907 CEST	21	52050	116.202.215.231	192.168.2.16
May 6, 2024 04:57:23.695621014 CEST	21	52079	34.128.145.40	192.168.2.16
May 6, 2024 04:57:23.699501038 CEST	21	52122	34.128.145.40	192.168.2.16
May 6, 2024 04:57:23.699558020 CEST	52122	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:23.699594975 CEST	52122	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:23.699728012 CEST	52131	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:23.710047007 CEST	51926	21	192.168.2.16	153.251.251.201
May 6, 2024 04:57:23.710344076 CEST	52132	21	192.168.2.16	101.249.43.16
May 6, 2024 04:57:23.710427046 CEST	52133	2121	192.168.2.16	101.249.43.16
May 6, 2024 04:57:23.719403028 CEST	2121	52123	34.128.145.40	192.168.2.16
May 6, 2024 04:57:23.719458103 CEST	52123	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:23.719505072 CEST	52123	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:23.719646931 CEST	52134	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:23.720427990 CEST	21	52110	188.214.156.147	192.168.2.16
May 6, 2024 04:57:23.720602989 CEST	52110	21	192.168.2.16	188.214.156.147
May 6, 2024 04:57:23.728218079 CEST	21	52070	45.87.1.166	192.168.2.16
May 6, 2024 04:57:23.737519026 CEST	21	52077	202.168.242.122	192.168.2.16
May 6, 2024 04:57:23.737575054 CEST	52077	21	192.168.2.16	202.168.242.122
May 6, 2024 04:57:23.737631083 CEST	52077	21	192.168.2.16	202.168.242.122
May 6, 2024 04:57:23.737667084 CEST	52077	21	192.168.2.16	202.168.242.122
May 6, 2024 04:57:23.737876892 CEST	52135	21	192.168.2.16	121.129.13.128
May 6, 2024 04:57:23.741029978 CEST	51927	2121	192.168.2.16	153.251.251.201
May 6, 2024 04:57:23.741399050 CEST	52136	2121	192.168.2.16	121.129.13.128
May 6, 2024 04:57:23.773286104 CEST	52137	21	192.168.2.16	122.38.205.196
May 6, 2024 04:57:23.785595894 CEST	2121	52121	118.53.253.160	192.168.2.16
May 6, 2024 04:57:23.787646055 CEST	21	52120	118.53.253.160	192.168.2.16
May 6, 2024 04:57:23.796670914 CEST	21	52088	103.109.6.215	192.168.2.16
May 6, 2024 04:57:23.796803951 CEST	52088	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:23.801796913 CEST	21	52071	182.16.189.156	192.168.2.16
May 6, 2024 04:57:23.801877022 CEST	52071	21	192.168.2.16	182.16.189.156
May 6, 2024 04:57:23.802054882 CEST	52138	2121	192.168.2.16	122.38.205.196
May 6, 2024 04:57:23.802351952 CEST	21	52078	149.154.65.23	192.168.2.16
May 6, 2024 04:57:23.802731991 CEST	21	52078	149.154.65.23	192.168.2.16
May 6, 2024 04:57:23.802850008 CEST	52078	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:23.805052996 CEST	51962	21	192.168.2.16	47.94.164.39
May 6, 2024 04:57:23.809601068 CEST	21	52122	34.128.145.40	192.168.2.16
May 6, 2024 04:57:23.810055017 CEST	21	52131	34.128.145.40	192.168.2.16
May 6, 2024 04:57:23.810128927 CEST	52131	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:23.810513020 CEST	21	52076	87.106.26.129	192.168.2.16
May 6, 2024 04:57:23.810647964 CEST	52076	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:23.810868025 CEST	52139	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:23.812906027 CEST	2121	52074	182.16.189.156	192.168.2.16
May 6, 2024 04:57:23.813196898 CEST	52140	21	192.168.2.16	1.183.194.91
May 6, 2024 04:57:23.829838037 CEST	2121	52134	34.128.145.40	192.168.2.16
May 6, 2024 04:57:23.829849005 CEST	2121	52123	34.128.145.40	192.168.2.16
May 6, 2024 04:57:23.829921007 CEST	52134	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:23.837030888 CEST	52037	2121	192.168.2.16	102.155.18.82
May 6, 2024 04:57:23.837054014 CEST	52036	21	192.168.2.16	102.155.18.82
May 6, 2024 04:57:23.852499962 CEST	52141	2121	192.168.2.16	1.183.194.91
May 6, 2024 04:57:23.868060112 CEST	51965	2121	192.168.2.16	47.94.164.39
May 6, 2024 04:57:23.868061066 CEST	52057	21	192.168.2.16	220.94.189.29
May 6, 2024 04:57:23.868241072 CEST	52142	21	192.168.2.16	181.33.195.52
May 6, 2024 04:57:23.890968084 CEST	21	52075	101.43.249.26	192.168.2.16
May 6, 2024 04:57:23.891109943 CEST	52075	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:23.891315937 CEST	52143	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:23.896929979 CEST	21	52128	81.88.252.91	192.168.2.16
May 6, 2024 04:57:23.897000074 CEST	52128	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:23.898045063 CEST	52058	2121	192.168.2.16	220.94.189.29
May 6, 2024 04:57:23.901504040 CEST	21	52045	118.59.230.75	192.168.2.16
May 6, 2024 04:57:23.909022093 CEST	52025	21	192.168.2.16	201.48.196.29
May 6, 2024 04:57:23.923270941 CEST	21	52131	34.128.145.40	192.168.2.16
May 6, 2024 04:57:23.923324108 CEST	52131	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:23.923377991 CEST	52131	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:23.923516989 CEST	52144	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:23.930042982 CEST	52097	21	192.168.2.16	59.11.131.181
May 6, 2024 04:57:23.930701971 CEST	52098	2121	192.168.2.16	59.11.131.181
May 6, 2024 04:57:23.939428091 CEST	2121	52134	34.128.145.40	192.168.2.16
May 6, 2024 04:57:23.939486980 CEST	52134	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:23.939526081 CEST	52134	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:23.939650059 CEST	52145	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:23.942456007 CEST	21	52129	115.9.253.163	192.168.2.16
May 6, 2024 04:57:23.945024014 CEST	52026	2121	192.168.2.16	201.48.196.29
May 6, 2024 04:57:23.945036888 CEST	52080	2121	192.168.2.16	202.168.242.122
May 6, 2024 04:57:23.945038080 CEST	52100	2121	192.168.2.16	218.39.247.8
May 6, 2024 04:57:23.945048094 CEST	52099	21	192.168.2.16	218.39.247.8
May 6, 2024 04:57:23.945410967 CEST	52146	2121	192.168.2.16	181.33.195.52
May 6, 2024 04:57:23.945483923 CEST	52147	21	192.168.2.16	49.63.99.86
May 6, 2024 04:57:23.953880072 CEST	2121	52130	115.9.253.163	192.168.2.16
May 6, 2024 04:57:23.960661888 CEST	2121	52049	118.59.230.75	192.168.2.16
May 6, 2024 04:57:23.961092949 CEST	52106	2121	192.168.2.16	203.248.159.105
May 6, 2024 04:57:23.961397886 CEST	52148	2121	192.168.2.16	49.63.99.86
May 6, 2024 04:57:23.964272976 CEST	2121	51982	210.204.200.190	192.168.2.16
May 6, 2024 04:57:23.967371941 CEST	21	51981	210.204.200.190	192.168.2.16
May 6, 2024 04:57:23.969183922 CEST	21	52110	188.214.156.147	192.168.2.16
May 6, 2024 04:57:23.969327927 CEST	21	52110	188.214.156.147	192.168.2.16
May 6, 2024 04:57:23.969527960 CEST	52110	21	192.168.2.16	188.214.156.147
May 6, 2024 04:57:23.977261066 CEST	52149	21	192.168.2.16	15.160.40.54
May 6, 2024 04:57:24.006719112 CEST	21	51932	181.231.57.173	192.168.2.16
May 6, 2024 04:57:24.009030104 CEST	51984	2121	192.168.2.16	192.34.211.79
May 6, 2024 04:57:24.011245012 CEST	51983	21	192.168.2.16	192.34.211.79
May 6, 2024 04:57:24.012250900 CEST	21	52063	154.210.32.21	192.168.2.16
May 6, 2024 04:57:24.012378931 CEST	52063	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:24.012535095 CEST	52150	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:24.012984991 CEST	21	52063	154.210.32.21	192.168.2.16
May 6, 2024 04:57:24.013060093 CEST	52063	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:24.014019966 CEST	2121	51934	181.231.57.173	192.168.2.16
May 6, 2024 04:57:24.024022102 CEST	51967	21	192.168.2.16	62.217.99.205
May 6, 2024 04:57:24.024049044 CEST	51969	21	192.168.2.16	64.252.171.95
May 6, 2024 04:57:24.032727957 CEST	21	52144	34.128.145.40	192.168.2.16
May 6, 2024 04:57:24.032793045 CEST	52144	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:24.032830000 CEST	21	52131	34.128.145.40	192.168.2.16
May 6, 2024 04:57:24.036364079 CEST	21	52076	87.106.26.129	192.168.2.16
May 6, 2024 04:57:24.036415100 CEST	52076	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:24.039081097 CEST	21	52139	87.106.26.129	192.168.2.16
May 6, 2024 04:57:24.039135933 CEST	52139	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:24.040046930 CEST	51968	2121	192.168.2.16	62.217.99.205
May 6, 2024 04:57:24.048372984 CEST	21	51926	153.251.251.201	192.168.2.16
May 6, 2024 04:57:24.048955917 CEST	2121	52134	34.128.145.40	192.168.2.16
May 6, 2024 04:57:24.049202919 CEST	2121	52145	34.128.145.40	192.168.2.16
May 6, 2024 04:57:24.049258947 CEST	52145	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:24.049582958 CEST	21	52135	121.129.13.128	192.168.2.16
May 6, 2024 04:57:24.051126003 CEST	2121	52136	121.129.13.128	192.168.2.16
May 6, 2024 04:57:24.056037903 CEST	52081	21	192.168.2.16	75.65.200.31
May 6, 2024 04:57:24.065450907 CEST	21	52078	149.154.65.23	192.168.2.16
May 6, 2024 04:57:24.065593004 CEST	52078	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:24.065782070 CEST	52151	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:24.072042942 CEST	52068	21	192.168.2.16	200.11.111.246
May 6, 2024 04:57:24.072321892 CEST	52152	2121	192.168.2.16	15.160.40.54
May 6, 2024 04:57:24.083440065 CEST	2121	51927	153.251.251.201	192.168.2.16
May 6, 2024 04:57:24.088027000 CEST	52084	21	192.168.2.16	153.92.72.21
May 6, 2024 04:57:24.088083029 CEST	52085	2121	192.168.2.16	153.92.72.21
May 6, 2024 04:57:24.088083982 CEST	51972	2121	192.168.2.16	64.252.171.95
May 6, 2024 04:57:24.088083982 CEST	52086	21	192.168.2.16	73.242.198.212
May 6, 2024 04:57:24.088083982 CEST	52083	2121	192.168.2.16	75.65.200.31
May 6, 2024 04:57:24.088084936 CEST	52087	2121	192.168.2.16	73.242.198.212
May 6, 2024 04:57:24.088083982 CEST	51975	2121	192.168.2.16	93.5.142.81
May 6, 2024 04:57:24.088084936 CEST	51974	21	192.168.2.16	93.5.142.81
May 6, 2024 04:57:24.104022026 CEST	52091	2121	192.168.2.16	95.143.29.9
May 6, 2024 04:57:24.104039907 CEST	52089	21	192.168.2.16	179.96.133.19
May 6, 2024 04:57:24.104041100 CEST	52069	2121	192.168.2.16	200.11.111.246
May 6, 2024 04:57:24.104058027 CEST	52041	2121	192.168.2.16	49.13.32.58
May 6, 2024 04:57:24.104058981 CEST	52090	21	192.168.2.16	95.143.29.9
May 6, 2024 04:57:24.104060888 CEST	52092	2121	192.168.2.16	179.96.133.19
May 6, 2024 04:57:24.104062080 CEST	52093	21	192.168.2.16	188.210.30.157
May 6, 2024 04:57:24.104062080 CEST	52094	2121	192.168.2.16	188.210.30.157
May 6, 2024 04:57:24.104075909 CEST	52042	21	192.168.2.16	49.13.32.58
May 6, 2024 04:57:24.104381084 CEST	52153	21	192.168.2.16	175.155.183.127
May 6, 2024 04:57:24.107609034 CEST	21	52077	202.168.242.122	192.168.2.16
May 6, 2024 04:57:24.107656002 CEST	21	52077	202.168.242.122	192.168.2.16
May 6, 2024 04:57:24.120049953 CEST	52114	21	192.168.2.16	130.244.25.204
May 6, 2024 04:57:24.120054960 CEST	52095	21	192.168.2.16	23.205.249.206
May 6, 2024 04:57:24.120054960 CEST	51976	21	192.168.2.16	40.74.94.47
May 6, 2024 04:57:24.124010086 CEST	52096	2121	192.168.2.16	23.205.249.206
May 6, 2024 04:57:24.136037111 CEST	52101	21	192.168.2.16	113.226.98.39
May 6, 2024 04:57:24.136063099 CEST	52102	2121	192.168.2.16	113.226.98.39
May 6, 2024 04:57:24.141715050 CEST	21	51792	188.214.156.147	192.168.2.16
May 6, 2024 04:57:24.141768932 CEST	51792	21	192.168.2.16	188.214.156.147
May 6, 2024 04:57:24.141897917 CEST	21	51792	188.214.156.147	192.168.2.16
May 6, 2024 04:57:24.141942978 CEST	51792	21	192.168.2.16	188.214.156.147
May 6, 2024 04:57:24.142333984 CEST	21	52144	34.128.145.40	192.168.2.16
May 6, 2024 04:57:24.142388105 CEST	52144	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:24.142441988 CEST	52144	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:24.142587900 CEST	52154	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:24.143580914 CEST	21	51792	188.214.156.147	192.168.2.16
May 6, 2024 04:57:24.143634081 CEST	51792	21	192.168.2.16	188.214.156.147
May 6, 2024 04:57:24.145005941 CEST	21	52025	201.48.196.29	192.168.2.16
May 6, 2024 04:57:24.147855043 CEST	21	52088	103.109.6.215	192.168.2.16
May 6, 2024 04:57:24.147991896 CEST	52088	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:24.152031898 CEST	52104	21	192.168.2.16	80.180.145.24
May 6, 2024 04:57:24.152033091 CEST	51977	2121	192.168.2.16	40.74.94.47
May 6, 2024 04:57:24.152045012 CEST	52115	2121	192.168.2.16	130.244.25.204
May 6, 2024 04:57:24.152045965 CEST	52103	2121	192.168.2.16	80.180.145.24
May 6, 2024 04:57:24.152046919 CEST	52105	21	192.168.2.16	203.248.159.105
May 6, 2024 04:57:24.157629013 CEST	21	52071	182.16.189.156	192.168.2.16
May 6, 2024 04:57:24.159059048 CEST	2121	52145	34.128.145.40	192.168.2.16
May 6, 2024 04:57:24.159109116 CEST	52145	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:24.159167051 CEST	52145	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:24.159327984 CEST	52155	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:24.173147917 CEST	21	52128	81.88.252.91	192.168.2.16
May 6, 2024 04:57:24.173260927 CEST	21	52057	220.94.189.29	192.168.2.16
May 6, 2024 04:57:24.173271894 CEST	52128	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:24.181058884 CEST	2121	52026	201.48.196.29	192.168.2.16
May 6, 2024 04:57:24.184062958 CEST	51958	2121	192.168.2.16	175.153.71.38
May 6, 2024 04:57:24.189179897 CEST	2121	51984	192.34.211.79	192.168.2.16
May 6, 2024 04:57:24.193111897 CEST	21	51983	192.34.211.79	192.168.2.16
May 6, 2024 04:57:24.200062037 CEST	52107	21	192.168.2.16	71.9.219.159
May 6, 2024 04:57:24.200062037 CEST	52113	2121	192.168.2.16	121.226.18.169
May 6, 2024 04:57:24.200450897 CEST	52050	21	192.168.2.16	116.202.215.231
May 6, 2024 04:57:24.200453043 CEST	51957	21	192.168.2.16	175.153.71.38
May 6, 2024 04:57:24.200577021 CEST	52156	2121	192.168.2.16	175.155.183.127
May 6, 2024 04:57:24.200596094 CEST	52157	21	192.168.2.16	54.192.6.149
May 6, 2024 04:57:24.202224016 CEST	2121	52058	220.94.189.29	192.168.2.16
May 6, 2024 04:57:24.215033054 CEST	51978	21	192.168.2.16	186.190.195.32
May 6, 2024 04:57:24.215033054 CEST	52108	2121	192.168.2.16	71.9.219.159
May 6, 2024 04:57:24.215058088 CEST	52109	21	192.168.2.16	121.226.18.169
May 6, 2024 04:57:24.215533018 CEST	52158	2121	192.168.2.16	54.192.6.149
May 6, 2024 04:57:24.215617895 CEST	52159	21	192.168.2.16	152.79.117.181
May 6, 2024 04:57:24.218158960 CEST	21	52110	188.214.156.147	192.168.2.16
May 6, 2024 04:57:24.231234074 CEST	2121	52098	59.11.131.181	192.168.2.16
May 6, 2024 04:57:24.232136011 CEST	21	52097	59.11.131.181	192.168.2.16
May 6, 2024 04:57:24.238018990 CEST	21	52075	101.43.249.26	192.168.2.16
May 6, 2024 04:57:24.238030910 CEST	21	52075	101.43.249.26	192.168.2.16
May 6, 2024 04:57:24.238168001 CEST	52075	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:24.241230965 CEST	21	52143	101.43.249.26	192.168.2.16
May 6, 2024 04:57:24.241364956 CEST	52143	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:24.247056007 CEST	51980	2121	192.168.2.16	186.190.195.32
May 6, 2024 04:57:24.251588106 CEST	21	52144	34.128.145.40	192.168.2.16
May 6, 2024 04:57:24.252154112 CEST	21	52154	34.128.145.40	192.168.2.16
May 6, 2024 04:57:24.252212048 CEST	52154	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:24.257065058 CEST	2121	52100	218.39.247.8	192.168.2.16
May 6, 2024 04:57:24.261641026 CEST	21	52099	218.39.247.8	192.168.2.16
May 6, 2024 04:57:24.268672943 CEST	2121	52145	34.128.145.40	192.168.2.16
May 6, 2024 04:57:24.268912077 CEST	2121	52155	34.128.145.40	192.168.2.16
May 6, 2024 04:57:24.269069910 CEST	52155	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:24.269112110 CEST	21	52068	200.11.111.246	192.168.2.16
May 6, 2024 04:57:24.279495001 CEST	2121	52106	203.248.159.105	192.168.2.16
May 6, 2024 04:57:24.279573917 CEST	21	52036	102.155.18.82	192.168.2.16
May 6, 2024 04:57:24.284126043 CEST	2121	52037	102.155.18.82	192.168.2.16
May 6, 2024 04:57:24.290911913 CEST	21	52139	87.106.26.129	192.168.2.16
May 6, 2024 04:57:24.291079998 CEST	52139	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:24.292171001 CEST	21	51967	62.217.99.205	192.168.2.16
May 6, 2024 04:57:24.295043945 CEST	52121	2121	192.168.2.16	118.53.253.160
May 6, 2024 04:57:24.295054913 CEST	51986	2121	192.168.2.16	34.133.60.194
May 6, 2024 04:57:24.295135975 CEST	51985	21	192.168.2.16	34.133.60.194
May 6, 2024 04:57:24.295171022 CEST	52120	21	192.168.2.16	118.53.253.160
May 6, 2024 04:57:24.300976038 CEST	2121	52069	200.11.111.246	192.168.2.16
May 6, 2024 04:57:24.308476925 CEST	2121	51968	62.217.99.205	192.168.2.16
May 6, 2024 04:57:24.311031103 CEST	51988	21	192.168.2.16	1.199.40.186
May 6, 2024 04:57:24.311038017 CEST	51989	2121	192.168.2.16	1.199.40.186
May 6, 2024 04:57:24.311233997 CEST	52160	2121	192.168.2.16	152.79.117.181
May 6, 2024 04:57:24.319351912 CEST	21	52151	149.154.65.23	192.168.2.16
May 6, 2024 04:57:24.319422960 CEST	52151	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:24.324897051 CEST	21	52042	49.13.32.58	192.168.2.16
May 6, 2024 04:57:24.324923992 CEST	2121	52041	49.13.32.58	192.168.2.16
May 6, 2024 04:57:24.326952934 CEST	21	52078	149.154.65.23	192.168.2.16
May 6, 2024 04:57:24.327044964 CEST	52078	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:24.327446938 CEST	52161	21	192.168.2.16	134.228.22.143
May 6, 2024 04:57:24.327466965 CEST	52162	2121	192.168.2.16	134.228.22.143
May 6, 2024 04:57:24.331020117 CEST	2121	52080	202.168.242.122	192.168.2.16
May 6, 2024 04:57:24.343060017 CEST	51991	21	192.168.2.16	79.78.95.9
May 6, 2024 04:57:24.343275070 CEST	52163	21	192.168.2.16	71.44.3.82
May 6, 2024 04:57:24.348432064 CEST	21	52114	130.244.25.204	192.168.2.16
May 6, 2024 04:57:24.359030008 CEST	51992	2121	192.168.2.16	79.78.95.9
May 6, 2024 04:57:24.359050989 CEST	51993	21	192.168.2.16	81.71.159.114
May 6, 2024 04:57:24.361870050 CEST	21	52063	154.210.32.21	192.168.2.16
May 6, 2024 04:57:24.361881018 CEST	21	52154	34.128.145.40	192.168.2.16
May 6, 2024 04:57:24.361949921 CEST	52154	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:24.361979008 CEST	52154	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:24.362112045 CEST	52164	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:24.366805077 CEST	21	52150	154.210.32.21	192.168.2.16
May 6, 2024 04:57:24.366873026 CEST	52150	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:24.375056028 CEST	51994	2121	192.168.2.16	81.71.159.114
May 6, 2024 04:57:24.375279903 CEST	52165	2121	192.168.2.16	71.44.3.82
May 6, 2024 04:57:24.378760099 CEST	2121	52155	34.128.145.40	192.168.2.16
May 6, 2024 04:57:24.378809929 CEST	52155	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:24.378860950 CEST	52155	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:24.379017115 CEST	52166	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:24.386744976 CEST	2121	52115	130.244.25.204	192.168.2.16
May 6, 2024 04:57:24.390963078 CEST	21	52159	152.79.117.181	192.168.2.16
May 6, 2024 04:57:24.407042027 CEST	52045	21	192.168.2.16	118.59.230.75
May 6, 2024 04:57:24.407043934 CEST	51997	21	192.168.2.16	49.172.137.53
May 6, 2024 04:57:24.422699928 CEST	21	52050	116.202.215.231	192.168.2.16
May 6, 2024 04:57:24.423023939 CEST	52116	21	192.168.2.16	91.248.29.24
May 6, 2024 04:57:24.424007893 CEST	51999	21	192.168.2.16	80.182.0.114
May 6, 2024 04:57:24.424007893 CEST	51998	2121	192.168.2.16	49.172.137.53
May 6, 2024 04:57:24.439028978 CEST	52117	2121	192.168.2.16	91.248.29.24
May 6, 2024 04:57:24.439083099 CEST	52002	21	192.168.2.16	71.244.204.109
May 6, 2024 04:57:24.441468000 CEST	21	52128	81.88.252.91	192.168.2.16
May 6, 2024 04:57:24.441595078 CEST	52128	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:24.455025911 CEST	52001	2121	192.168.2.16	80.182.0.114
May 6, 2024 04:57:24.455027103 CEST	52129	21	192.168.2.16	115.9.253.163
May 6, 2024 04:57:24.455035925 CEST	52118	21	192.168.2.16	118.70.87.27
May 6, 2024 04:57:24.455040932 CEST	52130	2121	192.168.2.16	115.9.253.163
May 6, 2024 04:57:24.471030951 CEST	52003	2121	192.168.2.16	71.244.204.109
May 6, 2024 04:57:24.471046925 CEST	51981	21	192.168.2.16	210.204.200.190
May 6, 2024 04:57:24.471051931 CEST	51982	2121	192.168.2.16	210.204.200.190
May 6, 2024 04:57:24.471056938 CEST	52049	2121	192.168.2.16	118.59.230.75
May 6, 2024 04:57:24.471545935 CEST	21	52154	34.128.145.40	192.168.2.16
May 6, 2024 04:57:24.472439051 CEST	21	52164	34.128.145.40	192.168.2.16
May 6, 2024 04:57:24.472503901 CEST	52164	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:24.487062931 CEST	52119	2121	192.168.2.16	118.70.87.27
May 6, 2024 04:57:24.487575054 CEST	2121	52160	152.79.117.181	192.168.2.16
May 6, 2024 04:57:24.488398075 CEST	2121	52155	34.128.145.40	192.168.2.16
May 6, 2024 04:57:24.488640070 CEST	2121	52166	34.128.145.40	192.168.2.16
May 6, 2024 04:57:24.488701105 CEST	52166	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:24.492005110 CEST	2121	52165	71.44.3.82	192.168.2.16
May 6, 2024 04:57:24.500762939 CEST	21	52088	103.109.6.215	192.168.2.16
May 6, 2024 04:57:24.500905037 CEST	52088	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:24.501091957 CEST	52167	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:24.503021955 CEST	52004	21	192.168.2.16	218.61.185.100
May 6, 2024 04:57:24.503357887 CEST	52168	21	192.168.2.16	131.226.196.37
May 6, 2024 04:57:24.519047022 CEST	51932	21	192.168.2.16	181.231.57.173
May 6, 2024 04:57:24.519057989 CEST	51934	2121	192.168.2.16	181.231.57.173
May 6, 2024 04:57:24.519057989 CEST	52125	2121	192.168.2.16	84.158.60.128
May 6, 2024 04:57:24.519387007 CEST	21	52139	87.106.26.129	192.168.2.16
May 6, 2024 04:57:24.519617081 CEST	21	52139	87.106.26.129	192.168.2.16
May 6, 2024 04:57:24.519776106 CEST	52139	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:24.531297922 CEST	2121	52113	121.226.18.169	192.168.2.16
May 6, 2024 04:57:24.534034967 CEST	52006	2121	192.168.2.16	218.61.185.100
May 6, 2024 04:57:24.534061909 CEST	52124	21	192.168.2.16	84.158.60.128
May 6, 2024 04:57:24.541531086 CEST	2121	51958	175.153.71.38	192.168.2.16
May 6, 2024 04:57:24.550024986 CEST	52008	21	192.168.2.16	114.238.78.175
May 6, 2024 04:57:24.550055027 CEST	52135	21	192.168.2.16	121.129.13.128
May 6, 2024 04:57:24.551409960 CEST	52126	21	192.168.2.16	80.232.240.247
May 6, 2024 04:57:24.566032887 CEST	52136	2121	192.168.2.16	121.129.13.128
May 6, 2024 04:57:24.566425085 CEST	52169	21	192.168.2.16	152.179.110.81
May 6, 2024 04:57:24.566503048 CEST	52170	2121	192.168.2.16	131.226.196.37
May 6, 2024 04:57:24.577289104 CEST	21	51957	175.153.71.38	192.168.2.16
May 6, 2024 04:57:24.577341080 CEST	21	52151	149.154.65.23	192.168.2.16
May 6, 2024 04:57:24.577471972 CEST	52151	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:24.582027912 CEST	52009	2121	192.168.2.16	114.238.78.175
May 6, 2024 04:57:24.583369970 CEST	21	52164	34.128.145.40	192.168.2.16
May 6, 2024 04:57:24.583420038 CEST	52164	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:24.583465099 CEST	52164	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:24.583622932 CEST	52171	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:24.586030006 CEST	52127	2121	192.168.2.16	80.232.240.247
May 6, 2024 04:57:24.591531992 CEST	21	52143	101.43.249.26	192.168.2.16
May 6, 2024 04:57:24.591675997 CEST	52143	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:24.598037958 CEST	52010	21	192.168.2.16	1.236.228.172
May 6, 2024 04:57:24.598303080 CEST	2121	52166	34.128.145.40	192.168.2.16
May 6, 2024 04:57:24.598351955 CEST	52166	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:24.598398924 CEST	52166	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:24.598457098 CEST	52172	21	192.168.2.16	98.67.131.230
May 6, 2024 04:57:24.598457098 CEST	52173	2121	192.168.2.16	152.179.110.81
May 6, 2024 04:57:24.598541021 CEST	52174	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:24.604635000 CEST	2121	52121	118.53.253.160	192.168.2.16
May 6, 2024 04:57:24.609190941 CEST	21	52120	118.53.253.160	192.168.2.16
May 6, 2024 04:57:24.614026070 CEST	52011	2121	192.168.2.16	1.236.228.172
May 6, 2024 04:57:24.614275932 CEST	52175	2121	192.168.2.16	98.67.131.230
May 6, 2024 04:57:24.637864113 CEST	21	51705	168.220.94.137	192.168.2.16
May 6, 2024 04:57:24.637923002 CEST	51705	21	192.168.2.16	168.220.94.137
May 6, 2024 04:57:24.646049976 CEST	52013	21	192.168.2.16	102.142.31.150
May 6, 2024 04:57:24.646051884 CEST	52018	2121	192.168.2.16	2.176.99.29
May 6, 2024 04:57:24.646053076 CEST	52015	21	192.168.2.16	111.196.40.107
May 6, 2024 04:57:24.646053076 CEST	52014	2121	192.168.2.16	102.142.31.150
May 6, 2024 04:57:24.646053076 CEST	52019	21	192.168.2.16	47.188.96.248
May 6, 2024 04:57:24.648597002 CEST	52016	2121	192.168.2.16	111.196.40.107
May 6, 2024 04:57:24.648597956 CEST	52017	21	192.168.2.16	2.176.99.29
May 6, 2024 04:57:24.648597002 CEST	52025	21	192.168.2.16	201.48.196.29
May 6, 2024 04:57:24.648597956 CEST	52020	2121	192.168.2.16	47.188.96.248
May 6, 2024 04:57:24.651504993 CEST	2121	51706	168.220.94.137	192.168.2.16
May 6, 2024 04:57:24.651549101 CEST	51706	2121	192.168.2.16	168.220.94.137
May 6, 2024 04:57:24.662286043 CEST	52176	21	192.168.2.16	153.154.186.17
May 6, 2024 04:57:24.677031994 CEST	52022	2121	192.168.2.16	73.110.68.240
May 6, 2024 04:57:24.677047968 CEST	52057	21	192.168.2.16	220.94.189.29
May 6, 2024 04:57:24.677048922 CEST	52021	21	192.168.2.16	73.110.68.240
May 6, 2024 04:57:24.693028927 CEST	52023	21	192.168.2.16	187.150.27.66
May 6, 2024 04:57:24.693049908 CEST	21	52164	34.128.145.40	192.168.2.16
May 6, 2024 04:57:24.693056107 CEST	52024	2121	192.168.2.16	187.150.27.66
May 6, 2024 04:57:24.693120003 CEST	52026	2121	192.168.2.16	201.48.196.29
May 6, 2024 04:57:24.693974972 CEST	21	52171	34.128.145.40	192.168.2.16
May 6, 2024 04:57:24.694041014 CEST	52171	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:24.707954884 CEST	2121	52166	34.128.145.40	192.168.2.16
May 6, 2024 04:57:24.708092928 CEST	2121	52174	34.128.145.40	192.168.2.16
May 6, 2024 04:57:24.708156109 CEST	52174	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:24.709048986 CEST	52058	2121	192.168.2.16	220.94.189.29
May 6, 2024 04:57:24.711653948 CEST	21	52128	81.88.252.91	192.168.2.16
May 6, 2024 04:57:24.711666107 CEST	21	52128	81.88.252.91	192.168.2.16
May 6, 2024 04:57:24.711968899 CEST	52177	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:24.722800970 CEST	21	52150	154.210.32.21	192.168.2.16
May 6, 2024 04:57:24.722963095 CEST	52150	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:24.723066092 CEST	21	52045	118.59.230.75	192.168.2.16
May 6, 2024 04:57:24.725035906 CEST	52132	21	192.168.2.16	101.249.43.16
May 6, 2024 04:57:24.725048065 CEST	52133	2121	192.168.2.16	101.249.43.16
May 6, 2024 04:57:24.741046906 CEST	52027	21	192.168.2.16	203.158.39.251
May 6, 2024 04:57:24.741046906 CEST	52098	2121	192.168.2.16	59.11.131.181
May 6, 2024 04:57:24.741049051 CEST	52097	21	192.168.2.16	59.11.131.181
May 6, 2024 04:57:24.748929024 CEST	21	52139	87.106.26.129	192.168.2.16
May 6, 2024 04:57:24.749094009 CEST	52139	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:24.749330997 CEST	52178	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:24.756263018 CEST	52179	2121	192.168.2.16	153.154.186.17
May 6, 2024 04:57:24.763107061 CEST	2121	52130	115.9.253.163	192.168.2.16
May 6, 2024 04:57:24.765248060 CEST	21	52129	115.9.253.163	192.168.2.16
May 6, 2024 04:57:24.772028923 CEST	52099	21	192.168.2.16	218.39.247.8
May 6, 2024 04:57:24.772051096 CEST	52100	2121	192.168.2.16	218.39.247.8
May 6, 2024 04:57:24.772052050 CEST	52068	21	192.168.2.16	200.11.111.246
May 6, 2024 04:57:24.772408009 CEST	52180	21	192.168.2.16	212.116.245.78
May 6, 2024 04:57:24.773046970 CEST	2121	51982	210.204.200.190	192.168.2.16
May 6, 2024 04:57:24.774651051 CEST	21	51981	210.204.200.190	192.168.2.16
May 6, 2024 04:57:24.785007000 CEST	2121	52049	118.59.230.75	192.168.2.16
May 6, 2024 04:57:24.788028955 CEST	52137	21	192.168.2.16	122.38.205.196
May 6, 2024 04:57:24.788053036 CEST	52106	2121	192.168.2.16	203.248.159.105
May 6, 2024 04:57:24.788053989 CEST	52030	2121	192.168.2.16	203.158.39.251
May 6, 2024 04:57:24.788055897 CEST	52036	21	192.168.2.16	102.155.18.82
May 6, 2024 04:57:24.788073063 CEST	52037	2121	192.168.2.16	102.155.18.82
May 6, 2024 04:57:24.788645029 CEST	52181	2121	192.168.2.16	212.116.245.78
May 6, 2024 04:57:24.788738012 CEST	52183	2121	192.168.2.16	181.56.197.98
May 6, 2024 04:57:24.788752079 CEST	52184	21	192.168.2.16	14.215.46.243
May 6, 2024 04:57:24.788754940 CEST	52182	21	192.168.2.16	181.56.197.98
May 6, 2024 04:57:24.788913965 CEST	52185	2121	192.168.2.16	14.215.46.243
May 6, 2024 04:57:24.804037094 CEST	52032	21	192.168.2.16	187.147.9.26
May 6, 2024 04:57:24.804052114 CEST	52069	2121	192.168.2.16	200.11.111.246
May 6, 2024 04:57:24.804157019 CEST	21	52071	182.16.189.156	192.168.2.16
May 6, 2024 04:57:24.804188013 CEST	52138	2121	192.168.2.16	122.38.205.196
May 6, 2024 04:57:24.804207087 CEST	52071	21	192.168.2.16	182.16.189.156
May 6, 2024 04:57:24.804419041 CEST	52186	21	192.168.2.16	139.59.195.201
May 6, 2024 04:57:24.804580927 CEST	21	52171	34.128.145.40	192.168.2.16
May 6, 2024 04:57:24.804637909 CEST	52171	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:24.804687023 CEST	52171	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:24.804827929 CEST	52187	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:24.818634033 CEST	2121	52174	34.128.145.40	192.168.2.16
May 6, 2024 04:57:24.818686962 CEST	52174	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:24.818770885 CEST	52174	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:24.818918943 CEST	52188	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:24.820027113 CEST	52034	21	192.168.2.16	189.141.9.254
May 6, 2024 04:57:24.820048094 CEST	52033	2121	192.168.2.16	187.147.9.26
May 6, 2024 04:57:24.820211887 CEST	52140	21	192.168.2.16	1.183.194.91
May 6, 2024 04:57:24.820215940 CEST	52189	2121	192.168.2.16	139.59.195.201
May 6, 2024 04:57:24.831044912 CEST	21	52151	149.154.65.23	192.168.2.16
May 6, 2024 04:57:24.831511021 CEST	21	52151	149.154.65.23	192.168.2.16
May 6, 2024 04:57:24.831695080 CEST	52151	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:24.836055994 CEST	52042	21	192.168.2.16	49.13.32.58
May 6, 2024 04:57:24.836056948 CEST	52041	2121	192.168.2.16	49.13.32.58
May 6, 2024 04:57:24.836427927 CEST	52190	21	192.168.2.16	61.184.1.110
May 6, 2024 04:57:24.837054014 CEST	52035	2121	192.168.2.16	189.141.9.254
May 6, 2024 04:57:24.838953972 CEST	52080	2121	192.168.2.16	202.168.242.122
May 6, 2024 04:57:24.852030993 CEST	52114	21	192.168.2.16	130.244.25.204
May 6, 2024 04:57:24.852035999 CEST	21	52088	103.109.6.215	192.168.2.16
May 6, 2024 04:57:24.852046967 CEST	21	52088	103.109.6.215	192.168.2.16
May 6, 2024 04:57:24.852092028 CEST	52088	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:24.852581024 CEST	52191	2121	192.168.2.16	61.184.1.110
May 6, 2024 04:57:24.852664948 CEST	52192	21	192.168.2.16	72.200.111.213
May 6, 2024 04:57:24.862390995 CEST	21	52135	121.129.13.128	192.168.2.16
May 6, 2024 04:57:24.867053986 CEST	52141	2121	192.168.2.16	1.183.194.91
May 6, 2024 04:57:24.872258902 CEST	21	52167	103.109.6.215	192.168.2.16
May 6, 2024 04:57:24.872323990 CEST	52167	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:24.875864983 CEST	2121	52136	121.129.13.128	192.168.2.16
May 6, 2024 04:57:24.883032084 CEST	52142	21	192.168.2.16	181.33.195.52
May 6, 2024 04:57:24.883042097 CEST	52038	21	192.168.2.16	107.171.141.238
May 6, 2024 04:57:24.883207083 CEST	52193	2121	192.168.2.16	72.200.111.213
May 6, 2024 04:57:24.884030104 CEST	21	52025	201.48.196.29	192.168.2.16
May 6, 2024 04:57:24.899029970 CEST	52159	21	192.168.2.16	152.79.117.181
May 6, 2024 04:57:24.899029016 CEST	52039	2121	192.168.2.16	107.171.141.238
May 6, 2024 04:57:24.899215937 CEST	52115	2121	192.168.2.16	130.244.25.204
May 6, 2024 04:57:24.899337053 CEST	52194	21	192.168.2.16	185.246.189.89
May 6, 2024 04:57:24.914442062 CEST	21	52187	34.128.145.40	192.168.2.16
May 6, 2024 04:57:24.914499998 CEST	52187	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:24.915043116 CEST	21	52171	34.128.145.40	192.168.2.16
May 6, 2024 04:57:24.923270941 CEST	21	52180	212.116.245.78	192.168.2.16
May 6, 2024 04:57:24.928383112 CEST	2121	52174	34.128.145.40	192.168.2.16
May 6, 2024 04:57:24.928545952 CEST	2121	52026	201.48.196.29	192.168.2.16
May 6, 2024 04:57:24.929394007 CEST	2121	52188	34.128.145.40	192.168.2.16
May 6, 2024 04:57:24.929456949 CEST	52188	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:24.931031942 CEST	52050	21	192.168.2.16	116.202.215.231
May 6, 2024 04:57:24.931051016 CEST	52040	21	192.168.2.16	189.25.98.198
May 6, 2024 04:57:24.938771009 CEST	2121	52181	212.116.245.78	192.168.2.16
May 6, 2024 04:57:24.941740990 CEST	21	52143	101.43.249.26	192.168.2.16
May 6, 2024 04:57:24.941896915 CEST	52143	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:24.942158937 CEST	52195	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:24.944164038 CEST	21	51932	181.231.57.173	192.168.2.16
May 6, 2024 04:57:24.947047949 CEST	52043	2121	192.168.2.16	189.25.98.198
May 6, 2024 04:57:24.947062969 CEST	52146	2121	192.168.2.16	181.33.195.52
May 6, 2024 04:57:24.947066069 CEST	52147	21	192.168.2.16	49.63.99.86
May 6, 2024 04:57:24.947372913 CEST	52196	2121	192.168.2.16	185.246.189.89
May 6, 2024 04:57:24.947479010 CEST	52197	21	192.168.2.16	61.98.1.136
May 6, 2024 04:57:24.949208975 CEST	2121	51934	181.231.57.173	192.168.2.16
May 6, 2024 04:57:24.955703020 CEST	21	51959	66.198.245.58	192.168.2.16
May 6, 2024 04:57:24.955796957 CEST	51959	21	192.168.2.16	66.198.245.58
May 6, 2024 04:57:24.955948114 CEST	52198	21	192.168.2.16	66.198.245.58
May 6, 2024 04:57:24.963047981 CEST	52148	2121	192.168.2.16	49.63.99.86
May 6, 2024 04:57:24.963669062 CEST	52199	2121	192.168.2.16	61.98.1.136
May 6, 2024 04:57:24.963717937 CEST	52200	21	192.168.2.16	208.106.130.31
May 6, 2024 04:57:24.969244957 CEST	21	52068	200.11.111.246	192.168.2.16
May 6, 2024 04:57:24.977348089 CEST	21	52178	87.106.26.129	192.168.2.16
May 6, 2024 04:57:24.977411985 CEST	52178	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:24.977683067 CEST	21	52177	81.88.252.91	192.168.2.16
May 6, 2024 04:57:24.977741003 CEST	52177	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:24.978049040 CEST	52149	21	192.168.2.16	15.160.40.54
May 6, 2024 04:57:24.978071928 CEST	51885	21	192.168.2.16	109.205.180.149
May 6, 2024 04:57:24.978215933 CEST	52201	21	192.168.2.16	109.205.180.149
May 6, 2024 04:57:24.979247093 CEST	21	52139	87.106.26.129	192.168.2.16
May 6, 2024 04:57:24.979299068 CEST	52139	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:24.982966900 CEST	21	52057	220.94.189.29	192.168.2.16
May 6, 2024 04:57:24.994041920 CEST	52165	2121	192.168.2.16	71.44.3.82
May 6, 2024 04:57:24.994805098 CEST	52160	2121	192.168.2.16	152.79.117.181
May 6, 2024 04:57:25.001024008 CEST	2121	52069	200.11.111.246	192.168.2.16
May 6, 2024 04:57:25.013384104 CEST	2121	52058	220.94.189.29	192.168.2.16
May 6, 2024 04:57:25.024233103 CEST	21	52187	34.128.145.40	192.168.2.16
May 6, 2024 04:57:25.024285078 CEST	52187	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:25.024333954 CEST	52187	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:25.024477959 CEST	52202	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:25.039943933 CEST	2121	52188	34.128.145.40	192.168.2.16
May 6, 2024 04:57:25.039994001 CEST	52188	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:25.040050030 CEST	52188	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:25.040213108 CEST	52203	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:25.040939093 CEST	2121	52098	59.11.131.181	192.168.2.16
May 6, 2024 04:57:25.042023897 CEST	52113	2121	192.168.2.16	121.226.18.169
May 6, 2024 04:57:25.043842077 CEST	21	52097	59.11.131.181	192.168.2.16
May 6, 2024 04:57:25.056962013 CEST	2121	52041	49.13.32.58	192.168.2.16
May 6, 2024 04:57:25.056972980 CEST	21	52042	49.13.32.58	192.168.2.16
May 6, 2024 04:57:25.057456017 CEST	52204	2121	192.168.2.16	208.106.130.31
May 6, 2024 04:57:25.057476044 CEST	52205	21	192.168.2.16	73.193.19.69
May 6, 2024 04:57:25.058027029 CEST	52051	2121	192.168.2.16	116.202.215.231
May 6, 2024 04:57:25.074029922 CEST	52152	2121	192.168.2.16	15.160.40.54
May 6, 2024 04:57:25.077250957 CEST	21	52150	154.210.32.21	192.168.2.16
May 6, 2024 04:57:25.077390909 CEST	21	52150	154.210.32.21	192.168.2.16
May 6, 2024 04:57:25.077506065 CEST	52150	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:25.080662012 CEST	21	52114	130.244.25.204	192.168.2.16
May 6, 2024 04:57:25.083600998 CEST	2121	52100	218.39.247.8	192.168.2.16
May 6, 2024 04:57:25.086118937 CEST	21	52151	149.154.65.23	192.168.2.16
May 6, 2024 04:57:25.086229086 CEST	52151	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:25.086420059 CEST	52206	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:25.087862015 CEST	21	52099	218.39.247.8	192.168.2.16
May 6, 2024 04:57:25.090223074 CEST	52207	2121	192.168.2.16	73.193.19.69
May 6, 2024 04:57:25.106050968 CEST	52153	21	192.168.2.16	175.155.183.127
May 6, 2024 04:57:25.106050968 CEST	52121	2121	192.168.2.16	118.53.253.160
May 6, 2024 04:57:25.106410980 CEST	2121	52106	203.248.159.105	192.168.2.16
May 6, 2024 04:57:25.110496998 CEST	2121	52165	71.44.3.82	192.168.2.16
May 6, 2024 04:57:25.111680984 CEST	21	52198	66.198.245.58	192.168.2.16
May 6, 2024 04:57:25.111695051 CEST	21	51959	66.198.245.58	192.168.2.16
May 6, 2024 04:57:25.111758947 CEST	51959	21	192.168.2.16	66.198.245.58
May 6, 2024 04:57:25.111779928 CEST	52198	21	192.168.2.16	66.198.245.58
May 6, 2024 04:57:25.111993074 CEST	21	51959	66.198.245.58	192.168.2.16
May 6, 2024 04:57:25.112041950 CEST	51959	21	192.168.2.16	66.198.245.58
May 6, 2024 04:57:25.118856907 CEST	21	52194	185.246.189.89	192.168.2.16
May 6, 2024 04:57:25.122030973 CEST	52120	21	192.168.2.16	118.53.253.160
May 6, 2024 04:57:25.134033918 CEST	21	52187	34.128.145.40	192.168.2.16
May 6, 2024 04:57:25.134109020 CEST	2121	52115	130.244.25.204	192.168.2.16
May 6, 2024 04:57:25.134180069 CEST	21	52202	34.128.145.40	192.168.2.16
May 6, 2024 04:57:25.134238005 CEST	52202	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:25.135668039 CEST	21	52184	14.215.46.243	192.168.2.16
May 6, 2024 04:57:25.138375044 CEST	52208	2121	192.168.2.16	66.68.64.135
May 6, 2024 04:57:25.138422966 CEST	52209	21	192.168.2.16	66.68.64.135
May 6, 2024 04:57:25.140163898 CEST	21	52200	208.106.130.31	192.168.2.16
May 6, 2024 04:57:25.140224934 CEST	52200	21	192.168.2.16	208.106.130.31
May 6, 2024 04:57:25.149689913 CEST	2121	52188	34.128.145.40	192.168.2.16
May 6, 2024 04:57:25.149825096 CEST	2121	52203	34.128.145.40	192.168.2.16
May 6, 2024 04:57:25.149878025 CEST	52203	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:25.153289080 CEST	21	52050	116.202.215.231	192.168.2.16
May 6, 2024 04:57:25.168576002 CEST	2121	52196	185.246.189.89	192.168.2.16
May 6, 2024 04:57:25.170691967 CEST	52210	21	192.168.2.16	106.221.58.193
May 6, 2024 04:57:25.191612959 CEST	21	52190	61.184.1.110	192.168.2.16
May 6, 2024 04:57:25.202054977 CEST	52156	2121	192.168.2.16	175.155.183.127
May 6, 2024 04:57:25.202056885 CEST	52157	21	192.168.2.16	54.192.6.149
May 6, 2024 04:57:25.202056885 CEST	52054	21	192.168.2.16	31.181.24.131
May 6, 2024 04:57:25.202224970 CEST	52211	2121	192.168.2.16	106.221.58.193
May 6, 2024 04:57:25.217643976 CEST	2121	52191	61.184.1.110	192.168.2.16
May 6, 2024 04:57:25.218041897 CEST	52158	2121	192.168.2.16	54.192.6.149
May 6, 2024 04:57:25.224634886 CEST	2121	52080	202.168.242.122	192.168.2.16
May 6, 2024 04:57:25.227231026 CEST	21	52201	109.205.180.149	192.168.2.16
May 6, 2024 04:57:25.227298021 CEST	52201	21	192.168.2.16	109.205.180.149
May 6, 2024 04:57:25.228699923 CEST	21	52178	87.106.26.129	192.168.2.16
May 6, 2024 04:57:25.228843927 CEST	52178	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:25.234046936 CEST	52045	21	192.168.2.16	118.59.230.75
May 6, 2024 04:57:25.243275881 CEST	21	52167	103.109.6.215	192.168.2.16
May 6, 2024 04:57:25.243390083 CEST	52167	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:25.243896961 CEST	21	52202	34.128.145.40	192.168.2.16
May 6, 2024 04:57:25.243953943 CEST	52202	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:25.244004011 CEST	52202	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:25.244162083 CEST	52212	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:25.250241995 CEST	21	51885	109.205.180.149	192.168.2.16
May 6, 2024 04:57:25.250322104 CEST	52213	21	192.168.2.16	37.221.67.225
May 6, 2024 04:57:25.252207994 CEST	2121	52037	102.155.18.82	192.168.2.16
May 6, 2024 04:57:25.253065109 CEST	21	52177	81.88.252.91	192.168.2.16
May 6, 2024 04:57:25.253160954 CEST	52177	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:25.255511045 CEST	21	52036	102.155.18.82	192.168.2.16
May 6, 2024 04:57:25.259613991 CEST	2121	52203	34.128.145.40	192.168.2.16
May 6, 2024 04:57:25.259661913 CEST	52203	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:25.259727955 CEST	52203	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:25.259887934 CEST	52214	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:25.266031981 CEST	52056	2121	192.168.2.16	31.181.24.131
May 6, 2024 04:57:25.266051054 CEST	52129	21	192.168.2.16	115.9.253.163
May 6, 2024 04:57:25.266052008 CEST	52130	2121	192.168.2.16	115.9.253.163
May 6, 2024 04:57:25.268241882 CEST	21	52198	66.198.245.58	192.168.2.16
May 6, 2024 04:57:25.268383026 CEST	52198	21	192.168.2.16	66.198.245.58
May 6, 2024 04:57:25.268902063 CEST	21	52197	61.98.1.136	192.168.2.16
May 6, 2024 04:57:25.282269001 CEST	52215	2121	192.168.2.16	37.221.67.225
May 6, 2024 04:57:25.285029888 CEST	2121	52199	61.98.1.136	192.168.2.16
May 6, 2024 04:57:25.289370060 CEST	21	52195	101.43.249.26	192.168.2.16
May 6, 2024 04:57:25.289434910 CEST	52195	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:25.291744947 CEST	21	52143	101.43.249.26	192.168.2.16
May 6, 2024 04:57:25.291754961 CEST	21	52143	101.43.249.26	192.168.2.16
May 6, 2024 04:57:25.291800022 CEST	52143	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:25.298032045 CEST	52049	2121	192.168.2.16	118.59.230.75
May 6, 2024 04:57:25.330043077 CEST	52161	21	192.168.2.16	134.228.22.143
May 6, 2024 04:57:25.330051899 CEST	52162	2121	192.168.2.16	134.228.22.143
May 6, 2024 04:57:25.330254078 CEST	52216	21	192.168.2.16	76.152.71.214
May 6, 2024 04:57:25.339958906 CEST	21	52151	149.154.65.23	192.168.2.16
May 6, 2024 04:57:25.340023994 CEST	52151	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:25.346048117 CEST	52163	21	192.168.2.16	71.44.3.82
May 6, 2024 04:57:25.346585035 CEST	52218	21	192.168.2.16	98.230.137.147
May 6, 2024 04:57:25.346596956 CEST	52217	2121	192.168.2.16	76.152.71.214
May 6, 2024 04:57:25.353687048 CEST	21	52212	34.128.145.40	192.168.2.16
May 6, 2024 04:57:25.353748083 CEST	52212	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:25.354531050 CEST	21	52202	34.128.145.40	192.168.2.16
May 6, 2024 04:57:25.355772018 CEST	21	52206	149.154.65.23	192.168.2.16
May 6, 2024 04:57:25.355824947 CEST	52206	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:25.362248898 CEST	52219	2121	192.168.2.16	98.230.137.147
May 6, 2024 04:57:25.369354963 CEST	2121	52203	34.128.145.40	192.168.2.16
May 6, 2024 04:57:25.369487047 CEST	2121	52214	34.128.145.40	192.168.2.16
May 6, 2024 04:57:25.369543076 CEST	52214	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:25.371366024 CEST	21	52200	208.106.130.31	192.168.2.16
May 6, 2024 04:57:25.371376038 CEST	21	52200	208.106.130.31	192.168.2.16
May 6, 2024 04:57:25.371418953 CEST	52200	21	192.168.2.16	208.106.130.31
May 6, 2024 04:57:25.371454000 CEST	52200	21	192.168.2.16	208.106.130.31
May 6, 2024 04:57:25.371694088 CEST	52220	21	192.168.2.16	176.22.193.151
May 6, 2024 04:57:25.372715950 CEST	2121	52113	121.226.18.169	192.168.2.16
May 6, 2024 04:57:25.378032923 CEST	52136	2121	192.168.2.16	121.129.13.128
May 6, 2024 04:57:25.378035069 CEST	52135	21	192.168.2.16	121.129.13.128
May 6, 2024 04:57:25.378225088 CEST	52221	2121	192.168.2.16	176.22.193.151
May 6, 2024 04:57:25.410528898 CEST	52222	21	192.168.2.16	72.238.232.239
May 6, 2024 04:57:25.416712046 CEST	2121	52121	118.53.253.160	192.168.2.16
May 6, 2024 04:57:25.423858881 CEST	21	52198	66.198.245.58	192.168.2.16
May 6, 2024 04:57:25.423894882 CEST	21	52198	66.198.245.58	192.168.2.16
May 6, 2024 04:57:25.424016953 CEST	52198	21	192.168.2.16	66.198.245.58
May 6, 2024 04:57:25.426049948 CEST	52180	21	192.168.2.16	212.116.245.78
May 6, 2024 04:57:25.434534073 CEST	21	52120	118.53.253.160	192.168.2.16
May 6, 2024 04:57:25.441921949 CEST	21	52150	154.210.32.21	192.168.2.16
May 6, 2024 04:57:25.442044020 CEST	52150	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:25.442193985 CEST	52223	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:25.442212105 CEST	52181	2121	192.168.2.16	212.116.245.78
May 6, 2024 04:57:25.442399025 CEST	52061	21	192.168.2.16	216.117.162.236
May 6, 2024 04:57:25.442725897 CEST	21	52150	154.210.32.21	192.168.2.16
May 6, 2024 04:57:25.442776918 CEST	52150	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:25.456856012 CEST	21	52178	87.106.26.129	192.168.2.16
May 6, 2024 04:57:25.457119942 CEST	21	52178	87.106.26.129	192.168.2.16
May 6, 2024 04:57:25.457241058 CEST	52178	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:25.463407040 CEST	21	52212	34.128.145.40	192.168.2.16
May 6, 2024 04:57:25.463463068 CEST	52212	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:25.463536024 CEST	52212	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:25.463704109 CEST	52224	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:25.473031998 CEST	52068	21	192.168.2.16	200.11.111.246
May 6, 2024 04:57:25.478472948 CEST	21	52201	109.205.180.149	192.168.2.16
May 6, 2024 04:57:25.478631020 CEST	52201	21	192.168.2.16	109.205.180.149
May 6, 2024 04:57:25.479597092 CEST	2121	52214	34.128.145.40	192.168.2.16
May 6, 2024 04:57:25.479644060 CEST	52214	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:25.479724884 CEST	52214	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:25.479911089 CEST	52225	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:25.489064932 CEST	52057	21	192.168.2.16	220.94.189.29
May 6, 2024 04:57:25.489428043 CEST	52226	2121	192.168.2.16	72.238.232.239
May 6, 2024 04:57:25.489480019 CEST	52227	21	192.168.2.16	108.156.205.118
May 6, 2024 04:57:25.505050898 CEST	52069	2121	192.168.2.16	200.11.111.246
May 6, 2024 04:57:25.505445004 CEST	52168	21	192.168.2.16	131.226.196.37
May 6, 2024 04:57:25.505749941 CEST	52228	2121	192.168.2.16	108.156.205.118
May 6, 2024 04:57:25.520071030 CEST	52058	2121	192.168.2.16	220.94.189.29
May 6, 2024 04:57:25.520607948 CEST	52229	21	192.168.2.16	114.132.167.209
May 6, 2024 04:57:25.520699978 CEST	52230	2121	192.168.2.16	114.132.167.209
May 6, 2024 04:57:25.535372019 CEST	52231	21	192.168.2.16	188.218.189.237
May 6, 2024 04:57:25.546242952 CEST	21	52177	81.88.252.91	192.168.2.16
May 6, 2024 04:57:25.546399117 CEST	52177	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:25.548214912 CEST	21	52200	208.106.130.31	192.168.2.16
May 6, 2024 04:57:25.550096035 CEST	21	52045	118.59.230.75	192.168.2.16
May 6, 2024 04:57:25.550522089 CEST	52232	2121	192.168.2.16	188.218.189.237
May 6, 2024 04:57:25.551042080 CEST	52098	2121	192.168.2.16	59.11.131.181
May 6, 2024 04:57:25.551058054 CEST	52097	21	192.168.2.16	59.11.131.181
May 6, 2024 04:57:25.560589075 CEST	21	51961	92.205.10.177	192.168.2.16
May 6, 2024 04:57:25.560715914 CEST	51961	21	192.168.2.16	92.205.10.177
May 6, 2024 04:57:25.561033010 CEST	52233	21	192.168.2.16	92.205.10.177
May 6, 2024 04:57:25.567028046 CEST	52170	2121	192.168.2.16	131.226.196.37
May 6, 2024 04:57:25.567090034 CEST	52169	21	192.168.2.16	152.179.110.81
May 6, 2024 04:57:25.567323923 CEST	52234	21	192.168.2.16	93.223.177.152
May 6, 2024 04:57:25.573012114 CEST	21	52212	34.128.145.40	192.168.2.16
May 6, 2024 04:57:25.574052095 CEST	21	52224	34.128.145.40	192.168.2.16
May 6, 2024 04:57:25.574110985 CEST	52224	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:25.574220896 CEST	2121	52130	115.9.253.163	192.168.2.16
May 6, 2024 04:57:25.576879978 CEST	21	52180	212.116.245.78	192.168.2.16
May 6, 2024 04:57:25.577338934 CEST	21	52129	115.9.253.163	192.168.2.16
May 6, 2024 04:57:25.582062006 CEST	52114	21	192.168.2.16	130.244.25.204
May 6, 2024 04:57:25.582396030 CEST	52235	2121	192.168.2.16	93.223.177.152
May 6, 2024 04:57:25.582458973 CEST	52236	21	192.168.2.16	68.52.102.207
May 6, 2024 04:57:25.589250088 CEST	2121	52214	34.128.145.40	192.168.2.16
May 6, 2024 04:57:25.589549065 CEST	2121	52225	34.128.145.40	192.168.2.16
May 6, 2024 04:57:25.589607954 CEST	52225	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:25.592112064 CEST	2121	52181	212.116.245.78	192.168.2.16
May 6, 2024 04:57:25.597059011 CEST	52100	2121	192.168.2.16	218.39.247.8
May 6, 2024 04:57:25.597063065 CEST	52099	21	192.168.2.16	218.39.247.8
May 6, 2024 04:57:25.613044977 CEST	52106	2121	192.168.2.16	203.248.159.105
May 6, 2024 04:57:25.613048077 CEST	52172	21	192.168.2.16	98.67.131.230
May 6, 2024 04:57:25.613285065 CEST	52165	2121	192.168.2.16	71.44.3.82
May 6, 2024 04:57:25.613286972 CEST	52173	2121	192.168.2.16	152.179.110.81
May 6, 2024 04:57:25.613354921 CEST	2121	52049	118.59.230.75	192.168.2.16
May 6, 2024 04:57:25.614258051 CEST	21	52167	103.109.6.215	192.168.2.16
May 6, 2024 04:57:25.614382029 CEST	52167	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:25.618896961 CEST	21	52198	66.198.245.58	192.168.2.16
May 6, 2024 04:57:25.629030943 CEST	52194	21	192.168.2.16	185.246.189.89
May 6, 2024 04:57:25.629031897 CEST	52175	2121	192.168.2.16	98.67.131.230
May 6, 2024 04:57:25.629254103 CEST	21	52206	149.154.65.23	192.168.2.16
May 6, 2024 04:57:25.629437923 CEST	52206	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:25.629724026 CEST	52237	2121	192.168.2.16	68.52.102.207
May 6, 2024 04:57:25.629786968 CEST	52238	21	192.168.2.16	32.216.64.98
May 6, 2024 04:57:25.629937887 CEST	52239	2121	192.168.2.16	32.216.64.98
May 6, 2024 04:57:25.638072014 CEST	21	52195	101.43.249.26	192.168.2.16
May 6, 2024 04:57:25.638206005 CEST	52195	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:25.645028114 CEST	52115	2121	192.168.2.16	130.244.25.204
May 6, 2024 04:57:25.647528887 CEST	52184	21	192.168.2.16	14.215.46.243
May 6, 2024 04:57:25.661057949 CEST	52067	2121	192.168.2.16	178.185.67.94
May 6, 2024 04:57:25.666033030 CEST	52066	21	192.168.2.16	178.185.67.94
May 6, 2024 04:57:25.670200109 CEST	21	52068	200.11.111.246	192.168.2.16
May 6, 2024 04:57:25.677032948 CEST	52176	21	192.168.2.16	153.154.186.17
May 6, 2024 04:57:25.677033901 CEST	52196	2121	192.168.2.16	185.246.189.89
May 6, 2024 04:57:25.684509993 CEST	21	52224	34.128.145.40	192.168.2.16
May 6, 2024 04:57:25.684571028 CEST	52224	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:25.684614897 CEST	52224	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:25.684761047 CEST	52240	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:25.685590982 CEST	21	52178	87.106.26.129	192.168.2.16
May 6, 2024 04:57:25.685745955 CEST	52178	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:25.686001062 CEST	52241	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:25.688741922 CEST	2121	52136	121.129.13.128	192.168.2.16
May 6, 2024 04:57:25.690159082 CEST	21	52135	121.129.13.128	192.168.2.16
May 6, 2024 04:57:25.693056107 CEST	52190	21	192.168.2.16	61.184.1.110
May 6, 2024 04:57:25.693236113 CEST	52242	21	192.168.2.16	80.115.43.206
May 6, 2024 04:57:25.700294971 CEST	2121	52225	34.128.145.40	192.168.2.16
May 6, 2024 04:57:25.700341940 CEST	52225	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:25.700392962 CEST	52225	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:25.700536013 CEST	52243	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:25.702754974 CEST	2121	52069	200.11.111.246	192.168.2.16
May 6, 2024 04:57:25.724045038 CEST	52191	2121	192.168.2.16	61.184.1.110
May 6, 2024 04:57:25.724302053 CEST	52244	2121	192.168.2.16	80.115.43.206
May 6, 2024 04:57:25.728566885 CEST	21	52201	109.205.180.149	192.168.2.16
May 6, 2024 04:57:25.728727102 CEST	21	52201	109.205.180.149	192.168.2.16
May 6, 2024 04:57:25.728835106 CEST	52201	21	192.168.2.16	109.205.180.149
May 6, 2024 04:57:25.731307983 CEST	2121	52165	71.44.3.82	192.168.2.16
May 6, 2024 04:57:25.740035057 CEST	52080	2121	192.168.2.16	202.168.242.122
May 6, 2024 04:57:25.756028891 CEST	52037	2121	192.168.2.16	102.155.18.82
May 6, 2024 04:57:25.764703035 CEST	21	51885	109.205.180.149	192.168.2.16
May 6, 2024 04:57:25.764779091 CEST	51885	21	192.168.2.16	109.205.180.149
May 6, 2024 04:57:25.764851093 CEST	21	51885	109.205.180.149	192.168.2.16
May 6, 2024 04:57:25.764904022 CEST	51885	21	192.168.2.16	109.205.180.149
May 6, 2024 04:57:25.765676975 CEST	21	51885	109.205.180.149	192.168.2.16
May 6, 2024 04:57:25.765719891 CEST	51885	21	192.168.2.16	109.205.180.149
May 6, 2024 04:57:25.771027088 CEST	52197	21	192.168.2.16	61.98.1.136
May 6, 2024 04:57:25.771042109 CEST	52179	2121	192.168.2.16	153.154.186.17
May 6, 2024 04:57:25.771061897 CEST	52036	21	192.168.2.16	102.155.18.82
May 6, 2024 04:57:25.786149025 CEST	21	52223	154.210.32.21	192.168.2.16
May 6, 2024 04:57:25.786204100 CEST	52223	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:25.786375999 CEST	21	52233	92.205.10.177	192.168.2.16
May 6, 2024 04:57:25.786427975 CEST	52233	21	192.168.2.16	92.205.10.177
May 6, 2024 04:57:25.786505938 CEST	21	51961	92.205.10.177	192.168.2.16
May 6, 2024 04:57:25.786550045 CEST	51961	21	192.168.2.16	92.205.10.177
May 6, 2024 04:57:25.787046909 CEST	52199	2121	192.168.2.16	61.98.1.136
May 6, 2024 04:57:25.787187099 CEST	21	51961	92.205.10.177	192.168.2.16
May 6, 2024 04:57:25.787226915 CEST	51961	21	192.168.2.16	92.205.10.177
May 6, 2024 04:57:25.794368029 CEST	21	52240	34.128.145.40	192.168.2.16
May 6, 2024 04:57:25.794423103 CEST	52240	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:25.794975042 CEST	21	52224	34.128.145.40	192.168.2.16
May 6, 2024 04:57:25.795036077 CEST	21	52057	220.94.189.29	192.168.2.16
May 6, 2024 04:57:25.796422005 CEST	21	52150	154.210.32.21	192.168.2.16
May 6, 2024 04:57:25.803031921 CEST	52185	2121	192.168.2.16	14.215.46.243
May 6, 2024 04:57:25.803045988 CEST	52183	2121	192.168.2.16	181.56.197.98
May 6, 2024 04:57:25.803075075 CEST	52182	21	192.168.2.16	181.56.197.98
May 6, 2024 04:57:25.803209066 CEST	52245	21	192.168.2.16	171.107.43.59
May 6, 2024 04:57:25.811588049 CEST	2121	52225	34.128.145.40	192.168.2.16
May 6, 2024 04:57:25.811598063 CEST	2121	52243	34.128.145.40	192.168.2.16
May 6, 2024 04:57:25.811611891 CEST	21	52114	130.244.25.204	192.168.2.16
May 6, 2024 04:57:25.811667919 CEST	52243	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:25.819032907 CEST	52186	21	192.168.2.16	139.59.195.201
May 6, 2024 04:57:25.819263935 CEST	52246	2121	192.168.2.16	171.107.43.59
May 6, 2024 04:57:25.825464010 CEST	2121	52058	220.94.189.29	192.168.2.16
May 6, 2024 04:57:25.825978994 CEST	52247	21	192.168.2.16	79.56.181.220
May 6, 2024 04:57:25.827208996 CEST	21	52177	81.88.252.91	192.168.2.16
May 6, 2024 04:57:25.827220917 CEST	21	52177	81.88.252.91	192.168.2.16
May 6, 2024 04:57:25.827518940 CEST	52248	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:25.834028959 CEST	52189	2121	192.168.2.16	139.59.195.201
May 6, 2024 04:57:25.849960089 CEST	21	52194	185.246.189.89	192.168.2.16
May 6, 2024 04:57:25.852303982 CEST	2121	52098	59.11.131.181	192.168.2.16
May 6, 2024 04:57:25.854629040 CEST	21	52097	59.11.131.181	192.168.2.16
May 6, 2024 04:57:25.866059065 CEST	52192	21	192.168.2.16	72.200.111.213
May 6, 2024 04:57:25.866414070 CEST	52249	2121	192.168.2.16	79.56.181.220
May 6, 2024 04:57:25.871304035 CEST	21	52229	114.132.167.209	192.168.2.16
May 6, 2024 04:57:25.881362915 CEST	2121	52115	130.244.25.204	192.168.2.16
May 6, 2024 04:57:25.882042885 CEST	52113	2121	192.168.2.16	121.226.18.169
May 6, 2024 04:57:25.882895947 CEST	2121	52230	114.132.167.209	192.168.2.16
May 6, 2024 04:57:25.898058891 CEST	52193	2121	192.168.2.16	72.200.111.213
May 6, 2024 04:57:25.900008917 CEST	2121	52196	185.246.189.89	192.168.2.16
May 6, 2024 04:57:25.900636911 CEST	21	52206	149.154.65.23	192.168.2.16
May 6, 2024 04:57:25.901201963 CEST	21	52206	149.154.65.23	192.168.2.16
May 6, 2024 04:57:25.901376009 CEST	52206	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:25.905227900 CEST	21	52240	34.128.145.40	192.168.2.16
May 6, 2024 04:57:25.905278921 CEST	52240	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:25.905324936 CEST	52240	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:25.905486107 CEST	52250	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:25.910147905 CEST	2121	52100	218.39.247.8	192.168.2.16
May 6, 2024 04:57:25.910959959 CEST	21	52241	87.106.26.129	192.168.2.16
May 6, 2024 04:57:25.911031961 CEST	52241	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:25.915229082 CEST	21	52099	218.39.247.8	192.168.2.16
May 6, 2024 04:57:25.917000055 CEST	21	52178	87.106.26.129	192.168.2.16
May 6, 2024 04:57:25.917052031 CEST	52178	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:25.922763109 CEST	2121	52243	34.128.145.40	192.168.2.16
May 6, 2024 04:57:25.922815084 CEST	52243	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:25.922875881 CEST	52243	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:25.923064947 CEST	52251	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:25.929032087 CEST	52121	2121	192.168.2.16	118.53.253.160
May 6, 2024 04:57:25.932624102 CEST	2121	52106	203.248.159.105	192.168.2.16
May 6, 2024 04:57:25.945033073 CEST	52120	21	192.168.2.16	118.53.253.160
May 6, 2024 04:57:25.987274885 CEST	21	52195	101.43.249.26	192.168.2.16
May 6, 2024 04:57:25.987435102 CEST	52195	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:25.987684011 CEST	52252	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:25.987749100 CEST	21	52167	103.109.6.215	192.168.2.16
May 6, 2024 04:57:25.987876892 CEST	52167	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:25.988049984 CEST	52253	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:25.994731903 CEST	21	52184	14.215.46.243	192.168.2.16
May 6, 2024 04:57:26.012840986 CEST	21	52233	92.205.10.177	192.168.2.16
May 6, 2024 04:57:26.013031006 CEST	52233	21	192.168.2.16	92.205.10.177
May 6, 2024 04:57:26.014923096 CEST	21	52240	34.128.145.40	192.168.2.16
May 6, 2024 04:57:26.015069962 CEST	21	52250	34.128.145.40	192.168.2.16
May 6, 2024 04:57:26.015142918 CEST	52250	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:26.017729044 CEST	21	52201	109.205.180.149	192.168.2.16
May 6, 2024 04:57:26.024308920 CEST	52254	21	192.168.2.16	86.29.248.5
May 6, 2024 04:57:26.032366991 CEST	2121	52243	34.128.145.40	192.168.2.16
May 6, 2024 04:57:26.033477068 CEST	2121	52251	34.128.145.40	192.168.2.16
May 6, 2024 04:57:26.033531904 CEST	52251	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:26.036624908 CEST	21	52176	153.154.186.17	192.168.2.16
May 6, 2024 04:57:26.047894001 CEST	21	52190	61.184.1.110	192.168.2.16
May 6, 2024 04:57:26.051722050 CEST	2121	52179	153.154.186.17	192.168.2.16
May 6, 2024 04:57:26.071046114 CEST	52204	2121	192.168.2.16	208.106.130.31
May 6, 2024 04:57:26.071048021 CEST	52081	21	192.168.2.16	75.65.200.31
May 6, 2024 04:57:26.071311951 CEST	52255	2121	192.168.2.16	86.29.248.5
May 6, 2024 04:57:26.071331978 CEST	52205	21	192.168.2.16	73.193.19.69
May 6, 2024 04:57:26.087034941 CEST	52129	21	192.168.2.16	115.9.253.163
May 6, 2024 04:57:26.087035894 CEST	52130	2121	192.168.2.16	115.9.253.163
May 6, 2024 04:57:26.087172985 CEST	52180	21	192.168.2.16	212.116.245.78
May 6, 2024 04:57:26.087419987 CEST	52256	2121	192.168.2.16	79.154.231.25
May 6, 2024 04:57:26.087481022 CEST	52257	21	192.168.2.16	79.154.231.25
May 6, 2024 04:57:26.087882996 CEST	21	52248	81.88.252.91	192.168.2.16
May 6, 2024 04:57:26.087939978 CEST	52248	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:26.088891983 CEST	2121	52191	61.184.1.110	192.168.2.16
May 6, 2024 04:57:26.090854883 CEST	21	52197	61.98.1.136	192.168.2.16
May 6, 2024 04:57:26.102063894 CEST	52083	2121	192.168.2.16	75.65.200.31
May 6, 2024 04:57:26.102065086 CEST	52181	2121	192.168.2.16	212.116.245.78
May 6, 2024 04:57:26.102065086 CEST	52085	2121	192.168.2.16	153.92.72.21
May 6, 2024 04:57:26.102066994 CEST	52084	21	192.168.2.16	153.92.72.21
May 6, 2024 04:57:26.102127075 CEST	52086	21	192.168.2.16	73.242.198.212
May 6, 2024 04:57:26.102128029 CEST	52087	2121	192.168.2.16	73.242.198.212
May 6, 2024 04:57:26.102130890 CEST	52207	2121	192.168.2.16	73.193.19.69
May 6, 2024 04:57:26.102421045 CEST	52258	21	192.168.2.16	94.210.242.120
May 6, 2024 04:57:26.107043982 CEST	2121	52199	61.98.1.136	192.168.2.16
May 6, 2024 04:57:26.118030071 CEST	52089	21	192.168.2.16	179.96.133.19
May 6, 2024 04:57:26.118041039 CEST	52090	21	192.168.2.16	95.143.29.9
May 6, 2024 04:57:26.118050098 CEST	52094	2121	192.168.2.16	188.210.30.157
May 6, 2024 04:57:26.118063927 CEST	52092	2121	192.168.2.16	179.96.133.19
May 6, 2024 04:57:26.118065119 CEST	52093	21	192.168.2.16	188.210.30.157
May 6, 2024 04:57:26.118066072 CEST	52091	2121	192.168.2.16	95.143.29.9
May 6, 2024 04:57:26.124735117 CEST	21	52250	34.128.145.40	192.168.2.16
May 6, 2024 04:57:26.124790907 CEST	52250	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:26.124845982 CEST	52250	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:26.125000000 CEST	52259	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:26.125816107 CEST	2121	52080	202.168.242.122	192.168.2.16
May 6, 2024 04:57:26.131717920 CEST	21	52223	154.210.32.21	192.168.2.16
May 6, 2024 04:57:26.131840944 CEST	52223	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:26.134042025 CEST	52096	2121	192.168.2.16	23.205.249.206
May 6, 2024 04:57:26.134280920 CEST	52260	2121	192.168.2.16	94.210.242.120
May 6, 2024 04:57:26.142026901 CEST	52095	21	192.168.2.16	23.205.249.206
May 6, 2024 04:57:26.144324064 CEST	2121	52251	34.128.145.40	192.168.2.16
May 6, 2024 04:57:26.144377947 CEST	52251	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:26.144422054 CEST	52251	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:26.144545078 CEST	52261	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:26.150032043 CEST	52209	21	192.168.2.16	66.68.64.135
May 6, 2024 04:57:26.150034904 CEST	52101	21	192.168.2.16	113.226.98.39
May 6, 2024 04:57:26.152163029 CEST	52208	2121	192.168.2.16	66.68.64.135
May 6, 2024 04:57:26.152164936 CEST	52102	2121	192.168.2.16	113.226.98.39
May 6, 2024 04:57:26.158432007 CEST	21	52241	87.106.26.129	192.168.2.16
May 6, 2024 04:57:26.158601999 CEST	52241	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:26.166033030 CEST	52103	2121	192.168.2.16	80.180.145.24
May 6, 2024 04:57:26.166121960 CEST	52105	21	192.168.2.16	203.248.159.105
May 6, 2024 04:57:26.171406031 CEST	21	52206	149.154.65.23	192.168.2.16
May 6, 2024 04:57:26.171530008 CEST	52206	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:26.171730995 CEST	52262	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:26.174022913 CEST	52104	21	192.168.2.16	80.180.145.24
May 6, 2024 04:57:26.181051970 CEST	52210	21	192.168.2.16	106.221.58.193
May 6, 2024 04:57:26.196120977 CEST	52135	21	192.168.2.16	121.129.13.128
May 6, 2024 04:57:26.196295977 CEST	52263	21	192.168.2.16	108.67.36.60
May 6, 2024 04:57:26.198409081 CEST	52136	2121	192.168.2.16	121.129.13.128
May 6, 2024 04:57:26.212033987 CEST	52107	21	192.168.2.16	71.9.219.159
May 6, 2024 04:57:26.212035894 CEST	52211	2121	192.168.2.16	106.221.58.193
May 6, 2024 04:57:26.213161945 CEST	2121	52113	121.226.18.169	192.168.2.16
May 6, 2024 04:57:26.220215082 CEST	2121	52037	102.155.18.82	192.168.2.16
May 6, 2024 04:57:26.223535061 CEST	21	52036	102.155.18.82	192.168.2.16
May 6, 2024 04:57:26.228034019 CEST	52108	2121	192.168.2.16	71.9.219.159
May 6, 2024 04:57:26.228055954 CEST	52109	21	192.168.2.16	121.226.18.169
May 6, 2024 04:57:26.228324890 CEST	52264	2121	192.168.2.16	108.67.36.60
May 6, 2024 04:57:26.234879017 CEST	21	52250	34.128.145.40	192.168.2.16
May 6, 2024 04:57:26.235313892 CEST	21	52259	34.128.145.40	192.168.2.16
May 6, 2024 04:57:26.235378027 CEST	52259	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:26.239146948 CEST	21	52180	212.116.245.78	192.168.2.16
May 6, 2024 04:57:26.239315033 CEST	21	52233	92.205.10.177	192.168.2.16
May 6, 2024 04:57:26.239464998 CEST	21	52233	92.205.10.177	192.168.2.16
May 6, 2024 04:57:26.239597082 CEST	52233	21	192.168.2.16	92.205.10.177
May 6, 2024 04:57:26.240071058 CEST	2121	52121	118.53.253.160	192.168.2.16
May 6, 2024 04:57:26.244362116 CEST	52165	2121	192.168.2.16	71.44.3.82
May 6, 2024 04:57:26.244362116 CEST	52265	21	192.168.2.16	87.1.68.206
May 6, 2024 04:57:26.244503021 CEST	52266	2121	192.168.2.16	87.1.68.206
May 6, 2024 04:57:26.251991987 CEST	2121	52181	212.116.245.78	192.168.2.16
May 6, 2024 04:57:26.254228115 CEST	2121	52261	34.128.145.40	192.168.2.16
May 6, 2024 04:57:26.254288912 CEST	52261	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:26.254858971 CEST	2121	52251	34.128.145.40	192.168.2.16
May 6, 2024 04:57:26.258672953 CEST	21	52120	118.53.253.160	192.168.2.16
May 6, 2024 04:57:26.266032934 CEST	52213	21	192.168.2.16	37.221.67.225
May 6, 2024 04:57:26.271228075 CEST	21	52055	193.124.183.222	192.168.2.16
May 6, 2024 04:57:26.271359921 CEST	52055	21	192.168.2.16	193.124.183.222
May 6, 2024 04:57:26.271564007 CEST	52267	21	192.168.2.16	193.124.183.222
May 6, 2024 04:57:26.276410103 CEST	52268	2121	192.168.2.16	179.35.49.149
May 6, 2024 04:57:26.276454926 CEST	52269	21	192.168.2.16	179.35.49.149
May 6, 2024 04:57:26.292032957 CEST	52215	2121	192.168.2.16	37.221.67.225
May 6, 2024 04:57:26.292558908 CEST	52270	21	192.168.2.16	80.158.18.247
May 6, 2024 04:57:26.292666912 CEST	52271	2121	192.168.2.16	80.158.18.247
May 6, 2024 04:57:26.324035883 CEST	52114	21	192.168.2.16	130.244.25.204
May 6, 2024 04:57:26.324275970 CEST	52272	21	192.168.2.16	79.61.53.83
May 6, 2024 04:57:26.326834917 CEST	21	52252	101.43.249.26	192.168.2.16
May 6, 2024 04:57:26.326898098 CEST	52252	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:26.334870100 CEST	21	52195	101.43.249.26	192.168.2.16
May 6, 2024 04:57:26.334880114 CEST	21	52195	101.43.249.26	192.168.2.16
May 6, 2024 04:57:26.334928036 CEST	52195	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:26.340042114 CEST	52216	21	192.168.2.16	76.152.71.214
May 6, 2024 04:57:26.340441942 CEST	52274	2121	192.168.2.16	79.61.53.83
May 6, 2024 04:57:26.340543985 CEST	52273	21	192.168.2.16	175.21.91.68
May 6, 2024 04:57:26.347609043 CEST	21	52259	34.128.145.40	192.168.2.16
May 6, 2024 04:57:26.347670078 CEST	52259	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:26.347750902 CEST	52259	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:26.347956896 CEST	52275	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:26.355027914 CEST	52218	21	192.168.2.16	98.230.137.147
May 6, 2024 04:57:26.355092049 CEST	52098	2121	192.168.2.16	59.11.131.181
May 6, 2024 04:57:26.355092049 CEST	52217	2121	192.168.2.16	76.152.71.214
May 6, 2024 04:57:26.355171919 CEST	52194	21	192.168.2.16	185.246.189.89
May 6, 2024 04:57:26.355242968 CEST	52276	2121	192.168.2.16	175.21.91.68
May 6, 2024 04:57:26.356347084 CEST	21	52248	81.88.252.91	192.168.2.16
May 6, 2024 04:57:26.356456041 CEST	52248	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:26.358612061 CEST	21	52167	103.109.6.215	192.168.2.16
May 6, 2024 04:57:26.358663082 CEST	21	52167	103.109.6.215	192.168.2.16
May 6, 2024 04:57:26.358707905 CEST	52167	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:26.361427069 CEST	2121	52165	71.44.3.82	192.168.2.16
May 6, 2024 04:57:26.361718893 CEST	21	52253	103.109.6.215	192.168.2.16
May 6, 2024 04:57:26.361783028 CEST	52253	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:26.363867998 CEST	2121	52261	34.128.145.40	192.168.2.16
May 6, 2024 04:57:26.363915920 CEST	52261	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:26.363965988 CEST	52261	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:26.364116907 CEST	52277	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:26.370031118 CEST	52219	2121	192.168.2.16	98.230.137.147
May 6, 2024 04:57:26.370055914 CEST	52097	21	192.168.2.16	59.11.131.181
May 6, 2024 04:57:26.382342100 CEST	21	52241	87.106.26.129	192.168.2.16
May 6, 2024 04:57:26.382607937 CEST	21	52241	87.106.26.129	192.168.2.16
May 6, 2024 04:57:26.382780075 CEST	52241	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:26.386050940 CEST	52229	21	192.168.2.16	114.132.167.209
May 6, 2024 04:57:26.386070013 CEST	52115	2121	192.168.2.16	130.244.25.204
May 6, 2024 04:57:26.386073112 CEST	52220	21	192.168.2.16	176.22.193.151
May 6, 2024 04:57:26.386073112 CEST	52221	2121	192.168.2.16	176.22.193.151
May 6, 2024 04:57:26.386163950 CEST	52230	2121	192.168.2.16	114.132.167.209
May 6, 2024 04:57:26.386363029 CEST	52278	21	192.168.2.16	98.122.99.237
May 6, 2024 04:57:26.395332098 CEST	2121	52130	115.9.253.163	192.168.2.16
May 6, 2024 04:57:26.397584915 CEST	21	52129	115.9.253.163	192.168.2.16
May 6, 2024 04:57:26.402038097 CEST	52196	2121	192.168.2.16	185.246.189.89
May 6, 2024 04:57:26.402610064 CEST	52279	2121	192.168.2.16	98.122.99.237
May 6, 2024 04:57:26.402709007 CEST	52280	21	192.168.2.16	27.57.253.243
May 6, 2024 04:57:26.418056011 CEST	52099	21	192.168.2.16	218.39.247.8
May 6, 2024 04:57:26.418056965 CEST	52222	21	192.168.2.16	72.238.232.239
May 6, 2024 04:57:26.419312954 CEST	52100	2121	192.168.2.16	218.39.247.8
May 6, 2024 04:57:26.432262897 CEST	21	52262	149.154.65.23	192.168.2.16
May 6, 2024 04:57:26.432327986 CEST	52262	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:26.434030056 CEST	52116	21	192.168.2.16	91.248.29.24
May 6, 2024 04:57:26.434048891 CEST	52106	2121	192.168.2.16	203.248.159.105
May 6, 2024 04:57:26.434417009 CEST	52281	2121	192.168.2.16	27.57.253.243
May 6, 2024 04:57:26.434451103 CEST	52282	21	192.168.2.16	58.239.189.34
May 6, 2024 04:57:26.441379070 CEST	21	52206	149.154.65.23	192.168.2.16
May 6, 2024 04:57:26.441433907 CEST	52206	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:26.450030088 CEST	52117	2121	192.168.2.16	91.248.29.24
May 6, 2024 04:57:26.450336933 CEST	52283	2121	192.168.2.16	58.239.189.34
May 6, 2024 04:57:26.457299948 CEST	21	52259	34.128.145.40	192.168.2.16
May 6, 2024 04:57:26.457530022 CEST	21	52275	34.128.145.40	192.168.2.16
May 6, 2024 04:57:26.457587957 CEST	52275	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:26.466032982 CEST	52118	21	192.168.2.16	118.70.87.27
May 6, 2024 04:57:26.466079950 CEST	51996	21	192.168.2.16	168.220.94.137
May 6, 2024 04:57:26.466175079 CEST	51995	2121	192.168.2.16	168.220.94.137
May 6, 2024 04:57:26.466413021 CEST	52284	21	192.168.2.16	168.220.94.137
May 6, 2024 04:57:26.466516018 CEST	52285	2121	192.168.2.16	168.220.94.137
May 6, 2024 04:57:26.473545074 CEST	2121	52261	34.128.145.40	192.168.2.16
May 6, 2024 04:57:26.473675966 CEST	2121	52277	34.128.145.40	192.168.2.16
May 6, 2024 04:57:26.473731041 CEST	52277	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:26.475804090 CEST	21	52223	154.210.32.21	192.168.2.16
May 6, 2024 04:57:26.475909948 CEST	21	52223	154.210.32.21	192.168.2.16
May 6, 2024 04:57:26.476010084 CEST	52223	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:26.482219934 CEST	52286	21	192.168.2.16	54.220.74.193
May 6, 2024 04:57:26.497044086 CEST	52226	2121	192.168.2.16	72.238.232.239
May 6, 2024 04:57:26.497051001 CEST	52184	21	192.168.2.16	14.215.46.243
May 6, 2024 04:57:26.497077942 CEST	52119	2121	192.168.2.16	118.70.87.27
May 6, 2024 04:57:26.497132063 CEST	52227	21	192.168.2.16	108.156.205.118
May 6, 2024 04:57:26.505646944 CEST	21	52233	92.205.10.177	192.168.2.16
May 6, 2024 04:57:26.507822990 CEST	21	52135	121.129.13.128	192.168.2.16
May 6, 2024 04:57:26.508388042 CEST	2121	52136	121.129.13.128	192.168.2.16
May 6, 2024 04:57:26.509062052 CEST	2121	52268	179.35.49.149	192.168.2.16
May 6, 2024 04:57:26.513051033 CEST	52228	2121	192.168.2.16	108.156.205.118
May 6, 2024 04:57:26.513333082 CEST	52287	2121	192.168.2.16	54.220.74.193
May 6, 2024 04:57:26.529062986 CEST	52125	2121	192.168.2.16	84.158.60.128
May 6, 2024 04:57:26.529318094 CEST	52288	21	192.168.2.16	203.167.20.180
May 6, 2024 04:57:26.542812109 CEST	21	52055	193.124.183.222	192.168.2.16
May 6, 2024 04:57:26.542865038 CEST	52055	21	192.168.2.16	193.124.183.222
May 6, 2024 04:57:26.544375896 CEST	21	52267	193.124.183.222	192.168.2.16
May 6, 2024 04:57:26.544439077 CEST	52267	21	192.168.2.16	193.124.183.222
May 6, 2024 04:57:26.545080900 CEST	52231	21	192.168.2.16	188.218.189.237
May 6, 2024 04:57:26.545162916 CEST	52124	21	192.168.2.16	84.158.60.128
May 6, 2024 04:57:26.545166016 CEST	52176	21	192.168.2.16	153.154.186.17
May 6, 2024 04:57:26.552403927 CEST	21	52114	130.244.25.204	192.168.2.16
May 6, 2024 04:57:26.561034918 CEST	52190	21	192.168.2.16	61.184.1.110
May 6, 2024 04:57:26.561049938 CEST	52126	21	192.168.2.16	80.232.240.247
May 6, 2024 04:57:26.561060905 CEST	52232	2121	192.168.2.16	188.218.189.237
May 6, 2024 04:57:26.561060905 CEST	52179	2121	192.168.2.16	153.154.186.17
May 6, 2024 04:57:26.561456919 CEST	52289	2121	192.168.2.16	203.167.20.180
May 6, 2024 04:57:26.567341089 CEST	21	52275	34.128.145.40	192.168.2.16
May 6, 2024 04:57:26.567397118 CEST	52275	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:26.567450047 CEST	52275	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:26.567608118 CEST	52290	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:26.574668884 CEST	21	52194	185.246.189.89	192.168.2.16
May 6, 2024 04:57:26.575720072 CEST	21	52284	168.220.94.137	192.168.2.16
May 6, 2024 04:57:26.575769901 CEST	52284	21	192.168.2.16	168.220.94.137
May 6, 2024 04:57:26.575795889 CEST	2121	52285	168.220.94.137	192.168.2.16
May 6, 2024 04:57:26.575845003 CEST	52285	2121	192.168.2.16	168.220.94.137
May 6, 2024 04:57:26.576967955 CEST	21	51996	168.220.94.137	192.168.2.16
May 6, 2024 04:57:26.576980114 CEST	2121	51995	168.220.94.137	192.168.2.16
May 6, 2024 04:57:26.577053070 CEST	52234	21	192.168.2.16	93.223.177.152
May 6, 2024 04:57:26.577419996 CEST	52291	21	192.168.2.16	134.158.73.30
May 6, 2024 04:57:26.577439070 CEST	52292	2121	192.168.2.16	134.158.73.30
May 6, 2024 04:57:26.583477020 CEST	2121	52277	34.128.145.40	192.168.2.16
May 6, 2024 04:57:26.583525896 CEST	52277	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:26.583579063 CEST	52277	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:26.583729029 CEST	52293	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:26.592031956 CEST	52236	21	192.168.2.16	68.52.102.207
May 6, 2024 04:57:26.592045069 CEST	52127	2121	192.168.2.16	80.232.240.247
May 6, 2024 04:57:26.592056990 CEST	52197	21	192.168.2.16	61.98.1.136
May 6, 2024 04:57:26.592058897 CEST	52235	2121	192.168.2.16	93.223.177.152
May 6, 2024 04:57:26.592060089 CEST	52191	2121	192.168.2.16	61.184.1.110
May 6, 2024 04:57:26.592226028 CEST	52294	21	192.168.2.16	76.168.230.178
May 6, 2024 04:57:26.606899977 CEST	21	52241	87.106.26.129	192.168.2.16
May 6, 2024 04:57:26.607036114 CEST	52241	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:26.607233047 CEST	52295	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:26.608053923 CEST	52199	2121	192.168.2.16	61.98.1.136
May 6, 2024 04:57:26.617577076 CEST	21	52070	45.87.1.166	192.168.2.16
May 6, 2024 04:57:26.617685080 CEST	52070	21	192.168.2.16	45.87.1.166
May 6, 2024 04:57:26.617805958 CEST	52296	21	192.168.2.16	45.87.1.166
May 6, 2024 04:57:26.620724916 CEST	2121	52115	130.244.25.204	192.168.2.16
May 6, 2024 04:57:26.621069908 CEST	52297	2121	192.168.2.16	76.168.230.178
May 6, 2024 04:57:26.623178005 CEST	2121	52196	185.246.189.89	192.168.2.16
May 6, 2024 04:57:26.623769999 CEST	21	52248	81.88.252.91	192.168.2.16
May 6, 2024 04:57:26.623884916 CEST	52248	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:26.624687910 CEST	52298	21	192.168.2.16	119.179.199.58
May 6, 2024 04:57:26.624744892 CEST	52299	2121	192.168.2.16	119.179.199.58
May 6, 2024 04:57:26.624808073 CEST	52300	21	192.168.2.16	123.144.156.102
May 6, 2024 04:57:26.640032053 CEST	52238	21	192.168.2.16	32.216.64.98
May 6, 2024 04:57:26.640052080 CEST	52080	2121	192.168.2.16	202.168.242.122
May 6, 2024 04:57:26.640069962 CEST	52237	2121	192.168.2.16	68.52.102.207
May 6, 2024 04:57:26.640512943 CEST	52301	2121	192.168.2.16	123.144.156.102
May 6, 2024 04:57:26.640513897 CEST	52239	2121	192.168.2.16	32.216.64.98
May 6, 2024 04:57:26.640626907 CEST	52302	21	192.168.2.16	125.149.107.42
May 6, 2024 04:57:26.640635967 CEST	52303	2121	192.168.2.16	125.149.107.42
May 6, 2024 04:57:26.640717983 CEST	52304	21	192.168.2.16	47.188.208.116
May 6, 2024 04:57:26.640783072 CEST	52305	2121	192.168.2.16	47.188.208.116
May 6, 2024 04:57:26.655370951 CEST	2121	52098	59.11.131.181	192.168.2.16
May 6, 2024 04:57:26.656366110 CEST	52306	21	192.168.2.16	188.32.44.25
May 6, 2024 04:57:26.656394005 CEST	52307	2121	192.168.2.16	188.32.44.25
May 6, 2024 04:57:26.666270971 CEST	21	52252	101.43.249.26	192.168.2.16
May 6, 2024 04:57:26.666409016 CEST	52252	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:26.672395945 CEST	52308	21	192.168.2.16	90.176.5.124
May 6, 2024 04:57:26.672436953 CEST	52309	2121	192.168.2.16	90.176.5.124
May 6, 2024 04:57:26.672509909 CEST	52310	21	192.168.2.16	104.98.95.157
May 6, 2024 04:57:26.672960997 CEST	21	52097	59.11.131.181	192.168.2.16
May 6, 2024 04:57:26.673168898 CEST	52311	2121	192.168.2.16	104.98.95.157
May 6, 2024 04:57:26.677535057 CEST	21	52290	34.128.145.40	192.168.2.16
May 6, 2024 04:57:26.677598953 CEST	52290	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:26.677836895 CEST	21	52275	34.128.145.40	192.168.2.16
May 6, 2024 04:57:26.693125963 CEST	2121	52277	34.128.145.40	192.168.2.16
May 6, 2024 04:57:26.693197966 CEST	2121	52293	34.128.145.40	192.168.2.16
May 6, 2024 04:57:26.693248987 CEST	52293	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:26.696911097 CEST	21	52262	149.154.65.23	192.168.2.16
May 6, 2024 04:57:26.697036028 CEST	52262	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:26.704034090 CEST	52242	21	192.168.2.16	80.115.43.206
May 6, 2024 04:57:26.720033884 CEST	52113	2121	192.168.2.16	121.226.18.169
May 6, 2024 04:57:26.720266104 CEST	52312	21	192.168.2.16	190.112.22.137
May 6, 2024 04:57:26.730839968 CEST	2121	52100	218.39.247.8	192.168.2.16
May 6, 2024 04:57:26.731127977 CEST	52313	2121	192.168.2.16	190.112.22.137
May 6, 2024 04:57:26.734155893 CEST	21	52099	218.39.247.8	192.168.2.16
May 6, 2024 04:57:26.734433889 CEST	52314	21	192.168.2.16	183.184.150.128
May 6, 2024 04:57:26.735749960 CEST	21	52253	103.109.6.215	192.168.2.16
May 6, 2024 04:57:26.735891104 CEST	52253	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:26.736047983 CEST	52133	2121	192.168.2.16	101.249.43.16
May 6, 2024 04:57:26.736066103 CEST	52244	2121	192.168.2.16	80.115.43.206
May 6, 2024 04:57:26.736068964 CEST	52132	21	192.168.2.16	101.249.43.16
May 6, 2024 04:57:26.736092091 CEST	21	52229	114.132.167.209	192.168.2.16
May 6, 2024 04:57:26.748344898 CEST	2121	52230	114.132.167.209	192.168.2.16
May 6, 2024 04:57:26.752410889 CEST	2121	52106	203.248.159.105	192.168.2.16
May 6, 2024 04:57:26.752439976 CEST	52121	2121	192.168.2.16	118.53.253.160
May 6, 2024 04:57:26.752449036 CEST	52181	2121	192.168.2.16	212.116.245.78
May 6, 2024 04:57:26.752456903 CEST	52180	21	192.168.2.16	212.116.245.78
May 6, 2024 04:57:26.768275976 CEST	52120	21	192.168.2.16	118.53.253.160
May 6, 2024 04:57:26.768606901 CEST	52315	21	192.168.2.16	73.130.233.160
May 6, 2024 04:57:26.768646955 CEST	2121	52283	58.239.189.34	192.168.2.16
May 6, 2024 04:57:26.768667936 CEST	52316	2121	192.168.2.16	183.184.150.128
May 6, 2024 04:57:26.771374941 CEST	21	52282	58.239.189.34	192.168.2.16
May 6, 2024 04:57:26.784286022 CEST	52317	2121	192.168.2.16	73.130.233.160
May 6, 2024 04:57:26.795300961 CEST	21	52290	34.128.145.40	192.168.2.16
May 6, 2024 04:57:26.795366049 CEST	52290	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:26.795416117 CEST	52290	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:26.795581102 CEST	52318	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:26.800056934 CEST	52137	21	192.168.2.16	122.38.205.196
May 6, 2024 04:57:26.800450087 CEST	52319	2121	192.168.2.16	189.86.157.30
May 6, 2024 04:57:26.800546885 CEST	52320	21	192.168.2.16	189.86.157.30
May 6, 2024 04:57:26.802846909 CEST	2121	52293	34.128.145.40	192.168.2.16
May 6, 2024 04:57:26.802901030 CEST	52293	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:26.802967072 CEST	52293	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:26.803128958 CEST	52321	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:26.816035986 CEST	52245	21	192.168.2.16	171.107.43.59
May 6, 2024 04:57:26.816059113 CEST	52138	2121	192.168.2.16	122.38.205.196
May 6, 2024 04:57:26.816277981 CEST	52322	21	192.168.2.16	119.179.81.209
May 6, 2024 04:57:26.819432020 CEST	21	52267	193.124.183.222	192.168.2.16
May 6, 2024 04:57:26.819597960 CEST	52267	21	192.168.2.16	193.124.183.222
May 6, 2024 04:57:26.832056999 CEST	52140	21	192.168.2.16	1.183.194.91
May 6, 2024 04:57:26.832058907 CEST	52246	2121	192.168.2.16	171.107.43.59
May 6, 2024 04:57:26.832133055 CEST	52247	21	192.168.2.16	79.56.181.220
May 6, 2024 04:57:26.832765102 CEST	21	52241	87.106.26.129	192.168.2.16
May 6, 2024 04:57:26.832814932 CEST	52241	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:26.834923029 CEST	21	52223	154.210.32.21	192.168.2.16
May 6, 2024 04:57:26.835056067 CEST	52223	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:26.835221052 CEST	52323	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:26.835423946 CEST	21	52295	87.106.26.129	192.168.2.16
May 6, 2024 04:57:26.835484028 CEST	52295	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:26.835609913 CEST	21	52223	154.210.32.21	192.168.2.16
May 6, 2024 04:57:26.835650921 CEST	52223	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:26.839956045 CEST	21	52070	45.87.1.166	192.168.2.16
May 6, 2024 04:57:26.840020895 CEST	52070	21	192.168.2.16	45.87.1.166
May 6, 2024 04:57:26.844428062 CEST	21	52184	14.215.46.243	192.168.2.16
May 6, 2024 04:57:26.848654985 CEST	21	52296	45.87.1.166	192.168.2.16
May 6, 2024 04:57:26.848716021 CEST	52296	21	192.168.2.16	45.87.1.166
May 6, 2024 04:57:26.864061117 CEST	52165	2121	192.168.2.16	71.44.3.82
May 6, 2024 04:57:26.864366055 CEST	52324	2121	192.168.2.16	119.179.81.209
May 6, 2024 04:57:26.880068064 CEST	52249	2121	192.168.2.16	79.56.181.220
May 6, 2024 04:57:26.880367994 CEST	52325	21	192.168.2.16	221.253.236.97
May 6, 2024 04:57:26.880407095 CEST	52141	2121	192.168.2.16	1.183.194.91
May 6, 2024 04:57:26.886688948 CEST	21	52176	153.154.186.17	192.168.2.16
May 6, 2024 04:57:26.896060944 CEST	52130	2121	192.168.2.16	115.9.253.163
May 6, 2024 04:57:26.899166107 CEST	52142	21	192.168.2.16	181.33.195.52
May 6, 2024 04:57:26.902347088 CEST	2121	52181	212.116.245.78	192.168.2.16
May 6, 2024 04:57:26.903053045 CEST	21	52248	81.88.252.91	192.168.2.16
May 6, 2024 04:57:26.903167963 CEST	52248	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:26.903244972 CEST	21	52180	212.116.245.78	192.168.2.16
May 6, 2024 04:57:26.903321981 CEST	52326	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:26.904692888 CEST	21	52290	34.128.145.40	192.168.2.16
May 6, 2024 04:57:26.905015945 CEST	21	52248	81.88.252.91	192.168.2.16
May 6, 2024 04:57:26.905653000 CEST	21	52318	34.128.145.40	192.168.2.16
May 6, 2024 04:57:26.905719042 CEST	52318	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:26.906393051 CEST	2121	52309	90.176.5.124	192.168.2.16
May 6, 2024 04:57:26.906405926 CEST	21	52308	90.176.5.124	192.168.2.16
May 6, 2024 04:57:26.911763906 CEST	2121	52179	153.154.186.17	192.168.2.16
May 6, 2024 04:57:26.912033081 CEST	52129	21	192.168.2.16	115.9.253.163
May 6, 2024 04:57:26.912353992 CEST	52327	2121	192.168.2.16	221.253.236.97
May 6, 2024 04:57:26.912353992 CEST	52159	21	192.168.2.16	152.79.117.181
May 6, 2024 04:57:26.912415981 CEST	2121	52293	34.128.145.40	192.168.2.16
May 6, 2024 04:57:26.913009882 CEST	21	52197	61.98.1.136	192.168.2.16
May 6, 2024 04:57:26.913463116 CEST	2121	52321	34.128.145.40	192.168.2.16
May 6, 2024 04:57:26.913517952 CEST	52321	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:26.916502953 CEST	21	52190	61.184.1.110	192.168.2.16
May 6, 2024 04:57:26.927346945 CEST	52328	21	192.168.2.16	92.46.161.160
May 6, 2024 04:57:26.929016113 CEST	2121	52199	61.98.1.136	192.168.2.16
May 6, 2024 04:57:26.947691917 CEST	2121	52303	125.149.107.42	192.168.2.16
May 6, 2024 04:57:26.948764086 CEST	21	52302	125.149.107.42	192.168.2.16
May 6, 2024 04:57:26.956916094 CEST	2121	52191	61.184.1.110	192.168.2.16
May 6, 2024 04:57:26.957886934 CEST	21	52262	149.154.65.23	192.168.2.16
May 6, 2024 04:57:26.958762884 CEST	21	52262	149.154.65.23	192.168.2.16
May 6, 2024 04:57:26.958900928 CEST	52262	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:26.959053993 CEST	52147	21	192.168.2.16	49.63.99.86
May 6, 2024 04:57:26.959057093 CEST	52146	2121	192.168.2.16	181.33.195.52
May 6, 2024 04:57:26.975027084 CEST	52148	2121	192.168.2.16	49.63.99.86
May 6, 2024 04:57:26.981055975 CEST	2121	52165	71.44.3.82	192.168.2.16
May 6, 2024 04:57:26.991029024 CEST	52149	21	192.168.2.16	15.160.40.54
May 6, 2024 04:57:27.006031036 CEST	52160	2121	192.168.2.16	152.79.117.181
May 6, 2024 04:57:27.006268024 CEST	52329	2121	192.168.2.16	92.46.161.160
May 6, 2024 04:57:27.006356955 CEST	21	52252	101.43.249.26	192.168.2.16
May 6, 2024 04:57:27.006475925 CEST	52252	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:27.006664991 CEST	52330	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:27.015948057 CEST	21	52318	34.128.145.40	192.168.2.16
May 6, 2024 04:57:27.016016006 CEST	52318	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:27.016079903 CEST	52318	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:27.016243935 CEST	52331	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:27.022033930 CEST	52136	2121	192.168.2.16	121.129.13.128
May 6, 2024 04:57:27.022054911 CEST	52135	21	192.168.2.16	121.129.13.128
May 6, 2024 04:57:27.022952080 CEST	52268	2121	192.168.2.16	179.35.49.149
May 6, 2024 04:57:27.023988962 CEST	2121	52321	34.128.145.40	192.168.2.16
May 6, 2024 04:57:27.024032116 CEST	52321	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:27.024090052 CEST	52321	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:27.024229050 CEST	52332	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:27.025737047 CEST	2121	52080	202.168.242.122	192.168.2.16
May 6, 2024 04:57:27.038032055 CEST	52254	21	192.168.2.16	86.29.248.5
May 6, 2024 04:57:27.038544893 CEST	52333	2121	192.168.2.16	81.82.156.120
May 6, 2024 04:57:27.038562059 CEST	52334	21	192.168.2.16	81.82.156.120
May 6, 2024 04:57:27.051215887 CEST	2121	52113	121.226.18.169	192.168.2.16
May 6, 2024 04:57:27.062685013 CEST	2121	52121	118.53.253.160	192.168.2.16
May 6, 2024 04:57:27.070405960 CEST	52335	21	192.168.2.16	73.36.52.115
May 6, 2024 04:57:27.082809925 CEST	21	52296	45.87.1.166	192.168.2.16
May 6, 2024 04:57:27.082961082 CEST	52296	21	192.168.2.16	45.87.1.166
May 6, 2024 04:57:27.083579063 CEST	21	52120	118.53.253.160	192.168.2.16
May 6, 2024 04:57:27.086025000 CEST	52255	2121	192.168.2.16	86.29.248.5
May 6, 2024 04:57:27.086028099 CEST	52152	2121	192.168.2.16	15.160.40.54
May 6, 2024 04:57:27.086299896 CEST	52336	2121	192.168.2.16	73.36.52.115
May 6, 2024 04:57:27.086299896 CEST	52194	21	192.168.2.16	185.246.189.89
May 6, 2024 04:57:27.087165117 CEST	21	52295	87.106.26.129	192.168.2.16
May 6, 2024 04:57:27.087327003 CEST	52295	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:27.092494011 CEST	21	52267	193.124.183.222	192.168.2.16
May 6, 2024 04:57:27.092581034 CEST	21	52267	193.124.183.222	192.168.2.16
May 6, 2024 04:57:27.092730999 CEST	52267	21	192.168.2.16	193.124.183.222
May 6, 2024 04:57:27.102057934 CEST	52257	21	192.168.2.16	79.154.231.25
May 6, 2024 04:57:27.102060080 CEST	52256	2121	192.168.2.16	79.154.231.25
May 6, 2024 04:57:27.102226973 CEST	52337	21	192.168.2.16	2.223.241.40
May 6, 2024 04:57:27.102231026 CEST	52258	21	192.168.2.16	94.210.242.120
May 6, 2024 04:57:27.109611988 CEST	21	52253	103.109.6.215	192.168.2.16
May 6, 2024 04:57:27.109719992 CEST	52253	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:27.117027998 CEST	52153	21	192.168.2.16	175.155.183.127
May 6, 2024 04:57:27.125263929 CEST	21	52318	34.128.145.40	192.168.2.16
May 6, 2024 04:57:27.125874043 CEST	21	52331	34.128.145.40	192.168.2.16
May 6, 2024 04:57:27.125931978 CEST	52331	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:27.132036924 CEST	52196	2121	192.168.2.16	185.246.189.89
May 6, 2024 04:57:27.133563042 CEST	2121	52321	34.128.145.40	192.168.2.16
May 6, 2024 04:57:27.133801937 CEST	2121	52332	34.128.145.40	192.168.2.16
May 6, 2024 04:57:27.133865118 CEST	52332	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:27.148035049 CEST	52260	2121	192.168.2.16	94.210.242.120
May 6, 2024 04:57:27.166248083 CEST	21	52326	81.88.252.91	192.168.2.16
May 6, 2024 04:57:27.166306973 CEST	52326	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:27.168124914 CEST	21	52248	81.88.252.91	192.168.2.16
May 6, 2024 04:57:27.173650026 CEST	21	52325	221.253.236.97	192.168.2.16
May 6, 2024 04:57:27.174545050 CEST	21	52323	154.210.32.21	192.168.2.16
May 6, 2024 04:57:27.174627066 CEST	52323	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:27.178925991 CEST	21	52223	154.210.32.21	192.168.2.16
May 6, 2024 04:57:27.189860106 CEST	2121	52327	221.253.236.97	192.168.2.16
May 6, 2024 04:57:27.196049929 CEST	52263	21	192.168.2.16	108.67.36.60
May 6, 2024 04:57:27.196348906 CEST	52338	2121	192.168.2.16	2.223.241.40
May 6, 2024 04:57:27.204376936 CEST	2121	52130	115.9.253.163	192.168.2.16
May 6, 2024 04:57:27.204747915 CEST	52339	21	192.168.2.16	177.241.126.50
May 6, 2024 04:57:27.212068081 CEST	52156	2121	192.168.2.16	175.155.183.127
May 6, 2024 04:57:27.212073088 CEST	52157	21	192.168.2.16	54.192.6.149
May 6, 2024 04:57:27.221041918 CEST	21	52262	149.154.65.23	192.168.2.16
May 6, 2024 04:57:27.221196890 CEST	52262	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:27.221412897 CEST	52340	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:27.222477913 CEST	21	52129	115.9.253.163	192.168.2.16
May 6, 2024 04:57:27.222872972 CEST	52341	2121	192.168.2.16	177.241.126.50
May 6, 2024 04:57:27.228049994 CEST	52264	2121	192.168.2.16	108.67.36.60
May 6, 2024 04:57:27.228079081 CEST	52158	2121	192.168.2.16	54.192.6.149
May 6, 2024 04:57:27.235626936 CEST	21	52331	34.128.145.40	192.168.2.16
May 6, 2024 04:57:27.235687017 CEST	52331	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:27.235754013 CEST	52331	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:27.235920906 CEST	52342	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:27.243494034 CEST	2121	52332	34.128.145.40	192.168.2.16
May 6, 2024 04:57:27.243552923 CEST	52332	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:27.243622065 CEST	52332	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:27.243781090 CEST	52343	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:27.244039059 CEST	52229	21	192.168.2.16	114.132.167.209
May 6, 2024 04:57:27.244060993 CEST	52265	21	192.168.2.16	87.1.68.206
May 6, 2024 04:57:27.244060993 CEST	52266	2121	192.168.2.16	87.1.68.206
May 6, 2024 04:57:27.256109953 CEST	2121	52268	179.35.49.149	192.168.2.16
May 6, 2024 04:57:27.260251999 CEST	52230	2121	192.168.2.16	114.132.167.209
May 6, 2024 04:57:27.260508060 CEST	52344	21	192.168.2.16	192.227.173.49
May 6, 2024 04:57:27.268625021 CEST	2121	52333	81.82.156.120	192.168.2.16
May 6, 2024 04:57:27.274914980 CEST	21	52334	81.82.156.120	192.168.2.16
May 6, 2024 04:57:27.276051998 CEST	52283	2121	192.168.2.16	58.239.189.34
May 6, 2024 04:57:27.276056051 CEST	52282	21	192.168.2.16	58.239.189.34
May 6, 2024 04:57:27.276154041 CEST	52269	21	192.168.2.16	179.35.49.149
May 6, 2024 04:57:27.292031050 CEST	52271	2121	192.168.2.16	80.158.18.247
May 6, 2024 04:57:27.306703091 CEST	21	52194	185.246.189.89	192.168.2.16
May 6, 2024 04:57:27.307066917 CEST	52270	21	192.168.2.16	80.158.18.247
May 6, 2024 04:57:27.315387964 CEST	21	52296	45.87.1.166	192.168.2.16
May 6, 2024 04:57:27.315516949 CEST	21	52295	87.106.26.129	192.168.2.16
May 6, 2024 04:57:27.315591097 CEST	21	52296	45.87.1.166	192.168.2.16
May 6, 2024 04:57:27.315720081 CEST	52296	21	192.168.2.16	45.87.1.166
May 6, 2024 04:57:27.315752029 CEST	21	52295	87.106.26.129	192.168.2.16
May 6, 2024 04:57:27.315901041 CEST	52295	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:27.332740068 CEST	2121	52136	121.129.13.128	192.168.2.16
May 6, 2024 04:57:27.334153891 CEST	21	52135	121.129.13.128	192.168.2.16
May 6, 2024 04:57:27.339039087 CEST	52272	21	192.168.2.16	79.61.53.83
May 6, 2024 04:57:27.339057922 CEST	52161	21	192.168.2.16	134.228.22.143
May 6, 2024 04:57:27.339059114 CEST	52162	2121	192.168.2.16	134.228.22.143
May 6, 2024 04:57:27.345463037 CEST	21	52331	34.128.145.40	192.168.2.16
May 6, 2024 04:57:27.345477104 CEST	21	52342	34.128.145.40	192.168.2.16
May 6, 2024 04:57:27.345571041 CEST	52342	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:27.346225977 CEST	21	52252	101.43.249.26	192.168.2.16
May 6, 2024 04:57:27.346237898 CEST	21	52252	101.43.249.26	192.168.2.16
May 6, 2024 04:57:27.346281052 CEST	52252	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:27.346900940 CEST	21	52330	101.43.249.26	192.168.2.16
May 6, 2024 04:57:27.346959114 CEST	52330	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:27.353113890 CEST	2121	52332	34.128.145.40	192.168.2.16
May 6, 2024 04:57:27.353174925 CEST	2121	52196	185.246.189.89	192.168.2.16
May 6, 2024 04:57:27.353378057 CEST	2121	52343	34.128.145.40	192.168.2.16
May 6, 2024 04:57:27.353434086 CEST	52343	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:27.355034113 CEST	52273	21	192.168.2.16	175.21.91.68
May 6, 2024 04:57:27.355037928 CEST	52184	21	192.168.2.16	14.215.46.243
May 6, 2024 04:57:27.355056047 CEST	52274	2121	192.168.2.16	79.61.53.83
May 6, 2024 04:57:27.355057001 CEST	52163	21	192.168.2.16	71.44.3.82
May 6, 2024 04:57:27.355377913 CEST	52345	21	192.168.2.16	107.13.194.110
May 6, 2024 04:57:27.355464935 CEST	52346	2121	192.168.2.16	192.227.173.49
May 6, 2024 04:57:27.376035929 CEST	52276	2121	192.168.2.16	175.21.91.68
May 6, 2024 04:57:27.386045933 CEST	52278	21	192.168.2.16	98.122.99.237
May 6, 2024 04:57:27.402033091 CEST	52176	21	192.168.2.16	153.154.186.17
May 6, 2024 04:57:27.403366089 CEST	52279	2121	192.168.2.16	98.122.99.237
May 6, 2024 04:57:27.409584045 CEST	21	52267	193.124.183.222	192.168.2.16
May 6, 2024 04:57:27.413312912 CEST	21	52344	192.227.173.49	192.168.2.16
May 6, 2024 04:57:27.417037010 CEST	52309	2121	192.168.2.16	90.176.5.124
May 6, 2024 04:57:27.417051077 CEST	52180	21	192.168.2.16	212.116.245.78
May 6, 2024 04:57:27.417058945 CEST	52190	21	192.168.2.16	61.184.1.110
May 6, 2024 04:57:27.417530060 CEST	52179	2121	192.168.2.16	153.154.186.17
May 6, 2024 04:57:27.417531967 CEST	52308	21	192.168.2.16	90.176.5.124
May 6, 2024 04:57:27.426028967 CEST	52280	21	192.168.2.16	27.57.253.243
May 6, 2024 04:57:27.426043034 CEST	52197	21	192.168.2.16	61.98.1.136
May 6, 2024 04:57:27.426043987 CEST	52181	2121	192.168.2.16	212.116.245.78
May 6, 2024 04:57:27.429233074 CEST	21	52326	81.88.252.91	192.168.2.16
May 6, 2024 04:57:27.429357052 CEST	52326	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:27.433068037 CEST	52199	2121	192.168.2.16	61.98.1.136
May 6, 2024 04:57:27.449063063 CEST	52281	2121	192.168.2.16	27.57.253.243
May 6, 2024 04:57:27.449063063 CEST	52303	2121	192.168.2.16	125.149.107.42
May 6, 2024 04:57:27.449064016 CEST	52302	21	192.168.2.16	125.149.107.42
May 6, 2024 04:57:27.449301004 CEST	52347	21	192.168.2.16	216.117.162.236
May 6, 2024 04:57:27.455144882 CEST	21	52342	34.128.145.40	192.168.2.16
May 6, 2024 04:57:27.455195904 CEST	52342	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:27.455261946 CEST	52342	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:27.455425024 CEST	52348	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:27.463289976 CEST	2121	52343	34.128.145.40	192.168.2.16
May 6, 2024 04:57:27.463335991 CEST	52343	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:27.463383913 CEST	52343	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:27.463546991 CEST	52349	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:27.465054035 CEST	52191	2121	192.168.2.16	61.184.1.110
May 6, 2024 04:57:27.481631041 CEST	21	52340	149.154.65.23	192.168.2.16
May 6, 2024 04:57:27.481698990 CEST	52340	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:27.481900930 CEST	21	52262	149.154.65.23	192.168.2.16
May 6, 2024 04:57:27.481956005 CEST	52262	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:27.484834909 CEST	21	52253	103.109.6.215	192.168.2.16
May 6, 2024 04:57:27.484983921 CEST	52253	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:27.485142946 CEST	52350	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:27.497051001 CEST	52286	21	192.168.2.16	54.220.74.193
May 6, 2024 04:57:27.509357929 CEST	2121	52346	192.227.173.49	192.168.2.16
May 6, 2024 04:57:27.513034105 CEST	52168	21	192.168.2.16	131.226.196.37
May 6, 2024 04:57:27.513134003 CEST	52287	2121	192.168.2.16	54.220.74.193
May 6, 2024 04:57:27.515495062 CEST	21	52323	154.210.32.21	192.168.2.16
May 6, 2024 04:57:27.515650034 CEST	52323	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:27.529063940 CEST	52288	21	192.168.2.16	203.167.20.180
May 6, 2024 04:57:27.544452906 CEST	21	52295	87.106.26.129	192.168.2.16
May 6, 2024 04:57:27.544605017 CEST	52295	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:27.544838905 CEST	52351	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:27.561055899 CEST	52289	2121	192.168.2.16	203.167.20.180
May 6, 2024 04:57:27.564825058 CEST	21	52342	34.128.145.40	192.168.2.16
May 6, 2024 04:57:27.564954996 CEST	21	52348	34.128.145.40	192.168.2.16
May 6, 2024 04:57:27.565043926 CEST	52348	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:27.567929029 CEST	21	52180	212.116.245.78	192.168.2.16
May 6, 2024 04:57:27.568306923 CEST	52352	2121	192.168.2.16	107.13.194.110
May 6, 2024 04:57:27.572932005 CEST	2121	52349	34.128.145.40	192.168.2.16
May 6, 2024 04:57:27.572983980 CEST	52349	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:27.573085070 CEST	2121	52343	34.128.145.40	192.168.2.16
May 6, 2024 04:57:27.575963974 CEST	2121	52181	212.116.245.78	192.168.2.16
May 6, 2024 04:57:27.577043056 CEST	52169	21	192.168.2.16	152.179.110.81
May 6, 2024 04:57:27.577065945 CEST	52291	21	192.168.2.16	134.158.73.30
May 6, 2024 04:57:27.577066898 CEST	52292	2121	192.168.2.16	134.158.73.30
May 6, 2024 04:57:27.577066898 CEST	52170	2121	192.168.2.16	131.226.196.37
May 6, 2024 04:57:27.590727091 CEST	21	52296	45.87.1.166	192.168.2.16
May 6, 2024 04:57:27.590883017 CEST	2121	52283	58.239.189.34	192.168.2.16
May 6, 2024 04:57:27.593031883 CEST	52294	21	192.168.2.16	76.168.230.178
May 6, 2024 04:57:27.593338966 CEST	52353	21	192.168.2.16	91.144.198.131
May 6, 2024 04:57:27.593791962 CEST	21	52229	114.132.167.209	192.168.2.16
May 6, 2024 04:57:27.611565113 CEST	21	52282	58.239.189.34	192.168.2.16
May 6, 2024 04:57:27.622507095 CEST	2121	52230	114.132.167.209	192.168.2.16
May 6, 2024 04:57:27.624037981 CEST	52300	21	192.168.2.16	123.144.156.102
May 6, 2024 04:57:27.624058008 CEST	52297	2121	192.168.2.16	76.168.230.178
May 6, 2024 04:57:27.624058008 CEST	52298	21	192.168.2.16	119.179.199.58
May 6, 2024 04:57:27.624059916 CEST	52172	21	192.168.2.16	98.67.131.230
May 6, 2024 04:57:27.624059916 CEST	52173	2121	192.168.2.16	152.179.110.81
May 6, 2024 04:57:27.639043093 CEST	52299	2121	192.168.2.16	119.179.199.58
May 6, 2024 04:57:27.639164925 CEST	52175	2121	192.168.2.16	98.67.131.230
May 6, 2024 04:57:27.639362097 CEST	52354	2121	192.168.2.16	91.144.198.131
May 6, 2024 04:57:27.650531054 CEST	2121	52309	90.176.5.124	192.168.2.16
May 6, 2024 04:57:27.650849104 CEST	21	52308	90.176.5.124	192.168.2.16
May 6, 2024 04:57:27.655030966 CEST	52305	2121	192.168.2.16	47.188.208.116
May 6, 2024 04:57:27.655031919 CEST	52304	21	192.168.2.16	47.188.208.116
May 6, 2024 04:57:27.655045986 CEST	52301	2121	192.168.2.16	123.144.156.102
May 6, 2024 04:57:27.655380964 CEST	52355	21	192.168.2.16	119.190.208.194
May 6, 2024 04:57:27.671036959 CEST	52307	2121	192.168.2.16	188.32.44.25
May 6, 2024 04:57:27.671041965 CEST	52306	21	192.168.2.16	188.32.44.25
May 6, 2024 04:57:27.675041914 CEST	21	52348	34.128.145.40	192.168.2.16
May 6, 2024 04:57:27.675102949 CEST	52348	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:27.675148010 CEST	52348	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:27.675285101 CEST	52356	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:27.683578014 CEST	2121	52349	34.128.145.40	192.168.2.16
May 6, 2024 04:57:27.683631897 CEST	52349	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:27.683716059 CEST	52349	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:27.683904886 CEST	52357	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:27.687033892 CEST	52325	21	192.168.2.16	221.253.236.97
May 6, 2024 04:57:27.687051058 CEST	52310	21	192.168.2.16	104.98.95.157
May 6, 2024 04:57:27.687051058 CEST	52311	2121	192.168.2.16	104.98.95.157
May 6, 2024 04:57:27.689353943 CEST	21	52330	101.43.249.26	192.168.2.16
May 6, 2024 04:57:27.689522028 CEST	52330	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:27.692434072 CEST	21	52326	81.88.252.91	192.168.2.16
May 6, 2024 04:57:27.692554951 CEST	52326	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:27.702438116 CEST	21	52184	14.215.46.243	192.168.2.16
May 6, 2024 04:57:27.703053951 CEST	52327	2121	192.168.2.16	221.253.236.97
May 6, 2024 04:57:27.735035896 CEST	52312	21	192.168.2.16	190.112.22.137
May 6, 2024 04:57:27.735055923 CEST	52313	2121	192.168.2.16	190.112.22.137
May 6, 2024 04:57:27.745526075 CEST	21	52340	149.154.65.23	192.168.2.16
May 6, 2024 04:57:27.745672941 CEST	52340	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:27.747315884 CEST	21	52197	61.98.1.136	192.168.2.16
May 6, 2024 04:57:27.750052929 CEST	52314	21	192.168.2.16	183.184.150.128
May 6, 2024 04:57:27.754383087 CEST	2121	52199	61.98.1.136	192.168.2.16
May 6, 2024 04:57:27.758481979 CEST	2121	52303	125.149.107.42	192.168.2.16
May 6, 2024 04:57:27.758492947 CEST	21	52302	125.149.107.42	192.168.2.16
May 6, 2024 04:57:27.758519888 CEST	21	52176	153.154.186.17	192.168.2.16
May 6, 2024 04:57:27.766253948 CEST	52268	2121	192.168.2.16	179.35.49.149
May 6, 2024 04:57:27.769083977 CEST	21	52351	87.106.26.129	192.168.2.16
May 6, 2024 04:57:27.769157887 CEST	52351	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:27.772245884 CEST	2121	52179	153.154.186.17	192.168.2.16
May 6, 2024 04:57:27.773169041 CEST	21	52190	61.184.1.110	192.168.2.16
May 6, 2024 04:57:27.775007963 CEST	21	52295	87.106.26.129	192.168.2.16
May 6, 2024 04:57:27.775062084 CEST	52295	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:27.782033920 CEST	52315	21	192.168.2.16	73.130.233.160
May 6, 2024 04:57:27.782052040 CEST	52333	2121	192.168.2.16	81.82.156.120
May 6, 2024 04:57:27.782052994 CEST	52316	2121	192.168.2.16	183.184.150.128
May 6, 2024 04:57:27.782052994 CEST	52334	21	192.168.2.16	81.82.156.120
May 6, 2024 04:57:27.785121918 CEST	21	52348	34.128.145.40	192.168.2.16
May 6, 2024 04:57:27.785437107 CEST	21	52356	34.128.145.40	192.168.2.16
May 6, 2024 04:57:27.785501003 CEST	52356	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:27.794308901 CEST	2121	52349	34.128.145.40	192.168.2.16
May 6, 2024 04:57:27.794959068 CEST	2121	52357	34.128.145.40	192.168.2.16
May 6, 2024 04:57:27.795023918 CEST	52357	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:27.798038960 CEST	52317	2121	192.168.2.16	73.130.233.160
May 6, 2024 04:57:27.813057899 CEST	52182	21	192.168.2.16	181.56.197.98
May 6, 2024 04:57:27.813059092 CEST	52183	2121	192.168.2.16	181.56.197.98
May 6, 2024 04:57:27.813057899 CEST	52320	21	192.168.2.16	189.86.157.30
May 6, 2024 04:57:27.813059092 CEST	52319	2121	192.168.2.16	189.86.157.30
May 6, 2024 04:57:27.813057899 CEST	52185	2121	192.168.2.16	14.215.46.243
May 6, 2024 04:57:27.814201117 CEST	52194	21	192.168.2.16	185.246.189.89
May 6, 2024 04:57:27.829039097 CEST	52186	21	192.168.2.16	139.59.195.201
May 6, 2024 04:57:27.829040051 CEST	52322	21	192.168.2.16	119.179.81.209
May 6, 2024 04:57:27.830379963 CEST	2121	52191	61.184.1.110	192.168.2.16
May 6, 2024 04:57:27.845051050 CEST	52189	2121	192.168.2.16	139.59.195.201
May 6, 2024 04:57:27.847588062 CEST	21	52350	103.109.6.215	192.168.2.16
May 6, 2024 04:57:27.847671032 CEST	52350	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:27.854950905 CEST	21	52323	154.210.32.21	192.168.2.16
May 6, 2024 04:57:27.855030060 CEST	21	52323	154.210.32.21	192.168.2.16
May 6, 2024 04:57:27.855145931 CEST	52323	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:27.858603001 CEST	21	52253	103.109.6.215	192.168.2.16
May 6, 2024 04:57:27.858613968 CEST	21	52253	103.109.6.215	192.168.2.16
May 6, 2024 04:57:27.858658075 CEST	52253	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:27.861051083 CEST	52196	2121	192.168.2.16	185.246.189.89
May 6, 2024 04:57:27.877037048 CEST	52324	2121	192.168.2.16	119.179.81.209
May 6, 2024 04:57:27.877053976 CEST	52192	21	192.168.2.16	72.200.111.213
May 6, 2024 04:57:27.895312071 CEST	21	52356	34.128.145.40	192.168.2.16
May 6, 2024 04:57:27.895370960 CEST	52356	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:27.895577908 CEST	52356	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:27.895772934 CEST	52358	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:27.904577971 CEST	2121	52357	34.128.145.40	192.168.2.16
May 6, 2024 04:57:27.904638052 CEST	52357	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:27.904697895 CEST	52357	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:27.904856920 CEST	52359	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:27.908047915 CEST	52193	2121	192.168.2.16	72.200.111.213
May 6, 2024 04:57:27.924031019 CEST	52344	21	192.168.2.16	192.227.173.49
May 6, 2024 04:57:27.940051079 CEST	52328	21	192.168.2.16	92.46.161.160
May 6, 2024 04:57:27.978868961 CEST	21	52325	221.253.236.97	192.168.2.16
May 6, 2024 04:57:27.979764938 CEST	2121	52327	221.253.236.97	192.168.2.16
May 6, 2024 04:57:27.986701012 CEST	21	52326	81.88.252.91	192.168.2.16
May 6, 2024 04:57:27.988517046 CEST	21	52326	81.88.252.91	192.168.2.16
May 6, 2024 04:57:27.988528013 CEST	21	52326	81.88.252.91	192.168.2.16
May 6, 2024 04:57:27.988821030 CEST	52360	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:27.999109030 CEST	2121	52268	179.35.49.149	192.168.2.16
May 6, 2024 04:57:28.005103111 CEST	21	52356	34.128.145.40	192.168.2.16
May 6, 2024 04:57:28.005368948 CEST	21	52358	34.128.145.40	192.168.2.16
May 6, 2024 04:57:28.005426884 CEST	52358	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:28.005539894 CEST	21	52340	149.154.65.23	192.168.2.16
May 6, 2024 04:57:28.005944967 CEST	21	52340	149.154.65.23	192.168.2.16
May 6, 2024 04:57:28.006103992 CEST	52340	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:28.014168024 CEST	2121	52357	34.128.145.40	192.168.2.16
May 6, 2024 04:57:28.014461994 CEST	2121	52359	34.128.145.40	192.168.2.16
May 6, 2024 04:57:28.014518023 CEST	52359	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:28.016488075 CEST	21	52351	87.106.26.129	192.168.2.16
May 6, 2024 04:57:28.016608000 CEST	52351	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:28.016664028 CEST	21	52334	81.82.156.120	192.168.2.16
May 6, 2024 04:57:28.017364025 CEST	2121	52333	81.82.156.120	192.168.2.16
May 6, 2024 04:57:28.019037008 CEST	52346	2121	192.168.2.16	192.227.173.49
May 6, 2024 04:57:28.019058943 CEST	52329	2121	192.168.2.16	92.46.161.160
May 6, 2024 04:57:28.029597044 CEST	21	52330	101.43.249.26	192.168.2.16
May 6, 2024 04:57:28.029707909 CEST	52330	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:28.029930115 CEST	52361	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:28.033665895 CEST	21	52194	185.246.189.89	192.168.2.16
May 6, 2024 04:57:28.051554918 CEST	52362	2121	192.168.2.16	119.190.208.194
May 6, 2024 04:57:28.051681042 CEST	52363	21	192.168.2.16	218.31.124.41
May 6, 2024 04:57:28.082191944 CEST	2121	52196	185.246.189.89	192.168.2.16
May 6, 2024 04:57:28.083034992 CEST	52205	21	192.168.2.16	73.193.19.69
May 6, 2024 04:57:28.083039999 CEST	52335	21	192.168.2.16	73.36.52.115
May 6, 2024 04:57:28.083528042 CEST	52204	2121	192.168.2.16	208.106.130.31
May 6, 2024 04:57:28.083806038 CEST	52364	2121	192.168.2.16	218.31.124.41
May 6, 2024 04:57:28.083935976 CEST	52365	21	192.168.2.16	170.250.175.90
May 6, 2024 04:57:28.083940029 CEST	52366	2121	192.168.2.16	170.250.175.90
May 6, 2024 04:57:28.083956003 CEST	52367	21	192.168.2.16	71.222.180.45
May 6, 2024 04:57:28.083981991 CEST	52368	2121	192.168.2.16	71.222.180.45
May 6, 2024 04:57:28.094069004 CEST	21	52344	192.227.173.49	192.168.2.16
May 6, 2024 04:57:28.099030972 CEST	52336	2121	192.168.2.16	73.36.52.115
May 6, 2024 04:57:28.099056959 CEST	52283	2121	192.168.2.16	58.239.189.34
May 6, 2024 04:57:28.099088907 CEST	52229	21	192.168.2.16	114.132.167.209
May 6, 2024 04:57:28.099869967 CEST	52370	21	192.168.2.16	39.123.55.26
May 6, 2024 04:57:28.099926949 CEST	52371	2121	192.168.2.16	39.123.55.26
May 6, 2024 04:57:28.099972963 CEST	52372	21	192.168.2.16	23.194.151.45
May 6, 2024 04:57:28.099986076 CEST	52373	21	192.168.2.16	27.210.218.131
May 6, 2024 04:57:28.100039959 CEST	52369	2121	192.168.2.16	93.218.237.16
May 6, 2024 04:57:28.100048065 CEST	52374	2121	192.168.2.16	23.194.151.45
May 6, 2024 04:57:28.100092888 CEST	52375	21	192.168.2.16	93.218.237.16
May 6, 2024 04:57:28.115042925 CEST	52337	21	192.168.2.16	2.223.241.40
May 6, 2024 04:57:28.115057945 CEST	52207	2121	192.168.2.16	73.193.19.69
May 6, 2024 04:57:28.115058899 CEST	52282	21	192.168.2.16	58.239.189.34
May 6, 2024 04:57:28.115082026 CEST	21	52358	34.128.145.40	192.168.2.16
May 6, 2024 04:57:28.115143061 CEST	52358	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:28.115272045 CEST	52358	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:28.115500927 CEST	52376	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:28.115638018 CEST	52378	21	192.168.2.16	201.108.85.182
May 6, 2024 04:57:28.115638971 CEST	52377	2121	192.168.2.16	27.210.218.131
May 6, 2024 04:57:28.125334978 CEST	2121	52359	34.128.145.40	192.168.2.16
May 6, 2024 04:57:28.125392914 CEST	52359	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:28.125438929 CEST	52359	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:28.125571966 CEST	52379	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:28.131062984 CEST	52230	2121	192.168.2.16	114.132.167.209
May 6, 2024 04:57:28.131350994 CEST	52380	2121	192.168.2.16	201.108.85.182
May 6, 2024 04:57:28.131423950 CEST	52381	21	192.168.2.16	81.221.225.19
May 6, 2024 04:57:28.147654057 CEST	52382	2121	192.168.2.16	81.221.225.19
May 6, 2024 04:57:28.147805929 CEST	52383	21	192.168.2.16	34.122.87.209
May 6, 2024 04:57:28.147860050 CEST	52384	2121	192.168.2.16	34.122.87.209
May 6, 2024 04:57:28.163036108 CEST	52209	21	192.168.2.16	66.68.64.135
May 6, 2024 04:57:28.163054943 CEST	52208	2121	192.168.2.16	66.68.64.135
May 6, 2024 04:57:28.163054943 CEST	52309	2121	192.168.2.16	90.176.5.124
May 6, 2024 04:57:28.163057089 CEST	52308	21	192.168.2.16	90.176.5.124
May 6, 2024 04:57:28.195050955 CEST	52210	21	192.168.2.16	106.221.58.193
May 6, 2024 04:57:28.195298910 CEST	52385	21	192.168.2.16	67.149.12.87
May 6, 2024 04:57:28.196486950 CEST	2121	52346	192.227.173.49	192.168.2.16
May 6, 2024 04:57:28.202940941 CEST	21	52323	154.210.32.21	192.168.2.16
May 6, 2024 04:57:28.203077078 CEST	52323	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:28.203241110 CEST	52386	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:28.203526020 CEST	21	52323	154.210.32.21	192.168.2.16
May 6, 2024 04:57:28.203571081 CEST	52323	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:28.211036921 CEST	52184	21	192.168.2.16	14.215.46.243
May 6, 2024 04:57:28.211050987 CEST	52338	2121	192.168.2.16	2.223.241.40
May 6, 2024 04:57:28.211219072 CEST	52339	21	192.168.2.16	177.241.126.50
May 6, 2024 04:57:28.211451054 CEST	52387	2121	192.168.2.16	67.149.12.87
May 6, 2024 04:57:28.211479902 CEST	52388	21	192.168.2.16	154.149.91.78
May 6, 2024 04:57:28.211679935 CEST	21	52350	103.109.6.215	192.168.2.16
May 6, 2024 04:57:28.211744070 CEST	52211	2121	192.168.2.16	106.221.58.193
May 6, 2024 04:57:28.211795092 CEST	52350	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:28.224793911 CEST	21	52358	34.128.145.40	192.168.2.16
May 6, 2024 04:57:28.225153923 CEST	21	52376	34.128.145.40	192.168.2.16
May 6, 2024 04:57:28.225213051 CEST	52376	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:28.225575924 CEST	52341	2121	192.168.2.16	177.241.126.50
May 6, 2024 04:57:28.234980106 CEST	2121	52359	34.128.145.40	192.168.2.16
May 6, 2024 04:57:28.235146046 CEST	2121	52379	34.128.145.40	192.168.2.16
May 6, 2024 04:57:28.235227108 CEST	52379	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:28.240417004 CEST	21	52351	87.106.26.129	192.168.2.16
May 6, 2024 04:57:28.240596056 CEST	21	52351	87.106.26.129	192.168.2.16
May 6, 2024 04:57:28.240755081 CEST	52351	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:28.254152060 CEST	21	52360	81.88.252.91	192.168.2.16
May 6, 2024 04:57:28.254229069 CEST	52360	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:28.259063959 CEST	52197	21	192.168.2.16	61.98.1.136
May 6, 2024 04:57:28.259239912 CEST	52303	2121	192.168.2.16	125.149.107.42
May 6, 2024 04:57:28.259269953 CEST	52302	21	192.168.2.16	125.149.107.42
May 6, 2024 04:57:28.263428926 CEST	52199	2121	192.168.2.16	61.98.1.136
May 6, 2024 04:57:28.263430119 CEST	52176	21	192.168.2.16	153.154.186.17
May 6, 2024 04:57:28.268368959 CEST	21	52340	149.154.65.23	192.168.2.16
May 6, 2024 04:57:28.268529892 CEST	52340	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:28.268785954 CEST	52389	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:28.275041103 CEST	52190	21	192.168.2.16	61.184.1.110
May 6, 2024 04:57:28.275042057 CEST	52213	21	192.168.2.16	37.221.67.225
May 6, 2024 04:57:28.275120020 CEST	52179	2121	192.168.2.16	153.154.186.17
May 6, 2024 04:57:28.307053089 CEST	52215	2121	192.168.2.16	37.221.67.225
May 6, 2024 04:57:28.334846020 CEST	21	52376	34.128.145.40	192.168.2.16
May 6, 2024 04:57:28.334913015 CEST	52376	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:28.334952116 CEST	52376	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:28.335127115 CEST	52390	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:28.339060068 CEST	52191	2121	192.168.2.16	61.184.1.110
May 6, 2024 04:57:28.345132113 CEST	2121	52379	34.128.145.40	192.168.2.16
May 6, 2024 04:57:28.345186949 CEST	52379	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:28.345264912 CEST	52379	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:28.345453978 CEST	52391	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:28.355056047 CEST	52217	2121	192.168.2.16	76.152.71.214
May 6, 2024 04:57:28.355061054 CEST	52216	21	192.168.2.16	76.152.71.214
May 6, 2024 04:57:28.355163097 CEST	52345	21	192.168.2.16	107.13.194.110
May 6, 2024 04:57:28.355165005 CEST	52218	21	192.168.2.16	98.230.137.147
May 6, 2024 04:57:28.371006012 CEST	21	52330	101.43.249.26	192.168.2.16
May 6, 2024 04:57:28.371018887 CEST	21	52330	101.43.249.26	192.168.2.16
May 6, 2024 04:57:28.371031046 CEST	52219	2121	192.168.2.16	98.230.137.147
May 6, 2024 04:57:28.371062040 CEST	52330	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:28.378112078 CEST	21	52361	101.43.249.26	192.168.2.16
May 6, 2024 04:57:28.378165960 CEST	52361	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:28.387049913 CEST	52221	2121	192.168.2.16	176.22.193.151
May 6, 2024 04:57:28.395034075 CEST	52220	21	192.168.2.16	176.22.193.151
May 6, 2024 04:57:28.397857904 CEST	2121	52309	90.176.5.124	192.168.2.16
May 6, 2024 04:57:28.397871017 CEST	21	52308	90.176.5.124	192.168.2.16
May 6, 2024 04:57:28.414376974 CEST	2121	52283	58.239.189.34	192.168.2.16
May 6, 2024 04:57:28.418304920 CEST	52392	2121	192.168.2.16	154.149.91.78
May 6, 2024 04:57:28.433109045 CEST	52222	21	192.168.2.16	72.238.232.239
May 6, 2024 04:57:28.433355093 CEST	52393	21	192.168.2.16	119.27.33.10
May 6, 2024 04:57:28.441453934 CEST	21	52363	218.31.124.41	192.168.2.16
May 6, 2024 04:57:28.444561005 CEST	21	52376	34.128.145.40	192.168.2.16
May 6, 2024 04:57:28.445658922 CEST	21	52390	34.128.145.40	192.168.2.16
May 6, 2024 04:57:28.445723057 CEST	52390	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:28.447463036 CEST	21	52373	27.210.218.131	192.168.2.16
May 6, 2024 04:57:28.448472977 CEST	52394	2121	192.168.2.16	119.27.33.10
May 6, 2024 04:57:28.449570894 CEST	21	52229	114.132.167.209	192.168.2.16
May 6, 2024 04:57:28.452239990 CEST	21	52282	58.239.189.34	192.168.2.16
May 6, 2024 04:57:28.455374956 CEST	2121	52391	34.128.145.40	192.168.2.16
May 6, 2024 04:57:28.455394983 CEST	2121	52379	34.128.145.40	192.168.2.16
May 6, 2024 04:57:28.455436945 CEST	52391	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:28.464040995 CEST	52347	21	192.168.2.16	216.117.162.236
May 6, 2024 04:57:28.464965105 CEST	21	52351	87.106.26.129	192.168.2.16
May 6, 2024 04:57:28.465102911 CEST	52351	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:28.465302944 CEST	52395	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:28.480063915 CEST	52325	21	192.168.2.16	221.253.236.97
May 6, 2024 04:57:28.480065107 CEST	52327	2121	192.168.2.16	221.253.236.97
May 6, 2024 04:57:28.480319977 CEST	52396	21	192.168.2.16	73.107.61.210
May 6, 2024 04:57:28.482629061 CEST	2121	52377	27.210.218.131	192.168.2.16
May 6, 2024 04:57:28.486722946 CEST	2121	52364	218.31.124.41	192.168.2.16
May 6, 2024 04:57:28.493268967 CEST	2121	52230	114.132.167.209	192.168.2.16
May 6, 2024 04:57:28.512061119 CEST	52226	2121	192.168.2.16	72.238.232.239
May 6, 2024 04:57:28.512063980 CEST	52227	21	192.168.2.16	108.156.205.118
May 6, 2024 04:57:28.513607025 CEST	52268	2121	192.168.2.16	179.35.49.149
May 6, 2024 04:57:28.524130106 CEST	21	52389	149.154.65.23	192.168.2.16
May 6, 2024 04:57:28.524198055 CEST	52389	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:28.527710915 CEST	21	52360	81.88.252.91	192.168.2.16
May 6, 2024 04:57:28.527842999 CEST	52360	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:28.528033972 CEST	52334	21	192.168.2.16	81.82.156.120
May 6, 2024 04:57:28.528036118 CEST	52228	2121	192.168.2.16	108.156.205.118
May 6, 2024 04:57:28.528419971 CEST	52333	2121	192.168.2.16	81.82.156.120
May 6, 2024 04:57:28.528420925 CEST	52397	2121	192.168.2.16	73.107.61.210
May 6, 2024 04:57:28.528491974 CEST	52398	21	192.168.2.16	119.163.63.142
May 6, 2024 04:57:28.528832912 CEST	21	52340	149.154.65.23	192.168.2.16
May 6, 2024 04:57:28.528886080 CEST	52340	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:28.536556005 CEST	21	52386	154.210.32.21	192.168.2.16
May 6, 2024 04:57:28.536613941 CEST	52386	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:28.542460918 CEST	21	52323	154.210.32.21	192.168.2.16
May 6, 2024 04:57:28.544380903 CEST	52399	2121	192.168.2.16	119.163.63.142
May 6, 2024 04:57:28.556972980 CEST	21	52390	34.128.145.40	192.168.2.16
May 6, 2024 04:57:28.557048082 CEST	52390	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:28.557115078 CEST	52390	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:28.557285070 CEST	52400	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:28.557946920 CEST	21	52184	14.215.46.243	192.168.2.16
May 6, 2024 04:57:28.558279037 CEST	52401	21	192.168.2.16	90.195.150.30
May 6, 2024 04:57:28.560043097 CEST	52231	21	192.168.2.16	188.218.189.237
May 6, 2024 04:57:28.565520048 CEST	2121	52391	34.128.145.40	192.168.2.16
May 6, 2024 04:57:28.565577984 CEST	52391	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:28.565644026 CEST	52391	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:28.565812111 CEST	52402	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:28.566191912 CEST	2121	52303	125.149.107.42	192.168.2.16
May 6, 2024 04:57:28.567827940 CEST	21	52302	125.149.107.42	192.168.2.16
May 6, 2024 04:57:28.574259043 CEST	21	52350	103.109.6.215	192.168.2.16
May 6, 2024 04:57:28.574407101 CEST	52350	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:28.576061964 CEST	52352	2121	192.168.2.16	107.13.194.110
May 6, 2024 04:57:28.576407909 CEST	52232	2121	192.168.2.16	188.218.189.237
May 6, 2024 04:57:28.576407909 CEST	52403	2121	192.168.2.16	90.195.150.30
May 6, 2024 04:57:28.578970909 CEST	21	52197	61.98.1.136	192.168.2.16
May 6, 2024 04:57:28.585026979 CEST	2121	52199	61.98.1.136	192.168.2.16
May 6, 2024 04:57:28.592031002 CEST	52234	21	192.168.2.16	93.223.177.152
May 6, 2024 04:57:28.592034101 CEST	52236	21	192.168.2.16	68.52.102.207
May 6, 2024 04:57:28.592303038 CEST	52235	2121	192.168.2.16	93.223.177.152
May 6, 2024 04:57:28.592303038 CEST	52404	21	192.168.2.16	49.172.220.154
May 6, 2024 04:57:28.597692013 CEST	21	52176	153.154.186.17	192.168.2.16
May 6, 2024 04:57:28.598037004 CEST	52405	2121	192.168.2.16	49.172.220.154
May 6, 2024 04:57:28.608036995 CEST	52344	21	192.168.2.16	192.227.173.49
May 6, 2024 04:57:28.608066082 CEST	52353	21	192.168.2.16	91.144.198.131
May 6, 2024 04:57:28.608315945 CEST	52406	21	192.168.2.16	52.237.175.110
May 6, 2024 04:57:28.611799002 CEST	2121	52179	153.154.186.17	192.168.2.16
May 6, 2024 04:57:28.612188101 CEST	52407	2121	192.168.2.16	52.237.175.110
May 6, 2024 04:57:28.629987955 CEST	21	52190	61.184.1.110	192.168.2.16
May 6, 2024 04:57:28.640074015 CEST	52237	2121	192.168.2.16	68.52.102.207
May 6, 2024 04:57:28.640074015 CEST	52354	2121	192.168.2.16	91.144.198.131
May 6, 2024 04:57:28.640381098 CEST	52239	2121	192.168.2.16	32.216.64.98
May 6, 2024 04:57:28.645049095 CEST	52238	21	192.168.2.16	32.216.64.98
May 6, 2024 04:57:28.655061960 CEST	52355	21	192.168.2.16	119.190.208.194
May 6, 2024 04:57:28.655401945 CEST	52408	21	192.168.2.16	54.36.99.119
May 6, 2024 04:57:28.667855024 CEST	21	52390	34.128.145.40	192.168.2.16
May 6, 2024 04:57:28.667866945 CEST	21	52400	34.128.145.40	192.168.2.16
May 6, 2024 04:57:28.667931080 CEST	52400	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:28.675827026 CEST	2121	52391	34.128.145.40	192.168.2.16
May 6, 2024 04:57:28.675977945 CEST	2121	52402	34.128.145.40	192.168.2.16
May 6, 2024 04:57:28.676040888 CEST	52402	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:28.689666986 CEST	2121	52285	168.220.94.137	192.168.2.16
May 6, 2024 04:57:28.689717054 CEST	52285	2121	192.168.2.16	168.220.94.137
May 6, 2024 04:57:28.691020966 CEST	21	52351	87.106.26.129	192.168.2.16
May 6, 2024 04:57:28.691066980 CEST	52351	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:28.693944931 CEST	21	52395	87.106.26.129	192.168.2.16
May 6, 2024 04:57:28.694003105 CEST	52395	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:28.697092056 CEST	21	52284	168.220.94.137	192.168.2.16
May 6, 2024 04:57:28.697138071 CEST	52284	21	192.168.2.16	168.220.94.137
May 6, 2024 04:57:28.703056097 CEST	52346	2121	192.168.2.16	192.227.173.49
May 6, 2024 04:57:28.703927994 CEST	2121	52191	61.184.1.110	192.168.2.16
May 6, 2024 04:57:28.719034910 CEST	52242	21	192.168.2.16	80.115.43.206
May 6, 2024 04:57:28.719660044 CEST	52409	2121	192.168.2.16	54.36.99.119
May 6, 2024 04:57:28.719789982 CEST	52411	2121	192.168.2.16	126.89.102.124
May 6, 2024 04:57:28.719791889 CEST	52410	21	192.168.2.16	126.89.102.124
May 6, 2024 04:57:28.726471901 CEST	21	52361	101.43.249.26	192.168.2.16
May 6, 2024 04:57:28.726617098 CEST	52361	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:28.747282982 CEST	2121	52268	179.35.49.149	192.168.2.16
May 6, 2024 04:57:28.751056910 CEST	52244	2121	192.168.2.16	80.115.43.206
May 6, 2024 04:57:28.755237103 CEST	2121	52333	81.82.156.120	192.168.2.16
May 6, 2024 04:57:28.755531073 CEST	21	52334	81.82.156.120	192.168.2.16
May 6, 2024 04:57:28.756861925 CEST	2121	52327	221.253.236.97	192.168.2.16
May 6, 2024 04:57:28.772373915 CEST	21	52325	221.253.236.97	192.168.2.16
May 6, 2024 04:57:28.778754950 CEST	21	52400	34.128.145.40	192.168.2.16
May 6, 2024 04:57:28.778819084 CEST	52400	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:28.778878927 CEST	52400	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:28.779139042 CEST	52412	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:28.783422947 CEST	52413	21	192.168.2.16	123.117.121.246
May 6, 2024 04:57:28.783664942 CEST	21	52389	149.154.65.23	192.168.2.16
May 6, 2024 04:57:28.783808947 CEST	52389	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:28.785788059 CEST	2121	52402	34.128.145.40	192.168.2.16
May 6, 2024 04:57:28.785840034 CEST	52402	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:28.785878897 CEST	52402	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:28.786017895 CEST	52414	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:28.789083958 CEST	21	51996	168.220.94.137	192.168.2.16
May 6, 2024 04:57:28.789096117 CEST	2121	51995	168.220.94.137	192.168.2.16
May 6, 2024 04:57:28.789127111 CEST	51996	21	192.168.2.16	168.220.94.137
May 6, 2024 04:57:28.789164066 CEST	51995	2121	192.168.2.16	168.220.94.137
May 6, 2024 04:57:28.797554016 CEST	21	52360	81.88.252.91	192.168.2.16
May 6, 2024 04:57:28.797566891 CEST	21	52344	192.227.173.49	192.168.2.16
May 6, 2024 04:57:28.797679901 CEST	52360	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:28.815392971 CEST	52415	2121	192.168.2.16	123.117.121.246
May 6, 2024 04:57:28.815418005 CEST	52416	21	192.168.2.16	119.245.126.206
May 6, 2024 04:57:28.831034899 CEST	52245	21	192.168.2.16	171.107.43.59
May 6, 2024 04:57:28.847070932 CEST	52246	2121	192.168.2.16	171.107.43.59
May 6, 2024 04:57:28.847274065 CEST	52247	21	192.168.2.16	79.56.181.220
May 6, 2024 04:57:28.863338947 CEST	52417	2121	192.168.2.16	119.245.126.206
May 6, 2024 04:57:28.871448994 CEST	21	52386	154.210.32.21	192.168.2.16
May 6, 2024 04:57:28.871629953 CEST	52386	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:28.879242897 CEST	52418	21	192.168.2.16	201.105.104.191
May 6, 2024 04:57:28.881447077 CEST	21	52408	54.36.99.119	192.168.2.16
May 6, 2024 04:57:28.888465881 CEST	21	52400	34.128.145.40	192.168.2.16
May 6, 2024 04:57:28.888636112 CEST	21	52412	34.128.145.40	192.168.2.16
May 6, 2024 04:57:28.888699055 CEST	52412	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:28.895067930 CEST	52249	2121	192.168.2.16	79.56.181.220
May 6, 2024 04:57:28.895756960 CEST	2121	52414	34.128.145.40	192.168.2.16
May 6, 2024 04:57:28.895929098 CEST	52414	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:28.896301985 CEST	2121	52402	34.128.145.40	192.168.2.16
May 6, 2024 04:57:28.898705959 CEST	2121	52346	192.227.173.49	192.168.2.16
May 6, 2024 04:57:28.911067963 CEST	52308	21	192.168.2.16	90.176.5.124
May 6, 2024 04:57:28.911067009 CEST	52309	2121	192.168.2.16	90.176.5.124
May 6, 2024 04:57:28.927066088 CEST	52283	2121	192.168.2.16	58.239.189.34
May 6, 2024 04:57:28.938108921 CEST	21	52350	103.109.6.215	192.168.2.16
May 6, 2024 04:57:28.938254118 CEST	52350	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:28.938448906 CEST	52419	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:28.938997984 CEST	2121	52409	54.36.99.119	192.168.2.16
May 6, 2024 04:57:28.943070889 CEST	52363	21	192.168.2.16	218.31.124.41
May 6, 2024 04:57:28.946865082 CEST	21	52395	87.106.26.129	192.168.2.16
May 6, 2024 04:57:28.947096109 CEST	52395	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:28.959070921 CEST	52373	21	192.168.2.16	27.210.218.131
May 6, 2024 04:57:28.959076881 CEST	52229	21	192.168.2.16	114.132.167.209
May 6, 2024 04:57:28.959110975 CEST	52282	21	192.168.2.16	58.239.189.34
May 6, 2024 04:57:28.959403992 CEST	52420	2121	192.168.2.16	201.105.104.191
May 6, 2024 04:57:28.959491014 CEST	52421	21	192.168.2.16	79.254.57.57
May 6, 2024 04:57:28.975127935 CEST	52110	21	192.168.2.16	188.214.156.147
May 6, 2024 04:57:28.975344896 CEST	52422	2121	192.168.2.16	79.254.57.57
May 6, 2024 04:57:28.975423098 CEST	52423	21	192.168.2.16	188.214.156.147
May 6, 2024 04:57:28.991064072 CEST	52364	2121	192.168.2.16	218.31.124.41
May 6, 2024 04:57:28.991074085 CEST	52377	2121	192.168.2.16	27.210.218.131
May 6, 2024 04:57:28.991235018 CEST	52424	21	192.168.2.16	110.12.224.197
May 6, 2024 04:57:29.003659964 CEST	21	52412	34.128.145.40	192.168.2.16
May 6, 2024 04:57:29.003716946 CEST	52412	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:29.003772974 CEST	52412	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:29.003916979 CEST	52425	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:29.004729986 CEST	21	52410	126.89.102.124	192.168.2.16
May 6, 2024 04:57:29.007049084 CEST	52230	2121	192.168.2.16	114.132.167.209
May 6, 2024 04:57:29.008097887 CEST	2121	52414	34.128.145.40	192.168.2.16
May 6, 2024 04:57:29.008164883 CEST	52414	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:29.008224964 CEST	52414	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:29.008373976 CEST	52426	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:29.018867970 CEST	2121	52411	126.89.102.124	192.168.2.16
May 6, 2024 04:57:29.039035082 CEST	52254	21	192.168.2.16	86.29.248.5
May 6, 2024 04:57:29.039115906 CEST	21	52389	149.154.65.23	192.168.2.16
May 6, 2024 04:57:29.039310932 CEST	21	52389	149.154.65.23	192.168.2.16
May 6, 2024 04:57:29.039464951 CEST	52389	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:29.055052042 CEST	52362	2121	192.168.2.16	119.190.208.194
May 6, 2024 04:57:29.071059942 CEST	52303	2121	192.168.2.16	125.149.107.42
May 6, 2024 04:57:29.071158886 CEST	52302	21	192.168.2.16	125.149.107.42
May 6, 2024 04:57:29.074928999 CEST	21	52361	101.43.249.26	192.168.2.16
May 6, 2024 04:57:29.075078964 CEST	52361	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:29.075297117 CEST	52427	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:29.085035086 CEST	21	52360	81.88.252.91	192.168.2.16
May 6, 2024 04:57:29.085046053 CEST	21	52360	81.88.252.91	192.168.2.16
May 6, 2024 04:57:29.085346937 CEST	52428	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:29.087042093 CEST	52255	2121	192.168.2.16	86.29.248.5
May 6, 2024 04:57:29.087060928 CEST	52366	2121	192.168.2.16	170.250.175.90
May 6, 2024 04:57:29.087064028 CEST	52365	21	192.168.2.16	170.250.175.90
May 6, 2024 04:57:29.087074041 CEST	52367	21	192.168.2.16	71.222.180.45
May 6, 2024 04:57:29.087074995 CEST	52368	2121	192.168.2.16	71.222.180.45
May 6, 2024 04:57:29.087268114 CEST	52429	2121	192.168.2.16	110.12.224.197
May 6, 2024 04:57:29.103060961 CEST	52371	2121	192.168.2.16	39.123.55.26
May 6, 2024 04:57:29.103060961 CEST	52256	2121	192.168.2.16	79.154.231.25
May 6, 2024 04:57:29.103060961 CEST	52372	21	192.168.2.16	23.194.151.45
May 6, 2024 04:57:29.103068113 CEST	52370	21	192.168.2.16	39.123.55.26
May 6, 2024 04:57:29.103071928 CEST	52257	21	192.168.2.16	79.154.231.25
May 6, 2024 04:57:29.103068113 CEST	52258	21	192.168.2.16	94.210.242.120
May 6, 2024 04:57:29.103068113 CEST	52369	2121	192.168.2.16	93.218.237.16
May 6, 2024 04:57:29.103079081 CEST	52374	2121	192.168.2.16	23.194.151.45
May 6, 2024 04:57:29.103085041 CEST	52375	21	192.168.2.16	93.218.237.16
May 6, 2024 04:57:29.107481003 CEST	21	52416	119.245.126.206	192.168.2.16
May 6, 2024 04:57:29.113630056 CEST	21	52425	34.128.145.40	192.168.2.16
May 6, 2024 04:57:29.113693953 CEST	52425	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:29.117836952 CEST	2121	52414	34.128.145.40	192.168.2.16
May 6, 2024 04:57:29.117973089 CEST	2121	52426	34.128.145.40	192.168.2.16
May 6, 2024 04:57:29.118033886 CEST	52426	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:29.119060993 CEST	52378	21	192.168.2.16	201.108.85.182
May 6, 2024 04:57:29.119452000 CEST	52430	21	192.168.2.16	200.9.99.204
May 6, 2024 04:57:29.135051012 CEST	52380	2121	192.168.2.16	201.108.85.182
May 6, 2024 04:57:29.145028114 CEST	52381	21	192.168.2.16	81.221.225.19
May 6, 2024 04:57:29.145163059 CEST	2121	52415	123.117.121.246	192.168.2.16
May 6, 2024 04:57:29.146759033 CEST	2121	52309	90.176.5.124	192.168.2.16
May 6, 2024 04:57:29.146881104 CEST	21	52308	90.176.5.124	192.168.2.16
May 6, 2024 04:57:29.151046038 CEST	52382	2121	192.168.2.16	81.221.225.19
May 6, 2024 04:57:29.151046991 CEST	52383	21	192.168.2.16	34.122.87.209
May 6, 2024 04:57:29.151065111 CEST	52384	2121	192.168.2.16	34.122.87.209
May 6, 2024 04:57:29.151166916 CEST	52260	2121	192.168.2.16	94.210.242.120
May 6, 2024 04:57:29.176561117 CEST	21	52201	109.205.180.149	192.168.2.16
May 6, 2024 04:57:29.176681042 CEST	52201	21	192.168.2.16	109.205.180.149
May 6, 2024 04:57:29.176824093 CEST	52431	21	192.168.2.16	109.205.180.149
May 6, 2024 04:57:29.177625895 CEST	21	52395	87.106.26.129	192.168.2.16
May 6, 2024 04:57:29.177851915 CEST	21	52395	87.106.26.129	192.168.2.16
May 6, 2024 04:57:29.177998066 CEST	52395	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:29.199052095 CEST	52385	21	192.168.2.16	67.149.12.87
May 6, 2024 04:57:29.206043005 CEST	52263	21	192.168.2.16	108.67.36.60
May 6, 2024 04:57:29.208326101 CEST	21	52386	154.210.32.21	192.168.2.16
May 6, 2024 04:57:29.208379030 CEST	21	52386	154.210.32.21	192.168.2.16
May 6, 2024 04:57:29.208534002 CEST	52386	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:29.215272903 CEST	52387	2121	192.168.2.16	67.149.12.87
May 6, 2024 04:57:29.215274096 CEST	52388	21	192.168.2.16	154.149.91.78
May 6, 2024 04:57:29.215580940 CEST	52432	2121	192.168.2.16	200.9.99.204
May 6, 2024 04:57:29.215725899 CEST	52433	21	192.168.2.16	114.217.64.51
May 6, 2024 04:57:29.230077982 CEST	52264	2121	192.168.2.16	108.67.36.60
May 6, 2024 04:57:29.230402946 CEST	52434	2121	192.168.2.16	114.217.64.51
May 6, 2024 04:57:29.230576038 CEST	52435	21	192.168.2.16	43.204.23.202
May 6, 2024 04:57:29.242654085 CEST	2121	52283	58.239.189.34	192.168.2.16
May 6, 2024 04:57:29.242849112 CEST	2121	52426	34.128.145.40	192.168.2.16
May 6, 2024 04:57:29.242923021 CEST	52426	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:29.243058920 CEST	52426	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:29.243283987 CEST	52436	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:29.246071100 CEST	52265	21	192.168.2.16	87.1.68.206
May 6, 2024 04:57:29.246073961 CEST	52266	2121	192.168.2.16	87.1.68.206
May 6, 2024 04:57:29.249522924 CEST	21	52425	34.128.145.40	192.168.2.16
May 6, 2024 04:57:29.249583006 CEST	52425	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:29.249655008 CEST	52425	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:29.249856949 CEST	52437	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:29.262259960 CEST	52327	2121	192.168.2.16	221.253.236.97
May 6, 2024 04:57:29.262970924 CEST	52268	2121	192.168.2.16	179.35.49.149
May 6, 2024 04:57:29.263008118 CEST	52333	2121	192.168.2.16	81.82.156.120
May 6, 2024 04:57:29.266056061 CEST	52334	21	192.168.2.16	81.82.156.120
May 6, 2024 04:57:29.278055906 CEST	52325	21	192.168.2.16	221.253.236.97
May 6, 2024 04:57:29.278064013 CEST	52269	21	192.168.2.16	179.35.49.149
May 6, 2024 04:57:29.286288977 CEST	21	52198	66.198.245.58	192.168.2.16
May 6, 2024 04:57:29.286449909 CEST	52198	21	192.168.2.16	66.198.245.58
May 6, 2024 04:57:29.286748886 CEST	52438	21	192.168.2.16	66.198.245.58
May 6, 2024 04:57:29.294044971 CEST	52271	2121	192.168.2.16	80.158.18.247
May 6, 2024 04:57:29.295514107 CEST	21	52389	149.154.65.23	192.168.2.16
May 6, 2024 04:57:29.295643091 CEST	52389	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:29.295869112 CEST	52439	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:29.297554970 CEST	21	52282	58.239.189.34	192.168.2.16
May 6, 2024 04:57:29.302189112 CEST	21	52350	103.109.6.215	192.168.2.16
May 6, 2024 04:57:29.302198887 CEST	21	52350	103.109.6.215	192.168.2.16
May 6, 2024 04:57:29.302258968 CEST	52350	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:29.308156013 CEST	21	52373	27.210.218.131	192.168.2.16
May 6, 2024 04:57:29.310039043 CEST	52344	21	192.168.2.16	192.227.173.49
May 6, 2024 04:57:29.310070992 CEST	52270	21	192.168.2.16	80.158.18.247
May 6, 2024 04:57:29.310224056 CEST	21	52229	114.132.167.209	192.168.2.16
May 6, 2024 04:57:29.310775042 CEST	52440	2121	192.168.2.16	43.204.23.202
May 6, 2024 04:57:29.321062088 CEST	21	52419	103.109.6.215	192.168.2.16
May 6, 2024 04:57:29.321145058 CEST	52419	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:29.326081991 CEST	52412	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:29.326236010 CEST	52441	21	192.168.2.16	174.6.105.216
May 6, 2024 04:57:29.334953070 CEST	21	52363	218.31.124.41	192.168.2.16
May 6, 2024 04:57:29.342179060 CEST	52272	21	192.168.2.16	79.61.53.83
May 6, 2024 04:57:29.342478991 CEST	52442	21	192.168.2.16	217.66.168.110
May 6, 2024 04:57:29.342544079 CEST	52443	2121	192.168.2.16	174.6.105.216
May 6, 2024 04:57:29.348712921 CEST	21	52428	81.88.252.91	192.168.2.16
May 6, 2024 04:57:29.348783016 CEST	52428	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:29.353388071 CEST	2121	52426	34.128.145.40	192.168.2.16
May 6, 2024 04:57:29.353913069 CEST	2121	52436	34.128.145.40	192.168.2.16
May 6, 2024 04:57:29.353976965 CEST	52436	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:29.358068943 CEST	52274	2121	192.168.2.16	79.61.53.83
May 6, 2024 04:57:29.358297110 CEST	2121	52377	27.210.218.131	192.168.2.16
May 6, 2024 04:57:29.358341932 CEST	52444	2121	192.168.2.16	217.66.168.110
May 6, 2024 04:57:29.358360052 CEST	52273	21	192.168.2.16	175.21.91.68
May 6, 2024 04:57:29.360133886 CEST	21	52425	34.128.145.40	192.168.2.16
May 6, 2024 04:57:29.360200882 CEST	21	52437	34.128.145.40	192.168.2.16
May 6, 2024 04:57:29.360259056 CEST	52437	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:29.369898081 CEST	2121	52230	114.132.167.209	192.168.2.16
May 6, 2024 04:57:29.380484104 CEST	2121	52303	125.149.107.42	192.168.2.16
May 6, 2024 04:57:29.380618095 CEST	21	52302	125.149.107.42	192.168.2.16
May 6, 2024 04:57:29.390047073 CEST	52408	21	192.168.2.16	54.36.99.119
May 6, 2024 04:57:29.390048027 CEST	52276	2121	192.168.2.16	175.21.91.68
May 6, 2024 04:57:29.390311956 CEST	52278	21	192.168.2.16	98.122.99.237
May 6, 2024 04:57:29.390484095 CEST	52445	21	192.168.2.16	83.99.102.130
May 6, 2024 04:57:29.394056082 CEST	2121	52364	218.31.124.41	192.168.2.16
May 6, 2024 04:57:29.406064034 CEST	52346	2121	192.168.2.16	192.227.173.49
May 6, 2024 04:57:29.406678915 CEST	52279	2121	192.168.2.16	98.122.99.237
May 6, 2024 04:57:29.407740116 CEST	21	52395	87.106.26.129	192.168.2.16
May 6, 2024 04:57:29.407917023 CEST	52395	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:29.408194065 CEST	52446	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:29.409430027 CEST	21	52431	109.205.180.149	192.168.2.16
May 6, 2024 04:57:29.409496069 CEST	52431	21	192.168.2.16	109.205.180.149
May 6, 2024 04:57:29.422061920 CEST	52392	2121	192.168.2.16	154.149.91.78
May 6, 2024 04:57:29.423197031 CEST	21	52361	101.43.249.26	192.168.2.16
May 6, 2024 04:57:29.423208952 CEST	21	52361	101.43.249.26	192.168.2.16
May 6, 2024 04:57:29.423255920 CEST	52361	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:29.423788071 CEST	21	52427	101.43.249.26	192.168.2.16
May 6, 2024 04:57:29.423841953 CEST	52427	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:29.426043987 CEST	21	52201	109.205.180.149	192.168.2.16
May 6, 2024 04:57:29.426090956 CEST	52201	21	192.168.2.16	109.205.180.149
May 6, 2024 04:57:29.427243948 CEST	21	52201	109.205.180.149	192.168.2.16
May 6, 2024 04:57:29.427287102 CEST	52201	21	192.168.2.16	109.205.180.149
May 6, 2024 04:57:29.435604095 CEST	21	52412	34.128.145.40	192.168.2.16
May 6, 2024 04:57:29.438035965 CEST	52393	21	192.168.2.16	119.27.33.10
May 6, 2024 04:57:29.438314915 CEST	52280	21	192.168.2.16	27.57.253.243
May 6, 2024 04:57:29.442107916 CEST	21	52198	66.198.245.58	192.168.2.16
May 6, 2024 04:57:29.442164898 CEST	52198	21	192.168.2.16	66.198.245.58
May 6, 2024 04:57:29.442214966 CEST	21	52438	66.198.245.58	192.168.2.16
May 6, 2024 04:57:29.442271948 CEST	52438	21	192.168.2.16	66.198.245.58
May 6, 2024 04:57:29.442572117 CEST	21	52198	66.198.245.58	192.168.2.16
May 6, 2024 04:57:29.442619085 CEST	52198	21	192.168.2.16	66.198.245.58
May 6, 2024 04:57:29.454057932 CEST	52281	2121	192.168.2.16	27.57.253.243
May 6, 2024 04:57:29.454071999 CEST	52409	2121	192.168.2.16	54.36.99.119
May 6, 2024 04:57:29.456017971 CEST	52394	2121	192.168.2.16	119.27.33.10
May 6, 2024 04:57:29.464406967 CEST	2121	52436	34.128.145.40	192.168.2.16
May 6, 2024 04:57:29.464467049 CEST	52436	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:29.464536905 CEST	52436	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:29.464711905 CEST	52447	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:29.470148087 CEST	21	52437	34.128.145.40	192.168.2.16
May 6, 2024 04:57:29.470201015 CEST	52437	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:29.470259905 CEST	52437	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:29.470487118 CEST	52448	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:29.486038923 CEST	52396	21	192.168.2.16	73.107.61.210
May 6, 2024 04:57:29.493036985 CEST	2121	52333	81.82.156.120	192.168.2.16
May 6, 2024 04:57:29.496033907 CEST	21	52344	192.227.173.49	192.168.2.16
May 6, 2024 04:57:29.497145891 CEST	2121	52268	179.35.49.149	192.168.2.16
May 6, 2024 04:57:29.499263048 CEST	21	52334	81.82.156.120	192.168.2.16
May 6, 2024 04:57:29.501066923 CEST	52110	21	192.168.2.16	188.214.156.147
May 6, 2024 04:57:29.501072884 CEST	52286	21	192.168.2.16	54.220.74.193
May 6, 2024 04:57:29.517039061 CEST	52410	21	192.168.2.16	126.89.102.124
May 6, 2024 04:57:29.517044067 CEST	52287	2121	192.168.2.16	54.220.74.193
May 6, 2024 04:57:29.517380953 CEST	52449	2121	192.168.2.16	83.99.102.130
May 6, 2024 04:57:29.517545938 CEST	52450	21	192.168.2.16	4.237.56.188
May 6, 2024 04:57:29.533035994 CEST	52411	2121	192.168.2.16	126.89.102.124
May 6, 2024 04:57:29.533056021 CEST	52398	21	192.168.2.16	119.163.63.142
May 6, 2024 04:57:29.533056021 CEST	52288	21	192.168.2.16	203.167.20.180
May 6, 2024 04:57:29.533058882 CEST	52397	2121	192.168.2.16	73.107.61.210
May 6, 2024 04:57:29.540337086 CEST	2121	52327	221.253.236.97	192.168.2.16
May 6, 2024 04:57:29.543452024 CEST	21	52386	154.210.32.21	192.168.2.16
May 6, 2024 04:57:29.543595076 CEST	52386	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:29.543766975 CEST	52451	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:29.544235945 CEST	21	52386	154.210.32.21	192.168.2.16
May 6, 2024 04:57:29.544280052 CEST	52386	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:29.549062014 CEST	52399	2121	192.168.2.16	119.163.63.142
May 6, 2024 04:57:29.552206993 CEST	21	52389	149.154.65.23	192.168.2.16
May 6, 2024 04:57:29.552256107 CEST	52389	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:29.565051079 CEST	52289	2121	192.168.2.16	203.167.20.180
May 6, 2024 04:57:29.565067053 CEST	52401	21	192.168.2.16	90.195.150.30
May 6, 2024 04:57:29.569413900 CEST	21	52439	149.154.65.23	192.168.2.16
May 6, 2024 04:57:29.569473982 CEST	52439	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:29.569992065 CEST	21	52325	221.253.236.97	192.168.2.16
May 6, 2024 04:57:29.574062109 CEST	2121	52436	34.128.145.40	192.168.2.16
May 6, 2024 04:57:29.574289083 CEST	2121	52447	34.128.145.40	192.168.2.16
May 6, 2024 04:57:29.574343920 CEST	52447	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:29.580423117 CEST	21	52448	34.128.145.40	192.168.2.16
May 6, 2024 04:57:29.580480099 CEST	52448	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:29.581039906 CEST	52403	2121	192.168.2.16	90.195.150.30
May 6, 2024 04:57:29.581057072 CEST	52291	21	192.168.2.16	134.158.73.30
May 6, 2024 04:57:29.581517935 CEST	52452	21	192.168.2.16	34.80.125.16
May 6, 2024 04:57:29.581571102 CEST	52453	2121	192.168.2.16	4.237.56.188
May 6, 2024 04:57:29.582041979 CEST	52292	2121	192.168.2.16	134.158.73.30
May 6, 2024 04:57:29.593909025 CEST	2121	52346	192.227.173.49	192.168.2.16
May 6, 2024 04:57:29.597037077 CEST	52294	21	192.168.2.16	76.168.230.178
May 6, 2024 04:57:29.597055912 CEST	52404	21	192.168.2.16	49.172.220.154
May 6, 2024 04:57:29.598494053 CEST	21	52438	66.198.245.58	192.168.2.16
May 6, 2024 04:57:29.598634958 CEST	52438	21	192.168.2.16	66.198.245.58
May 6, 2024 04:57:29.613044977 CEST	52416	21	192.168.2.16	119.245.126.206
May 6, 2024 04:57:29.613061905 CEST	52407	2121	192.168.2.16	52.237.175.110
May 6, 2024 04:57:29.613061905 CEST	52405	2121	192.168.2.16	49.172.220.154
May 6, 2024 04:57:29.613120079 CEST	52406	21	192.168.2.16	52.237.175.110
May 6, 2024 04:57:29.613635063 CEST	52454	2121	192.168.2.16	34.80.125.16
May 6, 2024 04:57:29.613686085 CEST	52455	21	192.168.2.16	14.63.16.123
May 6, 2024 04:57:29.614870071 CEST	21	52408	54.36.99.119	192.168.2.16
May 6, 2024 04:57:29.622364998 CEST	21	52428	81.88.252.91	192.168.2.16
May 6, 2024 04:57:29.622497082 CEST	52428	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:29.625183105 CEST	21	52435	43.204.23.202	192.168.2.16
May 6, 2024 04:57:29.629079103 CEST	52297	2121	192.168.2.16	76.168.230.178
May 6, 2024 04:57:29.629195929 CEST	52300	21	192.168.2.16	123.144.156.102
May 6, 2024 04:57:29.629199982 CEST	52298	21	192.168.2.16	119.179.199.58
May 6, 2024 04:57:29.629271030 CEST	52456	2121	192.168.2.16	14.63.16.123
May 6, 2024 04:57:29.636508942 CEST	21	52446	87.106.26.129	192.168.2.16
May 6, 2024 04:57:29.636580944 CEST	52446	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:29.638302088 CEST	21	52395	87.106.26.129	192.168.2.16
May 6, 2024 04:57:29.638345003 CEST	52395	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:29.644331932 CEST	21	52431	109.205.180.149	192.168.2.16
May 6, 2024 04:57:29.644473076 CEST	52431	21	192.168.2.16	109.205.180.149
May 6, 2024 04:57:29.645034075 CEST	52299	2121	192.168.2.16	119.179.199.58
May 6, 2024 04:57:29.660037041 CEST	52305	2121	192.168.2.16	47.188.208.116
May 6, 2024 04:57:29.660038948 CEST	52304	21	192.168.2.16	47.188.208.116
May 6, 2024 04:57:29.660039902 CEST	52309	2121	192.168.2.16	90.176.5.124
May 6, 2024 04:57:29.660052061 CEST	52415	2121	192.168.2.16	123.117.121.246
May 6, 2024 04:57:29.660064936 CEST	52301	2121	192.168.2.16	123.144.156.102
May 6, 2024 04:57:29.660068035 CEST	52308	21	192.168.2.16	90.176.5.124
May 6, 2024 04:57:29.674451113 CEST	2121	52409	54.36.99.119	192.168.2.16
May 6, 2024 04:57:29.676084042 CEST	52306	21	192.168.2.16	188.32.44.25
May 6, 2024 04:57:29.684828997 CEST	2121	52447	34.128.145.40	192.168.2.16
May 6, 2024 04:57:29.684887886 CEST	52447	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:29.684959888 CEST	52447	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:29.685144901 CEST	52457	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:29.686050892 CEST	52307	2121	192.168.2.16	188.32.44.25
May 6, 2024 04:57:29.691519976 CEST	21	52448	34.128.145.40	192.168.2.16
May 6, 2024 04:57:29.691570997 CEST	52448	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:29.691613913 CEST	52448	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:29.691726923 CEST	52458	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:29.692063093 CEST	52311	2121	192.168.2.16	104.98.95.157
May 6, 2024 04:57:29.692950964 CEST	52310	21	192.168.2.16	104.98.95.157
May 6, 2024 04:57:29.697117090 CEST	2121	52440	43.204.23.202	192.168.2.16
May 6, 2024 04:57:29.701867104 CEST	21	52419	103.109.6.215	192.168.2.16
May 6, 2024 04:57:29.701983929 CEST	52419	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:29.740061045 CEST	52312	21	192.168.2.16	190.112.22.137
May 6, 2024 04:57:29.746042967 CEST	52313	2121	192.168.2.16	190.112.22.137
May 6, 2024 04:57:29.747328997 CEST	52283	2121	192.168.2.16	58.239.189.34
May 6, 2024 04:57:29.753968000 CEST	21	52438	66.198.245.58	192.168.2.16
May 6, 2024 04:57:29.754138947 CEST	21	52438	66.198.245.58	192.168.2.16
May 6, 2024 04:57:29.754242897 CEST	52438	21	192.168.2.16	66.198.245.58
May 6, 2024 04:57:29.756241083 CEST	52314	21	192.168.2.16	183.184.150.128
May 6, 2024 04:57:29.763470888 CEST	2121	51995	168.220.94.137	192.168.2.16
May 6, 2024 04:57:29.763524055 CEST	51995	2121	192.168.2.16	168.220.94.137
May 6, 2024 04:57:29.772608042 CEST	21	52427	101.43.249.26	192.168.2.16
May 6, 2024 04:57:29.772757053 CEST	52427	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:29.788050890 CEST	52316	2121	192.168.2.16	183.184.150.128
May 6, 2024 04:57:29.788121939 CEST	52413	21	192.168.2.16	123.117.121.246
May 6, 2024 04:57:29.794495106 CEST	2121	52447	34.128.145.40	192.168.2.16
May 6, 2024 04:57:29.794749975 CEST	2121	52457	34.128.145.40	192.168.2.16
May 6, 2024 04:57:29.794802904 CEST	52457	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:29.799034119 CEST	52315	21	192.168.2.16	73.130.233.160
May 6, 2024 04:57:29.801165104 CEST	52317	2121	192.168.2.16	73.130.233.160
May 6, 2024 04:57:29.801269054 CEST	21	52448	34.128.145.40	192.168.2.16
May 6, 2024 04:57:29.801321983 CEST	21	52458	34.128.145.40	192.168.2.16
May 6, 2024 04:57:29.801377058 CEST	52458	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:29.802786112 CEST	21	52410	126.89.102.124	192.168.2.16
May 6, 2024 04:57:29.803056002 CEST	52437	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:29.803133965 CEST	52282	21	192.168.2.16	58.239.189.34
May 6, 2024 04:57:29.803561926 CEST	52459	21	192.168.2.16	76.104.160.216
May 6, 2024 04:57:29.803687096 CEST	52460	2121	192.168.2.16	76.104.160.216
May 6, 2024 04:57:29.803721905 CEST	52461	21	192.168.2.16	45.131.245.178
May 6, 2024 04:57:29.819036007 CEST	52319	2121	192.168.2.16	189.86.157.30
May 6, 2024 04:57:29.819276094 CEST	52320	21	192.168.2.16	189.86.157.30
May 6, 2024 04:57:29.819279909 CEST	52462	2121	192.168.2.16	45.131.245.178
May 6, 2024 04:57:29.819279909 CEST	52373	21	192.168.2.16	27.210.218.131
May 6, 2024 04:57:29.834079027 CEST	2121	52411	126.89.102.124	192.168.2.16
May 6, 2024 04:57:29.835042000 CEST	52322	21	192.168.2.16	119.179.81.209
May 6, 2024 04:57:29.835095882 CEST	52363	21	192.168.2.16	218.31.124.41
May 6, 2024 04:57:29.835211992 CEST	52463	21	192.168.2.16	187.155.237.209
May 6, 2024 04:57:29.847379923 CEST	21	52439	149.154.65.23	192.168.2.16
May 6, 2024 04:57:29.847517014 CEST	52439	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:29.867055893 CEST	52417	2121	192.168.2.16	119.245.126.206
May 6, 2024 04:57:29.867104053 CEST	52377	2121	192.168.2.16	27.210.218.131
May 6, 2024 04:57:29.867311001 CEST	52464	2121	192.168.2.16	187.155.237.209
May 6, 2024 04:57:29.876885891 CEST	21	52386	154.210.32.21	192.168.2.16
May 6, 2024 04:57:29.877295017 CEST	21	52431	109.205.180.149	192.168.2.16
May 6, 2024 04:57:29.877398014 CEST	21	52431	109.205.180.149	192.168.2.16
May 6, 2024 04:57:29.877505064 CEST	52431	21	192.168.2.16	109.205.180.149
May 6, 2024 04:57:29.883048058 CEST	52302	21	192.168.2.16	125.149.107.42
May 6, 2024 04:57:29.883053064 CEST	52324	2121	192.168.2.16	119.179.81.209
May 6, 2024 04:57:29.885159969 CEST	52418	21	192.168.2.16	201.105.104.191
May 6, 2024 04:57:29.885165930 CEST	52303	2121	192.168.2.16	125.149.107.42
May 6, 2024 04:57:29.885207891 CEST	21	52428	81.88.252.91	192.168.2.16
May 6, 2024 04:57:29.885323048 CEST	52428	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:29.888330936 CEST	21	52446	87.106.26.129	192.168.2.16
May 6, 2024 04:57:29.888438940 CEST	52446	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:29.893722057 CEST	21	52451	154.210.32.21	192.168.2.16
May 6, 2024 04:57:29.893774033 CEST	52451	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:29.898061991 CEST	52364	2121	192.168.2.16	218.31.124.41
May 6, 2024 04:57:29.898276091 CEST	52465	21	192.168.2.16	110.47.255.45
May 6, 2024 04:57:29.904526949 CEST	2121	52457	34.128.145.40	192.168.2.16
May 6, 2024 04:57:29.904587030 CEST	52457	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:29.904644966 CEST	52457	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:29.904793978 CEST	52466	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:29.908441067 CEST	21	52416	119.245.126.206	192.168.2.16
May 6, 2024 04:57:29.911057949 CEST	21	52458	34.128.145.40	192.168.2.16
May 6, 2024 04:57:29.911115885 CEST	52458	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:29.911166906 CEST	52458	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:29.911318064 CEST	52467	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:29.912590981 CEST	21	52437	34.128.145.40	192.168.2.16
May 6, 2024 04:57:29.925930977 CEST	21	52455	14.63.16.123	192.168.2.16
May 6, 2024 04:57:29.935940981 CEST	2121	52456	14.63.16.123	192.168.2.16
May 6, 2024 04:57:29.942044020 CEST	52328	21	192.168.2.16	92.46.161.160
May 6, 2024 04:57:29.948812962 CEST	21	52438	66.198.245.58	192.168.2.16
May 6, 2024 04:57:29.961045027 CEST	52420	2121	192.168.2.16	201.105.104.191
May 6, 2024 04:57:29.961080074 CEST	52421	21	192.168.2.16	79.254.57.57
May 6, 2024 04:57:29.977055073 CEST	52423	21	192.168.2.16	188.214.156.147
May 6, 2024 04:57:29.977158070 CEST	52422	2121	192.168.2.16	79.254.57.57
May 6, 2024 04:57:29.991142988 CEST	2121	52415	123.117.121.246	192.168.2.16
May 6, 2024 04:57:29.993052006 CEST	52333	2121	192.168.2.16	81.82.156.120
May 6, 2024 04:57:29.993057966 CEST	52424	21	192.168.2.16	110.12.224.197
May 6, 2024 04:57:30.009040117 CEST	52344	21	192.168.2.16	192.227.173.49
May 6, 2024 04:57:30.009066105 CEST	52334	21	192.168.2.16	81.82.156.120
May 6, 2024 04:57:30.015125990 CEST	2121	52466	34.128.145.40	192.168.2.16
May 6, 2024 04:57:30.015187025 CEST	52466	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:30.020879030 CEST	21	52467	34.128.145.40	192.168.2.16
May 6, 2024 04:57:30.020890951 CEST	21	52458	34.128.145.40	192.168.2.16
May 6, 2024 04:57:30.020951986 CEST	52467	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:30.025055885 CEST	52329	2121	192.168.2.16	92.46.161.160
May 6, 2024 04:57:30.032502890 CEST	21	52461	45.131.245.178	192.168.2.16
May 6, 2024 04:57:30.052476883 CEST	2121	52462	45.131.245.178	192.168.2.16
May 6, 2024 04:57:30.055047989 CEST	52327	2121	192.168.2.16	221.253.236.97
May 6, 2024 04:57:30.059475899 CEST	21	51996	168.220.94.137	192.168.2.16
May 6, 2024 04:57:30.059521914 CEST	51996	21	192.168.2.16	168.220.94.137
May 6, 2024 04:57:30.062052965 CEST	2121	52283	58.239.189.34	192.168.2.16
May 6, 2024 04:57:30.071058989 CEST	52325	21	192.168.2.16	221.253.236.97
May 6, 2024 04:57:30.071603060 CEST	52468	2121	192.168.2.16	110.47.255.45
May 6, 2024 04:57:30.071732044 CEST	52469	21	192.168.2.16	218.48.190.74
May 6, 2024 04:57:30.083894014 CEST	21	52419	103.109.6.215	192.168.2.16
May 6, 2024 04:57:30.084012985 CEST	52419	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:30.086040974 CEST	52335	21	192.168.2.16	73.36.52.115
May 6, 2024 04:57:30.086455107 CEST	52470	2121	192.168.2.16	218.48.190.74
May 6, 2024 04:57:30.101037979 CEST	52346	2121	192.168.2.16	192.227.173.49
May 6, 2024 04:57:30.101072073 CEST	52336	2121	192.168.2.16	73.36.52.115
May 6, 2024 04:57:30.101073027 CEST	52429	2121	192.168.2.16	110.12.224.197
May 6, 2024 04:57:30.101226091 CEST	52471	21	192.168.2.16	12.105.210.193
May 6, 2024 04:57:30.117038012 CEST	52337	21	192.168.2.16	2.223.241.40
May 6, 2024 04:57:30.117048025 CEST	52408	21	192.168.2.16	54.36.99.119
May 6, 2024 04:57:30.117846966 CEST	21	52446	87.106.26.129	192.168.2.16
May 6, 2024 04:57:30.117858887 CEST	21	52446	87.106.26.129	192.168.2.16
May 6, 2024 04:57:30.117991924 CEST	52446	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:30.122000933 CEST	21	52439	149.154.65.23	192.168.2.16
May 6, 2024 04:57:30.122011900 CEST	21	52439	149.154.65.23	192.168.2.16
May 6, 2024 04:57:30.122176886 CEST	52439	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:30.122667074 CEST	21	52427	101.43.249.26	192.168.2.16
May 6, 2024 04:57:30.122785091 CEST	52427	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:30.122976065 CEST	52472	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:30.127424002 CEST	2121	52466	34.128.145.40	192.168.2.16
May 6, 2024 04:57:30.127475977 CEST	52466	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:30.127506018 CEST	52466	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:30.127610922 CEST	52473	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:30.132038116 CEST	52435	21	192.168.2.16	43.204.23.202
May 6, 2024 04:57:30.132056952 CEST	52430	21	192.168.2.16	200.9.99.204
May 6, 2024 04:57:30.132564068 CEST	21	52467	34.128.145.40	192.168.2.16
May 6, 2024 04:57:30.132638931 CEST	52467	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:30.132685900 CEST	52467	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:30.132865906 CEST	52474	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:30.140981913 CEST	21	52282	58.239.189.34	192.168.2.16
May 6, 2024 04:57:30.148416042 CEST	52475	21	192.168.2.16	40.86.247.239
May 6, 2024 04:57:30.148448944 CEST	52476	2121	192.168.2.16	12.105.210.193
May 6, 2024 04:57:30.150863886 CEST	21	52431	109.205.180.149	192.168.2.16
May 6, 2024 04:57:30.157140017 CEST	21	52428	81.88.252.91	192.168.2.16
May 6, 2024 04:57:30.157151937 CEST	21	52428	81.88.252.91	192.168.2.16
May 6, 2024 04:57:30.157403946 CEST	52477	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:30.163539886 CEST	21	52344	192.227.173.49	192.168.2.16
May 6, 2024 04:57:30.164304018 CEST	52478	2121	192.168.2.16	40.86.247.239
May 6, 2024 04:57:30.168168068 CEST	21	52373	27.210.218.131	192.168.2.16
May 6, 2024 04:57:30.180052042 CEST	52409	2121	192.168.2.16	54.36.99.119
May 6, 2024 04:57:30.180428028 CEST	52479	21	192.168.2.16	163.229.134.211
May 6, 2024 04:57:30.180524111 CEST	52480	2121	192.168.2.16	163.229.134.211
May 6, 2024 04:57:30.193579912 CEST	21	52302	125.149.107.42	192.168.2.16
May 6, 2024 04:57:30.194417000 CEST	2121	52303	125.149.107.42	192.168.2.16
May 6, 2024 04:57:30.212043047 CEST	52440	2121	192.168.2.16	43.204.23.202
May 6, 2024 04:57:30.212055922 CEST	52338	2121	192.168.2.16	2.223.241.40
May 6, 2024 04:57:30.212057114 CEST	52339	21	192.168.2.16	177.241.126.50
May 6, 2024 04:57:30.212429047 CEST	52481	21	192.168.2.16	190.209.33.65
May 6, 2024 04:57:30.212441921 CEST	52482	21	192.168.2.16	178.75.182.238
May 6, 2024 04:57:30.212515116 CEST	52483	2121	192.168.2.16	190.209.33.65
May 6, 2024 04:57:30.220799923 CEST	2121	52333	81.82.156.120	192.168.2.16
May 6, 2024 04:57:30.225161076 CEST	21	52363	218.31.124.41	192.168.2.16
May 6, 2024 04:57:30.227045059 CEST	52433	21	192.168.2.16	114.217.64.51
May 6, 2024 04:57:30.227065086 CEST	52432	2121	192.168.2.16	200.9.99.204
May 6, 2024 04:57:30.227065086 CEST	52341	2121	192.168.2.16	177.241.126.50
May 6, 2024 04:57:30.227075100 CEST	52457	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:30.234582901 CEST	2121	52377	27.210.218.131	192.168.2.16
May 6, 2024 04:57:30.237298012 CEST	2121	52473	34.128.145.40	192.168.2.16
May 6, 2024 04:57:30.237356901 CEST	52473	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:30.239042044 CEST	21	52334	81.82.156.120	192.168.2.16
May 6, 2024 04:57:30.242512941 CEST	21	52474	34.128.145.40	192.168.2.16
May 6, 2024 04:57:30.242572069 CEST	52474	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:30.243052959 CEST	21	52467	34.128.145.40	192.168.2.16
May 6, 2024 04:57:30.243056059 CEST	52434	2121	192.168.2.16	114.217.64.51
May 6, 2024 04:57:30.243232965 CEST	52484	2121	192.168.2.16	178.75.182.238
May 6, 2024 04:57:30.245445967 CEST	21	52451	154.210.32.21	192.168.2.16
May 6, 2024 04:57:30.245580912 CEST	52451	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:30.253684998 CEST	2121	52346	192.227.173.49	192.168.2.16
May 6, 2024 04:57:30.254071951 CEST	52485	21	192.168.2.16	99.234.151.186
May 6, 2024 04:57:30.259267092 CEST	52486	2121	192.168.2.16	99.234.151.186
May 6, 2024 04:57:30.259866953 CEST	52487	21	192.168.2.16	119.162.161.87
May 6, 2024 04:57:30.290267944 CEST	52488	2121	192.168.2.16	119.162.161.87
May 6, 2024 04:57:30.294132948 CEST	21	52471	12.105.210.193	192.168.2.16
May 6, 2024 04:57:30.301386118 CEST	2121	52364	218.31.124.41	192.168.2.16
May 6, 2024 04:57:30.306056976 CEST	52410	21	192.168.2.16	126.89.102.124
May 6, 2024 04:57:30.331790924 CEST	2121	52327	221.253.236.97	192.168.2.16
May 6, 2024 04:57:30.332120895 CEST	52489	21	192.168.2.16	146.158.29.93
May 6, 2024 04:57:30.336622953 CEST	2121	52457	34.128.145.40	192.168.2.16
May 6, 2024 04:57:30.338059902 CEST	52411	2121	192.168.2.16	126.89.102.124
May 6, 2024 04:57:30.338063955 CEST	52441	21	192.168.2.16	174.6.105.216
May 6, 2024 04:57:30.338197947 CEST	52490	2121	192.168.2.16	146.158.29.93
May 6, 2024 04:57:30.340965033 CEST	2121	52476	12.105.210.193	192.168.2.16
May 6, 2024 04:57:30.342432022 CEST	21	52408	54.36.99.119	192.168.2.16
May 6, 2024 04:57:30.347197056 CEST	2121	52473	34.128.145.40	192.168.2.16
May 6, 2024 04:57:30.347246885 CEST	52473	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:30.347309113 CEST	21	52446	87.106.26.129	192.168.2.16
May 6, 2024 04:57:30.347328901 CEST	52473	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:30.347860098 CEST	52446	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:30.347861052 CEST	52492	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:30.347862005 CEST	52491	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:30.353169918 CEST	21	52474	34.128.145.40	192.168.2.16
May 6, 2024 04:57:30.353216887 CEST	52474	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:30.353266001 CEST	52474	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:30.353423119 CEST	52493	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:30.354067087 CEST	52442	21	192.168.2.16	217.66.168.110
May 6, 2024 04:57:30.354068041 CEST	52443	2121	192.168.2.16	174.6.105.216
May 6, 2024 04:57:30.354542017 CEST	52494	21	192.168.2.16	201.146.134.144
May 6, 2024 04:57:30.354568958 CEST	52495	2121	192.168.2.16	201.146.134.144
May 6, 2024 04:57:30.363076925 CEST	21	52325	221.253.236.97	192.168.2.16
May 6, 2024 04:57:30.370050907 CEST	52345	21	192.168.2.16	107.13.194.110
May 6, 2024 04:57:30.370409012 CEST	52496	21	192.168.2.16	118.80.62.189
May 6, 2024 04:57:30.370409966 CEST	52444	2121	192.168.2.16	217.66.168.110
May 6, 2024 04:57:30.386605978 CEST	52497	2121	192.168.2.16	180.227.97.92
May 6, 2024 04:57:30.386660099 CEST	52498	2121	192.168.2.16	118.80.62.189
May 6, 2024 04:57:30.386661053 CEST	52499	21	192.168.2.16	180.227.97.92
May 6, 2024 04:57:30.396537066 CEST	21	52439	149.154.65.23	192.168.2.16
May 6, 2024 04:57:30.396665096 CEST	52439	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:30.396867037 CEST	52500	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:30.399306059 CEST	2121	52409	54.36.99.119	192.168.2.16
May 6, 2024 04:57:30.402040958 CEST	52445	21	192.168.2.16	83.99.102.130
May 6, 2024 04:57:30.418042898 CEST	52416	21	192.168.2.16	119.245.126.206
May 6, 2024 04:57:30.418370008 CEST	52501	21	192.168.2.16	116.108.50.242
May 6, 2024 04:57:30.426520109 CEST	21	52477	81.88.252.91	192.168.2.16
May 6, 2024 04:57:30.426592112 CEST	52477	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:30.433049917 CEST	52455	21	192.168.2.16	14.63.16.123
May 6, 2024 04:57:30.449037075 CEST	52456	2121	192.168.2.16	14.63.16.123
May 6, 2024 04:57:30.456923008 CEST	2121	52473	34.128.145.40	192.168.2.16
May 6, 2024 04:57:30.457479000 CEST	2121	52491	34.128.145.40	192.168.2.16
May 6, 2024 04:57:30.457539082 CEST	52491	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:30.462975025 CEST	21	52493	34.128.145.40	192.168.2.16
May 6, 2024 04:57:30.462986946 CEST	21	52474	34.128.145.40	192.168.2.16
May 6, 2024 04:57:30.463037968 CEST	52493	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:30.465059996 CEST	52466	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:30.465131998 CEST	52347	21	192.168.2.16	216.117.162.236
May 6, 2024 04:57:30.465863943 CEST	21	52419	103.109.6.215	192.168.2.16
May 6, 2024 04:57:30.465981007 CEST	52419	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:30.466135025 CEST	52502	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:30.471254110 CEST	21	52427	101.43.249.26	192.168.2.16
May 6, 2024 04:57:30.471265078 CEST	21	52427	101.43.249.26	192.168.2.16
May 6, 2024 04:57:30.471306086 CEST	52427	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:30.472105026 CEST	21	52472	101.43.249.26	192.168.2.16
May 6, 2024 04:57:30.472160101 CEST	52472	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:30.497075081 CEST	52415	2121	192.168.2.16	123.117.121.246
May 6, 2024 04:57:30.497437000 CEST	52503	2121	192.168.2.16	116.108.50.242
May 6, 2024 04:57:30.497559071 CEST	52504	21	192.168.2.16	122.8.4.244
May 6, 2024 04:57:30.513293982 CEST	52505	2121	192.168.2.16	122.8.4.244
May 6, 2024 04:57:30.516319036 CEST	21	52267	193.124.183.222	192.168.2.16
May 6, 2024 04:57:30.516458035 CEST	52267	21	192.168.2.16	193.124.183.222
May 6, 2024 04:57:30.516659975 CEST	52506	21	192.168.2.16	193.124.183.222
May 6, 2024 04:57:30.526647091 CEST	21	52435	43.204.23.202	192.168.2.16
May 6, 2024 04:57:30.529041052 CEST	52450	21	192.168.2.16	4.237.56.188
May 6, 2024 04:57:30.529059887 CEST	52449	2121	192.168.2.16	83.99.102.130
May 6, 2024 04:57:30.545073032 CEST	52461	21	192.168.2.16	45.131.245.178
May 6, 2024 04:57:30.545173883 CEST	52110	21	192.168.2.16	188.214.156.147
May 6, 2024 04:57:30.545325994 CEST	52507	21	192.168.2.16	84.19.119.11
May 6, 2024 04:57:30.561065912 CEST	52462	2121	192.168.2.16	45.131.245.178
May 6, 2024 04:57:30.561366081 CEST	52508	2121	192.168.2.16	84.19.119.11
May 6, 2024 04:57:30.568485975 CEST	2121	52491	34.128.145.40	192.168.2.16
May 6, 2024 04:57:30.568558931 CEST	52491	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:30.568624973 CEST	52491	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:30.568795919 CEST	52509	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:30.573211908 CEST	21	52492	87.106.26.129	192.168.2.16
May 6, 2024 04:57:30.573307037 CEST	52492	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:30.574079990 CEST	21	52493	34.128.145.40	192.168.2.16
May 6, 2024 04:57:30.574136019 CEST	52493	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:30.574206114 CEST	52493	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:30.574369907 CEST	52510	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:30.575741053 CEST	2121	52466	34.128.145.40	192.168.2.16
May 6, 2024 04:57:30.577111006 CEST	52352	2121	192.168.2.16	107.13.194.110
May 6, 2024 04:57:30.577333927 CEST	52511	21	192.168.2.16	50.110.224.242
May 6, 2024 04:57:30.578087091 CEST	21	52446	87.106.26.129	192.168.2.16
May 6, 2024 04:57:30.578139067 CEST	52446	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:30.592046976 CEST	52452	21	192.168.2.16	34.80.125.16
May 6, 2024 04:57:30.592061043 CEST	52453	2121	192.168.2.16	4.237.56.188
May 6, 2024 04:57:30.592413902 CEST	52512	2121	192.168.2.16	50.110.224.242
May 6, 2024 04:57:30.592446089 CEST	52513	21	192.168.2.16	217.104.127.251
May 6, 2024 04:57:30.592900991 CEST	21	52410	126.89.102.124	192.168.2.16
May 6, 2024 04:57:30.597491026 CEST	21	52451	154.210.32.21	192.168.2.16
May 6, 2024 04:57:30.597503901 CEST	21	52451	154.210.32.21	192.168.2.16
May 6, 2024 04:57:30.597640038 CEST	52451	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:30.598807096 CEST	2121	52440	43.204.23.202	192.168.2.16
May 6, 2024 04:57:30.608066082 CEST	52353	21	192.168.2.16	91.144.198.131
May 6, 2024 04:57:30.624059916 CEST	52454	2121	192.168.2.16	34.80.125.16
May 6, 2024 04:57:30.640090942 CEST	2121	52411	126.89.102.124	192.168.2.16
May 6, 2024 04:57:30.640115023 CEST	52354	2121	192.168.2.16	91.144.198.131
May 6, 2024 04:57:30.640692949 CEST	52514	2121	192.168.2.16	217.104.127.251
May 6, 2024 04:57:30.640840054 CEST	52515	21	192.168.2.16	194.181.93.169
May 6, 2024 04:57:30.640877008 CEST	52516	2121	192.168.2.16	194.181.93.169
May 6, 2024 04:57:30.657165051 CEST	52355	21	192.168.2.16	119.190.208.194
May 6, 2024 04:57:30.669006109 CEST	21	52500	149.154.65.23	192.168.2.16
May 6, 2024 04:57:30.669066906 CEST	52500	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:30.670506954 CEST	21	52439	149.154.65.23	192.168.2.16
May 6, 2024 04:57:30.670557022 CEST	52439	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:30.672068119 CEST	52373	21	192.168.2.16	27.210.218.131
May 6, 2024 04:57:30.678033113 CEST	2121	52509	34.128.145.40	192.168.2.16
May 6, 2024 04:57:30.678070068 CEST	2121	52491	34.128.145.40	192.168.2.16
May 6, 2024 04:57:30.678090096 CEST	52509	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:30.683754921 CEST	21	52493	34.128.145.40	192.168.2.16
May 6, 2024 04:57:30.684897900 CEST	21	52510	34.128.145.40	192.168.2.16
May 6, 2024 04:57:30.684957027 CEST	52510	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:30.697937012 CEST	21	52296	45.87.1.166	192.168.2.16
May 6, 2024 04:57:30.698054075 CEST	52296	21	192.168.2.16	45.87.1.166
May 6, 2024 04:57:30.698216915 CEST	52517	21	192.168.2.16	45.87.1.166
May 6, 2024 04:57:30.704308033 CEST	52518	21	192.168.2.16	117.232.133.103
May 6, 2024 04:57:30.706191063 CEST	21	52477	81.88.252.91	192.168.2.16
May 6, 2024 04:57:30.706324100 CEST	52477	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:30.710270882 CEST	21	52416	119.245.126.206	192.168.2.16
May 6, 2024 04:57:30.719975948 CEST	2121	52497	180.227.97.92	192.168.2.16
May 6, 2024 04:57:30.736038923 CEST	52363	21	192.168.2.16	218.31.124.41
May 6, 2024 04:57:30.736063004 CEST	52377	2121	192.168.2.16	27.210.218.131
May 6, 2024 04:57:30.736352921 CEST	52519	2121	192.168.2.16	117.232.133.103
May 6, 2024 04:57:30.744529963 CEST	21	52455	14.63.16.123	192.168.2.16
May 6, 2024 04:57:30.757602930 CEST	2121	52456	14.63.16.123	192.168.2.16
May 6, 2024 04:57:30.773947954 CEST	21	52461	45.131.245.178	192.168.2.16
May 6, 2024 04:57:30.787427902 CEST	2121	52509	34.128.145.40	192.168.2.16
May 6, 2024 04:57:30.787482977 CEST	52509	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:30.787535906 CEST	52509	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:30.787688971 CEST	52520	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:30.789199114 CEST	21	52267	193.124.183.222	192.168.2.16
May 6, 2024 04:57:30.789247036 CEST	52267	21	192.168.2.16	193.124.183.222
May 6, 2024 04:57:30.790348053 CEST	21	52506	193.124.183.222	192.168.2.16
May 6, 2024 04:57:30.790409088 CEST	52506	21	192.168.2.16	193.124.183.222
May 6, 2024 04:57:30.793109894 CEST	2121	52462	45.131.245.178	192.168.2.16
May 6, 2024 04:57:30.795470953 CEST	21	52510	34.128.145.40	192.168.2.16
May 6, 2024 04:57:30.795526981 CEST	52510	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:30.795589924 CEST	52510	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:30.795758963 CEST	52521	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:30.800345898 CEST	52471	21	192.168.2.16	12.105.210.193
May 6, 2024 04:57:30.816044092 CEST	52459	21	192.168.2.16	76.104.160.216
May 6, 2024 04:57:30.816071987 CEST	52364	2121	192.168.2.16	218.31.124.41
May 6, 2024 04:57:30.816241026 CEST	52460	2121	192.168.2.16	76.104.160.216
May 6, 2024 04:57:30.816242933 CEST	52522	21	192.168.2.16	175.30.76.86
May 6, 2024 04:57:30.819386959 CEST	21	52502	103.109.6.215	192.168.2.16
May 6, 2024 04:57:30.819459915 CEST	52502	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:30.820719004 CEST	21	52492	87.106.26.129	192.168.2.16
May 6, 2024 04:57:30.820872068 CEST	52492	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:30.821588039 CEST	21	52472	101.43.249.26	192.168.2.16
May 6, 2024 04:57:30.821688890 CEST	52472	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:30.827045918 CEST	2121	52415	123.117.121.246	192.168.2.16
May 6, 2024 04:57:30.832618952 CEST	52523	2121	192.168.2.16	175.30.76.86
May 6, 2024 04:57:30.832710981 CEST	52524	21	192.168.2.16	24.131.39.150
May 6, 2024 04:57:30.846390963 CEST	21	52419	103.109.6.215	192.168.2.16
May 6, 2024 04:57:30.846451998 CEST	21	52419	103.109.6.215	192.168.2.16
May 6, 2024 04:57:30.846489906 CEST	52419	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:30.848050117 CEST	52476	2121	192.168.2.16	12.105.210.193
May 6, 2024 04:57:30.848058939 CEST	52408	21	192.168.2.16	54.36.99.119
May 6, 2024 04:57:30.848061085 CEST	52463	21	192.168.2.16	187.155.237.209
May 6, 2024 04:57:30.880060911 CEST	52464	2121	192.168.2.16	187.155.237.209
May 6, 2024 04:57:30.880322933 CEST	52525	2121	192.168.2.16	24.131.39.150
May 6, 2024 04:57:30.886280060 CEST	21	52515	194.181.93.169	192.168.2.16
May 6, 2024 04:57:30.886338949 CEST	52515	21	192.168.2.16	194.181.93.169
May 6, 2024 04:57:30.896712065 CEST	2121	52509	34.128.145.40	192.168.2.16
May 6, 2024 04:57:30.897254944 CEST	2121	52520	34.128.145.40	192.168.2.16
May 6, 2024 04:57:30.897315025 CEST	52520	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:30.907027960 CEST	21	52510	34.128.145.40	192.168.2.16
May 6, 2024 04:57:30.907310963 CEST	21	52521	34.128.145.40	192.168.2.16
May 6, 2024 04:57:30.907371998 CEST	52521	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:30.912069082 CEST	52465	21	192.168.2.16	110.47.255.45
May 6, 2024 04:57:30.912070990 CEST	52409	2121	192.168.2.16	54.36.99.119
May 6, 2024 04:57:30.920039892 CEST	21	52517	45.87.1.166	192.168.2.16
May 6, 2024 04:57:30.920118093 CEST	52517	21	192.168.2.16	45.87.1.166
May 6, 2024 04:57:30.929034948 CEST	21	52296	45.87.1.166	192.168.2.16
May 6, 2024 04:57:30.929100037 CEST	52296	21	192.168.2.16	45.87.1.166
May 6, 2024 04:57:30.944288015 CEST	21	52500	149.154.65.23	192.168.2.16
May 6, 2024 04:57:30.944468975 CEST	52500	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:30.955362082 CEST	21	52451	154.210.32.21	192.168.2.16
May 6, 2024 04:57:30.955492973 CEST	52451	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:30.955677986 CEST	52526	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:30.956140995 CEST	21	52451	154.210.32.21	192.168.2.16
May 6, 2024 04:57:30.956188917 CEST	52451	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:30.984868050 CEST	21	52477	81.88.252.91	192.168.2.16
May 6, 2024 04:57:30.984992981 CEST	52477	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:30.994299889 CEST	21	52471	12.105.210.193	192.168.2.16
May 6, 2024 04:57:31.009090900 CEST	2121	52520	34.128.145.40	192.168.2.16
May 6, 2024 04:57:31.009140015 CEST	52520	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:31.009227037 CEST	52520	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:31.009399891 CEST	52527	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:31.018973112 CEST	21	52521	34.128.145.40	192.168.2.16
May 6, 2024 04:57:31.019045115 CEST	52521	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:31.019121885 CEST	52521	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:31.019324064 CEST	52528	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:31.021475077 CEST	21	52373	27.210.218.131	192.168.2.16
May 6, 2024 04:57:31.039068937 CEST	52435	21	192.168.2.16	43.204.23.202
May 6, 2024 04:57:31.039376974 CEST	52529	21	192.168.2.16	67.176.204.202
May 6, 2024 04:57:31.042886972 CEST	2121	52476	12.105.210.193	192.168.2.16
May 6, 2024 04:57:31.044702053 CEST	21	52492	87.106.26.129	192.168.2.16
May 6, 2024 04:57:31.044894934 CEST	21	52492	87.106.26.129	192.168.2.16
May 6, 2024 04:57:31.045048952 CEST	52492	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:31.055063963 CEST	52362	2121	192.168.2.16	119.190.208.194
May 6, 2024 04:57:31.066462994 CEST	21	52506	193.124.183.222	192.168.2.16
May 6, 2024 04:57:31.066580057 CEST	52506	21	192.168.2.16	193.124.183.222
May 6, 2024 04:57:31.071063995 CEST	52468	2121	192.168.2.16	110.47.255.45
May 6, 2024 04:57:31.072839975 CEST	21	52408	54.36.99.119	192.168.2.16
May 6, 2024 04:57:31.086055994 CEST	52469	21	192.168.2.16	218.48.190.74
May 6, 2024 04:57:31.086366892 CEST	52530	2121	192.168.2.16	67.176.204.202
May 6, 2024 04:57:31.102082014 CEST	52365	21	192.168.2.16	170.250.175.90
May 6, 2024 04:57:31.102082968 CEST	52470	2121	192.168.2.16	218.48.190.74
May 6, 2024 04:57:31.102083921 CEST	52368	2121	192.168.2.16	71.222.180.45
May 6, 2024 04:57:31.102085114 CEST	52366	2121	192.168.2.16	170.250.175.90
May 6, 2024 04:57:31.102085114 CEST	52367	21	192.168.2.16	71.222.180.45
May 6, 2024 04:57:31.102601051 CEST	52440	2121	192.168.2.16	43.204.23.202
May 6, 2024 04:57:31.102602005 CEST	52531	21	192.168.2.16	84.189.87.171
May 6, 2024 04:57:31.102602959 CEST	52410	21	192.168.2.16	126.89.102.124
May 6, 2024 04:57:31.102602959 CEST	52532	21	192.168.2.16	125.151.227.33
May 6, 2024 04:57:31.102680922 CEST	52533	2121	192.168.2.16	84.189.87.171
May 6, 2024 04:57:31.103072882 CEST	2121	52377	27.210.218.131	192.168.2.16
May 6, 2024 04:57:31.118040085 CEST	52372	21	192.168.2.16	23.194.151.45
May 6, 2024 04:57:31.118041039 CEST	52370	21	192.168.2.16	39.123.55.26
May 6, 2024 04:57:31.118052959 CEST	52369	2121	192.168.2.16	93.218.237.16
May 6, 2024 04:57:31.118065119 CEST	52371	2121	192.168.2.16	39.123.55.26
May 6, 2024 04:57:31.118067980 CEST	52374	2121	192.168.2.16	23.194.151.45
May 6, 2024 04:57:31.118068933 CEST	52375	21	192.168.2.16	93.218.237.16
May 6, 2024 04:57:31.118792057 CEST	2121	52520	34.128.145.40	192.168.2.16
May 6, 2024 04:57:31.119843006 CEST	2121	52527	34.128.145.40	192.168.2.16
May 6, 2024 04:57:31.119896889 CEST	52527	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:31.125293970 CEST	21	52363	218.31.124.41	192.168.2.16
May 6, 2024 04:57:31.128654003 CEST	21	52521	34.128.145.40	192.168.2.16
May 6, 2024 04:57:31.129333973 CEST	21	52528	34.128.145.40	192.168.2.16
May 6, 2024 04:57:31.129400969 CEST	52528	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:31.131372929 CEST	2121	52409	54.36.99.119	192.168.2.16
May 6, 2024 04:57:31.134061098 CEST	52378	21	192.168.2.16	201.108.85.182
May 6, 2024 04:57:31.148452997 CEST	21	52517	45.87.1.166	192.168.2.16
May 6, 2024 04:57:31.148572922 CEST	52517	21	192.168.2.16	45.87.1.166
May 6, 2024 04:57:31.149043083 CEST	52411	2121	192.168.2.16	126.89.102.124
May 6, 2024 04:57:31.149058104 CEST	52380	2121	192.168.2.16	201.108.85.182
May 6, 2024 04:57:31.149059057 CEST	52381	21	192.168.2.16	81.221.225.19
May 6, 2024 04:57:31.149061918 CEST	52475	21	192.168.2.16	40.86.247.239
May 6, 2024 04:57:31.149283886 CEST	52534	2121	192.168.2.16	125.151.227.33
May 6, 2024 04:57:31.165060043 CEST	52382	2121	192.168.2.16	81.221.225.19
May 6, 2024 04:57:31.165060043 CEST	52384	2121	192.168.2.16	34.122.87.209
May 6, 2024 04:57:31.165123940 CEST	52383	21	192.168.2.16	34.122.87.209
May 6, 2024 04:57:31.165123940 CEST	52478	2121	192.168.2.16	40.86.247.239
May 6, 2024 04:57:31.170928955 CEST	21	52472	101.43.249.26	192.168.2.16
May 6, 2024 04:57:31.171061039 CEST	52472	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:31.171256065 CEST	52535	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:31.172904968 CEST	21	52502	103.109.6.215	192.168.2.16
May 6, 2024 04:57:31.173012972 CEST	52502	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:31.181055069 CEST	52480	2121	192.168.2.16	163.229.134.211
May 6, 2024 04:57:31.181056023 CEST	52479	21	192.168.2.16	163.229.134.211
May 6, 2024 04:57:31.202465057 CEST	21	52515	194.181.93.169	192.168.2.16
May 6, 2024 04:57:31.202589035 CEST	52515	21	192.168.2.16	194.181.93.169
May 6, 2024 04:57:31.202861071 CEST	52536	21	192.168.2.16	94.195.55.215
May 6, 2024 04:57:31.211046934 CEST	52385	21	192.168.2.16	67.149.12.87
May 6, 2024 04:57:31.211062908 CEST	52416	21	192.168.2.16	119.245.126.206
May 6, 2024 04:57:31.211422920 CEST	52537	2121	192.168.2.16	94.195.55.215
May 6, 2024 04:57:31.215853930 CEST	21	52500	149.154.65.23	192.168.2.16
May 6, 2024 04:57:31.216276884 CEST	21	52500	149.154.65.23	192.168.2.16
May 6, 2024 04:57:31.216420889 CEST	52500	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:31.219538927 CEST	2121	52364	218.31.124.41	192.168.2.16
May 6, 2024 04:57:31.227037907 CEST	52483	2121	192.168.2.16	190.209.33.65
May 6, 2024 04:57:31.227056980 CEST	52481	21	192.168.2.16	190.209.33.65
May 6, 2024 04:57:31.227057934 CEST	52482	21	192.168.2.16	178.75.182.238
May 6, 2024 04:57:31.227068901 CEST	52497	2121	192.168.2.16	180.227.97.92
May 6, 2024 04:57:31.227070093 CEST	52387	2121	192.168.2.16	67.149.12.87
May 6, 2024 04:57:31.227070093 CEST	52388	21	192.168.2.16	154.149.91.78
May 6, 2024 04:57:31.230269909 CEST	2121	52527	34.128.145.40	192.168.2.16
May 6, 2024 04:57:31.230323076 CEST	52527	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:31.230395079 CEST	52527	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:31.230560064 CEST	52538	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:31.239707947 CEST	21	52528	34.128.145.40	192.168.2.16
May 6, 2024 04:57:31.239757061 CEST	52528	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:31.239804029 CEST	52528	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:31.239913940 CEST	52539	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:31.243058920 CEST	52484	2121	192.168.2.16	178.75.182.238
May 6, 2024 04:57:31.243177891 CEST	52233	21	192.168.2.16	92.205.10.177
May 6, 2024 04:57:31.243581057 CEST	52540	21	192.168.2.16	92.205.10.177
May 6, 2024 04:57:31.243593931 CEST	52541	21	192.168.2.16	183.127.42.173
May 6, 2024 04:57:31.258049965 CEST	52485	21	192.168.2.16	99.234.151.186
May 6, 2024 04:57:31.258361101 CEST	52456	2121	192.168.2.16	14.63.16.123
May 6, 2024 04:57:31.258363008 CEST	52455	21	192.168.2.16	14.63.16.123
May 6, 2024 04:57:31.258363008 CEST	52542	21	192.168.2.16	182.31.110.154
May 6, 2024 04:57:31.258425951 CEST	52543	2121	192.168.2.16	183.127.42.173
May 6, 2024 04:57:31.268294096 CEST	21	52477	81.88.252.91	192.168.2.16
May 6, 2024 04:57:31.268414021 CEST	52477	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:31.268563032 CEST	52544	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:31.269263029 CEST	21	52492	87.106.26.129	192.168.2.16
May 6, 2024 04:57:31.269366026 CEST	52492	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:31.269512892 CEST	52545	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:31.269870043 CEST	21	52477	81.88.252.91	192.168.2.16
May 6, 2024 04:57:31.274048090 CEST	52461	21	192.168.2.16	45.131.245.178
May 6, 2024 04:57:31.274065018 CEST	52486	2121	192.168.2.16	99.234.151.186
May 6, 2024 04:57:31.274070978 CEST	52487	21	192.168.2.16	119.162.161.87
May 6, 2024 04:57:31.290074110 CEST	52488	2121	192.168.2.16	119.162.161.87
May 6, 2024 04:57:31.290390015 CEST	52546	2121	192.168.2.16	182.31.110.154
May 6, 2024 04:57:31.298999071 CEST	21	52526	154.210.32.21	192.168.2.16
May 6, 2024 04:57:31.300350904 CEST	52526	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:31.305445910 CEST	21	52451	154.210.32.21	192.168.2.16
May 6, 2024 04:57:31.306078911 CEST	52462	2121	192.168.2.16	45.131.245.178
May 6, 2024 04:57:31.306708097 CEST	52547	21	192.168.2.16	47.98.154.221
May 6, 2024 04:57:31.306781054 CEST	52548	2121	192.168.2.16	47.98.154.221
May 6, 2024 04:57:31.338053942 CEST	52490	2121	192.168.2.16	146.158.29.93
May 6, 2024 04:57:31.338063002 CEST	52489	21	192.168.2.16	146.158.29.93
May 6, 2024 04:57:31.338063002 CEST	52415	2121	192.168.2.16	123.117.121.246
May 6, 2024 04:57:31.338376999 CEST	52549	21	192.168.2.16	58.230.95.83
May 6, 2024 04:57:31.339931965 CEST	2121	52527	34.128.145.40	192.168.2.16
May 6, 2024 04:57:31.340157032 CEST	2121	52538	34.128.145.40	192.168.2.16
May 6, 2024 04:57:31.340219021 CEST	52538	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:31.340485096 CEST	21	52506	193.124.183.222	192.168.2.16
May 6, 2024 04:57:31.340564966 CEST	21	52506	193.124.183.222	192.168.2.16
May 6, 2024 04:57:31.340698957 CEST	52506	21	192.168.2.16	193.124.183.222
May 6, 2024 04:57:31.349442005 CEST	21	52539	34.128.145.40	192.168.2.16
May 6, 2024 04:57:31.349493980 CEST	52539	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:31.354110956 CEST	52494	21	192.168.2.16	201.146.134.144
May 6, 2024 04:57:31.354433060 CEST	52550	21	192.168.2.16	2.185.104.18
May 6, 2024 04:57:31.354476929 CEST	52551	2121	192.168.2.16	58.230.95.83
May 6, 2024 04:57:31.369052887 CEST	52495	2121	192.168.2.16	201.146.134.144
May 6, 2024 04:57:31.369352102 CEST	52552	2121	192.168.2.16	2.185.104.18
May 6, 2024 04:57:31.370388031 CEST	21	52517	45.87.1.166	192.168.2.16
May 6, 2024 04:57:31.370551109 CEST	21	52517	45.87.1.166	192.168.2.16
May 6, 2024 04:57:31.370683908 CEST	52517	21	192.168.2.16	45.87.1.166
May 6, 2024 04:57:31.385055065 CEST	52496	21	192.168.2.16	118.80.62.189
May 6, 2024 04:57:31.388706923 CEST	21	52410	126.89.102.124	192.168.2.16
May 6, 2024 04:57:31.401045084 CEST	52498	2121	192.168.2.16	118.80.62.189
May 6, 2024 04:57:31.401400089 CEST	52553	21	192.168.2.16	189.188.222.184
May 6, 2024 04:57:31.402111053 CEST	21	52532	125.151.227.33	192.168.2.16
May 6, 2024 04:57:31.402682066 CEST	52499	21	192.168.2.16	180.227.97.92
May 6, 2024 04:57:31.417438984 CEST	52554	2121	192.168.2.16	189.188.222.184
May 6, 2024 04:57:31.417618036 CEST	52555	21	192.168.2.16	220.70.226.142
May 6, 2024 04:57:31.432044029 CEST	52392	2121	192.168.2.16	154.149.91.78
May 6, 2024 04:57:31.432053089 CEST	52501	21	192.168.2.16	116.108.50.242
May 6, 2024 04:57:31.433743000 CEST	21	52435	43.204.23.202	192.168.2.16
May 6, 2024 04:57:31.447402954 CEST	21	52515	194.181.93.169	192.168.2.16
May 6, 2024 04:57:31.447458029 CEST	52515	21	192.168.2.16	194.181.93.169
May 6, 2024 04:57:31.448040009 CEST	52393	21	192.168.2.16	119.27.33.10
May 6, 2024 04:57:31.448276043 CEST	52556	2121	192.168.2.16	220.70.226.142
May 6, 2024 04:57:31.450143099 CEST	2121	52538	34.128.145.40	192.168.2.16
May 6, 2024 04:57:31.450200081 CEST	52538	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:31.450243950 CEST	52538	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:31.450376987 CEST	52557	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:31.450717926 CEST	2121	52411	126.89.102.124	192.168.2.16
May 6, 2024 04:57:31.457920074 CEST	2121	52534	125.151.227.33	192.168.2.16
May 6, 2024 04:57:31.459270000 CEST	21	52539	34.128.145.40	192.168.2.16
May 6, 2024 04:57:31.459317923 CEST	52539	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:31.459393978 CEST	52539	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:31.459609032 CEST	52558	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:31.462235928 CEST	21	52540	92.205.10.177	192.168.2.16
May 6, 2024 04:57:31.462310076 CEST	52540	21	192.168.2.16	92.205.10.177
May 6, 2024 04:57:31.464059114 CEST	52394	2121	192.168.2.16	119.27.33.10
May 6, 2024 04:57:31.488729000 CEST	21	52500	149.154.65.23	192.168.2.16
May 6, 2024 04:57:31.488887072 CEST	52500	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:31.489106894 CEST	2121	52440	43.204.23.202	192.168.2.16
May 6, 2024 04:57:31.489109993 CEST	52559	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:31.495193005 CEST	21	52492	87.106.26.129	192.168.2.16
May 6, 2024 04:57:31.495246887 CEST	52492	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:31.496042967 CEST	52396	21	192.168.2.16	73.107.61.210
May 6, 2024 04:57:31.496150970 CEST	52471	21	192.168.2.16	12.105.210.193
May 6, 2024 04:57:31.496485949 CEST	52560	21	192.168.2.16	88.13.202.144
May 6, 2024 04:57:31.497647047 CEST	21	52545	87.106.26.129	192.168.2.16
May 6, 2024 04:57:31.497704983 CEST	52545	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:31.502732038 CEST	21	52461	45.131.245.178	192.168.2.16
May 6, 2024 04:57:31.504436016 CEST	21	52416	119.245.126.206	192.168.2.16
May 6, 2024 04:57:31.508680105 CEST	21	52233	92.205.10.177	192.168.2.16
May 6, 2024 04:57:31.512064934 CEST	52503	2121	192.168.2.16	116.108.50.242
May 6, 2024 04:57:31.512160063 CEST	52504	21	192.168.2.16	122.8.4.244
May 6, 2024 04:57:31.512495995 CEST	21	52535	101.43.249.26	192.168.2.16
May 6, 2024 04:57:31.512557030 CEST	52535	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:31.520224094 CEST	21	52472	101.43.249.26	192.168.2.16
May 6, 2024 04:57:31.520236015 CEST	21	52472	101.43.249.26	192.168.2.16
May 6, 2024 04:57:31.520293951 CEST	52472	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:31.527060986 CEST	52505	2121	192.168.2.16	122.8.4.244
May 6, 2024 04:57:31.527076006 CEST	52373	21	192.168.2.16	27.210.218.131
May 6, 2024 04:57:31.527331114 CEST	52561	2121	192.168.2.16	88.13.202.144
May 6, 2024 04:57:31.527492046 CEST	21	52502	103.109.6.215	192.168.2.16
May 6, 2024 04:57:31.527623892 CEST	52502	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:31.531512976 CEST	21	52544	81.88.252.91	192.168.2.16
May 6, 2024 04:57:31.531570911 CEST	52544	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:31.538139105 CEST	21	52477	81.88.252.91	192.168.2.16
May 6, 2024 04:57:31.538650036 CEST	2121	52462	45.131.245.178	192.168.2.16
May 6, 2024 04:57:31.543045998 CEST	52476	2121	192.168.2.16	12.105.210.193
May 6, 2024 04:57:31.543045998 CEST	52397	2121	192.168.2.16	73.107.61.210
May 6, 2024 04:57:31.543056011 CEST	52398	21	192.168.2.16	119.163.63.142
May 6, 2024 04:57:31.543220997 CEST	52562	21	192.168.2.16	84.184.101.145
May 6, 2024 04:57:31.551212072 CEST	21	52541	183.127.42.173	192.168.2.16
May 6, 2024 04:57:31.553060055 CEST	21	52110	188.214.156.147	192.168.2.16
May 6, 2024 04:57:31.553101063 CEST	52110	21	192.168.2.16	188.214.156.147
May 6, 2024 04:57:31.559065104 CEST	52507	21	192.168.2.16	84.19.119.11
May 6, 2024 04:57:31.559120893 CEST	52399	2121	192.168.2.16	119.163.63.142
May 6, 2024 04:57:31.559629917 CEST	2121	52557	34.128.145.40	192.168.2.16
May 6, 2024 04:57:31.559688091 CEST	52557	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:31.559860945 CEST	2121	52538	34.128.145.40	192.168.2.16
May 6, 2024 04:57:31.560324907 CEST	2121	52497	180.227.97.92	192.168.2.16
May 6, 2024 04:57:31.568839073 CEST	21	52558	34.128.145.40	192.168.2.16
May 6, 2024 04:57:31.568905115 CEST	52558	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:31.569389105 CEST	2121	52543	183.127.42.173	192.168.2.16
May 6, 2024 04:57:31.569798946 CEST	21	52539	34.128.145.40	192.168.2.16
May 6, 2024 04:57:31.574055910 CEST	52508	2121	192.168.2.16	84.19.119.11
May 6, 2024 04:57:31.574076891 CEST	52408	21	192.168.2.16	54.36.99.119
May 6, 2024 04:57:31.574076891 CEST	52528	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:31.574106932 CEST	52401	21	192.168.2.16	90.195.150.30
May 6, 2024 04:57:31.574377060 CEST	52563	2121	192.168.2.16	84.184.101.145
May 6, 2024 04:57:31.590063095 CEST	52511	21	192.168.2.16	50.110.224.242
May 6, 2024 04:57:31.590115070 CEST	52285	2121	192.168.2.16	168.220.94.137
May 6, 2024 04:57:31.590182066 CEST	52403	2121	192.168.2.16	90.195.150.30
May 6, 2024 04:57:31.590367079 CEST	52284	21	192.168.2.16	168.220.94.137
May 6, 2024 04:57:31.590776920 CEST	52564	2121	192.168.2.16	168.220.94.137
May 6, 2024 04:57:31.590919018 CEST	52565	21	192.168.2.16	168.220.94.137
May 6, 2024 04:57:31.591025114 CEST	52566	2121	192.168.2.16	175.5.247.91
May 6, 2024 04:57:31.591101885 CEST	52567	21	192.168.2.16	175.5.247.91
May 6, 2024 04:57:31.605052948 CEST	52513	21	192.168.2.16	217.104.127.251
May 6, 2024 04:57:31.605108023 CEST	52512	2121	192.168.2.16	50.110.224.242
May 6, 2024 04:57:31.605144024 CEST	52404	21	192.168.2.16	49.172.220.154
May 6, 2024 04:57:31.605158091 CEST	52377	2121	192.168.2.16	27.210.218.131
May 6, 2024 04:57:31.605294943 CEST	52568	21	192.168.2.16	27.212.43.83
May 6, 2024 04:57:31.621051073 CEST	52406	21	192.168.2.16	52.237.175.110
May 6, 2024 04:57:31.621064901 CEST	52407	2121	192.168.2.16	52.237.175.110
May 6, 2024 04:57:31.621366024 CEST	52569	2121	192.168.2.16	27.212.43.83
May 6, 2024 04:57:31.623343945 CEST	52405	2121	192.168.2.16	49.172.220.154
May 6, 2024 04:57:31.636240959 CEST	21	52517	45.87.1.166	192.168.2.16
May 6, 2024 04:57:31.637042999 CEST	52363	21	192.168.2.16	218.31.124.41
May 6, 2024 04:57:31.637068033 CEST	52409	2121	192.168.2.16	54.36.99.119
May 6, 2024 04:57:31.637603045 CEST	52571	2121	192.168.2.16	73.49.252.159
May 6, 2024 04:57:31.637614012 CEST	52570	21	192.168.2.16	73.49.252.159
May 6, 2024 04:57:31.637644053 CEST	52572	21	192.168.2.16	143.255.66.199
May 6, 2024 04:57:31.644525051 CEST	21	52549	58.230.95.83	192.168.2.16
May 6, 2024 04:57:31.646219969 CEST	21	52526	154.210.32.21	192.168.2.16
May 6, 2024 04:57:31.646274090 CEST	52514	2121	192.168.2.16	217.104.127.251
May 6, 2024 04:57:31.646411896 CEST	52516	2121	192.168.2.16	194.181.93.169
May 6, 2024 04:57:31.646415949 CEST	52526	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:31.646651983 CEST	21	52547	47.98.154.221	192.168.2.16
May 6, 2024 04:57:31.646718979 CEST	52547	21	192.168.2.16	47.98.154.221
May 6, 2024 04:57:31.653669119 CEST	52573	21	192.168.2.16	182.85.106.39
May 6, 2024 04:57:31.653743029 CEST	52574	2121	192.168.2.16	143.255.66.199
May 6, 2024 04:57:31.653758049 CEST	52575	2121	192.168.2.16	182.85.106.39
May 6, 2024 04:57:31.654289961 CEST	2121	52551	58.230.95.83	192.168.2.16
May 6, 2024 04:57:31.655427933 CEST	21	52506	193.124.183.222	192.168.2.16
May 6, 2024 04:57:31.668250084 CEST	2121	52415	123.117.121.246	192.168.2.16
May 6, 2024 04:57:31.669323921 CEST	52576	21	192.168.2.16	92.203.45.81
May 6, 2024 04:57:31.669348001 CEST	52577	2121	192.168.2.16	92.203.45.81
May 6, 2024 04:57:31.669779062 CEST	2121	52557	34.128.145.40	192.168.2.16
May 6, 2024 04:57:31.669838905 CEST	52557	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:31.669886112 CEST	52557	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:31.670036077 CEST	52578	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:31.677807093 CEST	21	52455	14.63.16.123	192.168.2.16
May 6, 2024 04:57:31.678674936 CEST	21	52558	34.128.145.40	192.168.2.16
May 6, 2024 04:57:31.678720951 CEST	52558	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:31.678783894 CEST	52558	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:31.678905964 CEST	52579	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:31.681346893 CEST	2121	52456	14.63.16.123	192.168.2.16
May 6, 2024 04:57:31.681554079 CEST	21	52540	92.205.10.177	192.168.2.16
May 6, 2024 04:57:31.681727886 CEST	52540	21	192.168.2.16	92.205.10.177
May 6, 2024 04:57:31.683342934 CEST	21	52528	34.128.145.40	192.168.2.16
May 6, 2024 04:57:31.685729027 CEST	52580	21	192.168.2.16	73.203.139.207
May 6, 2024 04:57:31.685827017 CEST	52581	2121	192.168.2.16	73.203.139.207
May 6, 2024 04:57:31.685918093 CEST	52582	21	192.168.2.16	98.16.93.176
May 6, 2024 04:57:31.686033964 CEST	52583	2121	192.168.2.16	98.16.93.176
May 6, 2024 04:57:31.688992023 CEST	21	52471	12.105.210.193	192.168.2.16
May 6, 2024 04:57:31.699920893 CEST	2121	52564	168.220.94.137	192.168.2.16
May 6, 2024 04:57:31.699978113 CEST	52564	2121	192.168.2.16	168.220.94.137
May 6, 2024 04:57:31.700031996 CEST	21	52565	168.220.94.137	192.168.2.16
May 6, 2024 04:57:31.700087070 CEST	52565	21	192.168.2.16	168.220.94.137
May 6, 2024 04:57:31.700956106 CEST	21	52284	168.220.94.137	192.168.2.16
May 6, 2024 04:57:31.701610088 CEST	2121	52285	168.220.94.137	192.168.2.16
May 6, 2024 04:57:31.717061043 CEST	52518	21	192.168.2.16	117.232.133.103
May 6, 2024 04:57:31.723125935 CEST	21	52555	220.70.226.142	192.168.2.16
May 6, 2024 04:57:31.733062029 CEST	52364	2121	192.168.2.16	218.31.124.41
May 6, 2024 04:57:31.733350992 CEST	52584	21	192.168.2.16	47.76.113.82
May 6, 2024 04:57:31.733433008 CEST	52585	2121	192.168.2.16	47.76.113.82
May 6, 2024 04:57:31.735692024 CEST	2121	52476	12.105.210.193	192.168.2.16
May 6, 2024 04:57:31.743644953 CEST	2121	52556	220.70.226.142	192.168.2.16
May 6, 2024 04:57:31.748061895 CEST	52519	2121	192.168.2.16	117.232.133.103
May 6, 2024 04:57:31.748275995 CEST	52586	21	192.168.2.16	159.89.5.228
May 6, 2024 04:57:31.749305964 CEST	21	52545	87.106.26.129	192.168.2.16
May 6, 2024 04:57:31.749469995 CEST	52545	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:31.760016918 CEST	21	52500	149.154.65.23	192.168.2.16
May 6, 2024 04:57:31.760066986 CEST	52500	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:31.764117956 CEST	21	52559	149.154.65.23	192.168.2.16
May 6, 2024 04:57:31.764178991 CEST	52559	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:31.779056072 CEST	2121	52557	34.128.145.40	192.168.2.16
May 6, 2024 04:57:31.779622078 CEST	2121	52578	34.128.145.40	192.168.2.16
May 6, 2024 04:57:31.779673100 CEST	52578	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:31.780555964 CEST	52587	2121	192.168.2.16	159.89.5.228
May 6, 2024 04:57:31.780700922 CEST	52588	21	192.168.2.16	154.192.40.115
May 6, 2024 04:57:31.788585901 CEST	21	52579	34.128.145.40	192.168.2.16
May 6, 2024 04:57:31.788642883 CEST	52579	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:31.788786888 CEST	21	52558	34.128.145.40	192.168.2.16
May 6, 2024 04:57:31.794462919 CEST	21	52544	81.88.252.91	192.168.2.16
May 6, 2024 04:57:31.794590950 CEST	52544	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:31.795037985 CEST	52413	21	192.168.2.16	123.117.121.246
May 6, 2024 04:57:31.795594931 CEST	52589	2121	192.168.2.16	154.192.40.115
May 6, 2024 04:57:31.798899889 CEST	21	52408	54.36.99.119	192.168.2.16
May 6, 2024 04:57:31.801088095 CEST	21	52233	92.205.10.177	192.168.2.16
May 6, 2024 04:57:31.801141977 CEST	21	52233	92.205.10.177	192.168.2.16
May 6, 2024 04:57:31.801142931 CEST	52233	21	192.168.2.16	92.205.10.177
May 6, 2024 04:57:31.801188946 CEST	52233	21	192.168.2.16	92.205.10.177
May 6, 2024 04:57:31.801531076 CEST	21	52233	92.205.10.177	192.168.2.16
May 6, 2024 04:57:31.801578045 CEST	52233	21	192.168.2.16	92.205.10.177
May 6, 2024 04:57:31.811573982 CEST	52590	21	192.168.2.16	186.54.120.138
May 6, 2024 04:57:31.811597109 CEST	52591	2121	192.168.2.16	186.54.120.138
May 6, 2024 04:57:31.811621904 CEST	52592	21	192.168.2.16	162.218.101.178
May 6, 2024 04:57:31.827038050 CEST	52522	21	192.168.2.16	175.30.76.86
May 6, 2024 04:57:31.827368021 CEST	52593	2121	192.168.2.16	162.218.101.178
May 6, 2024 04:57:31.843061924 CEST	52524	21	192.168.2.16	24.131.39.150
May 6, 2024 04:57:31.843238115 CEST	52523	2121	192.168.2.16	175.30.76.86
May 6, 2024 04:57:31.854199886 CEST	21	52535	101.43.249.26	192.168.2.16
May 6, 2024 04:57:31.854386091 CEST	52535	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:31.859244108 CEST	2121	52409	54.36.99.119	192.168.2.16
May 6, 2024 04:57:31.874304056 CEST	21	52373	27.210.218.131	192.168.2.16
May 6, 2024 04:57:31.875039101 CEST	52417	2121	192.168.2.16	119.245.126.206
May 6, 2024 04:57:31.875515938 CEST	52594	21	192.168.2.16	116.126.222.27
May 6, 2024 04:57:31.875606060 CEST	52595	2121	192.168.2.16	116.126.222.27
May 6, 2024 04:57:31.882396936 CEST	21	52502	103.109.6.215	192.168.2.16
May 6, 2024 04:57:31.882519960 CEST	52502	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:31.882749081 CEST	52596	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:31.889317036 CEST	2121	52578	34.128.145.40	192.168.2.16
May 6, 2024 04:57:31.889374018 CEST	52578	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:31.889483929 CEST	52578	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:31.889636993 CEST	52597	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:31.891061068 CEST	52525	2121	192.168.2.16	24.131.39.150
May 6, 2024 04:57:31.891079903 CEST	52418	21	192.168.2.16	201.105.104.191
May 6, 2024 04:57:31.891081095 CEST	52410	21	192.168.2.16	126.89.102.124
May 6, 2024 04:57:31.891463995 CEST	52598	21	192.168.2.16	87.59.104.198
May 6, 2024 04:57:31.898344994 CEST	21	52579	34.128.145.40	192.168.2.16
May 6, 2024 04:57:31.898438931 CEST	52579	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:31.898539066 CEST	52579	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:31.898644924 CEST	52599	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:31.900089979 CEST	21	52540	92.205.10.177	192.168.2.16
May 6, 2024 04:57:31.900114059 CEST	21	52540	92.205.10.177	192.168.2.16
May 6, 2024 04:57:31.900269032 CEST	52540	21	192.168.2.16	92.205.10.177
May 6, 2024 04:57:31.907042027 CEST	52532	21	192.168.2.16	125.151.227.33
May 6, 2024 04:57:31.939047098 CEST	52435	21	192.168.2.16	43.204.23.202
May 6, 2024 04:57:31.939435005 CEST	52600	2121	192.168.2.16	87.59.104.198
May 6, 2024 04:57:31.955070019 CEST	52411	2121	192.168.2.16	126.89.102.124
May 6, 2024 04:57:31.970062017 CEST	52534	2121	192.168.2.16	125.151.227.33
May 6, 2024 04:57:31.970065117 CEST	52421	21	192.168.2.16	79.254.57.57
May 6, 2024 04:57:31.970617056 CEST	52420	2121	192.168.2.16	201.105.104.191
May 6, 2024 04:57:31.971590042 CEST	2121	52577	92.203.45.81	192.168.2.16
May 6, 2024 04:57:31.972007036 CEST	2121	52377	27.210.218.131	192.168.2.16
May 6, 2024 04:57:31.972371101 CEST	52601	21	192.168.2.16	83.8.70.228
May 6, 2024 04:57:31.977683067 CEST	21	52545	87.106.26.129	192.168.2.16
May 6, 2024 04:57:31.977870941 CEST	21	52545	87.106.26.129	192.168.2.16
May 6, 2024 04:57:31.978048086 CEST	52545	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:31.986042976 CEST	52423	21	192.168.2.16	188.214.156.147
May 6, 2024 04:57:31.986058950 CEST	52422	2121	192.168.2.16	79.254.57.57
May 6, 2024 04:57:31.986706018 CEST	21	52547	47.98.154.221	192.168.2.16
May 6, 2024 04:57:31.986794949 CEST	52547	21	192.168.2.16	47.98.154.221
May 6, 2024 04:57:31.987238884 CEST	52602	2121	192.168.2.16	83.8.70.228
May 6, 2024 04:57:31.989742041 CEST	21	52526	154.210.32.21	192.168.2.16
May 6, 2024 04:57:31.989833117 CEST	21	52526	154.210.32.21	192.168.2.16
May 6, 2024 04:57:31.989926100 CEST	52526	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:31.999078035 CEST	2121	52578	34.128.145.40	192.168.2.16
May 6, 2024 04:57:32.000015020 CEST	2121	52597	34.128.145.40	192.168.2.16
May 6, 2024 04:57:32.000116110 CEST	52597	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:32.002043009 CEST	52440	2121	192.168.2.16	43.204.23.202
May 6, 2024 04:57:32.002052069 CEST	52424	21	192.168.2.16	110.12.224.197
May 6, 2024 04:57:32.008131027 CEST	21	52579	34.128.145.40	192.168.2.16
May 6, 2024 04:57:32.008411884 CEST	21	52599	34.128.145.40	192.168.2.16
May 6, 2024 04:57:32.008462906 CEST	52599	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:32.018032074 CEST	52461	21	192.168.2.16	45.131.245.178
May 6, 2024 04:57:32.018141985 CEST	52416	21	192.168.2.16	119.245.126.206
May 6, 2024 04:57:32.018383980 CEST	52603	21	192.168.2.16	13.93.95.160
May 6, 2024 04:57:32.027744055 CEST	21	52363	218.31.124.41	192.168.2.16
May 6, 2024 04:57:32.042068005 CEST	21	52559	149.154.65.23	192.168.2.16
May 6, 2024 04:57:32.042195082 CEST	52559	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:32.050054073 CEST	52462	2121	192.168.2.16	45.131.245.178
May 6, 2024 04:57:32.050308943 CEST	52604	2121	192.168.2.16	13.93.95.160
May 6, 2024 04:57:32.050323963 CEST	52529	21	192.168.2.16	67.176.204.202
May 6, 2024 04:57:32.056967974 CEST	2121	52585	47.76.113.82	192.168.2.16
May 6, 2024 04:57:32.062767029 CEST	21	52544	81.88.252.91	192.168.2.16
May 6, 2024 04:57:32.062975883 CEST	52544	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:32.066056967 CEST	52541	21	192.168.2.16	183.127.42.173
May 6, 2024 04:57:32.066056967 CEST	52497	2121	192.168.2.16	180.227.97.92
May 6, 2024 04:57:32.066281080 CEST	21	52584	47.76.113.82	192.168.2.16
May 6, 2024 04:57:32.082266092 CEST	52543	2121	192.168.2.16	183.127.42.173
May 6, 2024 04:57:32.082446098 CEST	52605	21	192.168.2.16	73.169.12.1
May 6, 2024 04:57:32.098064899 CEST	52530	2121	192.168.2.16	67.176.204.202
May 6, 2024 04:57:32.098403931 CEST	52606	2121	192.168.2.16	73.169.12.1
May 6, 2024 04:57:32.113429070 CEST	2121	52597	34.128.145.40	192.168.2.16
May 6, 2024 04:57:32.113476038 CEST	52597	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:32.113576889 CEST	52597	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:32.113743067 CEST	52607	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:32.114062071 CEST	52429	2121	192.168.2.16	110.12.224.197
May 6, 2024 04:57:32.114065886 CEST	52531	21	192.168.2.16	84.189.87.171
May 6, 2024 04:57:32.114300013 CEST	52533	2121	192.168.2.16	84.189.87.171
May 6, 2024 04:57:32.114321947 CEST	52608	21	192.168.2.16	112.242.0.25
May 6, 2024 04:57:32.118880987 CEST	21	52599	34.128.145.40	192.168.2.16
May 6, 2024 04:57:32.118928909 CEST	52599	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:32.118964911 CEST	52599	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:32.119189978 CEST	52609	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:32.136116028 CEST	2121	52364	218.31.124.41	192.168.2.16
May 6, 2024 04:57:32.146044970 CEST	52549	21	192.168.2.16	58.230.95.83
May 6, 2024 04:57:32.146064043 CEST	52430	21	192.168.2.16	200.9.99.204
May 6, 2024 04:57:32.146570921 CEST	52610	2121	192.168.2.16	112.242.0.25
May 6, 2024 04:57:32.161425114 CEST	21	52540	92.205.10.177	192.168.2.16
May 6, 2024 04:57:32.162153006 CEST	52551	2121	192.168.2.16	58.230.95.83
May 6, 2024 04:57:32.178059101 CEST	52415	2121	192.168.2.16	123.117.121.246
May 6, 2024 04:57:32.178059101 CEST	52455	21	192.168.2.16	14.63.16.123
May 6, 2024 04:57:32.178427935 CEST	21	52410	126.89.102.124	192.168.2.16
May 6, 2024 04:57:32.179132938 CEST	2121	52595	116.126.222.27	192.168.2.16
May 6, 2024 04:57:32.194062948 CEST	52456	2121	192.168.2.16	14.63.16.123
May 6, 2024 04:57:32.194068909 CEST	52471	21	192.168.2.16	12.105.210.193
May 6, 2024 04:57:32.194305897 CEST	52611	21	192.168.2.16	104.85.128.73
May 6, 2024 04:57:32.195384979 CEST	21	52594	116.126.222.27	192.168.2.16
May 6, 2024 04:57:32.198211908 CEST	21	52535	101.43.249.26	192.168.2.16
May 6, 2024 04:57:32.198545933 CEST	52535	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:32.199309111 CEST	52612	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:32.207849026 CEST	21	52532	125.151.227.33	192.168.2.16
May 6, 2024 04:57:32.208930016 CEST	21	52545	87.106.26.129	192.168.2.16
May 6, 2024 04:57:32.209192991 CEST	52545	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:32.209775925 CEST	52613	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:32.210107088 CEST	52536	21	192.168.2.16	94.195.55.215
May 6, 2024 04:57:32.210577965 CEST	52615	21	192.168.2.16	220.90.78.219
May 6, 2024 04:57:32.210577965 CEST	52614	2121	192.168.2.16	104.85.128.73
May 6, 2024 04:57:32.223093033 CEST	2121	52597	34.128.145.40	192.168.2.16
May 6, 2024 04:57:32.223779917 CEST	2121	52607	34.128.145.40	192.168.2.16
May 6, 2024 04:57:32.224330902 CEST	52607	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:32.226072073 CEST	52555	21	192.168.2.16	220.70.226.142
May 6, 2024 04:57:32.226075888 CEST	52537	2121	192.168.2.16	94.195.55.215
May 6, 2024 04:57:32.226408958 CEST	52616	2121	192.168.2.16	220.90.78.219
May 6, 2024 04:57:32.231971979 CEST	21	52599	34.128.145.40	192.168.2.16
May 6, 2024 04:57:32.231982946 CEST	21	52609	34.128.145.40	192.168.2.16
May 6, 2024 04:57:32.233160019 CEST	52609	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:32.238030910 CEST	21	52502	103.109.6.215	192.168.2.16
May 6, 2024 04:57:32.238040924 CEST	21	52502	103.109.6.215	192.168.2.16
May 6, 2024 04:57:32.239728928 CEST	52502	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:32.242043972 CEST	52432	2121	192.168.2.16	200.9.99.204
May 6, 2024 04:57:32.242043972 CEST	52433	21	192.168.2.16	114.217.64.51
May 6, 2024 04:57:32.242408991 CEST	52476	2121	192.168.2.16	12.105.210.193
May 6, 2024 04:57:32.249113083 CEST	21	52461	45.131.245.178	192.168.2.16
May 6, 2024 04:57:32.256315947 CEST	2121	52411	126.89.102.124	192.168.2.16
May 6, 2024 04:57:32.257785082 CEST	21	52596	103.109.6.215	192.168.2.16
May 6, 2024 04:57:32.257997036 CEST	52596	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:32.258135080 CEST	52556	2121	192.168.2.16	220.70.226.142
May 6, 2024 04:57:32.258143902 CEST	52542	21	192.168.2.16	182.31.110.154
May 6, 2024 04:57:32.266469955 CEST	52434	2121	192.168.2.16	114.217.64.51
May 6, 2024 04:57:32.274359941 CEST	52617	21	192.168.2.16	84.33.117.251
May 6, 2024 04:57:32.275460005 CEST	21	52110	188.214.156.147	192.168.2.16
May 6, 2024 04:57:32.275897026 CEST	52110	21	192.168.2.16	188.214.156.147
May 6, 2024 04:57:32.278517962 CEST	2121	52534	125.151.227.33	192.168.2.16
May 6, 2024 04:57:32.282030106 CEST	2121	52462	45.131.245.178	192.168.2.16
May 6, 2024 04:57:32.290083885 CEST	52546	2121	192.168.2.16	182.31.110.154
May 6, 2024 04:57:32.310590982 CEST	21	52416	119.245.126.206	192.168.2.16
May 6, 2024 04:57:32.317393064 CEST	21	52559	149.154.65.23	192.168.2.16
May 6, 2024 04:57:32.317704916 CEST	21	52559	149.154.65.23	192.168.2.16
May 6, 2024 04:57:32.321072102 CEST	52559	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:32.321073055 CEST	52548	2121	192.168.2.16	47.98.154.221
May 6, 2024 04:57:32.326108932 CEST	21	52547	47.98.154.221	192.168.2.16
May 6, 2024 04:57:32.326431036 CEST	21	52547	47.98.154.221	192.168.2.16
May 6, 2024 04:57:32.326508999 CEST	52547	21	192.168.2.16	47.98.154.221
May 6, 2024 04:57:32.326508999 CEST	52547	21	192.168.2.16	47.98.154.221
May 6, 2024 04:57:32.333841085 CEST	21	52435	43.204.23.202	192.168.2.16
May 6, 2024 04:57:32.334367037 CEST	2121	52607	34.128.145.40	192.168.2.16
May 6, 2024 04:57:32.336922884 CEST	52607	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:32.336922884 CEST	52607	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:32.337579966 CEST	52619	2121	192.168.2.16	84.33.117.251
May 6, 2024 04:57:32.337594032 CEST	52618	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:32.339080095 CEST	21	52526	154.210.32.21	192.168.2.16
May 6, 2024 04:57:32.339093924 CEST	21	52544	81.88.252.91	192.168.2.16
May 6, 2024 04:57:32.339216948 CEST	21	52544	81.88.252.91	192.168.2.16
May 6, 2024 04:57:32.339257002 CEST	52544	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:32.339498043 CEST	52526	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:32.339499950 CEST	52620	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:32.339551926 CEST	21	52526	154.210.32.21	192.168.2.16
May 6, 2024 04:57:32.339581966 CEST	52621	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:32.340890884 CEST	52526	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:32.343081951 CEST	21	52609	34.128.145.40	192.168.2.16
May 6, 2024 04:57:32.345232010 CEST	52609	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:32.345232010 CEST	52609	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:32.349159956 CEST	52622	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:32.353070021 CEST	52441	21	192.168.2.16	174.6.105.216
May 6, 2024 04:57:32.369048119 CEST	52552	2121	192.168.2.16	2.185.104.18
May 6, 2024 04:57:32.369064093 CEST	52442	21	192.168.2.16	217.66.168.110
May 6, 2024 04:57:32.369064093 CEST	52443	2121	192.168.2.16	174.6.105.216
May 6, 2024 04:57:32.369066954 CEST	52550	21	192.168.2.16	2.185.104.18
May 6, 2024 04:57:32.370248079 CEST	52623	21	192.168.2.16	74.139.25.119
May 6, 2024 04:57:32.373991966 CEST	21	52541	183.127.42.173	192.168.2.16
May 6, 2024 04:57:32.385157108 CEST	52444	2121	192.168.2.16	217.66.168.110
May 6, 2024 04:57:32.387027979 CEST	21	52471	12.105.210.193	192.168.2.16
May 6, 2024 04:57:32.388330936 CEST	2121	52440	43.204.23.202	192.168.2.16
May 6, 2024 04:57:32.392649889 CEST	2121	52543	183.127.42.173	192.168.2.16
May 6, 2024 04:57:32.400464058 CEST	2121	52497	180.227.97.92	192.168.2.16
May 6, 2024 04:57:32.401166916 CEST	52553	21	192.168.2.16	189.188.222.184
May 6, 2024 04:57:32.417161942 CEST	52445	21	192.168.2.16	83.99.102.130
May 6, 2024 04:57:32.432071924 CEST	52554	2121	192.168.2.16	189.188.222.184
May 6, 2024 04:57:32.434995890 CEST	2121	52476	12.105.210.193	192.168.2.16
May 6, 2024 04:57:32.437855005 CEST	21	52613	87.106.26.129	192.168.2.16
May 6, 2024 04:57:32.439032078 CEST	52613	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:32.439322948 CEST	21	52545	87.106.26.129	192.168.2.16
May 6, 2024 04:57:32.441241980 CEST	52545	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:32.448261023 CEST	2121	52607	34.128.145.40	192.168.2.16
May 6, 2024 04:57:32.448880911 CEST	2121	52618	34.128.145.40	192.168.2.16
May 6, 2024 04:57:32.448941946 CEST	52618	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:32.452337027 CEST	21	52549	58.230.95.83	192.168.2.16
May 6, 2024 04:57:32.455113888 CEST	21	52609	34.128.145.40	192.168.2.16
May 6, 2024 04:57:32.458877087 CEST	21	52622	34.128.145.40	192.168.2.16
May 6, 2024 04:57:32.458966970 CEST	52622	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:32.462255001 CEST	2121	52551	58.230.95.83	192.168.2.16
May 6, 2024 04:57:32.465157032 CEST	52624	21	192.168.2.16	216.117.162.236
May 6, 2024 04:57:32.480046988 CEST	52577	2121	192.168.2.16	92.203.45.81
May 6, 2024 04:57:32.489733934 CEST	21	52455	14.63.16.123	192.168.2.16
May 6, 2024 04:57:32.500761032 CEST	2121	52456	14.63.16.123	192.168.2.16
May 6, 2024 04:57:32.507915974 CEST	2121	52415	123.117.121.246	192.168.2.16
May 6, 2024 04:57:32.510082960 CEST	52560	21	192.168.2.16	88.13.202.144
May 6, 2024 04:57:32.511012077 CEST	21	52615	220.90.78.219	192.168.2.16
May 6, 2024 04:57:32.525449991 CEST	52625	2121	192.168.2.16	74.139.25.119
May 6, 2024 04:57:32.528503895 CEST	2121	52616	220.90.78.219	192.168.2.16
May 6, 2024 04:57:32.531106949 CEST	21	52555	220.70.226.142	192.168.2.16
May 6, 2024 04:57:32.540061951 CEST	52450	21	192.168.2.16	4.237.56.188
May 6, 2024 04:57:32.540075064 CEST	52449	2121	192.168.2.16	83.99.102.130
May 6, 2024 04:57:32.540076971 CEST	52561	2121	192.168.2.16	88.13.202.144
May 6, 2024 04:57:32.540124893 CEST	21	52535	101.43.249.26	192.168.2.16
May 6, 2024 04:57:32.540137053 CEST	21	52535	101.43.249.26	192.168.2.16
May 6, 2024 04:57:32.540788889 CEST	52535	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:32.547746897 CEST	21	52612	101.43.249.26	192.168.2.16
May 6, 2024 04:57:32.547854900 CEST	52612	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:32.553580999 CEST	2121	52556	220.70.226.142	192.168.2.16
May 6, 2024 04:57:32.556243896 CEST	52562	21	192.168.2.16	84.184.101.145
May 6, 2024 04:57:32.558294058 CEST	2121	52618	34.128.145.40	192.168.2.16
May 6, 2024 04:57:32.558353901 CEST	52618	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:32.558485985 CEST	52618	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:32.558640957 CEST	52626	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:32.568762064 CEST	21	52622	34.128.145.40	192.168.2.16
May 6, 2024 04:57:32.568871975 CEST	52622	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:32.568871975 CEST	52622	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:32.569159985 CEST	52627	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:32.572067976 CEST	52584	21	192.168.2.16	47.76.113.82
May 6, 2024 04:57:32.572068930 CEST	52585	2121	192.168.2.16	47.76.113.82
May 6, 2024 04:57:32.572760105 CEST	52628	21	192.168.2.16	87.4.141.61
May 6, 2024 04:57:32.588241100 CEST	52563	2121	192.168.2.16	84.184.101.145
May 6, 2024 04:57:32.597949028 CEST	21	52559	149.154.65.23	192.168.2.16
May 6, 2024 04:57:32.598169088 CEST	52559	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:32.599195004 CEST	52629	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:32.604074001 CEST	52566	2121	192.168.2.16	175.5.247.91
May 6, 2024 04:57:32.604077101 CEST	52567	21	192.168.2.16	175.5.247.91
May 6, 2024 04:57:32.604078054 CEST	52452	21	192.168.2.16	34.80.125.16
May 6, 2024 04:57:32.604163885 CEST	52453	2121	192.168.2.16	4.237.56.188
May 6, 2024 04:57:32.604613066 CEST	21	52620	81.88.252.91	192.168.2.16
May 6, 2024 04:57:32.604641914 CEST	52630	2121	192.168.2.16	87.4.141.61
May 6, 2024 04:57:32.605160952 CEST	52620	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:32.617527962 CEST	21	52544	81.88.252.91	192.168.2.16
May 6, 2024 04:57:32.620060921 CEST	52568	21	192.168.2.16	27.212.43.83
May 6, 2024 04:57:32.630821943 CEST	21	52596	103.109.6.215	192.168.2.16
May 6, 2024 04:57:32.631793976 CEST	52596	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:32.636075974 CEST	52454	2121	192.168.2.16	34.80.125.16
May 6, 2024 04:57:32.636076927 CEST	52569	2121	192.168.2.16	27.212.43.83
May 6, 2024 04:57:32.652055025 CEST	52570	21	192.168.2.16	73.49.252.159
May 6, 2024 04:57:32.652167082 CEST	52572	21	192.168.2.16	143.255.66.199
May 6, 2024 04:57:32.652172089 CEST	52571	2121	192.168.2.16	73.49.252.159
May 6, 2024 04:57:32.652331114 CEST	52631	21	192.168.2.16	108.54.153.113
May 6, 2024 04:57:32.667625904 CEST	2121	52618	34.128.145.40	192.168.2.16
May 6, 2024 04:57:32.668065071 CEST	52573	21	192.168.2.16	182.85.106.39
May 6, 2024 04:57:32.668066025 CEST	52575	2121	192.168.2.16	182.85.106.39
May 6, 2024 04:57:32.668066978 CEST	52574	2121	192.168.2.16	143.255.66.199
May 6, 2024 04:57:32.668205976 CEST	2121	52626	34.128.145.40	192.168.2.16
May 6, 2024 04:57:32.668329954 CEST	52632	2121	192.168.2.16	108.54.153.113
May 6, 2024 04:57:32.668356895 CEST	52626	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:32.676083088 CEST	21	52621	154.210.32.21	192.168.2.16
May 6, 2024 04:57:32.676156998 CEST	52621	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:32.678596973 CEST	21	52622	34.128.145.40	192.168.2.16
May 6, 2024 04:57:32.678634882 CEST	21	52627	34.128.145.40	192.168.2.16
May 6, 2024 04:57:32.678793907 CEST	52627	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:32.684045076 CEST	52576	21	192.168.2.16	92.203.45.81
May 6, 2024 04:57:32.684114933 CEST	52595	2121	192.168.2.16	116.126.222.27
May 6, 2024 04:57:32.684920073 CEST	21	52526	154.210.32.21	192.168.2.16
May 6, 2024 04:57:32.690841913 CEST	21	52613	87.106.26.129	192.168.2.16
May 6, 2024 04:57:32.690979004 CEST	52613	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:32.700042963 CEST	52580	21	192.168.2.16	73.203.139.207
May 6, 2024 04:57:32.700043917 CEST	52581	2121	192.168.2.16	73.203.139.207
May 6, 2024 04:57:32.700046062 CEST	52582	21	192.168.2.16	98.16.93.176
May 6, 2024 04:57:32.700154066 CEST	52594	21	192.168.2.16	116.126.222.27
May 6, 2024 04:57:32.700154066 CEST	52583	2121	192.168.2.16	98.16.93.176
May 6, 2024 04:57:32.716063023 CEST	52532	21	192.168.2.16	125.151.227.33
May 6, 2024 04:57:32.749165058 CEST	52586	21	192.168.2.16	159.89.5.228
May 6, 2024 04:57:32.765156984 CEST	52461	21	192.168.2.16	45.131.245.178
May 6, 2024 04:57:32.780070066 CEST	52534	2121	192.168.2.16	125.151.227.33
May 6, 2024 04:57:32.780070066 CEST	52587	2121	192.168.2.16	159.89.5.228
May 6, 2024 04:57:32.780109882 CEST	2121	52626	34.128.145.40	192.168.2.16
May 6, 2024 04:57:32.780139923 CEST	52588	21	192.168.2.16	154.192.40.115
May 6, 2024 04:57:32.780256033 CEST	52626	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:32.780256033 CEST	52626	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:32.781157017 CEST	52633	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:32.782406092 CEST	2121	52577	92.203.45.81	192.168.2.16
May 6, 2024 04:57:32.788397074 CEST	21	52627	34.128.145.40	192.168.2.16
May 6, 2024 04:57:32.788512945 CEST	52627	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:32.788512945 CEST	52627	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:32.789161921 CEST	52634	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:32.796073914 CEST	52462	2121	192.168.2.16	45.131.245.178
May 6, 2024 04:57:32.796076059 CEST	52589	2121	192.168.2.16	154.192.40.115
May 6, 2024 04:57:32.811070919 CEST	52590	21	192.168.2.16	186.54.120.138
May 6, 2024 04:57:32.812551975 CEST	52591	2121	192.168.2.16	186.54.120.138
May 6, 2024 04:57:32.827050924 CEST	52459	21	192.168.2.16	76.104.160.216
May 6, 2024 04:57:32.827052116 CEST	52592	21	192.168.2.16	162.218.101.178
May 6, 2024 04:57:32.827131987 CEST	52593	2121	192.168.2.16	162.218.101.178
May 6, 2024 04:57:32.827132940 CEST	52460	2121	192.168.2.16	76.104.160.216
May 6, 2024 04:57:32.844614029 CEST	52435	21	192.168.2.16	43.204.23.202
May 6, 2024 04:57:32.854861975 CEST	21	52629	149.154.65.23	192.168.2.16
May 6, 2024 04:57:32.857156992 CEST	52629	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:32.861159086 CEST	52463	21	192.168.2.16	187.155.237.209
May 6, 2024 04:57:32.873924971 CEST	21	52559	149.154.65.23	192.168.2.16
May 6, 2024 04:57:32.874026060 CEST	52559	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:32.875066042 CEST	52541	21	192.168.2.16	183.127.42.173
May 6, 2024 04:57:32.890991926 CEST	21	52620	81.88.252.91	192.168.2.16
May 6, 2024 04:57:32.891084909 CEST	52464	2121	192.168.2.16	187.155.237.209
May 6, 2024 04:57:32.891086102 CEST	52440	2121	192.168.2.16	43.204.23.202
May 6, 2024 04:57:32.891211987 CEST	52620	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:32.891458988 CEST	52471	21	192.168.2.16	12.105.210.193
May 6, 2024 04:57:32.892896891 CEST	2121	52633	34.128.145.40	192.168.2.16
May 6, 2024 04:57:32.892961979 CEST	52633	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:32.897272110 CEST	2121	52585	47.76.113.82	192.168.2.16
May 6, 2024 04:57:32.898628950 CEST	21	52612	101.43.249.26	192.168.2.16
May 6, 2024 04:57:32.898803949 CEST	52612	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:32.900700092 CEST	21	52627	34.128.145.40	192.168.2.16
May 6, 2024 04:57:32.900839090 CEST	21	52634	34.128.145.40	192.168.2.16
May 6, 2024 04:57:32.901074886 CEST	52634	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:32.906677008 CEST	21	52584	47.76.113.82	192.168.2.16
May 6, 2024 04:57:32.907063007 CEST	52543	2121	192.168.2.16	183.127.42.173
May 6, 2024 04:57:32.907062054 CEST	52598	21	192.168.2.16	87.59.104.198
May 6, 2024 04:57:32.907526016 CEST	52497	2121	192.168.2.16	180.227.97.92
May 6, 2024 04:57:32.919008017 CEST	21	52613	87.106.26.129	192.168.2.16
May 6, 2024 04:57:32.919255018 CEST	21	52613	87.106.26.129	192.168.2.16
May 6, 2024 04:57:32.919542074 CEST	52613	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:32.923063993 CEST	52465	21	192.168.2.16	110.47.255.45
May 6, 2024 04:57:32.939070940 CEST	52600	2121	192.168.2.16	87.59.104.198
May 6, 2024 04:57:32.939078093 CEST	52476	2121	192.168.2.16	12.105.210.193
May 6, 2024 04:57:32.955068111 CEST	52549	21	192.168.2.16	58.230.95.83
May 6, 2024 04:57:32.972651958 CEST	52551	2121	192.168.2.16	58.230.95.83
May 6, 2024 04:57:32.982187033 CEST	21	52110	188.214.156.147	192.168.2.16
May 6, 2024 04:57:32.982292891 CEST	52110	21	192.168.2.16	188.214.156.147
May 6, 2024 04:57:32.986639023 CEST	2121	52595	116.126.222.27	192.168.2.16
May 6, 2024 04:57:32.987509966 CEST	52601	21	192.168.2.16	83.8.70.228
May 6, 2024 04:57:32.993963957 CEST	21	52461	45.131.245.178	192.168.2.16
May 6, 2024 04:57:33.002073050 CEST	52602	2121	192.168.2.16	83.8.70.228
May 6, 2024 04:57:33.002074957 CEST	52455	21	192.168.2.16	14.63.16.123
May 6, 2024 04:57:33.002123117 CEST	52456	2121	192.168.2.16	14.63.16.123
May 6, 2024 04:57:33.002427101 CEST	2121	52633	34.128.145.40	192.168.2.16
May 6, 2024 04:57:33.002988100 CEST	52633	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:33.003104925 CEST	52633	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:33.003314018 CEST	52635	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:33.004511118 CEST	21	52596	103.109.6.215	192.168.2.16
May 6, 2024 04:57:33.005162954 CEST	52596	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:33.010663986 CEST	21	52634	34.128.145.40	192.168.2.16
May 6, 2024 04:57:33.011367083 CEST	52634	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:33.011367083 CEST	52634	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:33.012242079 CEST	52636	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:33.012862921 CEST	21	52621	154.210.32.21	192.168.2.16
May 6, 2024 04:57:33.014343977 CEST	52621	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:33.015049934 CEST	21	52532	125.151.227.33	192.168.2.16
May 6, 2024 04:57:33.018506050 CEST	52615	21	192.168.2.16	220.90.78.219
May 6, 2024 04:57:33.018507004 CEST	52637	21	192.168.2.16	88.115.188.149
May 6, 2024 04:57:33.018604040 CEST	21	52594	116.126.222.27	192.168.2.16
May 6, 2024 04:57:33.028029919 CEST	2121	52462	45.131.245.178	192.168.2.16
May 6, 2024 04:57:33.033052921 CEST	52603	21	192.168.2.16	13.93.95.160
May 6, 2024 04:57:33.033052921 CEST	52616	2121	192.168.2.16	220.90.78.219
May 6, 2024 04:57:33.033054113 CEST	52555	21	192.168.2.16	220.70.226.142
May 6, 2024 04:57:33.050229073 CEST	52638	2121	192.168.2.16	88.115.188.149
May 6, 2024 04:57:33.065061092 CEST	52556	2121	192.168.2.16	220.70.226.142
May 6, 2024 04:57:33.065063000 CEST	52604	2121	192.168.2.16	13.93.95.160
May 6, 2024 04:57:33.066514015 CEST	52639	21	192.168.2.16	79.21.7.32
May 6, 2024 04:57:33.081161022 CEST	52468	2121	192.168.2.16	110.47.255.45
May 6, 2024 04:57:33.084469080 CEST	21	52471	12.105.210.193	192.168.2.16
May 6, 2024 04:57:33.088790894 CEST	2121	52534	125.151.227.33	192.168.2.16
May 6, 2024 04:57:33.097069025 CEST	52469	21	192.168.2.16	218.48.190.74
May 6, 2024 04:57:33.097069979 CEST	52605	21	192.168.2.16	73.169.12.1
May 6, 2024 04:57:33.097682953 CEST	52641	21	192.168.2.16	188.81.21.242
May 6, 2024 04:57:33.097683907 CEST	52640	2121	192.168.2.16	188.81.21.242
May 6, 2024 04:57:33.097755909 CEST	52643	2121	192.168.2.16	61.69.211.194
May 6, 2024 04:57:33.097758055 CEST	52642	2121	192.168.2.16	79.21.7.32
May 6, 2024 04:57:33.097763062 CEST	52644	21	192.168.2.16	61.69.211.194
May 6, 2024 04:57:33.112920046 CEST	2121	52635	34.128.145.40	192.168.2.16
May 6, 2024 04:57:33.113055944 CEST	52635	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:33.113055944 CEST	52626	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:33.113058090 CEST	52606	2121	192.168.2.16	73.169.12.1
May 6, 2024 04:57:33.113087893 CEST	2121	52633	34.128.145.40	192.168.2.16
May 6, 2024 04:57:33.113115072 CEST	52470	2121	192.168.2.16	218.48.190.74
May 6, 2024 04:57:33.113944054 CEST	52646	2121	192.168.2.16	23.201.234.9
May 6, 2024 04:57:33.113945961 CEST	52645	21	192.168.2.16	23.201.234.9
May 6, 2024 04:57:33.114090919 CEST	52647	21	192.168.2.16	98.171.102.192
May 6, 2024 04:57:33.114090919 CEST	52648	2121	192.168.2.16	98.171.102.192
May 6, 2024 04:57:33.114149094 CEST	52650	2121	192.168.2.16	123.190.169.224
May 6, 2024 04:57:33.114150047 CEST	52649	21	192.168.2.16	123.190.169.224
May 6, 2024 04:57:33.115679979 CEST	21	52629	149.154.65.23	192.168.2.16
May 6, 2024 04:57:33.117162943 CEST	52629	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:33.121807098 CEST	21	52636	34.128.145.40	192.168.2.16
May 6, 2024 04:57:33.122777939 CEST	52636	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:33.129167080 CEST	52608	21	192.168.2.16	112.242.0.25
May 6, 2024 04:57:33.129487038 CEST	52651	21	192.168.2.16	174.174.198.67
May 6, 2024 04:57:33.136040926 CEST	2121	52476	12.105.210.193	192.168.2.16
May 6, 2024 04:57:33.137161970 CEST	52652	2121	192.168.2.16	174.174.198.67
May 6, 2024 04:57:33.145541906 CEST	52653	21	192.168.2.16	173.54.123.47
May 6, 2024 04:57:33.145544052 CEST	52654	2121	192.168.2.16	173.54.123.47
May 6, 2024 04:57:33.150262117 CEST	21	52613	87.106.26.129	192.168.2.16
May 6, 2024 04:57:33.150554895 CEST	52655	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:33.150557041 CEST	52613	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:33.159068108 CEST	21	52620	81.88.252.91	192.168.2.16
May 6, 2024 04:57:33.159198046 CEST	52620	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:33.161041975 CEST	52610	2121	192.168.2.16	112.242.0.25
May 6, 2024 04:57:33.161061049 CEST	52475	21	192.168.2.16	40.86.247.239
May 6, 2024 04:57:33.161456108 CEST	52656	21	192.168.2.16	221.231.16.21
May 6, 2024 04:57:33.161483049 CEST	52657	2121	192.168.2.16	221.231.16.21
May 6, 2024 04:57:33.161483049 CEST	52658	21	192.168.2.16	73.228.87.159
May 6, 2024 04:57:33.177046061 CEST	52478	2121	192.168.2.16	40.86.247.239
May 6, 2024 04:57:33.182602882 CEST	21	52541	183.127.42.173	192.168.2.16
May 6, 2024 04:57:33.193043947 CEST	52480	2121	192.168.2.16	163.229.134.211
May 6, 2024 04:57:33.193059921 CEST	52479	21	192.168.2.16	163.229.134.211
May 6, 2024 04:57:33.209068060 CEST	52611	21	192.168.2.16	104.85.128.73
May 6, 2024 04:57:33.209383011 CEST	52659	2121	192.168.2.16	73.228.87.159
May 6, 2024 04:57:33.220778942 CEST	2121	52543	183.127.42.173	192.168.2.16
May 6, 2024 04:57:33.224050045 CEST	52614	2121	192.168.2.16	104.85.128.73
May 6, 2024 04:57:33.224463940 CEST	52661	2121	192.168.2.16	159.65.56.173
May 6, 2024 04:57:33.225070953 CEST	2121	52626	34.128.145.40	192.168.2.16
May 6, 2024 04:57:33.225104094 CEST	52660	21	192.168.2.16	159.65.56.173
May 6, 2024 04:57:33.227535009 CEST	2121	52635	34.128.145.40	192.168.2.16
May 6, 2024 04:57:33.227593899 CEST	52635	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:33.227632999 CEST	52635	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:33.227761984 CEST	52662	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:33.235225916 CEST	21	52636	34.128.145.40	192.168.2.16
May 6, 2024 04:57:33.235274076 CEST	52636	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:33.235337019 CEST	52636	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:33.235498905 CEST	52663	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:33.240046978 CEST	52481	21	192.168.2.16	190.209.33.65
May 6, 2024 04:57:33.240046978 CEST	52483	2121	192.168.2.16	190.209.33.65
May 6, 2024 04:57:33.240058899 CEST	52482	21	192.168.2.16	178.75.182.238
May 6, 2024 04:57:33.241688013 CEST	21	52435	43.204.23.202	192.168.2.16
May 6, 2024 04:57:33.244051933 CEST	2121	52497	180.227.97.92	192.168.2.16
May 6, 2024 04:57:33.249419928 CEST	21	52612	101.43.249.26	192.168.2.16
May 6, 2024 04:57:33.249532938 CEST	52612	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:33.249723911 CEST	52664	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:33.256071091 CEST	52484	2121	192.168.2.16	178.75.182.238
May 6, 2024 04:57:33.256330967 CEST	52665	21	192.168.2.16	109.22.100.198
May 6, 2024 04:57:33.261043072 CEST	21	52549	58.230.95.83	192.168.2.16
May 6, 2024 04:57:33.272058964 CEST	52485	21	192.168.2.16	99.234.151.186
May 6, 2024 04:57:33.274681091 CEST	2121	52551	58.230.95.83	192.168.2.16
May 6, 2024 04:57:33.279886007 CEST	2121	52440	43.204.23.202	192.168.2.16
May 6, 2024 04:57:33.288049936 CEST	52617	21	192.168.2.16	84.33.117.251
May 6, 2024 04:57:33.288059950 CEST	52577	2121	192.168.2.16	92.203.45.81
May 6, 2024 04:57:33.288065910 CEST	52486	2121	192.168.2.16	99.234.151.186
May 6, 2024 04:57:33.289170980 CEST	52487	21	192.168.2.16	119.162.161.87
May 6, 2024 04:57:33.304743052 CEST	52666	2121	192.168.2.16	109.22.100.198
May 6, 2024 04:57:33.304770947 CEST	52488	2121	192.168.2.16	119.162.161.87
May 6, 2024 04:57:33.320789099 CEST	21	52615	220.90.78.219	192.168.2.16
May 6, 2024 04:57:33.335161924 CEST	2121	52616	220.90.78.219	192.168.2.16
May 6, 2024 04:57:33.337172031 CEST	2121	52635	34.128.145.40	192.168.2.16
May 6, 2024 04:57:33.337380886 CEST	2121	52662	34.128.145.40	192.168.2.16
May 6, 2024 04:57:33.337457895 CEST	52662	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:33.337861061 CEST	21	52555	220.70.226.142	192.168.2.16
May 6, 2024 04:57:33.344789028 CEST	21	52663	34.128.145.40	192.168.2.16
May 6, 2024 04:57:33.344854116 CEST	52663	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:33.344882965 CEST	21	52636	34.128.145.40	192.168.2.16
May 6, 2024 04:57:33.349109888 CEST	21	52621	154.210.32.21	192.168.2.16
May 6, 2024 04:57:33.349201918 CEST	21	52621	154.210.32.21	192.168.2.16
May 6, 2024 04:57:33.349318027 CEST	52621	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:33.352051973 CEST	52619	2121	192.168.2.16	84.33.117.251
May 6, 2024 04:57:33.352055073 CEST	52489	21	192.168.2.16	146.158.29.93
May 6, 2024 04:57:33.352065086 CEST	52634	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:33.352072001 CEST	52490	2121	192.168.2.16	146.158.29.93
May 6, 2024 04:57:33.360904932 CEST	2121	52556	220.70.226.142	192.168.2.16
May 6, 2024 04:57:33.368056059 CEST	52494	21	192.168.2.16	201.146.134.144
May 6, 2024 04:57:33.372606993 CEST	21	52629	149.154.65.23	192.168.2.16
May 6, 2024 04:57:33.372773886 CEST	21	52629	149.154.65.23	192.168.2.16
May 6, 2024 04:57:33.372904062 CEST	52629	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:33.374358892 CEST	21	52655	87.106.26.129	192.168.2.16
May 6, 2024 04:57:33.374416113 CEST	52655	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:33.379095078 CEST	21	52596	103.109.6.215	192.168.2.16
May 6, 2024 04:57:33.379225969 CEST	52596	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:33.379419088 CEST	52667	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:33.380589962 CEST	21	52613	87.106.26.129	192.168.2.16
May 6, 2024 04:57:33.380637884 CEST	52613	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:33.384037971 CEST	52623	21	192.168.2.16	74.139.25.119
May 6, 2024 04:57:33.384038925 CEST	52495	2121	192.168.2.16	201.146.134.144
May 6, 2024 04:57:33.400074005 CEST	52496	21	192.168.2.16	118.80.62.189
May 6, 2024 04:57:33.400089025 CEST	52585	2121	192.168.2.16	47.76.113.82
May 6, 2024 04:57:33.416045904 CEST	52584	21	192.168.2.16	47.76.113.82
May 6, 2024 04:57:33.416045904 CEST	52499	21	192.168.2.16	180.227.97.92
May 6, 2024 04:57:33.416068077 CEST	52498	2121	192.168.2.16	118.80.62.189
May 6, 2024 04:57:33.432065010 CEST	52501	21	192.168.2.16	116.108.50.242
May 6, 2024 04:57:33.432282925 CEST	21	52620	81.88.252.91	192.168.2.16
May 6, 2024 04:57:33.432311058 CEST	52668	21	192.168.2.16	173.77.7.92
May 6, 2024 04:57:33.432322979 CEST	21	52620	81.88.252.91	192.168.2.16
May 6, 2024 04:57:33.432621956 CEST	52669	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:33.443073034 CEST	2121	52661	159.65.56.173	192.168.2.16
May 6, 2024 04:57:33.446438074 CEST	21	52660	159.65.56.173	192.168.2.16
May 6, 2024 04:57:33.447211981 CEST	2121	52662	34.128.145.40	192.168.2.16
May 6, 2024 04:57:33.447268963 CEST	52662	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:33.447326899 CEST	52662	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:33.447495937 CEST	52670	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:33.448456049 CEST	52671	2121	192.168.2.16	173.77.7.92
May 6, 2024 04:57:33.448477983 CEST	52672	21	192.168.2.16	157.245.145.2
May 6, 2024 04:57:33.454163074 CEST	21	52663	34.128.145.40	192.168.2.16
May 6, 2024 04:57:33.454216957 CEST	52663	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:33.454268932 CEST	52663	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:33.454397917 CEST	52673	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:33.461203098 CEST	21	52634	34.128.145.40	192.168.2.16
May 6, 2024 04:57:33.461532116 CEST	2121	52650	123.190.169.224	192.168.2.16
May 6, 2024 04:57:33.464062929 CEST	52624	21	192.168.2.16	216.117.162.236
May 6, 2024 04:57:33.480300903 CEST	52674	2121	192.168.2.16	157.245.145.2
May 6, 2024 04:57:33.496043921 CEST	52595	2121	192.168.2.16	116.126.222.27
May 6, 2024 04:57:33.520529032 CEST	21	52455	14.63.16.123	192.168.2.16
May 6, 2024 04:57:33.524094105 CEST	2121	52456	14.63.16.123	192.168.2.16
May 6, 2024 04:57:33.527048111 CEST	52532	21	192.168.2.16	125.151.227.33
May 6, 2024 04:57:33.527065039 CEST	52503	2121	192.168.2.16	116.108.50.242
May 6, 2024 04:57:33.527067900 CEST	52505	2121	192.168.2.16	122.8.4.244
May 6, 2024 04:57:33.527067900 CEST	52594	21	192.168.2.16	116.126.222.27
May 6, 2024 04:57:33.527105093 CEST	52625	2121	192.168.2.16	74.139.25.119
May 6, 2024 04:57:33.527106047 CEST	52504	21	192.168.2.16	122.8.4.244
May 6, 2024 04:57:33.543617010 CEST	52676	2121	192.168.2.16	125.44.207.200
May 6, 2024 04:57:33.543698072 CEST	52675	21	192.168.2.16	95.233.116.132
May 6, 2024 04:57:33.543699026 CEST	52678	2121	192.168.2.16	95.233.116.132
May 6, 2024 04:57:33.543699980 CEST	52677	21	192.168.2.16	125.44.207.200
May 6, 2024 04:57:33.557090998 CEST	2121	52670	34.128.145.40	192.168.2.16
May 6, 2024 04:57:33.557149887 CEST	52670	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:33.559386969 CEST	52679	21	192.168.2.16	14.48.52.23
May 6, 2024 04:57:33.559420109 CEST	52680	2121	192.168.2.16	14.48.52.23
May 6, 2024 04:57:33.563421965 CEST	21	52663	34.128.145.40	192.168.2.16
May 6, 2024 04:57:33.564009905 CEST	21	52673	34.128.145.40	192.168.2.16
May 6, 2024 04:57:33.564065933 CEST	52673	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:33.574064970 CEST	52508	2121	192.168.2.16	84.19.119.11
May 6, 2024 04:57:33.574064970 CEST	52507	21	192.168.2.16	84.19.119.11
May 6, 2024 04:57:33.574223995 CEST	52628	21	192.168.2.16	87.4.141.61
May 6, 2024 04:57:33.588733912 CEST	21	52664	101.43.249.26	192.168.2.16
May 6, 2024 04:57:33.588792086 CEST	52664	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:33.590044022 CEST	52534	2121	192.168.2.16	125.151.227.33
May 6, 2024 04:57:33.590250015 CEST	52511	21	192.168.2.16	50.110.224.242
May 6, 2024 04:57:33.590339899 CEST	52681	21	192.168.2.16	81.44.171.153
May 6, 2024 04:57:33.590374947 CEST	2121	52577	92.203.45.81	192.168.2.16
May 6, 2024 04:57:33.597724915 CEST	21	52612	101.43.249.26	192.168.2.16
May 6, 2024 04:57:33.597939968 CEST	21	52612	101.43.249.26	192.168.2.16
May 6, 2024 04:57:33.597985029 CEST	52612	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:33.606048107 CEST	52630	2121	192.168.2.16	87.4.141.61
May 6, 2024 04:57:33.606071949 CEST	52512	2121	192.168.2.16	50.110.224.242
May 6, 2024 04:57:33.606074095 CEST	52513	21	192.168.2.16	217.104.127.251
May 6, 2024 04:57:33.606440067 CEST	52682	2121	192.168.2.16	81.44.171.153
May 6, 2024 04:57:33.606534004 CEST	52683	21	192.168.2.16	124.167.80.164
May 6, 2024 04:57:33.621474981 CEST	52684	2121	192.168.2.16	124.167.80.164
May 6, 2024 04:57:33.621500015 CEST	52685	21	192.168.2.16	175.238.101.134
May 6, 2024 04:57:33.621726990 CEST	21	52655	87.106.26.129	192.168.2.16
May 6, 2024 04:57:33.621861935 CEST	52655	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:33.628609896 CEST	21	52629	149.154.65.23	192.168.2.16
May 6, 2024 04:57:33.628746033 CEST	52629	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:33.628979921 CEST	52686	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:33.653057098 CEST	52631	21	192.168.2.16	108.54.153.113
May 6, 2024 04:57:33.653072119 CEST	52516	2121	192.168.2.16	194.181.93.169
May 6, 2024 04:57:33.653073072 CEST	52514	2121	192.168.2.16	217.104.127.251
May 6, 2024 04:57:33.667004108 CEST	2121	52670	34.128.145.40	192.168.2.16
May 6, 2024 04:57:33.667066097 CEST	52670	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:33.667143106 CEST	52670	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:33.667318106 CEST	52687	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:33.669064045 CEST	52632	2121	192.168.2.16	108.54.153.113
May 6, 2024 04:57:33.674457073 CEST	21	52673	34.128.145.40	192.168.2.16
May 6, 2024 04:57:33.674511909 CEST	52673	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:33.674566984 CEST	52673	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:33.674694061 CEST	52688	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:33.684485912 CEST	52541	21	192.168.2.16	183.127.42.173
May 6, 2024 04:57:33.684520006 CEST	21	52621	154.210.32.21	192.168.2.16
May 6, 2024 04:57:33.684617043 CEST	52621	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:33.684732914 CEST	52689	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:33.685278893 CEST	21	52621	154.210.32.21	192.168.2.16
May 6, 2024 04:57:33.685323954 CEST	52621	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:33.722943068 CEST	2121	52585	47.76.113.82	192.168.2.16
May 6, 2024 04:57:33.729701996 CEST	21	52669	81.88.252.91	192.168.2.16
May 6, 2024 04:57:33.729769945 CEST	52669	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:33.730046988 CEST	52518	21	192.168.2.16	117.232.133.103
May 6, 2024 04:57:33.730068922 CEST	52543	2121	192.168.2.16	183.127.42.173
May 6, 2024 04:57:33.731775999 CEST	21	52667	103.109.6.215	192.168.2.16
May 6, 2024 04:57:33.731831074 CEST	52667	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:33.746071100 CEST	52497	2121	192.168.2.16	180.227.97.92
May 6, 2024 04:57:33.748147964 CEST	21	52584	47.76.113.82	192.168.2.16
May 6, 2024 04:57:33.751773119 CEST	21	52596	103.109.6.215	192.168.2.16
May 6, 2024 04:57:33.751857042 CEST	21	52596	103.109.6.215	192.168.2.16
May 6, 2024 04:57:33.752023935 CEST	52596	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:33.762059927 CEST	52549	21	192.168.2.16	58.230.95.83
May 6, 2024 04:57:33.762059927 CEST	52519	2121	192.168.2.16	117.232.133.103
May 6, 2024 04:57:33.776660919 CEST	2121	52687	34.128.145.40	192.168.2.16
May 6, 2024 04:57:33.776715994 CEST	52687	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:33.776721001 CEST	2121	52670	34.128.145.40	192.168.2.16
May 6, 2024 04:57:33.778146029 CEST	52662	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:33.778147936 CEST	52551	2121	192.168.2.16	58.230.95.83
May 6, 2024 04:57:33.779989004 CEST	21	52431	109.205.180.149	192.168.2.16
May 6, 2024 04:57:33.780093908 CEST	52431	21	192.168.2.16	109.205.180.149
May 6, 2024 04:57:33.780246019 CEST	52690	21	192.168.2.16	109.205.180.149
May 6, 2024 04:57:33.783263922 CEST	21	52672	157.245.145.2	192.168.2.16
May 6, 2024 04:57:33.784182072 CEST	21	52673	34.128.145.40	192.168.2.16
May 6, 2024 04:57:33.784277916 CEST	21	52688	34.128.145.40	192.168.2.16
May 6, 2024 04:57:33.784331083 CEST	52688	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:33.794337034 CEST	52691	2121	192.168.2.16	175.238.101.134
May 6, 2024 04:57:33.797497034 CEST	2121	52595	116.126.222.27	192.168.2.16
May 6, 2024 04:57:33.809654951 CEST	21	52565	168.220.94.137	192.168.2.16
May 6, 2024 04:57:33.809668064 CEST	2121	52564	168.220.94.137	192.168.2.16
May 6, 2024 04:57:33.809705019 CEST	52565	21	192.168.2.16	168.220.94.137
May 6, 2024 04:57:33.809832096 CEST	52564	2121	192.168.2.16	168.220.94.137
May 6, 2024 04:57:33.825077057 CEST	21	52532	125.151.227.33	192.168.2.16
May 6, 2024 04:57:33.826061010 CEST	52615	21	192.168.2.16	220.90.78.219
May 6, 2024 04:57:33.838531971 CEST	2121	52674	157.245.145.2	192.168.2.16
May 6, 2024 04:57:33.842042923 CEST	52522	21	192.168.2.16	175.30.76.86
May 6, 2024 04:57:33.842056036 CEST	52555	21	192.168.2.16	220.70.226.142
May 6, 2024 04:57:33.842070103 CEST	52616	2121	192.168.2.16	220.90.78.219
May 6, 2024 04:57:33.845292091 CEST	21	52594	116.126.222.27	192.168.2.16
May 6, 2024 04:57:33.845634937 CEST	21	52655	87.106.26.129	192.168.2.16
May 6, 2024 04:57:33.845870972 CEST	21	52655	87.106.26.129	192.168.2.16
May 6, 2024 04:57:33.846048117 CEST	52655	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:33.857076883 CEST	52524	21	192.168.2.16	24.131.39.150
May 6, 2024 04:57:33.857264996 CEST	52523	2121	192.168.2.16	175.30.76.86
May 6, 2024 04:57:33.864707947 CEST	21	52679	14.48.52.23	192.168.2.16
May 6, 2024 04:57:33.870647907 CEST	2121	52680	14.48.52.23	192.168.2.16
May 6, 2024 04:57:33.873138905 CEST	52556	2121	192.168.2.16	220.70.226.142
May 6, 2024 04:57:33.873534918 CEST	52692	21	192.168.2.16	113.230.6.20
May 6, 2024 04:57:33.883958101 CEST	21	52629	149.154.65.23	192.168.2.16
May 6, 2024 04:57:33.884037971 CEST	52629	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:33.885981083 CEST	2121	52687	34.128.145.40	192.168.2.16
May 6, 2024 04:57:33.886045933 CEST	52687	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:33.886100054 CEST	52687	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:33.886285067 CEST	52693	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:33.887710094 CEST	2121	52662	34.128.145.40	192.168.2.16
May 6, 2024 04:57:33.888329983 CEST	21	52677	125.44.207.200	192.168.2.16
May 6, 2024 04:57:33.889241934 CEST	52694	2121	192.168.2.16	113.230.6.20
May 6, 2024 04:57:33.894042015 CEST	21	52688	34.128.145.40	192.168.2.16
May 6, 2024 04:57:33.894098997 CEST	52688	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:33.894134998 CEST	52688	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:33.894247055 CEST	52695	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:33.894656897 CEST	21	52686	149.154.65.23	192.168.2.16
May 6, 2024 04:57:33.894716978 CEST	52686	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:33.897660017 CEST	2121	52534	125.151.227.33	192.168.2.16
May 6, 2024 04:57:33.905045033 CEST	52525	2121	192.168.2.16	24.131.39.150
May 6, 2024 04:57:33.909029961 CEST	21	52284	168.220.94.137	192.168.2.16
May 6, 2024 04:57:33.909075975 CEST	52284	21	192.168.2.16	168.220.94.137
May 6, 2024 04:57:33.920088053 CEST	2121	52676	125.44.207.200	192.168.2.16
May 6, 2024 04:57:33.924791098 CEST	21	52685	175.238.101.134	192.168.2.16
May 6, 2024 04:57:33.927860975 CEST	21	52664	101.43.249.26	192.168.2.16
May 6, 2024 04:57:33.928132057 CEST	52664	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:33.937709093 CEST	2121	52285	168.220.94.137	192.168.2.16
May 6, 2024 04:57:33.937758923 CEST	52285	2121	192.168.2.16	168.220.94.137
May 6, 2024 04:57:33.953046083 CEST	52660	21	192.168.2.16	159.65.56.173
May 6, 2024 04:57:33.953047991 CEST	52661	2121	192.168.2.16	159.65.56.173
May 6, 2024 04:57:33.969083071 CEST	52650	2121	192.168.2.16	123.190.169.224
May 6, 2024 04:57:33.969451904 CEST	52697	2121	192.168.2.16	72.80.255.205
May 6, 2024 04:57:33.969469070 CEST	52696	21	192.168.2.16	72.80.255.205
May 6, 2024 04:57:33.985488892 CEST	52698	21	192.168.2.16	83.39.246.112
May 6, 2024 04:57:33.985542059 CEST	52699	21	192.168.2.16	188.214.156.147
May 6, 2024 04:57:33.992850065 CEST	21	52541	183.127.42.173	192.168.2.16
May 6, 2024 04:57:33.996937037 CEST	2121	52693	34.128.145.40	192.168.2.16
May 6, 2024 04:57:33.997004032 CEST	52693	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:34.001391888 CEST	52700	2121	192.168.2.16	83.39.246.112
May 6, 2024 04:57:34.003720045 CEST	21	52688	34.128.145.40	192.168.2.16
May 6, 2024 04:57:34.003804922 CEST	21	52695	34.128.145.40	192.168.2.16
May 6, 2024 04:57:34.003866911 CEST	52695	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:34.011099100 CEST	21	52669	81.88.252.91	192.168.2.16
May 6, 2024 04:57:34.011221886 CEST	52669	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:34.012979031 CEST	21	52690	109.205.180.149	192.168.2.16
May 6, 2024 04:57:34.013040066 CEST	52690	21	192.168.2.16	109.205.180.149
May 6, 2024 04:57:34.013119936 CEST	21	52431	109.205.180.149	192.168.2.16
May 6, 2024 04:57:34.013168097 CEST	52431	21	192.168.2.16	109.205.180.149
May 6, 2024 04:57:34.014108896 CEST	21	52431	109.205.180.149	192.168.2.16
May 6, 2024 04:57:34.014156103 CEST	52431	21	192.168.2.16	109.205.180.149
May 6, 2024 04:57:34.016968966 CEST	21	52689	154.210.32.21	192.168.2.16
May 6, 2024 04:57:34.017040014 CEST	52689	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:34.019325018 CEST	21	52621	154.210.32.21	192.168.2.16
May 6, 2024 04:57:34.033052921 CEST	52637	21	192.168.2.16	88.115.188.149
May 6, 2024 04:57:34.041512012 CEST	2121	52543	183.127.42.173	192.168.2.16
May 6, 2024 04:57:34.049068928 CEST	52638	2121	192.168.2.16	88.115.188.149
May 6, 2024 04:57:34.065047026 CEST	52639	21	192.168.2.16	79.21.7.32
May 6, 2024 04:57:34.065047026 CEST	52529	21	192.168.2.16	67.176.204.202
May 6, 2024 04:57:34.067401886 CEST	21	52549	58.230.95.83	192.168.2.16
May 6, 2024 04:57:34.070954084 CEST	21	52655	87.106.26.129	192.168.2.16
May 6, 2024 04:57:34.071099043 CEST	52655	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:34.071415901 CEST	52701	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:34.075452089 CEST	2121	52551	58.230.95.83	192.168.2.16
May 6, 2024 04:57:34.080221891 CEST	2121	52497	180.227.97.92	192.168.2.16
May 6, 2024 04:57:34.084966898 CEST	21	52667	103.109.6.215	192.168.2.16
May 6, 2024 04:57:34.085100889 CEST	52667	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:34.097045898 CEST	52641	21	192.168.2.16	188.81.21.242
May 6, 2024 04:57:34.097064018 CEST	52577	2121	192.168.2.16	92.203.45.81
May 6, 2024 04:57:34.097069979 CEST	52643	2121	192.168.2.16	61.69.211.194
May 6, 2024 04:57:34.097075939 CEST	52642	2121	192.168.2.16	79.21.7.32
May 6, 2024 04:57:34.097495079 CEST	52702	21	192.168.2.16	185.229.173.129
May 6, 2024 04:57:34.097558975 CEST	52703	2121	192.168.2.16	185.229.173.129
May 6, 2024 04:57:34.101172924 CEST	2121	52691	175.238.101.134	192.168.2.16
May 6, 2024 04:57:34.108350039 CEST	2121	52693	34.128.145.40	192.168.2.16
May 6, 2024 04:57:34.108409882 CEST	52693	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:34.108458996 CEST	52693	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:34.108586073 CEST	52704	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:34.113048077 CEST	52640	2121	192.168.2.16	188.81.21.242
May 6, 2024 04:57:34.113054991 CEST	52645	21	192.168.2.16	23.201.234.9
May 6, 2024 04:57:34.113061905 CEST	52644	21	192.168.2.16	61.69.211.194
May 6, 2024 04:57:34.113061905 CEST	52646	2121	192.168.2.16	23.201.234.9
May 6, 2024 04:57:34.113066912 CEST	52530	2121	192.168.2.16	67.176.204.202
May 6, 2024 04:57:34.113070011 CEST	52647	21	192.168.2.16	98.171.102.192
May 6, 2024 04:57:34.113527060 CEST	21	52695	34.128.145.40	192.168.2.16
May 6, 2024 04:57:34.113576889 CEST	52695	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:34.113621950 CEST	52695	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:34.113743067 CEST	52705	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:34.126008987 CEST	21	52615	220.90.78.219	192.168.2.16
May 6, 2024 04:57:34.129046917 CEST	52649	21	192.168.2.16	123.190.169.224
May 6, 2024 04:57:34.129055977 CEST	52651	21	192.168.2.16	174.174.198.67
May 6, 2024 04:57:34.129163027 CEST	52531	21	192.168.2.16	84.189.87.171
May 6, 2024 04:57:34.129170895 CEST	52533	2121	192.168.2.16	84.189.87.171
May 6, 2024 04:57:34.129170895 CEST	52648	2121	192.168.2.16	98.171.102.192
May 6, 2024 04:57:34.129343033 CEST	52706	21	192.168.2.16	47.226.71.44
May 6, 2024 04:57:34.144536972 CEST	2121	52616	220.90.78.219	192.168.2.16
May 6, 2024 04:57:34.145061016 CEST	52652	2121	192.168.2.16	174.174.198.67
May 6, 2024 04:57:34.145159960 CEST	52653	21	192.168.2.16	173.54.123.47
May 6, 2024 04:57:34.147121906 CEST	21	52555	220.70.226.142	192.168.2.16
May 6, 2024 04:57:34.160056114 CEST	52654	2121	192.168.2.16	173.54.123.47
May 6, 2024 04:57:34.163563013 CEST	21	52686	149.154.65.23	192.168.2.16
May 6, 2024 04:57:34.163708925 CEST	52686	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:34.168234110 CEST	2121	52556	220.70.226.142	192.168.2.16
May 6, 2024 04:57:34.170770884 CEST	2121	52661	159.65.56.173	192.168.2.16
May 6, 2024 04:57:34.174413919 CEST	21	52660	159.65.56.173	192.168.2.16
May 6, 2024 04:57:34.176052094 CEST	52656	21	192.168.2.16	221.231.16.21
May 6, 2024 04:57:34.176052094 CEST	52657	2121	192.168.2.16	221.231.16.21
May 6, 2024 04:57:34.176285028 CEST	52658	21	192.168.2.16	73.228.87.159
May 6, 2024 04:57:34.209258080 CEST	52687	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:34.212040901 CEST	52536	21	192.168.2.16	94.195.55.215
May 6, 2024 04:57:34.218902111 CEST	2121	52704	34.128.145.40	192.168.2.16
May 6, 2024 04:57:34.218974113 CEST	52704	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:34.219381094 CEST	2121	52693	34.128.145.40	192.168.2.16
May 6, 2024 04:57:34.224046946 CEST	52659	2121	192.168.2.16	73.228.87.159
May 6, 2024 04:57:34.224066973 CEST	52585	2121	192.168.2.16	47.76.113.82
May 6, 2024 04:57:34.224093914 CEST	21	52705	34.128.145.40	192.168.2.16
May 6, 2024 04:57:34.224144936 CEST	52705	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:34.224590063 CEST	52707	2121	192.168.2.16	47.226.71.44
May 6, 2024 04:57:34.224678993 CEST	52708	21	192.168.2.16	94.33.238.2
May 6, 2024 04:57:34.224781990 CEST	21	52695	34.128.145.40	192.168.2.16
May 6, 2024 04:57:34.240063906 CEST	52537	2121	192.168.2.16	94.195.55.215
May 6, 2024 04:57:34.240365028 CEST	52709	2121	192.168.2.16	94.33.238.2
May 6, 2024 04:57:34.247232914 CEST	2121	52694	113.230.6.20	192.168.2.16
May 6, 2024 04:57:34.247984886 CEST	21	52690	109.205.180.149	192.168.2.16
May 6, 2024 04:57:34.248121977 CEST	52690	21	192.168.2.16	109.205.180.149
May 6, 2024 04:57:34.256068945 CEST	52584	21	192.168.2.16	47.76.113.82
May 6, 2024 04:57:34.256237030 CEST	52665	21	192.168.2.16	109.22.100.198
May 6, 2024 04:57:34.267128944 CEST	21	52664	101.43.249.26	192.168.2.16
May 6, 2024 04:57:34.267297029 CEST	52664	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:34.267678022 CEST	52710	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:34.272066116 CEST	52542	21	192.168.2.16	182.31.110.154
May 6, 2024 04:57:34.287188053 CEST	21	52669	81.88.252.91	192.168.2.16
May 6, 2024 04:57:34.287322044 CEST	52669	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:34.288187981 CEST	52672	21	192.168.2.16	157.245.145.2
May 6, 2024 04:57:34.289571047 CEST	21	52517	45.87.1.166	192.168.2.16
May 6, 2024 04:57:34.289688110 CEST	52517	21	192.168.2.16	45.87.1.166
May 6, 2024 04:57:34.289854050 CEST	52711	21	192.168.2.16	45.87.1.166
May 6, 2024 04:57:34.297009945 CEST	21	52655	87.106.26.129	192.168.2.16
May 6, 2024 04:57:34.297064066 CEST	52655	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:34.299578905 CEST	21	52701	87.106.26.129	192.168.2.16
May 6, 2024 04:57:34.299639940 CEST	52701	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:34.304049015 CEST	52595	2121	192.168.2.16	116.126.222.27
May 6, 2024 04:57:34.304071903 CEST	52546	2121	192.168.2.16	182.31.110.154
May 6, 2024 04:57:34.311511993 CEST	21	52506	193.124.183.222	192.168.2.16
May 6, 2024 04:57:34.311665058 CEST	52506	21	192.168.2.16	193.124.183.222
May 6, 2024 04:57:34.311893940 CEST	52712	21	192.168.2.16	193.124.183.222
May 6, 2024 04:57:34.317092896 CEST	2121	52650	123.190.169.224	192.168.2.16
May 6, 2024 04:57:34.319555998 CEST	2121	52687	34.128.145.40	192.168.2.16
May 6, 2024 04:57:34.320059061 CEST	52666	2121	192.168.2.16	109.22.100.198
May 6, 2024 04:57:34.329304934 CEST	2121	52704	34.128.145.40	192.168.2.16
May 6, 2024 04:57:34.329370975 CEST	52704	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:34.329447031 CEST	52704	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:34.329624891 CEST	52713	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:34.334686995 CEST	21	52705	34.128.145.40	192.168.2.16
May 6, 2024 04:57:34.334743977 CEST	52705	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:34.334815025 CEST	52705	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:34.334996939 CEST	52714	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:34.336042881 CEST	52532	21	192.168.2.16	125.151.227.33
May 6, 2024 04:57:34.336080074 CEST	52548	2121	192.168.2.16	47.98.154.221
May 6, 2024 04:57:34.336298943 CEST	52715	21	192.168.2.16	62.235.48.92
May 6, 2024 04:57:34.351716042 CEST	21	52689	154.210.32.21	192.168.2.16
May 6, 2024 04:57:34.352005959 CEST	52689	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:34.352046967 CEST	52674	2121	192.168.2.16	157.245.145.2
May 6, 2024 04:57:34.352425098 CEST	52716	2121	192.168.2.16	62.235.48.92
May 6, 2024 04:57:34.352427006 CEST	52594	21	192.168.2.16	116.126.222.27
May 6, 2024 04:57:34.352489948 CEST	52717	21	192.168.2.16	36.85.141.215
May 6, 2024 04:57:34.367052078 CEST	52679	21	192.168.2.16	14.48.52.23
May 6, 2024 04:57:34.367327929 CEST	52718	2121	192.168.2.16	36.85.141.215
May 6, 2024 04:57:34.383049965 CEST	52552	2121	192.168.2.16	2.185.104.18
May 6, 2024 04:57:34.383071899 CEST	52550	21	192.168.2.16	2.185.104.18
May 6, 2024 04:57:34.383147001 CEST	52680	2121	192.168.2.16	14.48.52.23
May 6, 2024 04:57:34.387516975 CEST	21	52110	188.214.156.147	192.168.2.16
May 6, 2024 04:57:34.387568951 CEST	52110	21	192.168.2.16	188.214.156.147
May 6, 2024 04:57:34.399158955 CEST	52534	2121	192.168.2.16	125.151.227.33
May 6, 2024 04:57:34.399163008 CEST	52677	21	192.168.2.16	125.44.207.200
May 6, 2024 04:57:34.399286032 CEST	2121	52577	92.203.45.81	192.168.2.16
May 6, 2024 04:57:34.399374008 CEST	52719	21	192.168.2.16	123.190.186.181
May 6, 2024 04:57:34.415102005 CEST	52553	21	192.168.2.16	189.188.222.184
May 6, 2024 04:57:34.429357052 CEST	21	52686	149.154.65.23	192.168.2.16
May 6, 2024 04:57:34.429508924 CEST	21	52686	149.154.65.23	192.168.2.16
May 6, 2024 04:57:34.429744005 CEST	52686	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:34.431050062 CEST	52685	21	192.168.2.16	175.238.101.134
May 6, 2024 04:57:34.431051016 CEST	52676	2121	192.168.2.16	125.44.207.200
May 6, 2024 04:57:34.441450119 CEST	21	52667	103.109.6.215	192.168.2.16
May 6, 2024 04:57:34.441564083 CEST	52667	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:34.442744017 CEST	2121	52713	34.128.145.40	192.168.2.16
May 6, 2024 04:57:34.442809105 CEST	52713	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:34.442903042 CEST	2121	52704	34.128.145.40	192.168.2.16
May 6, 2024 04:57:34.445621014 CEST	21	52705	34.128.145.40	192.168.2.16
May 6, 2024 04:57:34.445642948 CEST	21	52714	34.128.145.40	192.168.2.16
May 6, 2024 04:57:34.445698977 CEST	52714	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:34.447082043 CEST	52554	2121	192.168.2.16	189.188.222.184
May 6, 2024 04:57:34.448894024 CEST	52668	21	192.168.2.16	173.77.7.92
May 6, 2024 04:57:34.463047981 CEST	52671	2121	192.168.2.16	173.77.7.92
May 6, 2024 04:57:34.483294010 CEST	21	52690	109.205.180.149	192.168.2.16
May 6, 2024 04:57:34.483601093 CEST	21	52690	109.205.180.149	192.168.2.16
May 6, 2024 04:57:34.483834028 CEST	52690	21	192.168.2.16	109.205.180.149
May 6, 2024 04:57:34.495101929 CEST	52541	21	192.168.2.16	183.127.42.173
May 6, 2024 04:57:34.511120081 CEST	52560	21	192.168.2.16	88.13.202.144
May 6, 2024 04:57:34.511559010 CEST	21	52517	45.87.1.166	192.168.2.16
May 6, 2024 04:57:34.511570930 CEST	21	52711	45.87.1.166	192.168.2.16
May 6, 2024 04:57:34.511729956 CEST	52711	21	192.168.2.16	45.87.1.166
May 6, 2024 04:57:34.511730909 CEST	52517	21	192.168.2.16	45.87.1.166
May 6, 2024 04:57:34.527390003 CEST	52720	2121	192.168.2.16	123.190.186.181
May 6, 2024 04:57:34.527513981 CEST	52721	21	192.168.2.16	92.93.157.152
May 6, 2024 04:57:34.543077946 CEST	52543	2121	192.168.2.16	183.127.42.173
May 6, 2024 04:57:34.543078899 CEST	52561	2121	192.168.2.16	88.13.202.144
May 6, 2024 04:57:34.546209097 CEST	52678	2121	192.168.2.16	95.233.116.132
May 6, 2024 04:57:34.550801039 CEST	2121	52585	47.76.113.82	192.168.2.16
May 6, 2024 04:57:34.554955006 CEST	2121	52713	34.128.145.40	192.168.2.16
May 6, 2024 04:57:34.555007935 CEST	52713	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:34.555082083 CEST	52713	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:34.555233955 CEST	52722	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:34.558159113 CEST	21	52714	34.128.145.40	192.168.2.16
May 6, 2024 04:57:34.558207989 CEST	52714	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:34.558264971 CEST	52714	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:34.558428049 CEST	52723	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:34.558806896 CEST	21	52701	87.106.26.129	192.168.2.16
May 6, 2024 04:57:34.558960915 CEST	52701	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:34.559051037 CEST	52675	21	192.168.2.16	95.233.116.132
May 6, 2024 04:57:34.559067011 CEST	52562	21	192.168.2.16	84.184.101.145
May 6, 2024 04:57:34.570487976 CEST	21	52669	81.88.252.91	192.168.2.16
May 6, 2024 04:57:34.570498943 CEST	21	52669	81.88.252.91	192.168.2.16
May 6, 2024 04:57:34.570789099 CEST	52724	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:34.576064110 CEST	52549	21	192.168.2.16	58.230.95.83
May 6, 2024 04:57:34.588663101 CEST	21	52712	193.124.183.222	192.168.2.16
May 6, 2024 04:57:34.588722944 CEST	52712	21	192.168.2.16	193.124.183.222
May 6, 2024 04:57:34.588937998 CEST	21	52506	193.124.183.222	192.168.2.16
May 6, 2024 04:57:34.588983059 CEST	52506	21	192.168.2.16	193.124.183.222
May 6, 2024 04:57:34.590960979 CEST	21	52584	47.76.113.82	192.168.2.16
May 6, 2024 04:57:34.591049910 CEST	52563	2121	192.168.2.16	84.184.101.145
May 6, 2024 04:57:34.591079950 CEST	52551	2121	192.168.2.16	58.230.95.83
May 6, 2024 04:57:34.591084003 CEST	52681	21	192.168.2.16	81.44.171.153
May 6, 2024 04:57:34.591358900 CEST	52725	2121	192.168.2.16	92.93.157.152
May 6, 2024 04:57:34.591471910 CEST	52726	21	192.168.2.16	128.201.198.188
May 6, 2024 04:57:34.606055975 CEST	52691	2121	192.168.2.16	175.238.101.134
May 6, 2024 04:57:34.606070995 CEST	52566	2121	192.168.2.16	175.5.247.91
May 6, 2024 04:57:34.606086016 CEST	52567	21	192.168.2.16	175.5.247.91
May 6, 2024 04:57:34.606086016 CEST	52683	21	192.168.2.16	124.167.80.164
May 6, 2024 04:57:34.606087923 CEST	52682	2121	192.168.2.16	81.44.171.153
May 6, 2024 04:57:34.608318090 CEST	2121	52595	116.126.222.27	192.168.2.16
May 6, 2024 04:57:34.609019995 CEST	21	52664	101.43.249.26	192.168.2.16
May 6, 2024 04:57:34.609030008 CEST	21	52664	101.43.249.26	192.168.2.16
May 6, 2024 04:57:34.609096050 CEST	52664	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:34.610297918 CEST	21	52710	101.43.249.26	192.168.2.16
May 6, 2024 04:57:34.610363007 CEST	52710	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:34.621079922 CEST	52568	21	192.168.2.16	27.212.43.83
May 6, 2024 04:57:34.621095896 CEST	52684	2121	192.168.2.16	124.167.80.164
May 6, 2024 04:57:34.621367931 CEST	52727	2121	192.168.2.16	128.201.198.188
May 6, 2024 04:57:34.625123978 CEST	21	52672	157.245.145.2	192.168.2.16
May 6, 2024 04:57:34.637098074 CEST	52615	21	192.168.2.16	220.90.78.219
May 6, 2024 04:57:34.637115002 CEST	52569	2121	192.168.2.16	27.212.43.83
May 6, 2024 04:57:34.637873888 CEST	21	52532	125.151.227.33	192.168.2.16
May 6, 2024 04:57:34.638570070 CEST	52728	21	192.168.2.16	68.112.60.119
May 6, 2024 04:57:34.652055979 CEST	52616	2121	192.168.2.16	220.90.78.219
May 6, 2024 04:57:34.652057886 CEST	52555	21	192.168.2.16	220.70.226.142
May 6, 2024 04:57:34.652071953 CEST	52571	2121	192.168.2.16	73.49.252.159
May 6, 2024 04:57:34.652075052 CEST	52570	21	192.168.2.16	73.49.252.159
May 6, 2024 04:57:34.652220964 CEST	52572	21	192.168.2.16	143.255.66.199
May 6, 2024 04:57:34.667345047 CEST	2121	52713	34.128.145.40	192.168.2.16
May 6, 2024 04:57:34.668044090 CEST	52574	2121	192.168.2.16	143.255.66.199
May 6, 2024 04:57:34.668215036 CEST	2121	52722	34.128.145.40	192.168.2.16
May 6, 2024 04:57:34.668241024 CEST	52556	2121	192.168.2.16	220.70.226.142
May 6, 2024 04:57:34.668278933 CEST	52722	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:34.671036005 CEST	21	52723	34.128.145.40	192.168.2.16
May 6, 2024 04:57:34.671114922 CEST	52723	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:34.671708107 CEST	21	52714	34.128.145.40	192.168.2.16
May 6, 2024 04:57:34.674253941 CEST	21	52594	116.126.222.27	192.168.2.16
May 6, 2024 04:57:34.675333023 CEST	21	52679	14.48.52.23	192.168.2.16
May 6, 2024 04:57:34.683043957 CEST	52660	21	192.168.2.16	159.65.56.173
May 6, 2024 04:57:34.683088064 CEST	52575	2121	192.168.2.16	182.85.106.39
May 6, 2024 04:57:34.683089018 CEST	52573	21	192.168.2.16	182.85.106.39
May 6, 2024 04:57:34.683089018 CEST	52661	2121	192.168.2.16	159.65.56.173
May 6, 2024 04:57:34.687581062 CEST	21	52689	154.210.32.21	192.168.2.16
May 6, 2024 04:57:34.687592030 CEST	21	52689	154.210.32.21	192.168.2.16
May 6, 2024 04:57:34.687705040 CEST	52689	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:34.697375059 CEST	2121	52680	14.48.52.23	192.168.2.16
May 6, 2024 04:57:34.699068069 CEST	52576	21	192.168.2.16	92.203.45.81
May 6, 2024 04:57:34.700268030 CEST	21	52686	149.154.65.23	192.168.2.16
May 6, 2024 04:57:34.700417042 CEST	52686	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:34.700637102 CEST	52729	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:34.710777044 CEST	2121	52534	125.151.227.33	192.168.2.16
May 6, 2024 04:57:34.713207006 CEST	2121	52674	157.245.145.2	192.168.2.16
May 6, 2024 04:57:34.715046883 CEST	52580	21	192.168.2.16	73.203.139.207
May 6, 2024 04:57:34.715049028 CEST	52581	2121	192.168.2.16	73.203.139.207
May 6, 2024 04:57:34.715152025 CEST	52582	21	192.168.2.16	98.16.93.176
May 6, 2024 04:57:34.715152979 CEST	52583	2121	192.168.2.16	98.16.93.176
May 6, 2024 04:57:34.731276035 CEST	52730	2121	192.168.2.16	68.112.60.119
May 6, 2024 04:57:34.739573956 CEST	21	52685	175.238.101.134	192.168.2.16
May 6, 2024 04:57:34.739849091 CEST	21	52711	45.87.1.166	192.168.2.16
May 6, 2024 04:57:34.739962101 CEST	52711	21	192.168.2.16	45.87.1.166
May 6, 2024 04:57:34.746733904 CEST	21	52677	125.44.207.200	192.168.2.16
May 6, 2024 04:57:34.756278992 CEST	21	52690	109.205.180.149	192.168.2.16
May 6, 2024 04:57:34.762054920 CEST	52694	2121	192.168.2.16	113.230.6.20
May 6, 2024 04:57:34.762056112 CEST	52586	21	192.168.2.16	159.89.5.228
May 6, 2024 04:57:34.762108088 CEST	52438	21	192.168.2.16	66.198.245.58
May 6, 2024 04:57:34.762342930 CEST	52731	21	192.168.2.16	66.198.245.58
May 6, 2024 04:57:34.781605005 CEST	2121	52722	34.128.145.40	192.168.2.16
May 6, 2024 04:57:34.781619072 CEST	21	52726	128.201.198.188	192.168.2.16
May 6, 2024 04:57:34.781661034 CEST	52722	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:34.781754971 CEST	52722	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:34.781923056 CEST	52732	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:34.783991098 CEST	21	52723	34.128.145.40	192.168.2.16
May 6, 2024 04:57:34.784058094 CEST	52723	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:34.784116030 CEST	52723	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:34.784282923 CEST	52733	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:34.790637970 CEST	21	52701	87.106.26.129	192.168.2.16
May 6, 2024 04:57:34.790782928 CEST	21	52701	87.106.26.129	192.168.2.16
May 6, 2024 04:57:34.790931940 CEST	52701	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:34.793044090 CEST	52587	2121	192.168.2.16	159.89.5.228
May 6, 2024 04:57:34.793066978 CEST	52588	21	192.168.2.16	154.192.40.115
May 6, 2024 04:57:34.798584938 CEST	21	52667	103.109.6.215	192.168.2.16
May 6, 2024 04:57:34.798700094 CEST	52667	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:34.798847914 CEST	52734	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:34.805279016 CEST	21	52541	183.127.42.173	192.168.2.16
May 6, 2024 04:57:34.809072971 CEST	52589	2121	192.168.2.16	154.192.40.115
May 6, 2024 04:57:34.809293032 CEST	2121	52727	128.201.198.188	192.168.2.16
May 6, 2024 04:57:34.809304953 CEST	2121	52676	125.44.207.200	192.168.2.16
May 6, 2024 04:57:34.809434891 CEST	52735	21	192.168.2.16	217.72.82.85
May 6, 2024 04:57:34.809449911 CEST	52736	2121	192.168.2.16	217.72.82.85
May 6, 2024 04:57:34.825042963 CEST	52591	2121	192.168.2.16	186.54.120.138
May 6, 2024 04:57:34.825079918 CEST	52590	21	192.168.2.16	186.54.120.138
May 6, 2024 04:57:34.825155020 CEST	52650	2121	192.168.2.16	123.190.169.224
May 6, 2024 04:57:34.825275898 CEST	52737	21	192.168.2.16	95.246.211.214
May 6, 2024 04:57:34.840044022 CEST	52592	21	192.168.2.16	162.218.101.178
May 6, 2024 04:57:34.840048075 CEST	52593	2121	192.168.2.16	162.218.101.178
May 6, 2024 04:57:34.840204000 CEST	52738	2121	192.168.2.16	95.246.211.214
May 6, 2024 04:57:34.844625950 CEST	21	52724	81.88.252.91	192.168.2.16
May 6, 2024 04:57:34.844691038 CEST	52724	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:34.855001926 CEST	2121	52543	183.127.42.173	192.168.2.16
May 6, 2024 04:57:34.855408907 CEST	52739	21	192.168.2.16	120.232.156.179
May 6, 2024 04:57:34.864284992 CEST	21	52712	193.124.183.222	192.168.2.16
May 6, 2024 04:57:34.864428997 CEST	52712	21	192.168.2.16	193.124.183.222
May 6, 2024 04:57:34.872309923 CEST	52740	2121	192.168.2.16	120.232.156.179
May 6, 2024 04:57:34.881537914 CEST	21	52549	58.230.95.83	192.168.2.16
May 6, 2024 04:57:34.881867886 CEST	52741	21	192.168.2.16	188.16.78.41
May 6, 2024 04:57:34.888351917 CEST	2121	52551	58.230.95.83	192.168.2.16
May 6, 2024 04:57:34.888520002 CEST	52692	21	192.168.2.16	113.230.6.20
May 6, 2024 04:57:34.890888929 CEST	2121	52722	34.128.145.40	192.168.2.16
May 6, 2024 04:57:34.891386986 CEST	2121	52732	34.128.145.40	192.168.2.16
May 6, 2024 04:57:34.891447067 CEST	52732	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:34.893848896 CEST	21	52733	34.128.145.40	192.168.2.16
May 6, 2024 04:57:34.893945932 CEST	52733	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:34.894455910 CEST	21	52723	34.128.145.40	192.168.2.16
May 6, 2024 04:57:34.900840998 CEST	2121	52661	159.65.56.173	192.168.2.16
May 6, 2024 04:57:34.904069901 CEST	52577	2121	192.168.2.16	92.203.45.81
May 6, 2024 04:57:34.904342890 CEST	21	52660	159.65.56.173	192.168.2.16
May 6, 2024 04:57:34.904406071 CEST	52742	21	192.168.2.16	124.46.202.51
May 6, 2024 04:57:34.904464006 CEST	52743	2121	192.168.2.16	188.16.78.41
May 6, 2024 04:57:34.912647009 CEST	2121	52691	175.238.101.134	192.168.2.16
May 6, 2024 04:57:34.917823076 CEST	21	52731	66.198.245.58	192.168.2.16
May 6, 2024 04:57:34.917880058 CEST	52731	21	192.168.2.16	66.198.245.58
May 6, 2024 04:57:34.920063019 CEST	52598	21	192.168.2.16	87.59.104.198
May 6, 2024 04:57:34.937495947 CEST	21	52615	220.90.78.219	192.168.2.16
May 6, 2024 04:57:34.951281071 CEST	21	52710	101.43.249.26	192.168.2.16
May 6, 2024 04:57:34.951569080 CEST	52710	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:34.952141047 CEST	52600	2121	192.168.2.16	87.59.104.198
May 6, 2024 04:57:34.954969883 CEST	2121	52616	220.90.78.219	192.168.2.16
May 6, 2024 04:57:34.956408024 CEST	21	52729	149.154.65.23	192.168.2.16
May 6, 2024 04:57:34.956471920 CEST	52729	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:34.956861973 CEST	21	52438	66.198.245.58	192.168.2.16
May 6, 2024 04:57:34.957406998 CEST	21	52555	220.70.226.142	192.168.2.16
May 6, 2024 04:57:34.961699963 CEST	21	52711	45.87.1.166	192.168.2.16
May 6, 2024 04:57:34.961960077 CEST	21	52711	45.87.1.166	192.168.2.16
May 6, 2024 04:57:34.962058067 CEST	52711	21	192.168.2.16	45.87.1.166
May 6, 2024 04:57:34.963634014 CEST	2121	52556	220.70.226.142	192.168.2.16
May 6, 2024 04:57:34.965827942 CEST	21	52686	149.154.65.23	192.168.2.16
May 6, 2024 04:57:34.965877056 CEST	52686	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:34.965900898 CEST	2121	52285	168.220.94.137	192.168.2.16
May 6, 2024 04:57:34.965945005 CEST	52285	2121	192.168.2.16	168.220.94.137
May 6, 2024 04:57:34.968446016 CEST	52744	2121	192.168.2.16	124.46.202.51
May 6, 2024 04:57:34.984155893 CEST	52696	21	192.168.2.16	72.80.255.205
May 6, 2024 04:57:34.984159946 CEST	52697	2121	192.168.2.16	72.80.255.205
May 6, 2024 04:57:34.984450102 CEST	52745	21	192.168.2.16	77.34.191.82
May 6, 2024 04:57:35.000087023 CEST	52698	21	192.168.2.16	83.39.246.112
May 6, 2024 04:57:35.000957012 CEST	52699	21	192.168.2.16	188.214.156.147
May 6, 2024 04:57:35.000957966 CEST	52601	21	192.168.2.16	83.8.70.228
May 6, 2024 04:57:35.000993967 CEST	2121	52732	34.128.145.40	192.168.2.16
May 6, 2024 04:57:35.001055956 CEST	52732	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:35.002635956 CEST	52732	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:35.002830029 CEST	52746	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:35.003565073 CEST	21	52733	34.128.145.40	192.168.2.16
May 6, 2024 04:57:35.003624916 CEST	52733	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:35.003674984 CEST	52733	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:35.003838062 CEST	52747	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:35.016067982 CEST	52700	2121	192.168.2.16	83.39.246.112
May 6, 2024 04:57:35.016068935 CEST	52602	2121	192.168.2.16	83.8.70.228
May 6, 2024 04:57:35.019515038 CEST	21	52701	87.106.26.129	192.168.2.16
May 6, 2024 04:57:35.019690037 CEST	52701	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:35.019957066 CEST	52748	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:35.022097111 CEST	21	52689	154.210.32.21	192.168.2.16
May 6, 2024 04:57:35.022198915 CEST	52689	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:35.022347927 CEST	52749	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:35.022886992 CEST	21	52689	154.210.32.21	192.168.2.16
May 6, 2024 04:57:35.022934914 CEST	52689	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:35.039769888 CEST	21	52438	66.198.245.58	192.168.2.16
May 6, 2024 04:57:35.039822102 CEST	52438	21	192.168.2.16	66.198.245.58
May 6, 2024 04:57:35.039838076 CEST	21	52438	66.198.245.58	192.168.2.16
May 6, 2024 04:57:35.039877892 CEST	52438	21	192.168.2.16	66.198.245.58
May 6, 2024 04:57:35.040316105 CEST	21	52438	66.198.245.58	192.168.2.16
May 6, 2024 04:57:35.040358067 CEST	52438	21	192.168.2.16	66.198.245.58
May 6, 2024 04:57:35.048047066 CEST	52603	21	192.168.2.16	13.93.95.160
May 6, 2024 04:57:35.051515102 CEST	21	52284	168.220.94.137	192.168.2.16
May 6, 2024 04:57:35.051563025 CEST	52284	21	192.168.2.16	168.220.94.137
May 6, 2024 04:57:35.064071894 CEST	52585	2121	192.168.2.16	47.76.113.82
May 6, 2024 04:57:35.074450016 CEST	21	52731	66.198.245.58	192.168.2.16
May 6, 2024 04:57:35.074628115 CEST	52731	21	192.168.2.16	66.198.245.58
May 6, 2024 04:57:35.080149889 CEST	52604	2121	192.168.2.16	13.93.95.160
May 6, 2024 04:57:35.080619097 CEST	52750	2121	192.168.2.16	77.34.191.82
May 6, 2024 04:57:35.080620050 CEST	52751	21	192.168.2.16	61.253.48.222
May 6, 2024 04:57:35.096295118 CEST	52584	21	192.168.2.16	47.76.113.82
May 6, 2024 04:57:35.096302032 CEST	52752	2121	192.168.2.16	61.253.48.222
May 6, 2024 04:57:35.112050056 CEST	52605	21	192.168.2.16	73.169.12.1
May 6, 2024 04:57:35.112050056 CEST	52703	2121	192.168.2.16	185.229.173.129
May 6, 2024 04:57:35.112077951 CEST	52702	21	192.168.2.16	185.229.173.129
May 6, 2024 04:57:35.112077951 CEST	52595	2121	192.168.2.16	116.126.222.27
May 6, 2024 04:57:35.112131119 CEST	2121	52732	34.128.145.40	192.168.2.16
May 6, 2024 04:57:35.113426924 CEST	21	52747	34.128.145.40	192.168.2.16
May 6, 2024 04:57:35.113490105 CEST	52747	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:35.114029884 CEST	21	52733	34.128.145.40	192.168.2.16
May 6, 2024 04:57:35.117942095 CEST	21	52724	81.88.252.91	192.168.2.16
May 6, 2024 04:57:35.118058920 CEST	52724	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:35.118949890 CEST	2121	52746	34.128.145.40	192.168.2.16
May 6, 2024 04:57:35.119096994 CEST	52746	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:35.119767904 CEST	2121	52694	113.230.6.20	192.168.2.16
May 6, 2024 04:57:35.128051996 CEST	52606	2121	192.168.2.16	73.169.12.1
May 6, 2024 04:57:35.128468037 CEST	52672	21	192.168.2.16	157.245.145.2
May 6, 2024 04:57:35.138000011 CEST	21	52712	193.124.183.222	192.168.2.16
May 6, 2024 04:57:35.138176918 CEST	21	52712	193.124.183.222	192.168.2.16
May 6, 2024 04:57:35.138293982 CEST	52712	21	192.168.2.16	193.124.183.222
May 6, 2024 04:57:35.144059896 CEST	52608	21	192.168.2.16	112.242.0.25
May 6, 2024 04:57:35.144059896 CEST	52706	21	192.168.2.16	47.226.71.44
May 6, 2024 04:57:35.150948048 CEST	21	52667	103.109.6.215	192.168.2.16
May 6, 2024 04:57:35.151010036 CEST	21	52667	103.109.6.215	192.168.2.16
May 6, 2024 04:57:35.151061058 CEST	52667	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:35.160475969 CEST	52753	21	192.168.2.16	39.106.171.20
May 6, 2024 04:57:35.172523022 CEST	2121	52650	123.190.169.224	192.168.2.16
May 6, 2024 04:57:35.175748110 CEST	21	52734	103.109.6.215	192.168.2.16
May 6, 2024 04:57:35.175797939 CEST	52734	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:35.176043034 CEST	52610	2121	192.168.2.16	112.242.0.25
May 6, 2024 04:57:35.176074982 CEST	52594	21	192.168.2.16	116.126.222.27
May 6, 2024 04:57:35.176078081 CEST	52679	21	192.168.2.16	14.48.52.23
May 6, 2024 04:57:35.176378965 CEST	52754	2121	192.168.2.16	39.106.171.20
May 6, 2024 04:57:35.191495895 CEST	52755	21	192.168.2.16	123.248.201.229
May 6, 2024 04:57:35.191565990 CEST	52756	2121	192.168.2.16	123.248.201.229
May 6, 2024 04:57:35.207045078 CEST	52680	2121	192.168.2.16	14.48.52.23
May 6, 2024 04:57:35.208867073 CEST	2121	52577	92.203.45.81	192.168.2.16
May 6, 2024 04:57:35.223071098 CEST	52674	2121	192.168.2.16	157.245.145.2
May 6, 2024 04:57:35.223092079 CEST	52611	21	192.168.2.16	104.85.128.73
May 6, 2024 04:57:35.223587036 CEST	52758	21	192.168.2.16	85.244.143.189
May 6, 2024 04:57:35.223628044 CEST	52759	2121	192.168.2.16	85.244.143.189
May 6, 2024 04:57:35.223628044 CEST	52757	21	192.168.2.16	85.247.153.249
May 6, 2024 04:57:35.223685026 CEST	52760	2121	192.168.2.16	85.247.153.249
May 6, 2024 04:57:35.224694967 CEST	21	52729	149.154.65.23	192.168.2.16
May 6, 2024 04:57:35.225086927 CEST	52729	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:35.228043079 CEST	21	52747	34.128.145.40	192.168.2.16
May 6, 2024 04:57:35.228104115 CEST	52747	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:35.228138924 CEST	52747	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:35.228283882 CEST	52761	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:35.231564999 CEST	21	52711	45.87.1.166	192.168.2.16
May 6, 2024 04:57:35.233349085 CEST	2121	52746	34.128.145.40	192.168.2.16
May 6, 2024 04:57:35.233402967 CEST	52746	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:35.233462095 CEST	52746	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:35.233519077 CEST	21	52731	66.198.245.58	192.168.2.16
May 6, 2024 04:57:35.233627081 CEST	52762	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:35.233807087 CEST	21	52731	66.198.245.58	192.168.2.16
May 6, 2024 04:57:35.233897924 CEST	52731	21	192.168.2.16	66.198.245.58
May 6, 2024 04:57:35.239051104 CEST	52707	2121	192.168.2.16	47.226.71.44
May 6, 2024 04:57:35.239051104 CEST	52614	2121	192.168.2.16	104.85.128.73
May 6, 2024 04:57:35.240875959 CEST	52708	21	192.168.2.16	94.33.238.2
May 6, 2024 04:57:35.247946978 CEST	21	52748	87.106.26.129	192.168.2.16
May 6, 2024 04:57:35.248007059 CEST	52748	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:35.249747038 CEST	21	52701	87.106.26.129	192.168.2.16
May 6, 2024 04:57:35.249818087 CEST	52701	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:35.255065918 CEST	52677	21	192.168.2.16	125.44.207.200
May 6, 2024 04:57:35.255065918 CEST	52685	21	192.168.2.16	175.238.101.134
May 6, 2024 04:57:35.255659103 CEST	52709	2121	192.168.2.16	94.33.238.2
May 6, 2024 04:57:35.255659103 CEST	52763	21	192.168.2.16	109.133.106.77
May 6, 2024 04:57:35.255659103 CEST	52764	2121	192.168.2.16	109.133.106.77
May 6, 2024 04:57:35.271334887 CEST	52765	2121	192.168.2.16	218.20.198.95
May 6, 2024 04:57:35.271431923 CEST	52766	21	192.168.2.16	218.20.198.95
May 6, 2024 04:57:35.287069082 CEST	52726	21	192.168.2.16	128.201.198.188
May 6, 2024 04:57:35.292212009 CEST	21	52710	101.43.249.26	192.168.2.16
May 6, 2024 04:57:35.292355061 CEST	52710	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:35.292570114 CEST	52767	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:35.303086042 CEST	52617	21	192.168.2.16	84.33.117.251
May 6, 2024 04:57:35.303308964 CEST	52768	21	192.168.2.16	98.20.176.253
May 6, 2024 04:57:35.319056988 CEST	52727	2121	192.168.2.16	128.201.198.188
May 6, 2024 04:57:35.319772959 CEST	52676	2121	192.168.2.16	125.44.207.200
May 6, 2024 04:57:35.335412025 CEST	52769	2121	192.168.2.16	98.20.176.253
May 6, 2024 04:57:35.337698936 CEST	21	52747	34.128.145.40	192.168.2.16
May 6, 2024 04:57:35.337881088 CEST	21	52761	34.128.145.40	192.168.2.16
May 6, 2024 04:57:35.337953091 CEST	52761	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:35.343162060 CEST	2121	52746	34.128.145.40	192.168.2.16
May 6, 2024 04:57:35.343178988 CEST	2121	52762	34.128.145.40	192.168.2.16
May 6, 2024 04:57:35.343362093 CEST	52762	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:35.351089954 CEST	52715	21	192.168.2.16	62.235.48.92
May 6, 2024 04:57:35.351350069 CEST	52770	21	192.168.2.16	100.8.10.204
May 6, 2024 04:57:35.354520082 CEST	21	52689	154.210.32.21	192.168.2.16
May 6, 2024 04:57:35.366045952 CEST	52619	2121	192.168.2.16	84.33.117.251
May 6, 2024 04:57:35.366070986 CEST	52716	2121	192.168.2.16	62.235.48.92
May 6, 2024 04:57:35.366075039 CEST	52717	21	192.168.2.16	36.85.141.215
May 6, 2024 04:57:35.366513968 CEST	52771	2121	192.168.2.16	100.8.10.204
May 6, 2024 04:57:35.366605997 CEST	52772	21	192.168.2.16	38.56.42.35
May 6, 2024 04:57:35.367281914 CEST	21	52749	154.210.32.21	192.168.2.16
May 6, 2024 04:57:35.367341995 CEST	52749	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:35.381078959 CEST	52718	2121	192.168.2.16	36.85.141.215
May 6, 2024 04:57:35.381309986 CEST	52773	2121	192.168.2.16	38.56.42.35
May 6, 2024 04:57:35.386723042 CEST	2121	52585	47.76.113.82	192.168.2.16
May 6, 2024 04:57:35.397057056 CEST	52623	21	192.168.2.16	74.139.25.119
May 6, 2024 04:57:35.397624969 CEST	52774	21	192.168.2.16	174.118.44.203
May 6, 2024 04:57:35.397676945 CEST	52775	2121	192.168.2.16	174.118.44.203
May 6, 2024 04:57:35.397754908 CEST	52776	21	192.168.2.16	213.192.93.136
May 6, 2024 04:57:35.407370090 CEST	21	52724	81.88.252.91	192.168.2.16
May 6, 2024 04:57:35.407494068 CEST	52724	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:35.413049936 CEST	52660	21	192.168.2.16	159.65.56.173
May 6, 2024 04:57:35.413065910 CEST	52719	21	192.168.2.16	123.190.186.181
May 6, 2024 04:57:35.413069963 CEST	52661	2121	192.168.2.16	159.65.56.173
May 6, 2024 04:57:35.413161993 CEST	52691	2121	192.168.2.16	175.238.101.134
May 6, 2024 04:57:35.413361073 CEST	2121	52595	116.126.222.27	192.168.2.16
May 6, 2024 04:57:35.428388119 CEST	21	52584	47.76.113.82	192.168.2.16
May 6, 2024 04:57:35.428972006 CEST	21	52731	66.198.245.58	192.168.2.16
May 6, 2024 04:57:35.429466963 CEST	52777	2121	192.168.2.16	213.192.93.136
May 6, 2024 04:57:35.429625988 CEST	52778	21	192.168.2.16	72.74.189.6
May 6, 2024 04:57:35.445064068 CEST	52615	21	192.168.2.16	220.90.78.219
May 6, 2024 04:57:35.445271969 CEST	52779	2121	192.168.2.16	72.74.189.6
May 6, 2024 04:57:35.447989941 CEST	21	52761	34.128.145.40	192.168.2.16
May 6, 2024 04:57:35.448060989 CEST	52761	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:35.448126078 CEST	52761	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:35.448246956 CEST	52780	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:35.455022097 CEST	2121	52762	34.128.145.40	192.168.2.16
May 6, 2024 04:57:35.455073118 CEST	52762	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:35.455132008 CEST	52762	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:35.455291986 CEST	52781	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:35.455558062 CEST	21	52712	193.124.183.222	192.168.2.16
May 6, 2024 04:57:35.461069107 CEST	52616	2121	192.168.2.16	220.90.78.219
May 6, 2024 04:57:35.462502956 CEST	21	52672	157.245.145.2	192.168.2.16
May 6, 2024 04:57:35.473841906 CEST	21	52726	128.201.198.188	192.168.2.16
May 6, 2024 04:57:35.477155924 CEST	52624	21	192.168.2.16	216.117.162.236
May 6, 2024 04:57:35.481136084 CEST	21	52729	149.154.65.23	192.168.2.16
May 6, 2024 04:57:35.481441021 CEST	21	52729	149.154.65.23	192.168.2.16
May 6, 2024 04:57:35.481594086 CEST	52729	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:35.482055902 CEST	21	52679	14.48.52.23	192.168.2.16
May 6, 2024 04:57:35.494127035 CEST	21	52594	116.126.222.27	192.168.2.16
May 6, 2024 04:57:35.500001907 CEST	21	52748	87.106.26.129	192.168.2.16
May 6, 2024 04:57:35.500161886 CEST	52748	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:35.505819082 CEST	2121	52727	128.201.198.188	192.168.2.16
May 6, 2024 04:57:35.509543896 CEST	52783	2121	192.168.2.16	27.77.113.5
May 6, 2024 04:57:35.509553909 CEST	52782	21	192.168.2.16	27.77.113.5
May 6, 2024 04:57:35.509655952 CEST	52784	21	192.168.2.16	110.66.102.25
May 6, 2024 04:57:35.512840986 CEST	21	52753	39.106.171.20	192.168.2.16
May 6, 2024 04:57:35.512908936 CEST	52753	21	192.168.2.16	39.106.171.20
May 6, 2024 04:57:35.518326044 CEST	2121	52680	14.48.52.23	192.168.2.16
May 6, 2024 04:57:35.525233030 CEST	52785	2121	192.168.2.16	110.66.102.25
May 6, 2024 04:57:35.535044909 CEST	52721	21	192.168.2.16	92.93.157.152
May 6, 2024 04:57:35.541059017 CEST	52625	2121	192.168.2.16	74.139.25.119
May 6, 2024 04:57:35.541074038 CEST	52720	2121	192.168.2.16	123.190.186.181
May 6, 2024 04:57:35.552896023 CEST	21	52734	103.109.6.215	192.168.2.16
May 6, 2024 04:57:35.553018093 CEST	52734	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:35.557255030 CEST	52786	21	192.168.2.16	183.236.95.99
May 6, 2024 04:57:35.558255911 CEST	21	52780	34.128.145.40	192.168.2.16
May 6, 2024 04:57:35.558325052 CEST	52780	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:35.558594942 CEST	21	52761	34.128.145.40	192.168.2.16
May 6, 2024 04:57:35.559835911 CEST	21	52685	175.238.101.134	192.168.2.16
May 6, 2024 04:57:35.565648079 CEST	2121	52781	34.128.145.40	192.168.2.16
May 6, 2024 04:57:35.565692902 CEST	52781	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:35.566982985 CEST	2121	52762	34.128.145.40	192.168.2.16
May 6, 2024 04:57:35.573318958 CEST	52787	2121	192.168.2.16	183.236.95.99
May 6, 2024 04:57:35.581357002 CEST	2121	52674	157.245.145.2	192.168.2.16
May 6, 2024 04:57:35.581413031 CEST	52628	21	192.168.2.16	87.4.141.61
May 6, 2024 04:57:35.589463949 CEST	52788	21	192.168.2.16	187.232.88.226
May 6, 2024 04:57:35.599828005 CEST	21	52677	125.44.207.200	192.168.2.16
May 6, 2024 04:57:35.605076075 CEST	52725	2121	192.168.2.16	92.93.157.152
May 6, 2024 04:57:35.605469942 CEST	52789	2121	192.168.2.16	187.232.88.226
May 6, 2024 04:57:35.605577946 CEST	52790	21	192.168.2.16	70.80.186.55
May 6, 2024 04:57:35.621057987 CEST	52630	2121	192.168.2.16	87.4.141.61
May 6, 2024 04:57:35.621079922 CEST	52694	2121	192.168.2.16	113.230.6.20
May 6, 2024 04:57:35.630994081 CEST	2121	52661	159.65.56.173	192.168.2.16
May 6, 2024 04:57:35.633161068 CEST	21	52710	101.43.249.26	192.168.2.16
May 6, 2024 04:57:35.633172035 CEST	21	52710	101.43.249.26	192.168.2.16
May 6, 2024 04:57:35.633184910 CEST	21	52767	101.43.249.26	192.168.2.16
May 6, 2024 04:57:35.633213997 CEST	52710	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:35.633256912 CEST	52767	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:35.634356022 CEST	21	52660	159.65.56.173	192.168.2.16
May 6, 2024 04:57:35.652071953 CEST	52728	21	192.168.2.16	68.112.60.119
May 6, 2024 04:57:35.652391911 CEST	52791	2121	192.168.2.16	70.80.186.55
May 6, 2024 04:57:35.652446032 CEST	52792	21	192.168.2.16	60.130.34.64
May 6, 2024 04:57:35.668055058 CEST	52631	21	192.168.2.16	108.54.153.113
May 6, 2024 04:57:35.668911934 CEST	21	52780	34.128.145.40	192.168.2.16
May 6, 2024 04:57:35.668970108 CEST	52780	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:35.669290066 CEST	52780	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:35.669338942 CEST	52632	2121	192.168.2.16	108.54.153.113
May 6, 2024 04:57:35.669456959 CEST	52793	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:35.675751925 CEST	52650	2121	192.168.2.16	123.190.169.224
May 6, 2024 04:57:35.676284075 CEST	2121	52781	34.128.145.40	192.168.2.16
May 6, 2024 04:57:35.676335096 CEST	52781	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:35.676407099 CEST	52781	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:35.676609993 CEST	52794	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:35.688604116 CEST	21	52724	81.88.252.91	192.168.2.16
May 6, 2024 04:57:35.688618898 CEST	21	52724	81.88.252.91	192.168.2.16
May 6, 2024 04:57:35.688898087 CEST	52795	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:35.696078062 CEST	2121	52676	125.44.207.200	192.168.2.16
May 6, 2024 04:57:35.714545965 CEST	21	52749	154.210.32.21	192.168.2.16
May 6, 2024 04:57:35.714709044 CEST	52749	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:35.716308117 CEST	52796	2121	192.168.2.16	60.130.34.64
May 6, 2024 04:57:35.719144106 CEST	2121	52691	175.238.101.134	192.168.2.16
May 6, 2024 04:57:35.728221893 CEST	21	52748	87.106.26.129	192.168.2.16
May 6, 2024 04:57:35.728382111 CEST	21	52748	87.106.26.129	192.168.2.16
May 6, 2024 04:57:35.728646040 CEST	52748	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:35.731071949 CEST	52730	2121	192.168.2.16	68.112.60.119
May 6, 2024 04:57:35.738430023 CEST	21	52729	149.154.65.23	192.168.2.16
May 6, 2024 04:57:35.738548994 CEST	52729	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:35.738776922 CEST	52797	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:35.744887114 CEST	21	52615	220.90.78.219	192.168.2.16
May 6, 2024 04:57:35.747478008 CEST	52798	21	192.168.2.16	47.234.213.54
May 6, 2024 04:57:35.763276100 CEST	52799	2121	192.168.2.16	47.234.213.54
May 6, 2024 04:57:35.764363050 CEST	2121	52616	220.90.78.219	192.168.2.16
May 6, 2024 04:57:35.779247046 CEST	52800	21	192.168.2.16	126.78.179.192
May 6, 2024 04:57:35.781702995 CEST	21	52780	34.128.145.40	192.168.2.16
May 6, 2024 04:57:35.781714916 CEST	21	52793	34.128.145.40	192.168.2.16
May 6, 2024 04:57:35.781786919 CEST	52793	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:35.788146973 CEST	2121	52781	34.128.145.40	192.168.2.16
May 6, 2024 04:57:35.789030075 CEST	2121	52794	34.128.145.40	192.168.2.16
May 6, 2024 04:57:35.789093971 CEST	52794	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:35.810781956 CEST	2121	52785	110.66.102.25	192.168.2.16
May 6, 2024 04:57:35.811075926 CEST	52735	21	192.168.2.16	217.72.82.85
May 6, 2024 04:57:35.811230898 CEST	52736	2121	192.168.2.16	217.72.82.85
May 6, 2024 04:57:35.827151060 CEST	52737	21	192.168.2.16	95.246.211.214
May 6, 2024 04:57:35.827477932 CEST	52801	2121	192.168.2.16	126.78.179.192
May 6, 2024 04:57:35.843175888 CEST	52738	2121	192.168.2.16	95.246.211.214
May 6, 2024 04:57:35.843560934 CEST	52802	21	192.168.2.16	42.193.108.129
May 6, 2024 04:57:35.843601942 CEST	52803	2121	192.168.2.16	42.193.108.129
May 6, 2024 04:57:35.859066963 CEST	52739	21	192.168.2.16	120.232.156.179
May 6, 2024 04:57:35.865684032 CEST	21	52753	39.106.171.20	192.168.2.16
May 6, 2024 04:57:35.865765095 CEST	52753	21	192.168.2.16	39.106.171.20
May 6, 2024 04:57:35.865950108 CEST	52804	21	192.168.2.16	190.32.203.69
May 6, 2024 04:57:35.875076056 CEST	52740	2121	192.168.2.16	120.232.156.179
May 6, 2024 04:57:35.891068935 CEST	52741	21	192.168.2.16	188.16.78.41
May 6, 2024 04:57:35.891427994 CEST	52805	2121	192.168.2.16	190.32.203.69
May 6, 2024 04:57:35.891588926 CEST	21	52793	34.128.145.40	192.168.2.16
May 6, 2024 04:57:35.891653061 CEST	52793	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:35.891686916 CEST	52793	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:35.891805887 CEST	52806	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:35.899920940 CEST	2121	52794	34.128.145.40	192.168.2.16
May 6, 2024 04:57:35.899974108 CEST	52794	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:35.900022984 CEST	52794	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:35.900172949 CEST	52807	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:35.907072067 CEST	52743	2121	192.168.2.16	188.16.78.41
May 6, 2024 04:57:35.907078981 CEST	52742	21	192.168.2.16	124.46.202.51
May 6, 2024 04:57:35.929985046 CEST	21	52734	103.109.6.215	192.168.2.16
May 6, 2024 04:57:35.930121899 CEST	52734	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:35.947902918 CEST	21	52792	60.130.34.64	192.168.2.16
May 6, 2024 04:57:35.958676100 CEST	21	52748	87.106.26.129	192.168.2.16
May 6, 2024 04:57:35.958827019 CEST	52748	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:35.959068060 CEST	52808	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:35.959757090 CEST	21	52795	81.88.252.91	192.168.2.16
May 6, 2024 04:57:35.959824085 CEST	52795	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:35.971071959 CEST	52672	21	192.168.2.16	157.245.145.2
May 6, 2024 04:57:35.971074104 CEST	52744	2121	192.168.2.16	124.46.202.51
May 6, 2024 04:57:35.975574017 CEST	21	52767	101.43.249.26	192.168.2.16
May 6, 2024 04:57:35.975722075 CEST	52767	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:35.978818893 CEST	2121	52694	113.230.6.20	192.168.2.16
May 6, 2024 04:57:35.986068010 CEST	52745	21	192.168.2.16	77.34.191.82
May 6, 2024 04:57:35.986076117 CEST	52679	21	192.168.2.16	14.48.52.23
May 6, 2024 04:57:35.986078024 CEST	52726	21	192.168.2.16	128.201.198.188
May 6, 2024 04:57:35.994656086 CEST	21	52729	149.154.65.23	192.168.2.16
May 6, 2024 04:57:35.994719028 CEST	52729	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:36.000967979 CEST	21	52806	34.128.145.40	192.168.2.16
May 6, 2024 04:57:36.001043081 CEST	52806	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:36.005707979 CEST	21	52793	34.128.145.40	192.168.2.16
May 6, 2024 04:57:36.005721092 CEST	21	52797	149.154.65.23	192.168.2.16
May 6, 2024 04:57:36.005733967 CEST	2121	52796	60.130.34.64	192.168.2.16
May 6, 2024 04:57:36.005795956 CEST	52797	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:36.012808084 CEST	2121	52807	34.128.145.40	192.168.2.16
May 6, 2024 04:57:36.012859106 CEST	52807	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:36.012923002 CEST	2121	52794	34.128.145.40	192.168.2.16
May 6, 2024 04:57:36.018059969 CEST	52727	2121	192.168.2.16	128.201.198.188
May 6, 2024 04:57:36.019586086 CEST	52680	2121	192.168.2.16	14.48.52.23
May 6, 2024 04:57:36.023960114 CEST	21	52804	190.32.203.69	192.168.2.16
May 6, 2024 04:57:36.028964996 CEST	2121	52650	123.190.169.224	192.168.2.16
May 6, 2024 04:57:36.034073114 CEST	52637	21	192.168.2.16	88.115.188.149
May 6, 2024 04:57:36.045286894 CEST	2121	52805	190.32.203.69	192.168.2.16
May 6, 2024 04:57:36.049156904 CEST	52638	2121	192.168.2.16	88.115.188.149
May 6, 2024 04:57:36.049351931 CEST	52809	21	192.168.2.16	175.170.226.50
May 6, 2024 04:57:36.061889887 CEST	21	52749	154.210.32.21	192.168.2.16
May 6, 2024 04:57:36.061960936 CEST	21	52749	154.210.32.21	192.168.2.16
May 6, 2024 04:57:36.062083006 CEST	52749	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:36.065053940 CEST	52639	21	192.168.2.16	79.21.7.32
May 6, 2024 04:57:36.065067053 CEST	52685	21	192.168.2.16	175.238.101.134
May 6, 2024 04:57:36.069020987 CEST	21	52800	126.78.179.192	192.168.2.16
May 6, 2024 04:57:36.081079960 CEST	52750	2121	192.168.2.16	77.34.191.82
May 6, 2024 04:57:36.081163883 CEST	52751	21	192.168.2.16	61.253.48.222
May 6, 2024 04:57:36.096076965 CEST	52752	2121	192.168.2.16	61.253.48.222
May 6, 2024 04:57:36.096077919 CEST	52674	2121	192.168.2.16	157.245.145.2
May 6, 2024 04:57:36.096378088 CEST	52810	2121	192.168.2.16	175.170.226.50
May 6, 2024 04:57:36.110295057 CEST	21	52806	34.128.145.40	192.168.2.16
May 6, 2024 04:57:36.110357046 CEST	52806	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:36.110414028 CEST	52806	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:36.110582113 CEST	52811	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:36.112051964 CEST	52643	2121	192.168.2.16	61.69.211.194
May 6, 2024 04:57:36.112076044 CEST	52641	21	192.168.2.16	188.81.21.242
May 6, 2024 04:57:36.112077951 CEST	52642	2121	192.168.2.16	79.21.7.32
May 6, 2024 04:57:36.112078905 CEST	52677	21	192.168.2.16	125.44.207.200
May 6, 2024 04:57:36.112626076 CEST	52812	21	192.168.2.16	99.254.163.23
May 6, 2024 04:57:36.112766027 CEST	52813	2121	192.168.2.16	99.254.163.23
May 6, 2024 04:57:36.124134064 CEST	2121	52807	34.128.145.40	192.168.2.16
May 6, 2024 04:57:36.124186039 CEST	52807	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:36.124247074 CEST	52807	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:36.124394894 CEST	52814	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:36.128046989 CEST	52640	2121	192.168.2.16	188.81.21.242
May 6, 2024 04:57:36.128053904 CEST	52644	21	192.168.2.16	61.69.211.194
May 6, 2024 04:57:36.128063917 CEST	52645	21	192.168.2.16	23.201.234.9
May 6, 2024 04:57:36.128063917 CEST	52646	2121	192.168.2.16	23.201.234.9
May 6, 2024 04:57:36.129163980 CEST	52647	21	192.168.2.16	98.171.102.192
May 6, 2024 04:57:36.134661913 CEST	2121	52801	126.78.179.192	192.168.2.16
May 6, 2024 04:57:36.144150019 CEST	52648	2121	192.168.2.16	98.171.102.192
May 6, 2024 04:57:36.144150972 CEST	52649	21	192.168.2.16	123.190.169.224
May 6, 2024 04:57:36.144153118 CEST	52651	21	192.168.2.16	174.174.198.67
May 6, 2024 04:57:36.144153118 CEST	52660	21	192.168.2.16	159.65.56.173
May 6, 2024 04:57:36.144154072 CEST	52661	2121	192.168.2.16	159.65.56.173
May 6, 2024 04:57:36.159071922 CEST	52652	2121	192.168.2.16	174.174.198.67
May 6, 2024 04:57:36.159142971 CEST	52653	21	192.168.2.16	173.54.123.47
May 6, 2024 04:57:36.174285889 CEST	21	52726	128.201.198.188	192.168.2.16
May 6, 2024 04:57:36.175051928 CEST	52654	2121	192.168.2.16	173.54.123.47
May 6, 2024 04:57:36.182756901 CEST	21	52808	87.106.26.129	192.168.2.16
May 6, 2024 04:57:36.182920933 CEST	52808	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:36.182950974 CEST	21	52802	42.193.108.129	192.168.2.16
May 6, 2024 04:57:36.188791990 CEST	21	52748	87.106.26.129	192.168.2.16
May 6, 2024 04:57:36.188843966 CEST	52748	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:36.191050053 CEST	52656	21	192.168.2.16	221.231.16.21
May 6, 2024 04:57:36.191051006 CEST	52657	2121	192.168.2.16	221.231.16.21
May 6, 2024 04:57:36.191066027 CEST	52658	21	192.168.2.16	73.228.87.159
May 6, 2024 04:57:36.191068888 CEST	52754	2121	192.168.2.16	39.106.171.20
May 6, 2024 04:57:36.191070080 CEST	52756	2121	192.168.2.16	123.248.201.229
May 6, 2024 04:57:36.191353083 CEST	2121	52803	42.193.108.129	192.168.2.16
May 6, 2024 04:57:36.191385031 CEST	52755	21	192.168.2.16	123.248.201.229
May 6, 2024 04:57:36.201353073 CEST	21	52772	38.56.42.35	192.168.2.16
May 6, 2024 04:57:36.204781055 CEST	2121	52727	128.201.198.188	192.168.2.16
May 6, 2024 04:57:36.206082106 CEST	2121	52773	38.56.42.35	192.168.2.16
May 6, 2024 04:57:36.207081079 CEST	52676	2121	192.168.2.16	125.44.207.200
May 6, 2024 04:57:36.207508087 CEST	52815	21	192.168.2.16	124.64.94.184
May 6, 2024 04:57:36.219485044 CEST	21	52753	39.106.171.20	192.168.2.16
May 6, 2024 04:57:36.219609976 CEST	21	52753	39.106.171.20	192.168.2.16
May 6, 2024 04:57:36.219659090 CEST	52753	21	192.168.2.16	39.106.171.20
May 6, 2024 04:57:36.220124006 CEST	21	52806	34.128.145.40	192.168.2.16
May 6, 2024 04:57:36.221311092 CEST	21	52811	34.128.145.40	192.168.2.16
May 6, 2024 04:57:36.221371889 CEST	52811	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:36.223073959 CEST	52760	2121	192.168.2.16	85.247.153.249
May 6, 2024 04:57:36.223073959 CEST	52758	21	192.168.2.16	85.244.143.189
May 6, 2024 04:57:36.223284960 CEST	52757	21	192.168.2.16	85.247.153.249
May 6, 2024 04:57:36.223288059 CEST	52691	2121	192.168.2.16	175.238.101.134
May 6, 2024 04:57:36.223292112 CEST	52816	2121	192.168.2.16	124.64.94.184
May 6, 2024 04:57:36.223294020 CEST	52759	2121	192.168.2.16	85.244.143.189
May 6, 2024 04:57:36.233433962 CEST	2121	52807	34.128.145.40	192.168.2.16
May 6, 2024 04:57:36.234082937 CEST	2121	52814	34.128.145.40	192.168.2.16
May 6, 2024 04:57:36.234138012 CEST	52814	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:36.239042997 CEST	52659	2121	192.168.2.16	73.228.87.159
May 6, 2024 04:57:36.243791103 CEST	21	52795	81.88.252.91	192.168.2.16
May 6, 2024 04:57:36.243921041 CEST	52795	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:36.255240917 CEST	52764	2121	192.168.2.16	109.133.106.77
May 6, 2024 04:57:36.270056009 CEST	52665	21	192.168.2.16	109.22.100.198
May 6, 2024 04:57:36.270056963 CEST	52763	21	192.168.2.16	109.133.106.77
May 6, 2024 04:57:36.270349026 CEST	52817	21	192.168.2.16	121.148.201.189
May 6, 2024 04:57:36.273705006 CEST	21	52797	149.154.65.23	192.168.2.16
May 6, 2024 04:57:36.273859978 CEST	52797	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:36.286056995 CEST	52766	21	192.168.2.16	218.20.198.95
May 6, 2024 04:57:36.286077976 CEST	52765	2121	192.168.2.16	218.20.198.95
May 6, 2024 04:57:36.290126085 CEST	2121	52813	99.254.163.23	192.168.2.16
May 6, 2024 04:57:36.290139914 CEST	21	52812	99.254.163.23	192.168.2.16
May 6, 2024 04:57:36.293234110 CEST	21	52679	14.48.52.23	192.168.2.16
May 6, 2024 04:57:36.302392006 CEST	52818	2121	192.168.2.16	121.148.201.189
May 6, 2024 04:57:36.306050062 CEST	21	52672	157.245.145.2	192.168.2.16
May 6, 2024 04:57:36.308703899 CEST	21	52734	103.109.6.215	192.168.2.16
May 6, 2024 04:57:36.308885098 CEST	52734	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:36.308979988 CEST	52819	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:36.317711115 CEST	21	52767	101.43.249.26	192.168.2.16
May 6, 2024 04:57:36.317898989 CEST	52767	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:36.318051100 CEST	52768	21	192.168.2.16	98.20.176.253
May 6, 2024 04:57:36.318082094 CEST	52785	2121	192.168.2.16	110.66.102.25
May 6, 2024 04:57:36.318305969 CEST	52820	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:36.318439007 CEST	52821	21	192.168.2.16	47.204.129.166
May 6, 2024 04:57:36.331842899 CEST	21	52811	34.128.145.40	192.168.2.16
May 6, 2024 04:57:36.331908941 CEST	52811	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:36.331964970 CEST	52811	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:36.332118034 CEST	52822	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:36.332464933 CEST	2121	52680	14.48.52.23	192.168.2.16
May 6, 2024 04:57:36.333054066 CEST	52666	2121	192.168.2.16	109.22.100.198
May 6, 2024 04:57:36.343895912 CEST	2121	52814	34.128.145.40	192.168.2.16
May 6, 2024 04:57:36.343983889 CEST	52814	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:36.344046116 CEST	52814	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:36.344218969 CEST	52823	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:36.350704908 CEST	52769	2121	192.168.2.16	98.20.176.253
May 6, 2024 04:57:36.361865044 CEST	2121	52661	159.65.56.173	192.168.2.16
May 6, 2024 04:57:36.365057945 CEST	52770	21	192.168.2.16	100.8.10.204
May 6, 2024 04:57:36.365356922 CEST	52824	2121	192.168.2.16	47.204.129.166
May 6, 2024 04:57:36.365525007 CEST	21	52660	159.65.56.173	192.168.2.16
May 6, 2024 04:57:36.368951082 CEST	21	52685	175.238.101.134	192.168.2.16
May 6, 2024 04:57:36.381069899 CEST	52771	2121	192.168.2.16	100.8.10.204
May 6, 2024 04:57:36.381690025 CEST	52825	21	192.168.2.16	35.139.146.239
May 6, 2024 04:57:36.381788015 CEST	52826	2121	192.168.2.16	35.139.146.239
May 6, 2024 04:57:36.381820917 CEST	52827	21	192.168.2.16	147.135.252.51
May 6, 2024 04:57:36.412053108 CEST	52775	2121	192.168.2.16	174.118.44.203
May 6, 2024 04:57:36.412074089 CEST	52774	21	192.168.2.16	174.118.44.203
May 6, 2024 04:57:36.412077904 CEST	52776	21	192.168.2.16	213.192.93.136
May 6, 2024 04:57:36.412298918 CEST	52828	2121	192.168.2.16	147.135.252.51
May 6, 2024 04:57:36.415482998 CEST	21	52749	154.210.32.21	192.168.2.16
May 6, 2024 04:57:36.415597916 CEST	52749	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:36.415716887 CEST	52829	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:36.416392088 CEST	21	52749	154.210.32.21	192.168.2.16
May 6, 2024 04:57:36.416436911 CEST	52749	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:36.428327084 CEST	52830	21	192.168.2.16	23.24.208.142
May 6, 2024 04:57:36.430816889 CEST	21	52808	87.106.26.129	192.168.2.16
May 6, 2024 04:57:36.430991888 CEST	52808	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:36.441468000 CEST	21	52811	34.128.145.40	192.168.2.16
May 6, 2024 04:57:36.441684008 CEST	21	52822	34.128.145.40	192.168.2.16
May 6, 2024 04:57:36.441744089 CEST	52822	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:36.444051981 CEST	52777	2121	192.168.2.16	213.192.93.136
May 6, 2024 04:57:36.444789886 CEST	52778	21	192.168.2.16	72.74.189.6
May 6, 2024 04:57:36.453742981 CEST	2121	52814	34.128.145.40	192.168.2.16
May 6, 2024 04:57:36.454590082 CEST	2121	52823	34.128.145.40	192.168.2.16
May 6, 2024 04:57:36.454642057 CEST	52823	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:36.454737902 CEST	2121	52674	157.245.145.2	192.168.2.16
May 6, 2024 04:57:36.456317902 CEST	21	52677	125.44.207.200	192.168.2.16
May 6, 2024 04:57:36.460052967 CEST	52792	21	192.168.2.16	60.130.34.64
May 6, 2024 04:57:36.460074902 CEST	52779	2121	192.168.2.16	72.74.189.6
May 6, 2024 04:57:36.460123062 CEST	52668	21	192.168.2.16	173.77.7.92
May 6, 2024 04:57:36.476047993 CEST	52671	2121	192.168.2.16	173.77.7.92
May 6, 2024 04:57:36.492050886 CEST	52694	2121	192.168.2.16	113.230.6.20
May 6, 2024 04:57:36.508063078 CEST	52796	2121	192.168.2.16	60.130.34.64
May 6, 2024 04:57:36.508272886 CEST	52831	2121	192.168.2.16	23.24.208.142
May 6, 2024 04:57:36.524055958 CEST	52783	2121	192.168.2.16	27.77.113.5
May 6, 2024 04:57:36.524059057 CEST	52784	21	192.168.2.16	110.66.102.25
May 6, 2024 04:57:36.524082899 CEST	52804	21	192.168.2.16	190.32.203.69
May 6, 2024 04:57:36.524082899 CEST	52782	21	192.168.2.16	27.77.113.5
May 6, 2024 04:57:36.528759003 CEST	21	52795	81.88.252.91	192.168.2.16
May 6, 2024 04:57:36.528886080 CEST	52795	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:36.530270100 CEST	2121	52691	175.238.101.134	192.168.2.16
May 6, 2024 04:57:36.537671089 CEST	21	52797	149.154.65.23	192.168.2.16
May 6, 2024 04:57:36.538103104 CEST	21	52797	149.154.65.23	192.168.2.16
May 6, 2024 04:57:36.538255930 CEST	52797	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:36.540075064 CEST	52650	2121	192.168.2.16	123.190.169.224
May 6, 2024 04:57:36.540369034 CEST	52832	21	192.168.2.16	24.28.32.247
May 6, 2024 04:57:36.551451921 CEST	21	52822	34.128.145.40	192.168.2.16
May 6, 2024 04:57:36.551517963 CEST	52822	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:36.551561117 CEST	52822	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:36.551731110 CEST	52833	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:36.556057930 CEST	52805	2121	192.168.2.16	190.32.203.69
May 6, 2024 04:57:36.556061029 CEST	52678	2121	192.168.2.16	95.233.116.132
May 6, 2024 04:57:36.556431055 CEST	52834	2121	192.168.2.16	24.28.32.247
May 6, 2024 04:57:36.565115929 CEST	2121	52823	34.128.145.40	192.168.2.16
May 6, 2024 04:57:36.565177917 CEST	52823	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:36.565242052 CEST	52823	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:36.565428019 CEST	52835	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:36.572046041 CEST	52786	21	192.168.2.16	183.236.95.99
May 6, 2024 04:57:36.572181940 CEST	52800	21	192.168.2.16	126.78.179.192
May 6, 2024 04:57:36.575047016 CEST	52675	21	192.168.2.16	95.233.116.132
May 6, 2024 04:57:36.576678991 CEST	52787	2121	192.168.2.16	183.236.95.99
May 6, 2024 04:57:36.583583117 CEST	2121	52676	125.44.207.200	192.168.2.16
May 6, 2024 04:57:36.587348938 CEST	52836	21	192.168.2.16	123.232.103.209
May 6, 2024 04:57:36.603053093 CEST	52681	21	192.168.2.16	81.44.171.153
May 6, 2024 04:57:36.603075027 CEST	52788	21	192.168.2.16	187.232.88.226
May 6, 2024 04:57:36.603363037 CEST	21	52540	92.205.10.177	192.168.2.16
May 6, 2024 04:57:36.603519917 CEST	52540	21	192.168.2.16	92.205.10.177
May 6, 2024 04:57:36.603801012 CEST	52837	21	192.168.2.16	218.27.113.126
May 6, 2024 04:57:36.603842020 CEST	52838	2121	192.168.2.16	123.232.103.209
May 6, 2024 04:57:36.603909969 CEST	52839	21	192.168.2.16	92.205.10.177
May 6, 2024 04:57:36.603971004 CEST	2121	52785	110.66.102.25	192.168.2.16
May 6, 2024 04:57:36.619082928 CEST	52682	2121	192.168.2.16	81.44.171.153
May 6, 2024 04:57:36.619096994 CEST	52789	2121	192.168.2.16	187.232.88.226
May 6, 2024 04:57:36.619097948 CEST	52683	21	192.168.2.16	124.167.80.164
May 6, 2024 04:57:36.619141102 CEST	52790	21	192.168.2.16	70.80.186.55
May 6, 2024 04:57:36.619313955 CEST	52840	2121	192.168.2.16	218.27.113.126
May 6, 2024 04:57:36.635082960 CEST	52684	2121	192.168.2.16	124.167.80.164
May 6, 2024 04:57:36.635083914 CEST	52801	2121	192.168.2.16	126.78.179.192
May 6, 2024 04:57:36.635371923 CEST	52841	21	192.168.2.16	117.85.46.89
May 6, 2024 04:57:36.651772022 CEST	52842	2121	192.168.2.16	107.4.91.127
May 6, 2024 04:57:36.651983976 CEST	52843	21	192.168.2.16	107.4.91.127
May 6, 2024 04:57:36.652224064 CEST	52844	2121	192.168.2.16	117.85.46.89
May 6, 2024 04:57:36.654696941 CEST	21	52808	87.106.26.129	192.168.2.16
May 6, 2024 04:57:36.654901981 CEST	21	52808	87.106.26.129	192.168.2.16
May 6, 2024 04:57:36.655139923 CEST	52808	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:36.658601999 CEST	21	52767	101.43.249.26	192.168.2.16
May 6, 2024 04:57:36.658615112 CEST	21	52767	101.43.249.26	192.168.2.16
May 6, 2024 04:57:36.658672094 CEST	52767	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:36.659517050 CEST	21	52820	101.43.249.26	192.168.2.16
May 6, 2024 04:57:36.659593105 CEST	52820	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:36.660933971 CEST	21	52833	34.128.145.40	192.168.2.16
May 6, 2024 04:57:36.661004066 CEST	52833	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:36.665258884 CEST	21	52819	103.109.6.215	192.168.2.16
May 6, 2024 04:57:36.665332079 CEST	52819	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:36.667100906 CEST	52791	2121	192.168.2.16	70.80.186.55
May 6, 2024 04:57:36.667500019 CEST	52845	21	192.168.2.16	47.150.215.103
May 6, 2024 04:57:36.667618990 CEST	52846	2121	192.168.2.16	47.150.215.103
May 6, 2024 04:57:36.667778969 CEST	52847	21	192.168.2.16	86.2.56.6
May 6, 2024 04:57:36.674679995 CEST	2121	52823	34.128.145.40	192.168.2.16
May 6, 2024 04:57:36.675738096 CEST	2121	52835	34.128.145.40	192.168.2.16
May 6, 2024 04:57:36.675802946 CEST	52835	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:36.677432060 CEST	21	52804	190.32.203.69	192.168.2.16
May 6, 2024 04:57:36.683068037 CEST	52802	21	192.168.2.16	42.193.108.129
May 6, 2024 04:57:36.683093071 CEST	52726	21	192.168.2.16	128.201.198.188
May 6, 2024 04:57:36.683324099 CEST	52848	2121	192.168.2.16	86.2.56.6
May 6, 2024 04:57:36.685791016 CEST	21	52734	103.109.6.215	192.168.2.16
May 6, 2024 04:57:36.685803890 CEST	21	52734	103.109.6.215	192.168.2.16
May 6, 2024 04:57:36.685853958 CEST	52734	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:36.699090958 CEST	52803	2121	192.168.2.16	42.193.108.129
May 6, 2024 04:57:36.699731112 CEST	52849	21	192.168.2.16	42.59.71.141
May 6, 2024 04:57:36.699852943 CEST	52850	2121	192.168.2.16	42.59.71.141
May 6, 2024 04:57:36.699923038 CEST	52851	21	192.168.2.16	104.196.244.21
May 6, 2024 04:57:36.700053930 CEST	52852	2121	192.168.2.16	104.196.244.21
May 6, 2024 04:57:36.709887028 CEST	2121	52805	190.32.203.69	192.168.2.16
May 6, 2024 04:57:36.715080023 CEST	52773	2121	192.168.2.16	38.56.42.35
May 6, 2024 04:57:36.715080976 CEST	52772	21	192.168.2.16	38.56.42.35
May 6, 2024 04:57:36.715112925 CEST	52727	2121	192.168.2.16	128.201.198.188
May 6, 2024 04:57:36.715115070 CEST	52565	21	192.168.2.16	168.220.94.137
May 6, 2024 04:57:36.715186119 CEST	52564	2121	192.168.2.16	168.220.94.137
May 6, 2024 04:57:36.715557098 CEST	52853	2121	192.168.2.16	168.220.94.137
May 6, 2024 04:57:36.715648890 CEST	52854	21	192.168.2.16	168.220.94.137
May 6, 2024 04:57:36.755486012 CEST	21	52792	60.130.34.64	192.168.2.16
May 6, 2024 04:57:36.757601023 CEST	21	52829	154.210.32.21	192.168.2.16
May 6, 2024 04:57:36.757766008 CEST	52829	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:36.760464907 CEST	21	52749	154.210.32.21	192.168.2.16
May 6, 2024 04:57:36.763232946 CEST	52798	21	192.168.2.16	47.234.213.54
May 6, 2024 04:57:36.763236046 CEST	52799	2121	192.168.2.16	47.234.213.54
May 6, 2024 04:57:36.763417006 CEST	52855	21	192.168.2.16	208.181.214.78
May 6, 2024 04:57:36.772006035 CEST	21	52833	34.128.145.40	192.168.2.16
May 6, 2024 04:57:36.772063971 CEST	52833	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:36.772118092 CEST	52833	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:36.772279024 CEST	52856	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:36.786731958 CEST	2121	52835	34.128.145.40	192.168.2.16
May 6, 2024 04:57:36.786787033 CEST	52835	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:36.786851883 CEST	52835	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:36.787012100 CEST	52857	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:36.793382883 CEST	2121	52796	60.130.34.64	192.168.2.16
May 6, 2024 04:57:36.795047045 CEST	52813	2121	192.168.2.16	99.254.163.23
May 6, 2024 04:57:36.795073986 CEST	52679	21	192.168.2.16	14.48.52.23
May 6, 2024 04:57:36.795089006 CEST	52812	21	192.168.2.16	99.254.163.23
May 6, 2024 04:57:36.795756102 CEST	52858	2121	192.168.2.16	208.181.214.78
May 6, 2024 04:57:36.795939922 CEST	52859	21	192.168.2.16	61.6.0.143
May 6, 2024 04:57:36.796091080 CEST	52860	2121	192.168.2.16	61.6.0.143
May 6, 2024 04:57:36.803062916 CEST	21	52797	149.154.65.23	192.168.2.16
May 6, 2024 04:57:36.803232908 CEST	52797	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:36.803481102 CEST	52861	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:36.810374022 CEST	21	52795	81.88.252.91	192.168.2.16
May 6, 2024 04:57:36.810384989 CEST	21	52795	81.88.252.91	192.168.2.16
May 6, 2024 04:57:36.810653925 CEST	52862	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:36.811074972 CEST	52672	21	192.168.2.16	157.245.145.2
May 6, 2024 04:57:36.811672926 CEST	52863	21	192.168.2.16	202.168.242.122
May 6, 2024 04:57:36.811697006 CEST	52864	21	192.168.2.16	182.16.189.156
May 6, 2024 04:57:36.811762094 CEST	52865	2121	192.168.2.16	182.16.189.156
May 6, 2024 04:57:36.816044092 CEST	2121	52818	121.148.201.189	192.168.2.16
May 6, 2024 04:57:36.818830967 CEST	21	52817	121.148.201.189	192.168.2.16
May 6, 2024 04:57:36.822105885 CEST	21	52540	92.205.10.177	192.168.2.16
May 6, 2024 04:57:36.822163105 CEST	52540	21	192.168.2.16	92.205.10.177
May 6, 2024 04:57:36.822705984 CEST	21	52540	92.205.10.177	192.168.2.16
May 6, 2024 04:57:36.822752953 CEST	52540	21	192.168.2.16	92.205.10.177
May 6, 2024 04:57:36.824723959 CEST	2121	52853	168.220.94.137	192.168.2.16
May 6, 2024 04:57:36.824780941 CEST	52853	2121	192.168.2.16	168.220.94.137
May 6, 2024 04:57:36.824791908 CEST	21	52854	168.220.94.137	192.168.2.16
May 6, 2024 04:57:36.824841022 CEST	52854	21	192.168.2.16	168.220.94.137
May 6, 2024 04:57:36.825632095 CEST	2121	52564	168.220.94.137	192.168.2.16
May 6, 2024 04:57:36.825643063 CEST	21	52565	168.220.94.137	192.168.2.16
May 6, 2024 04:57:36.827312946 CEST	52866	21	192.168.2.16	208.106.130.31
May 6, 2024 04:57:36.829315901 CEST	21	52839	92.205.10.177	192.168.2.16
May 6, 2024 04:57:36.829372883 CEST	52839	21	192.168.2.16	92.205.10.177
May 6, 2024 04:57:36.843079090 CEST	52680	2121	192.168.2.16	14.48.52.23
May 6, 2024 04:57:36.849551916 CEST	2121	52694	113.230.6.20	192.168.2.16
May 6, 2024 04:57:36.862617016 CEST	21	52800	126.78.179.192	192.168.2.16
May 6, 2024 04:57:36.869865894 CEST	21	52726	128.201.198.188	192.168.2.16
May 6, 2024 04:57:36.875055075 CEST	52822	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:36.875082016 CEST	52685	21	192.168.2.16	175.238.101.134
May 6, 2024 04:57:36.879174948 CEST	21	52808	87.106.26.129	192.168.2.16
May 6, 2024 04:57:36.879306078 CEST	52808	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:36.879533052 CEST	52867	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:36.881267071 CEST	21	52833	34.128.145.40	192.168.2.16
May 6, 2024 04:57:36.882747889 CEST	21	52856	34.128.145.40	192.168.2.16
May 6, 2024 04:57:36.882806063 CEST	52856	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:36.887542009 CEST	2121	52650	123.190.169.224	192.168.2.16
May 6, 2024 04:57:36.891088009 CEST	52692	21	192.168.2.16	113.230.6.20
May 6, 2024 04:57:36.891421080 CEST	52868	21	192.168.2.16	194.181.93.169
May 6, 2024 04:57:36.896330118 CEST	2121	52835	34.128.145.40	192.168.2.16
May 6, 2024 04:57:36.896507978 CEST	2121	52857	34.128.145.40	192.168.2.16
May 6, 2024 04:57:36.896569014 CEST	52857	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:36.901899099 CEST	2121	52727	128.201.198.188	192.168.2.16
May 6, 2024 04:57:36.907284021 CEST	52869	21	192.168.2.16	47.98.154.221
May 6, 2024 04:57:36.942687035 CEST	2121	52801	126.78.179.192	192.168.2.16
May 6, 2024 04:57:36.948129892 CEST	21	52837	218.27.113.126	192.168.2.16
May 6, 2024 04:57:36.954796076 CEST	52870	21	192.168.2.16	200.185.196.34
May 6, 2024 04:57:36.961580038 CEST	21	52772	38.56.42.35	192.168.2.16
May 6, 2024 04:57:36.962146997 CEST	2121	52840	218.27.113.126	192.168.2.16
May 6, 2024 04:57:36.966376066 CEST	2121	52773	38.56.42.35	192.168.2.16
May 6, 2024 04:57:36.970083952 CEST	52674	2121	192.168.2.16	157.245.145.2
May 6, 2024 04:57:36.970084906 CEST	52677	21	192.168.2.16	125.44.207.200
May 6, 2024 04:57:36.972117901 CEST	2121	52813	99.254.163.23	192.168.2.16
May 6, 2024 04:57:36.972129107 CEST	21	52812	99.254.163.23	192.168.2.16
May 6, 2024 04:57:36.977714062 CEST	21	52841	117.85.46.89	192.168.2.16
May 6, 2024 04:57:36.985459089 CEST	21	52822	34.128.145.40	192.168.2.16
May 6, 2024 04:57:36.986078024 CEST	52696	21	192.168.2.16	72.80.255.205
May 6, 2024 04:57:36.986097097 CEST	52697	2121	192.168.2.16	72.80.255.205
May 6, 2024 04:57:36.986485958 CEST	52871	2121	192.168.2.16	200.185.196.34
May 6, 2024 04:57:36.993268013 CEST	21	52856	34.128.145.40	192.168.2.16
May 6, 2024 04:57:36.993326902 CEST	52856	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:36.993375063 CEST	52856	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:36.993525028 CEST	52872	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:36.997237921 CEST	21	52855	208.181.214.78	192.168.2.16
May 6, 2024 04:57:37.000986099 CEST	21	52820	101.43.249.26	192.168.2.16
May 6, 2024 04:57:37.001142979 CEST	52820	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:37.002070904 CEST	52699	21	192.168.2.16	188.214.156.147
May 6, 2024 04:57:37.002276897 CEST	52698	21	192.168.2.16	83.39.246.112
May 6, 2024 04:57:37.002305984 CEST	52873	21	192.168.2.16	207.161.20.232
May 6, 2024 04:57:37.005091906 CEST	21	52866	208.106.130.31	192.168.2.16
May 6, 2024 04:57:37.005165100 CEST	52866	21	192.168.2.16	208.106.130.31
May 6, 2024 04:57:37.006594896 CEST	2121	52857	34.128.145.40	192.168.2.16
May 6, 2024 04:57:37.006661892 CEST	52857	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:37.006716967 CEST	52857	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:37.006890059 CEST	52874	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:37.008167028 CEST	2121	52844	117.85.46.89	192.168.2.16
May 6, 2024 04:57:37.017085075 CEST	52700	2121	192.168.2.16	83.39.246.112
May 6, 2024 04:57:37.021629095 CEST	21	52819	103.109.6.215	192.168.2.16
May 6, 2024 04:57:37.022403002 CEST	21	52802	42.193.108.129	192.168.2.16
May 6, 2024 04:57:37.023056030 CEST	52819	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:37.033075094 CEST	52691	2121	192.168.2.16	175.238.101.134
May 6, 2024 04:57:37.033580065 CEST	52875	2121	192.168.2.16	207.161.20.232
May 6, 2024 04:57:37.037461996 CEST	2121	52858	208.181.214.78	192.168.2.16
May 6, 2024 04:57:37.048042059 CEST	2121	52803	42.193.108.129	192.168.2.16
May 6, 2024 04:57:37.061435938 CEST	21	52839	92.205.10.177	192.168.2.16
May 6, 2024 04:57:37.061672926 CEST	52839	21	192.168.2.16	92.205.10.177
May 6, 2024 04:57:37.064068079 CEST	52809	21	192.168.2.16	175.170.226.50
May 6, 2024 04:57:37.064363956 CEST	52876	21	192.168.2.16	39.174.153.108
May 6, 2024 04:57:37.067033052 CEST	21	52797	149.154.65.23	192.168.2.16
May 6, 2024 04:57:37.067095041 CEST	52797	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:37.071396112 CEST	21	52861	149.154.65.23	192.168.2.16
May 6, 2024 04:57:37.071456909 CEST	52861	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:37.075403929 CEST	21	52862	81.88.252.91	192.168.2.16
May 6, 2024 04:57:37.075460911 CEST	52862	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:37.096074104 CEST	52676	2121	192.168.2.16	125.44.207.200
May 6, 2024 04:57:37.096283913 CEST	52810	2121	192.168.2.16	175.170.226.50
May 6, 2024 04:57:37.096285105 CEST	52877	2121	192.168.2.16	39.174.153.108
May 6, 2024 04:57:37.100522995 CEST	21	52679	14.48.52.23	192.168.2.16
May 6, 2024 04:57:37.102005959 CEST	21	52829	154.210.32.21	192.168.2.16
May 6, 2024 04:57:37.102180004 CEST	52829	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:37.102679968 CEST	21	52872	34.128.145.40	192.168.2.16
May 6, 2024 04:57:37.102744102 CEST	52872	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:37.103002071 CEST	21	52856	34.128.145.40	192.168.2.16
May 6, 2024 04:57:37.104868889 CEST	21	52808	87.106.26.129	192.168.2.16
May 6, 2024 04:57:37.104927063 CEST	52808	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:37.107875109 CEST	21	52867	87.106.26.129	192.168.2.16
May 6, 2024 04:57:37.107932091 CEST	52867	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:37.112082958 CEST	52785	2121	192.168.2.16	110.66.102.25
May 6, 2024 04:57:37.112786055 CEST	52878	21	192.168.2.16	223.242.39.72
May 6, 2024 04:57:37.112787008 CEST	52702	21	192.168.2.16	185.229.173.129
May 6, 2024 04:57:37.112826109 CEST	52879	2121	192.168.2.16	223.242.39.72
May 6, 2024 04:57:37.116492033 CEST	2121	52874	34.128.145.40	192.168.2.16
May 6, 2024 04:57:37.116555929 CEST	52874	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:37.117100000 CEST	2121	52857	34.128.145.40	192.168.2.16
May 6, 2024 04:57:37.127053022 CEST	52703	2121	192.168.2.16	185.229.173.129
May 6, 2024 04:57:37.127223015 CEST	52880	21	192.168.2.16	94.194.250.167
May 6, 2024 04:57:37.136387110 CEST	21	52868	194.181.93.169	192.168.2.16
May 6, 2024 04:57:37.136447906 CEST	52868	21	192.168.2.16	194.181.93.169
May 6, 2024 04:57:37.145143032 CEST	21	52672	157.245.145.2	192.168.2.16
May 6, 2024 04:57:37.154208899 CEST	2121	52680	14.48.52.23	192.168.2.16
May 6, 2024 04:57:37.159058094 CEST	52706	21	192.168.2.16	47.226.71.44
May 6, 2024 04:57:37.159535885 CEST	52881	2121	192.168.2.16	94.194.250.167
May 6, 2024 04:57:37.159590006 CEST	52882	21	192.168.2.16	108.158.112.58
May 6, 2024 04:57:37.167541981 CEST	21	52864	182.16.189.156	192.168.2.16
May 6, 2024 04:57:37.167603970 CEST	52864	21	192.168.2.16	182.16.189.156
May 6, 2024 04:57:37.175321102 CEST	52883	2121	192.168.2.16	108.158.112.58
May 6, 2024 04:57:37.177413940 CEST	21	52863	202.168.242.122	192.168.2.16
May 6, 2024 04:57:37.177427053 CEST	2121	52865	182.16.189.156	192.168.2.16
May 6, 2024 04:57:37.177489996 CEST	52865	2121	192.168.2.16	182.16.189.156
May 6, 2024 04:57:37.177489996 CEST	52863	21	192.168.2.16	202.168.242.122
May 6, 2024 04:57:37.178687096 CEST	21	52685	175.238.101.134	192.168.2.16
May 6, 2024 04:57:37.191076994 CEST	52804	21	192.168.2.16	190.32.203.69
May 6, 2024 04:57:37.191442013 CEST	52884	21	192.168.2.16	82.59.39.51
May 6, 2024 04:57:37.199296951 CEST	21	52866	208.106.130.31	192.168.2.16
May 6, 2024 04:57:37.199307919 CEST	21	52866	208.106.130.31	192.168.2.16
May 6, 2024 04:57:37.199357986 CEST	52866	21	192.168.2.16	208.106.130.31
May 6, 2024 04:57:37.199419975 CEST	52866	21	192.168.2.16	208.106.130.31
May 6, 2024 04:57:37.199593067 CEST	52885	21	192.168.2.16	208.106.130.31
May 6, 2024 04:57:37.207264900 CEST	52815	21	192.168.2.16	124.64.94.184
May 6, 2024 04:57:37.207264900 CEST	52886	2121	192.168.2.16	82.59.39.51
May 6, 2024 04:57:37.212335110 CEST	21	52872	34.128.145.40	192.168.2.16
May 6, 2024 04:57:37.212388992 CEST	52872	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:37.212443113 CEST	52872	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:37.212604046 CEST	52887	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:37.223057032 CEST	52805	2121	192.168.2.16	190.32.203.69
May 6, 2024 04:57:37.223324060 CEST	52888	21	192.168.2.16	104.165.110.236
May 6, 2024 04:57:37.226280928 CEST	2121	52874	34.128.145.40	192.168.2.16
May 6, 2024 04:57:37.226329088 CEST	52874	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:37.226372957 CEST	52874	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:37.226509094 CEST	52889	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:37.239048004 CEST	52816	2121	192.168.2.16	124.64.94.184
May 6, 2024 04:57:37.254059076 CEST	52707	2121	192.168.2.16	47.226.71.44
May 6, 2024 04:57:37.254223108 CEST	52708	21	192.168.2.16	94.33.238.2
May 6, 2024 04:57:37.256047010 CEST	52709	2121	192.168.2.16	94.33.238.2
May 6, 2024 04:57:37.267606974 CEST	21	52110	188.214.156.147	192.168.2.16
May 6, 2024 04:57:37.267654896 CEST	52110	21	192.168.2.16	188.214.156.147
May 6, 2024 04:57:37.270051956 CEST	52792	21	192.168.2.16	60.130.34.64
May 6, 2024 04:57:37.270447969 CEST	21	52869	47.98.154.221	192.168.2.16
May 6, 2024 04:57:37.270517111 CEST	52869	21	192.168.2.16	47.98.154.221
May 6, 2024 04:57:37.286340952 CEST	52890	2121	192.168.2.16	104.165.110.236
May 6, 2024 04:57:37.287034035 CEST	21	52839	92.205.10.177	192.168.2.16
May 6, 2024 04:57:37.287081957 CEST	21	52839	92.205.10.177	192.168.2.16
May 6, 2024 04:57:37.287190914 CEST	52839	21	192.168.2.16	92.205.10.177
May 6, 2024 04:57:37.302073956 CEST	52796	2121	192.168.2.16	60.130.34.64
May 6, 2024 04:57:37.314507008 CEST	21	52677	125.44.207.200	192.168.2.16
May 6, 2024 04:57:37.318057060 CEST	52818	2121	192.168.2.16	121.148.201.189
May 6, 2024 04:57:37.322175980 CEST	21	52887	34.128.145.40	192.168.2.16
May 6, 2024 04:57:37.322241068 CEST	52887	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:37.322454929 CEST	21	52872	34.128.145.40	192.168.2.16
May 6, 2024 04:57:37.328289032 CEST	2121	52674	157.245.145.2	192.168.2.16
May 6, 2024 04:57:37.332633972 CEST	21	52888	104.165.110.236	192.168.2.16
May 6, 2024 04:57:37.332700968 CEST	52888	21	192.168.2.16	104.165.110.236
May 6, 2024 04:57:37.333054066 CEST	52817	21	192.168.2.16	121.148.201.189
May 6, 2024 04:57:37.333065987 CEST	52821	21	192.168.2.16	47.204.129.166
May 6, 2024 04:57:37.333410978 CEST	52891	21	192.168.2.16	94.12.248.226
May 6, 2024 04:57:37.336036921 CEST	2121	52874	34.128.145.40	192.168.2.16
May 6, 2024 04:57:37.336215019 CEST	2121	52889	34.128.145.40	192.168.2.16
May 6, 2024 04:57:37.336272955 CEST	52889	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:37.339257002 CEST	2121	52691	175.238.101.134	192.168.2.16
May 6, 2024 04:57:37.342482090 CEST	21	52820	101.43.249.26	192.168.2.16
May 6, 2024 04:57:37.342595100 CEST	52820	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:37.342700958 CEST	21	52861	149.154.65.23	192.168.2.16
May 6, 2024 04:57:37.342833996 CEST	52861	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:37.342835903 CEST	52892	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:37.343605042 CEST	21	52862	81.88.252.91	192.168.2.16
May 6, 2024 04:57:37.343693972 CEST	52862	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:37.344351053 CEST	21	52804	190.32.203.69	192.168.2.16
May 6, 2024 04:57:37.349517107 CEST	52893	2121	192.168.2.16	94.12.248.226
May 6, 2024 04:57:37.349601030 CEST	52894	21	192.168.2.16	208.72.119.237
May 6, 2024 04:57:37.359517097 CEST	21	52867	87.106.26.129	192.168.2.16
May 6, 2024 04:57:37.359647036 CEST	52867	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:37.364063025 CEST	52694	2121	192.168.2.16	113.230.6.20
May 6, 2024 04:57:37.364074945 CEST	52800	21	192.168.2.16	126.78.179.192
May 6, 2024 04:57:37.364077091 CEST	52715	21	192.168.2.16	62.235.48.92
May 6, 2024 04:57:37.364367962 CEST	52895	2121	192.168.2.16	208.72.119.237
May 6, 2024 04:57:37.376029015 CEST	21	52885	208.106.130.31	192.168.2.16
May 6, 2024 04:57:37.376168013 CEST	52885	21	192.168.2.16	208.106.130.31
May 6, 2024 04:57:37.376890898 CEST	2121	52805	190.32.203.69	192.168.2.16
May 6, 2024 04:57:37.377037048 CEST	21	52866	208.106.130.31	192.168.2.16
May 6, 2024 04:57:37.379336119 CEST	21	52819	103.109.6.215	192.168.2.16
May 6, 2024 04:57:37.379455090 CEST	52819	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:37.380057096 CEST	52717	21	192.168.2.16	36.85.141.215
May 6, 2024 04:57:37.380085945 CEST	52726	21	192.168.2.16	128.201.198.188
May 6, 2024 04:57:37.380116940 CEST	52716	2121	192.168.2.16	62.235.48.92
May 6, 2024 04:57:37.380120993 CEST	52824	2121	192.168.2.16	47.204.129.166
May 6, 2024 04:57:37.380426884 CEST	52896	21	192.168.2.16	185.151.48.204
May 6, 2024 04:57:37.395749092 CEST	2121	52890	104.165.110.236	192.168.2.16
May 6, 2024 04:57:37.396061897 CEST	52826	2121	192.168.2.16	35.139.146.239
May 6, 2024 04:57:37.396080971 CEST	52825	21	192.168.2.16	35.139.146.239
May 6, 2024 04:57:37.396080971 CEST	52827	21	192.168.2.16	147.135.252.51
May 6, 2024 04:57:37.396090984 CEST	52718	2121	192.168.2.16	36.85.141.215
May 6, 2024 04:57:37.397968054 CEST	2121	52785	110.66.102.25	192.168.2.16
May 6, 2024 04:57:37.412053108 CEST	52727	2121	192.168.2.16	128.201.198.188
May 6, 2024 04:57:37.412064075 CEST	52828	2121	192.168.2.16	147.135.252.51
May 6, 2024 04:57:37.420650959 CEST	21	52876	39.174.153.108	192.168.2.16
May 6, 2024 04:57:37.428073883 CEST	52719	21	192.168.2.16	123.190.186.181
May 6, 2024 04:57:37.428411961 CEST	52830	21	192.168.2.16	23.24.208.142
May 6, 2024 04:57:37.433093071 CEST	21	52887	34.128.145.40	192.168.2.16
May 6, 2024 04:57:37.433146000 CEST	52887	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:37.433211088 CEST	52887	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:37.433367014 CEST	52897	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:37.441188097 CEST	2121	52879	223.242.39.72	192.168.2.16
May 6, 2024 04:57:37.442320108 CEST	21	52888	104.165.110.236	192.168.2.16
May 6, 2024 04:57:37.442416906 CEST	52888	21	192.168.2.16	104.165.110.236
May 6, 2024 04:57:37.442653894 CEST	52898	2121	192.168.2.16	185.151.48.204
May 6, 2024 04:57:37.443998098 CEST	21	52829	154.210.32.21	192.168.2.16
May 6, 2024 04:57:37.444062948 CEST	21	52829	154.210.32.21	192.168.2.16
May 6, 2024 04:57:37.444066048 CEST	52801	2121	192.168.2.16	126.78.179.192
May 6, 2024 04:57:37.444169044 CEST	52829	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:37.445965052 CEST	2121	52889	34.128.145.40	192.168.2.16
May 6, 2024 04:57:37.446016073 CEST	52889	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:37.446072102 CEST	21	52878	223.242.39.72	192.168.2.16
May 6, 2024 04:57:37.446072102 CEST	52889	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:37.446222067 CEST	52899	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:37.452054024 CEST	21	52868	194.181.93.169	192.168.2.16
May 6, 2024 04:57:37.453162909 CEST	52868	21	192.168.2.16	194.181.93.169
May 6, 2024 04:57:37.460067034 CEST	52837	21	192.168.2.16	218.27.113.126
May 6, 2024 04:57:37.472734928 CEST	2121	52676	125.44.207.200	192.168.2.16
May 6, 2024 04:57:37.476057053 CEST	52840	2121	192.168.2.16	218.27.113.126
May 6, 2024 04:57:37.476079941 CEST	52773	2121	192.168.2.16	38.56.42.35
May 6, 2024 04:57:37.476079941 CEST	52772	21	192.168.2.16	38.56.42.35
May 6, 2024 04:57:37.476293087 CEST	52812	21	192.168.2.16	99.254.163.23
May 6, 2024 04:57:37.476294041 CEST	52813	2121	192.168.2.16	99.254.163.23
May 6, 2024 04:57:37.476294041 CEST	52900	21	192.168.2.16	216.117.162.236
May 6, 2024 04:57:37.480916977 CEST	2121	52877	39.174.153.108	192.168.2.16
May 6, 2024 04:57:37.492053986 CEST	52841	21	192.168.2.16	117.85.46.89
May 6, 2024 04:57:37.492274046 CEST	52901	21	192.168.2.16	112.180.75.15
May 6, 2024 04:57:37.508071899 CEST	52855	21	192.168.2.16	208.181.214.78
May 6, 2024 04:57:37.508074999 CEST	52844	2121	192.168.2.16	117.85.46.89
May 6, 2024 04:57:37.509165049 CEST	52831	2121	192.168.2.16	23.24.208.142
May 6, 2024 04:57:37.524071932 CEST	52802	21	192.168.2.16	42.193.108.129
May 6, 2024 04:57:37.535435915 CEST	21	52894	208.72.119.237	192.168.2.16
May 6, 2024 04:57:37.540064096 CEST	52721	21	192.168.2.16	92.93.157.152
May 6, 2024 04:57:37.540082932 CEST	52858	2121	192.168.2.16	208.181.214.78
May 6, 2024 04:57:37.540301085 CEST	52832	21	192.168.2.16	24.28.32.247
May 6, 2024 04:57:37.540304899 CEST	52902	2121	192.168.2.16	112.180.75.15
May 6, 2024 04:57:37.542680979 CEST	21	52887	34.128.145.40	192.168.2.16
May 6, 2024 04:57:37.542917013 CEST	21	52897	34.128.145.40	192.168.2.16
May 6, 2024 04:57:37.542984009 CEST	52897	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:37.543060064 CEST	21	52863	202.168.242.122	192.168.2.16
May 6, 2024 04:57:37.543111086 CEST	52863	21	192.168.2.16	202.168.242.122
May 6, 2024 04:57:37.543178082 CEST	52863	21	192.168.2.16	202.168.242.122
May 6, 2024 04:57:37.543404102 CEST	52903	21	192.168.2.16	202.168.242.122
May 6, 2024 04:57:37.550198078 CEST	2121	52895	208.72.119.237	192.168.2.16
May 6, 2024 04:57:37.551697969 CEST	21	52888	104.165.110.236	192.168.2.16
May 6, 2024 04:57:37.551743031 CEST	52888	21	192.168.2.16	104.165.110.236
May 6, 2024 04:57:37.551959038 CEST	21	52888	104.165.110.236	192.168.2.16
May 6, 2024 04:57:37.551996946 CEST	52888	21	192.168.2.16	104.165.110.236
May 6, 2024 04:57:37.552726984 CEST	21	52839	92.205.10.177	192.168.2.16
May 6, 2024 04:57:37.555072069 CEST	52720	2121	192.168.2.16	123.190.186.181
May 6, 2024 04:57:37.555453062 CEST	52803	2121	192.168.2.16	42.193.108.129
May 6, 2024 04:57:37.555589914 CEST	2121	52889	34.128.145.40	192.168.2.16
May 6, 2024 04:57:37.555788040 CEST	2121	52899	34.128.145.40	192.168.2.16
May 6, 2024 04:57:37.555838108 CEST	52899	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:37.565224886 CEST	21	52792	60.130.34.64	192.168.2.16
May 6, 2024 04:57:37.566934109 CEST	21	52726	128.201.198.188	192.168.2.16
May 6, 2024 04:57:37.574038982 CEST	21	52885	208.106.130.31	192.168.2.16
May 6, 2024 04:57:37.574053049 CEST	21	52885	208.106.130.31	192.168.2.16
May 6, 2024 04:57:37.574091911 CEST	52885	21	192.168.2.16	208.106.130.31
May 6, 2024 04:57:37.574191093 CEST	52885	21	192.168.2.16	208.106.130.31
May 6, 2024 04:57:37.574436903 CEST	52904	21	192.168.2.16	208.106.130.31
May 6, 2024 04:57:37.576057911 CEST	52834	2121	192.168.2.16	24.28.32.247
May 6, 2024 04:57:37.587655067 CEST	2121	52796	60.130.34.64	192.168.2.16
May 6, 2024 04:57:37.587707996 CEST	52905	21	192.168.2.16	171.239.80.64
May 6, 2024 04:57:37.587779999 CEST	21	52867	87.106.26.129	192.168.2.16
May 6, 2024 04:57:37.587805033 CEST	52906	2121	192.168.2.16	171.239.80.64
May 6, 2024 04:57:37.587989092 CEST	21	52867	87.106.26.129	192.168.2.16
May 6, 2024 04:57:37.588150978 CEST	52867	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:37.598830938 CEST	2121	52727	128.201.198.188	192.168.2.16
May 6, 2024 04:57:37.602056026 CEST	52836	21	192.168.2.16	123.232.103.209
May 6, 2024 04:57:37.610609055 CEST	21	52861	149.154.65.23	192.168.2.16
May 6, 2024 04:57:37.610901117 CEST	21	52861	149.154.65.23	192.168.2.16
May 6, 2024 04:57:37.611046076 CEST	52861	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:37.612173080 CEST	21	52862	81.88.252.91	192.168.2.16
May 6, 2024 04:57:37.612262964 CEST	52862	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:37.618055105 CEST	52838	2121	192.168.2.16	123.232.103.209
May 6, 2024 04:57:37.618069887 CEST	52725	2121	192.168.2.16	92.93.157.152
May 6, 2024 04:57:37.618578911 CEST	52907	21	192.168.2.16	141.94.161.97
May 6, 2024 04:57:37.618655920 CEST	52908	2121	192.168.2.16	141.94.161.97
May 6, 2024 04:57:37.634201050 CEST	21	52869	47.98.154.221	192.168.2.16
May 6, 2024 04:57:37.634520054 CEST	52869	21	192.168.2.16	47.98.154.221
May 6, 2024 04:57:37.644973993 CEST	2121	52818	121.148.201.189	192.168.2.16
May 6, 2024 04:57:37.650638103 CEST	21	52817	121.148.201.189	192.168.2.16
May 6, 2024 04:57:37.652730942 CEST	21	52897	34.128.145.40	192.168.2.16
May 6, 2024 04:57:37.652797937 CEST	52897	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:37.652837038 CEST	52897	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:37.653048992 CEST	52909	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:37.654006004 CEST	21	52800	126.78.179.192	192.168.2.16
May 6, 2024 04:57:37.656446934 CEST	2121	52813	99.254.163.23	192.168.2.16
May 6, 2024 04:57:37.656465054 CEST	21	52812	99.254.163.23	192.168.2.16
May 6, 2024 04:57:37.665652990 CEST	2121	52899	34.128.145.40	192.168.2.16
May 6, 2024 04:57:37.665713072 CEST	52899	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:37.665787935 CEST	52899	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:37.665966034 CEST	52910	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:37.666064024 CEST	52728	21	192.168.2.16	68.112.60.119
May 6, 2024 04:57:37.666079044 CEST	52843	21	192.168.2.16	107.4.91.127
May 6, 2024 04:57:37.666093111 CEST	52842	2121	192.168.2.16	107.4.91.127
May 6, 2024 04:57:37.666347980 CEST	52911	21	192.168.2.16	61.105.65.248
May 6, 2024 04:57:37.682056904 CEST	52846	2121	192.168.2.16	47.150.215.103
May 6, 2024 04:57:37.682075977 CEST	52845	21	192.168.2.16	47.150.215.103
May 6, 2024 04:57:37.682157993 CEST	52847	21	192.168.2.16	86.2.56.6
May 6, 2024 04:57:37.682503939 CEST	52912	2121	192.168.2.16	61.105.65.248
May 6, 2024 04:57:37.683784008 CEST	21	52820	101.43.249.26	192.168.2.16
May 6, 2024 04:57:37.683816910 CEST	21	52820	101.43.249.26	192.168.2.16
May 6, 2024 04:57:37.683859110 CEST	52820	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:37.691860914 CEST	21	52892	101.43.249.26	192.168.2.16
May 6, 2024 04:57:37.691921949 CEST	52892	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:37.698051929 CEST	52848	2121	192.168.2.16	86.2.56.6
May 6, 2024 04:57:37.698112011 CEST	21	52868	194.181.93.169	192.168.2.16
May 6, 2024 04:57:37.698679924 CEST	21	52868	194.181.93.169	192.168.2.16
May 6, 2024 04:57:37.698807001 CEST	52868	21	192.168.2.16	194.181.93.169
May 6, 2024 04:57:37.714095116 CEST	52852	2121	192.168.2.16	104.196.244.21
May 6, 2024 04:57:37.714096069 CEST	52850	2121	192.168.2.16	42.59.71.141
May 6, 2024 04:57:37.714200974 CEST	52851	21	192.168.2.16	104.196.244.21
May 6, 2024 04:57:37.716074944 CEST	52849	21	192.168.2.16	42.59.71.141
May 6, 2024 04:57:37.721525908 CEST	2121	52694	113.230.6.20	192.168.2.16
May 6, 2024 04:57:37.721872091 CEST	52913	21	192.168.2.16	221.165.0.14
May 6, 2024 04:57:37.724539042 CEST	21	52772	38.56.42.35	192.168.2.16
May 6, 2024 04:57:37.729250908 CEST	2121	52773	38.56.42.35	192.168.2.16
May 6, 2024 04:57:37.737073898 CEST	21	52819	103.109.6.215	192.168.2.16
May 6, 2024 04:57:37.737200022 CEST	52819	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:37.737361908 CEST	52914	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:37.738514900 CEST	21	52896	185.151.48.204	192.168.2.16
May 6, 2024 04:57:37.738576889 CEST	52896	21	192.168.2.16	185.151.48.204
May 6, 2024 04:57:37.746068954 CEST	52730	2121	192.168.2.16	68.112.60.119
May 6, 2024 04:57:37.750473976 CEST	21	52885	208.106.130.31	192.168.2.16
May 6, 2024 04:57:37.750904083 CEST	21	52904	208.106.130.31	192.168.2.16
May 6, 2024 04:57:37.750967026 CEST	52904	21	192.168.2.16	208.106.130.31
May 6, 2024 04:57:37.751849890 CEST	2121	52801	126.78.179.192	192.168.2.16
May 6, 2024 04:57:37.756247044 CEST	21	52864	182.16.189.156	192.168.2.16
May 6, 2024 04:57:37.756385088 CEST	52864	21	192.168.2.16	182.16.189.156
May 6, 2024 04:57:37.762307882 CEST	21	52909	34.128.145.40	192.168.2.16
May 6, 2024 04:57:37.762367010 CEST	52909	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:37.763226032 CEST	21	52897	34.128.145.40	192.168.2.16
May 6, 2024 04:57:37.766252041 CEST	2121	52865	182.16.189.156	192.168.2.16
May 6, 2024 04:57:37.766608953 CEST	52915	2121	192.168.2.16	182.16.189.156
May 6, 2024 04:57:37.775137901 CEST	2121	52910	34.128.145.40	192.168.2.16
May 6, 2024 04:57:37.775197029 CEST	52910	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:37.775330067 CEST	2121	52899	34.128.145.40	192.168.2.16
May 6, 2024 04:57:37.786984921 CEST	21	52855	208.181.214.78	192.168.2.16
May 6, 2024 04:57:37.787075043 CEST	2121	52858	208.181.214.78	192.168.2.16
May 6, 2024 04:57:37.796538115 CEST	21	52829	154.210.32.21	192.168.2.16
May 6, 2024 04:57:37.796641111 CEST	52829	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:37.796802044 CEST	52916	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:37.797207117 CEST	21	52829	154.210.32.21	192.168.2.16
May 6, 2024 04:57:37.797252893 CEST	52829	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:37.804297924 CEST	21	52837	218.27.113.126	192.168.2.16
May 6, 2024 04:57:37.804964066 CEST	21	52901	112.180.75.15	192.168.2.16
May 6, 2024 04:57:37.809163094 CEST	52859	21	192.168.2.16	61.6.0.143
May 6, 2024 04:57:37.809163094 CEST	52860	2121	192.168.2.16	61.6.0.143
May 6, 2024 04:57:37.816715956 CEST	21	52867	87.106.26.129	192.168.2.16
May 6, 2024 04:57:37.816838026 CEST	52867	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:37.817048073 CEST	52917	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:37.818922043 CEST	2121	52840	218.27.113.126	192.168.2.16
May 6, 2024 04:57:37.825072050 CEST	52735	21	192.168.2.16	217.72.82.85
May 6, 2024 04:57:37.825140953 CEST	52736	2121	192.168.2.16	217.72.82.85
May 6, 2024 04:57:37.834563017 CEST	21	52841	117.85.46.89	192.168.2.16
May 6, 2024 04:57:37.841063023 CEST	52737	21	192.168.2.16	95.246.211.214
May 6, 2024 04:57:37.856141090 CEST	2121	52902	112.180.75.15	192.168.2.16
May 6, 2024 04:57:37.857059002 CEST	52738	2121	192.168.2.16	95.246.211.214
May 6, 2024 04:57:37.857167959 CEST	52804	21	192.168.2.16	190.32.203.69
May 6, 2024 04:57:37.863312960 CEST	21	52802	42.193.108.129	192.168.2.16
May 6, 2024 04:57:37.863962889 CEST	2121	52844	117.85.46.89	192.168.2.16
May 6, 2024 04:57:37.871675968 CEST	21	52909	34.128.145.40	192.168.2.16
May 6, 2024 04:57:37.871733904 CEST	52909	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:37.871788979 CEST	52909	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:37.871941090 CEST	52918	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:37.872071981 CEST	52739	21	192.168.2.16	120.232.156.179
May 6, 2024 04:57:37.879314899 CEST	21	52861	149.154.65.23	192.168.2.16
May 6, 2024 04:57:37.879436016 CEST	52861	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:37.879625082 CEST	52919	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:37.884990931 CEST	2121	52910	34.128.145.40	192.168.2.16
May 6, 2024 04:57:37.885051012 CEST	52910	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:37.885116100 CEST	52910	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:37.885283947 CEST	52920	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:37.888062954 CEST	52805	2121	192.168.2.16	190.32.203.69
May 6, 2024 04:57:37.888062954 CEST	52740	2121	192.168.2.16	120.232.156.179
May 6, 2024 04:57:37.889344931 CEST	21	52862	81.88.252.91	192.168.2.16
May 6, 2024 04:57:37.889357090 CEST	21	52862	81.88.252.91	192.168.2.16
May 6, 2024 04:57:37.889668941 CEST	52921	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:37.903764009 CEST	2121	52803	42.193.108.129	192.168.2.16
May 6, 2024 04:57:37.904166937 CEST	52741	21	192.168.2.16	188.16.78.41
May 6, 2024 04:57:37.904170990 CEST	52890	2121	192.168.2.16	104.165.110.236
May 6, 2024 04:57:37.904172897 CEST	52785	2121	192.168.2.16	110.66.102.25
May 6, 2024 04:57:37.908809900 CEST	21	52863	202.168.242.122	192.168.2.16
May 6, 2024 04:57:37.920077085 CEST	52743	2121	192.168.2.16	188.16.78.41
May 6, 2024 04:57:37.920078039 CEST	52742	21	192.168.2.16	124.46.202.51
May 6, 2024 04:57:37.931149960 CEST	21	52903	202.168.242.122	192.168.2.16
May 6, 2024 04:57:37.931217909 CEST	52903	21	192.168.2.16	202.168.242.122
May 6, 2024 04:57:37.936057091 CEST	52876	21	192.168.2.16	39.174.153.108
May 6, 2024 04:57:37.948942900 CEST	21	52904	208.106.130.31	192.168.2.16
May 6, 2024 04:57:37.948956966 CEST	21	52904	208.106.130.31	192.168.2.16
May 6, 2024 04:57:37.949006081 CEST	52904	21	192.168.2.16	208.106.130.31
May 6, 2024 04:57:37.949074030 CEST	52904	21	192.168.2.16	208.106.130.31
May 6, 2024 04:57:37.949285984 CEST	52922	21	192.168.2.16	208.106.130.31
May 6, 2024 04:57:37.952066898 CEST	52879	2121	192.168.2.16	223.242.39.72
May 6, 2024 04:57:37.952069044 CEST	52878	21	192.168.2.16	223.242.39.72
May 6, 2024 04:57:37.968075037 CEST	52870	21	192.168.2.16	200.185.196.34
May 6, 2024 04:57:37.981458902 CEST	21	52918	34.128.145.40	192.168.2.16
May 6, 2024 04:57:37.981534958 CEST	52918	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:37.981749058 CEST	21	52909	34.128.145.40	192.168.2.16
May 6, 2024 04:57:37.983042955 CEST	21	52868	194.181.93.169	192.168.2.16
May 6, 2024 04:57:37.983057022 CEST	52877	2121	192.168.2.16	39.174.153.108
May 6, 2024 04:57:37.983084917 CEST	52744	2121	192.168.2.16	124.46.202.51
May 6, 2024 04:57:37.993248940 CEST	21	52911	61.105.65.248	192.168.2.16
May 6, 2024 04:57:37.994290113 CEST	2121	52910	34.128.145.40	192.168.2.16
May 6, 2024 04:57:37.994718075 CEST	2121	52920	34.128.145.40	192.168.2.16
May 6, 2024 04:57:37.994785070 CEST	52920	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:37.997637033 CEST	21	52869	47.98.154.221	192.168.2.16
May 6, 2024 04:57:37.997684002 CEST	21	52869	47.98.154.221	192.168.2.16
May 6, 2024 04:57:37.997823954 CEST	52869	21	192.168.2.16	47.98.154.221
May 6, 2024 04:57:37.999048948 CEST	52745	21	192.168.2.16	77.34.191.82
May 6, 2024 04:57:37.999068975 CEST	52871	2121	192.168.2.16	200.185.196.34
May 6, 2024 04:57:38.009205103 CEST	2121	52912	61.105.65.248	192.168.2.16
May 6, 2024 04:57:38.010432959 CEST	21	52804	190.32.203.69	192.168.2.16
May 6, 2024 04:57:38.013521910 CEST	2121	52890	104.165.110.236	192.168.2.16
May 6, 2024 04:57:38.015054941 CEST	52873	21	192.168.2.16	207.161.20.232
May 6, 2024 04:57:38.031341076 CEST	52923	2121	192.168.2.16	221.165.0.14
May 6, 2024 04:57:38.041105032 CEST	21	52892	101.43.249.26	192.168.2.16
May 6, 2024 04:57:38.041271925 CEST	52892	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:38.041908026 CEST	2121	52805	190.32.203.69	192.168.2.16
May 6, 2024 04:57:38.045129061 CEST	21	52917	87.106.26.129	192.168.2.16
May 6, 2024 04:57:38.045185089 CEST	52917	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:38.046957970 CEST	21	52867	87.106.26.129	192.168.2.16
May 6, 2024 04:57:38.047019958 CEST	52867	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:38.047096968 CEST	52875	2121	192.168.2.16	207.161.20.232
May 6, 2024 04:57:38.047214985 CEST	52894	21	192.168.2.16	208.72.119.237
May 6, 2024 04:57:38.063085079 CEST	52895	2121	192.168.2.16	208.72.119.237
May 6, 2024 04:57:38.063451052 CEST	52924	21	192.168.2.16	82.55.44.250
May 6, 2024 04:57:38.079072952 CEST	52792	21	192.168.2.16	60.130.34.64
May 6, 2024 04:57:38.079339981 CEST	52925	2121	192.168.2.16	82.55.44.250
May 6, 2024 04:57:38.092159033 CEST	21	52918	34.128.145.40	192.168.2.16
May 6, 2024 04:57:38.092211962 CEST	52918	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:38.092279911 CEST	52918	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:38.092464924 CEST	52926	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:38.093323946 CEST	21	52819	103.109.6.215	192.168.2.16
May 6, 2024 04:57:38.093383074 CEST	21	52819	103.109.6.215	192.168.2.16
May 6, 2024 04:57:38.093430996 CEST	52819	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:38.095081091 CEST	52750	2121	192.168.2.16	77.34.191.82
May 6, 2024 04:57:38.095096111 CEST	52796	2121	192.168.2.16	60.130.34.64
May 6, 2024 04:57:38.095098972 CEST	52751	21	192.168.2.16	61.253.48.222
May 6, 2024 04:57:38.097486973 CEST	21	52896	185.151.48.204	192.168.2.16
May 6, 2024 04:57:38.097558975 CEST	52896	21	192.168.2.16	185.151.48.204
May 6, 2024 04:57:38.097805023 CEST	52927	21	192.168.2.16	5.58.114.174
May 6, 2024 04:57:38.099513054 CEST	21	52711	45.87.1.166	192.168.2.16
May 6, 2024 04:57:38.099617958 CEST	52711	21	192.168.2.16	45.87.1.166
May 6, 2024 04:57:38.099760056 CEST	52928	21	192.168.2.16	45.87.1.166
May 6, 2024 04:57:38.104461908 CEST	2121	52920	34.128.145.40	192.168.2.16
May 6, 2024 04:57:38.104511023 CEST	52920	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:38.104573965 CEST	52920	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:38.104729891 CEST	52929	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:38.111112118 CEST	52752	2121	192.168.2.16	61.253.48.222
May 6, 2024 04:57:38.111716986 CEST	52930	2121	192.168.2.16	5.58.114.174
May 6, 2024 04:57:38.111777067 CEST	52931	2121	192.168.2.16	216.239.50.93
May 6, 2024 04:57:38.111821890 CEST	52933	2121	192.168.2.16	73.176.95.1
May 6, 2024 04:57:38.111843109 CEST	52932	21	192.168.2.16	216.239.50.93
May 6, 2024 04:57:38.111898899 CEST	52934	21	192.168.2.16	73.176.95.1
May 6, 2024 04:57:38.112306118 CEST	21	52864	182.16.189.156	192.168.2.16
May 6, 2024 04:57:38.116055965 CEST	2121	52915	182.16.189.156	192.168.2.16
May 6, 2024 04:57:38.116137028 CEST	52915	2121	192.168.2.16	182.16.189.156
May 6, 2024 04:57:38.117573023 CEST	21	52914	103.109.6.215	192.168.2.16
May 6, 2024 04:57:38.117650032 CEST	52914	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:38.125374079 CEST	21	52904	208.106.130.31	192.168.2.16
May 6, 2024 04:57:38.127094984 CEST	52880	21	192.168.2.16	94.194.250.167
May 6, 2024 04:57:38.127465010 CEST	21	52922	208.106.130.31	192.168.2.16
May 6, 2024 04:57:38.127523899 CEST	52922	21	192.168.2.16	208.106.130.31
May 6, 2024 04:57:38.127883911 CEST	52935	21	192.168.2.16	201.40.217.61
May 6, 2024 04:57:38.128011942 CEST	52936	2121	192.168.2.16	201.40.217.61
May 6, 2024 04:57:38.128050089 CEST	52937	21	192.168.2.16	27.153.138.27
May 6, 2024 04:57:38.128125906 CEST	52938	2121	192.168.2.16	27.153.138.27
May 6, 2024 04:57:38.128165007 CEST	52939	21	192.168.2.16	73.226.38.197
May 6, 2024 04:57:38.139163971 CEST	21	52829	154.210.32.21	192.168.2.16
May 6, 2024 04:57:38.141079903 CEST	21	52916	154.210.32.21	192.168.2.16
May 6, 2024 04:57:38.141139030 CEST	52916	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:38.141521931 CEST	21	52919	149.154.65.23	192.168.2.16
May 6, 2024 04:57:38.141669989 CEST	52919	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:38.143569946 CEST	52940	2121	192.168.2.16	73.226.38.197
May 6, 2024 04:57:38.143671036 CEST	52941	21	192.168.2.16	154.13.147.58
May 6, 2024 04:57:38.147064924 CEST	21	52861	149.154.65.23	192.168.2.16
May 6, 2024 04:57:38.147119999 CEST	52861	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:38.153804064 CEST	21	52921	81.88.252.91	192.168.2.16
May 6, 2024 04:57:38.153867006 CEST	52921	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:38.159070969 CEST	52813	2121	192.168.2.16	99.254.163.23
May 6, 2024 04:57:38.159070015 CEST	52817	21	192.168.2.16	121.148.201.189
May 6, 2024 04:57:38.159070015 CEST	52800	21	192.168.2.16	126.78.179.192
May 6, 2024 04:57:38.159174919 CEST	52881	2121	192.168.2.16	94.194.250.167
May 6, 2024 04:57:38.159176111 CEST	52882	21	192.168.2.16	108.158.112.58
May 6, 2024 04:57:38.159178019 CEST	52812	21	192.168.2.16	99.254.163.23
May 6, 2024 04:57:38.159185886 CEST	52818	2121	192.168.2.16	121.148.201.189
May 6, 2024 04:57:38.159513950 CEST	52942	2121	192.168.2.16	154.13.147.58
May 6, 2024 04:57:38.159529924 CEST	52943	21	192.168.2.16	20.239.168.93
May 6, 2024 04:57:38.175079107 CEST	52883	2121	192.168.2.16	108.158.112.58
May 6, 2024 04:57:38.175589085 CEST	52946	21	192.168.2.16	199.182.223.194
May 6, 2024 04:57:38.175590038 CEST	52944	2121	192.168.2.16	20.239.168.93
May 6, 2024 04:57:38.175590038 CEST	52945	2121	192.168.2.16	199.182.223.194
May 6, 2024 04:57:38.190092087 CEST	2121	52785	110.66.102.25	192.168.2.16
May 6, 2024 04:57:38.191062927 CEST	52754	2121	192.168.2.16	39.106.171.20
May 6, 2024 04:57:38.191072941 CEST	52756	2121	192.168.2.16	123.248.201.229
May 6, 2024 04:57:38.202008963 CEST	21	52926	34.128.145.40	192.168.2.16
May 6, 2024 04:57:38.202084064 CEST	52926	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:38.202573061 CEST	21	52918	34.128.145.40	192.168.2.16
May 6, 2024 04:57:38.206079006 CEST	52884	21	192.168.2.16	82.59.39.51
May 6, 2024 04:57:38.206088066 CEST	52755	21	192.168.2.16	123.248.201.229
May 6, 2024 04:57:38.214046001 CEST	2121	52920	34.128.145.40	192.168.2.16
May 6, 2024 04:57:38.214401007 CEST	2121	52929	34.128.145.40	192.168.2.16
May 6, 2024 04:57:38.214463949 CEST	52929	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:38.222071886 CEST	52886	2121	192.168.2.16	82.59.39.51
May 6, 2024 04:57:38.222574949 CEST	52947	21	192.168.2.16	24.158.218.44
May 6, 2024 04:57:38.233052015 CEST	21	52894	208.72.119.237	192.168.2.16
May 6, 2024 04:57:38.238050938 CEST	52759	2121	192.168.2.16	85.244.143.189
May 6, 2024 04:57:38.238050938 CEST	52760	2121	192.168.2.16	85.247.153.249
May 6, 2024 04:57:38.238075018 CEST	52772	21	192.168.2.16	38.56.42.35
May 6, 2024 04:57:38.238075018 CEST	52757	21	192.168.2.16	85.247.153.249
May 6, 2024 04:57:38.238075972 CEST	52758	21	192.168.2.16	85.244.143.189
May 6, 2024 04:57:38.238230944 CEST	52773	2121	192.168.2.16	38.56.42.35
May 6, 2024 04:57:38.249058962 CEST	2121	52895	208.72.119.237	192.168.2.16
May 6, 2024 04:57:38.254132032 CEST	52801	2121	192.168.2.16	126.78.179.192
May 6, 2024 04:57:38.270061016 CEST	52764	2121	192.168.2.16	109.133.106.77
May 6, 2024 04:57:38.270068884 CEST	52763	21	192.168.2.16	109.133.106.77
May 6, 2024 04:57:38.270340919 CEST	52948	2121	192.168.2.16	24.158.218.44
May 6, 2024 04:57:38.286072016 CEST	52766	21	192.168.2.16	218.20.198.95
May 6, 2024 04:57:38.287020922 CEST	2121	52879	223.242.39.72	192.168.2.16
May 6, 2024 04:57:38.290055990 CEST	52765	2121	192.168.2.16	218.20.198.95
May 6, 2024 04:57:38.290764093 CEST	52855	21	192.168.2.16	208.181.214.78
May 6, 2024 04:57:38.292243958 CEST	21	52876	39.174.153.108	192.168.2.16
May 6, 2024 04:57:38.293591022 CEST	21	52878	223.242.39.72	192.168.2.16
May 6, 2024 04:57:38.297787905 CEST	21	52917	87.106.26.129	192.168.2.16
May 6, 2024 04:57:38.297967911 CEST	52917	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:38.302066088 CEST	52858	2121	192.168.2.16	208.181.214.78
May 6, 2024 04:57:38.311680079 CEST	21	52926	34.128.145.40	192.168.2.16
May 6, 2024 04:57:38.311736107 CEST	52926	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:38.311793089 CEST	52926	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:38.311950922 CEST	52949	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:38.317058086 CEST	52837	21	192.168.2.16	218.27.113.126
May 6, 2024 04:57:38.317059040 CEST	52901	21	192.168.2.16	112.180.75.15
May 6, 2024 04:57:38.317404985 CEST	52950	21	192.168.2.16	78.134.82.102
May 6, 2024 04:57:38.318545103 CEST	21	52903	202.168.242.122	192.168.2.16
May 6, 2024 04:57:38.318600893 CEST	52903	21	192.168.2.16	202.168.242.122
May 6, 2024 04:57:38.318670034 CEST	52903	21	192.168.2.16	202.168.242.122
May 6, 2024 04:57:38.318902969 CEST	52951	21	192.168.2.16	202.168.242.122
May 6, 2024 04:57:38.321510077 CEST	21	52711	45.87.1.166	192.168.2.16
May 6, 2024 04:57:38.321579933 CEST	52711	21	192.168.2.16	45.87.1.166
May 6, 2024 04:57:38.324130058 CEST	21	52922	208.106.130.31	192.168.2.16
May 6, 2024 04:57:38.324141026 CEST	21	52922	208.106.130.31	192.168.2.16
May 6, 2024 04:57:38.324174881 CEST	2121	52929	34.128.145.40	192.168.2.16
May 6, 2024 04:57:38.324182987 CEST	52922	21	192.168.2.16	208.106.130.31
May 6, 2024 04:57:38.324222088 CEST	52929	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:38.324318886 CEST	52929	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:38.324377060 CEST	52922	21	192.168.2.16	208.106.130.31
May 6, 2024 04:57:38.324445963 CEST	21	52712	193.124.183.222	192.168.2.16
May 6, 2024 04:57:38.324556112 CEST	52712	21	192.168.2.16	193.124.183.222
May 6, 2024 04:57:38.324737072 CEST	52953	21	192.168.2.16	208.106.130.31
May 6, 2024 04:57:38.324738026 CEST	52952	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:38.324805021 CEST	52954	21	192.168.2.16	193.124.183.222
May 6, 2024 04:57:38.325644970 CEST	21	52928	45.87.1.166	192.168.2.16
May 6, 2024 04:57:38.325717926 CEST	52928	21	192.168.2.16	45.87.1.166
May 6, 2024 04:57:38.333060026 CEST	52768	21	192.168.2.16	98.20.176.253
May 6, 2024 04:57:38.333173990 CEST	52840	2121	192.168.2.16	218.27.113.126
May 6, 2024 04:57:38.336075068 CEST	2121	52813	99.254.163.23	192.168.2.16
May 6, 2024 04:57:38.344290018 CEST	21	52812	99.254.163.23	192.168.2.16
May 6, 2024 04:57:38.348054886 CEST	52891	21	192.168.2.16	94.12.248.226
May 6, 2024 04:57:38.348067999 CEST	52841	21	192.168.2.16	117.85.46.89
May 6, 2024 04:57:38.363694906 CEST	21	52941	154.13.147.58	192.168.2.16
May 6, 2024 04:57:38.364053965 CEST	52769	2121	192.168.2.16	98.20.176.253
May 6, 2024 04:57:38.364068031 CEST	52893	2121	192.168.2.16	94.12.248.226
May 6, 2024 04:57:38.364082098 CEST	52802	21	192.168.2.16	42.193.108.129
May 6, 2024 04:57:38.364083052 CEST	52902	2121	192.168.2.16	112.180.75.15
May 6, 2024 04:57:38.367711067 CEST	2121	52877	39.174.153.108	192.168.2.16
May 6, 2024 04:57:38.367978096 CEST	21	52869	47.98.154.221	192.168.2.16
May 6, 2024 04:57:38.368170023 CEST	52869	21	192.168.2.16	47.98.154.221
May 6, 2024 04:57:38.368398905 CEST	52955	21	192.168.2.16	47.98.154.221
May 6, 2024 04:57:38.368499041 CEST	21	52869	47.98.154.221	192.168.2.16
May 6, 2024 04:57:38.368552923 CEST	52869	21	192.168.2.16	47.98.154.221
May 6, 2024 04:57:38.374121904 CEST	21	52792	60.130.34.64	192.168.2.16
May 6, 2024 04:57:38.379076958 CEST	52770	21	192.168.2.16	100.8.10.204
May 6, 2024 04:57:38.379096985 CEST	52844	2121	192.168.2.16	117.85.46.89
May 6, 2024 04:57:38.380381107 CEST	2121	52796	60.130.34.64	192.168.2.16
May 6, 2024 04:57:38.382618904 CEST	2121	52942	154.13.147.58	192.168.2.16
May 6, 2024 04:57:38.390439034 CEST	21	52892	101.43.249.26	192.168.2.16
May 6, 2024 04:57:38.390588999 CEST	52892	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:38.390826941 CEST	52956	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:38.395075083 CEST	52771	2121	192.168.2.16	100.8.10.204
May 6, 2024 04:57:38.406532049 CEST	21	52919	149.154.65.23	192.168.2.16
May 6, 2024 04:57:38.406673908 CEST	52919	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:38.411075115 CEST	52803	2121	192.168.2.16	42.193.108.129
May 6, 2024 04:57:38.421200991 CEST	21	52949	34.128.145.40	192.168.2.16
May 6, 2024 04:57:38.421269894 CEST	52949	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:38.421344995 CEST	21	52926	34.128.145.40	192.168.2.16
May 6, 2024 04:57:38.427056074 CEST	52775	2121	192.168.2.16	174.118.44.203
May 6, 2024 04:57:38.427057981 CEST	52774	21	192.168.2.16	174.118.44.203
May 6, 2024 04:57:38.427074909 CEST	52776	21	192.168.2.16	213.192.93.136
May 6, 2024 04:57:38.427215099 CEST	21	52921	81.88.252.91	192.168.2.16
May 6, 2024 04:57:38.427340031 CEST	52921	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:38.433937073 CEST	2121	52929	34.128.145.40	192.168.2.16
May 6, 2024 04:57:38.434221029 CEST	2121	52952	34.128.145.40	192.168.2.16
May 6, 2024 04:57:38.434277058 CEST	52952	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:38.442058086 CEST	52898	2121	192.168.2.16	185.151.48.204
May 6, 2024 04:57:38.442356110 CEST	52957	2121	192.168.2.16	78.134.82.102
May 6, 2024 04:57:38.449558973 CEST	21	52800	126.78.179.192	192.168.2.16
May 6, 2024 04:57:38.455933094 CEST	21	52896	185.151.48.204	192.168.2.16
May 6, 2024 04:57:38.455993891 CEST	52896	21	192.168.2.16	185.151.48.204
May 6, 2024 04:57:38.456331015 CEST	21	52896	185.151.48.204	192.168.2.16
May 6, 2024 04:57:38.456382990 CEST	52896	21	192.168.2.16	185.151.48.204
May 6, 2024 04:57:38.458077908 CEST	52777	2121	192.168.2.16	213.192.93.136
May 6, 2024 04:57:38.458493948 CEST	52958	21	192.168.2.16	187.169.54.105
May 6, 2024 04:57:38.458501101 CEST	52778	21	192.168.2.16	72.74.189.6
May 6, 2024 04:57:38.474073887 CEST	52779	2121	192.168.2.16	72.74.189.6
May 6, 2024 04:57:38.476113081 CEST	2121	52818	121.148.201.189	192.168.2.16
May 6, 2024 04:57:38.479511023 CEST	21	52817	121.148.201.189	192.168.2.16
May 6, 2024 04:57:38.485197067 CEST	21	52772	38.56.42.35	192.168.2.16
May 6, 2024 04:57:38.487087965 CEST	21	52916	154.210.32.21	192.168.2.16
May 6, 2024 04:57:38.487240076 CEST	52916	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:38.489979029 CEST	2121	52773	38.56.42.35	192.168.2.16
May 6, 2024 04:57:38.490060091 CEST	52900	21	192.168.2.16	216.117.162.236
May 6, 2024 04:57:38.498117924 CEST	21	52914	103.109.6.215	192.168.2.16
May 6, 2024 04:57:38.498238087 CEST	52914	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:38.501167059 CEST	21	52953	208.106.130.31	192.168.2.16
May 6, 2024 04:57:38.501231909 CEST	52953	21	192.168.2.16	208.106.130.31
May 6, 2024 04:57:38.501878023 CEST	21	52922	208.106.130.31	192.168.2.16
May 6, 2024 04:57:38.505057096 CEST	52911	21	192.168.2.16	61.105.65.248
May 6, 2024 04:57:38.521059990 CEST	52912	2121	192.168.2.16	61.105.65.248
May 6, 2024 04:57:38.521060944 CEST	52804	21	192.168.2.16	190.32.203.69
May 6, 2024 04:57:38.521167040 CEST	52890	2121	192.168.2.16	104.165.110.236
May 6, 2024 04:57:38.526125908 CEST	21	52917	87.106.26.129	192.168.2.16
May 6, 2024 04:57:38.526319027 CEST	21	52917	87.106.26.129	192.168.2.16
May 6, 2024 04:57:38.526479006 CEST	52917	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:38.530527115 CEST	21	52949	34.128.145.40	192.168.2.16
May 6, 2024 04:57:38.530580997 CEST	52949	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:38.530648947 CEST	52949	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:38.530833960 CEST	52959	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:38.536060095 CEST	52783	2121	192.168.2.16	27.77.113.5
May 6, 2024 04:57:38.536076069 CEST	52782	21	192.168.2.16	27.77.113.5
May 6, 2024 04:57:38.536078930 CEST	52784	21	192.168.2.16	110.66.102.25
May 6, 2024 04:57:38.537154913 CEST	21	52855	208.181.214.78	192.168.2.16
May 6, 2024 04:57:38.537168026 CEST	2121	52858	208.181.214.78	192.168.2.16
May 6, 2024 04:57:38.544377089 CEST	2121	52952	34.128.145.40	192.168.2.16
May 6, 2024 04:57:38.544549942 CEST	52952	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:38.544549942 CEST	52952	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:38.544711113 CEST	52960	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:38.552057028 CEST	52805	2121	192.168.2.16	190.32.203.69
May 6, 2024 04:57:38.552548885 CEST	52962	21	192.168.2.16	77.183.105.197
May 6, 2024 04:57:38.552551985 CEST	52961	2121	192.168.2.16	187.169.54.105
May 6, 2024 04:57:38.553035021 CEST	21	52928	45.87.1.166	192.168.2.16
May 6, 2024 04:57:38.553164959 CEST	52928	21	192.168.2.16	45.87.1.166
May 6, 2024 04:57:38.562575102 CEST	2121	52801	126.78.179.192	192.168.2.16
May 6, 2024 04:57:38.565850019 CEST	21	52950	78.134.82.102	192.168.2.16
May 6, 2024 04:57:38.584054947 CEST	52787	2121	192.168.2.16	183.236.95.99
May 6, 2024 04:57:38.584076881 CEST	52786	21	192.168.2.16	183.236.95.99
May 6, 2024 04:57:38.597690105 CEST	21	52954	193.124.183.222	192.168.2.16
May 6, 2024 04:57:38.597749949 CEST	52954	21	192.168.2.16	193.124.183.222
May 6, 2024 04:57:38.598009109 CEST	21	52712	193.124.183.222	192.168.2.16
May 6, 2024 04:57:38.598056078 CEST	52712	21	192.168.2.16	193.124.183.222
May 6, 2024 04:57:38.599052906 CEST	52906	2121	192.168.2.16	171.239.80.64
May 6, 2024 04:57:38.599054098 CEST	52905	21	192.168.2.16	171.239.80.64
May 6, 2024 04:57:38.599355936 CEST	52963	2121	192.168.2.16	77.183.105.197
May 6, 2024 04:57:38.615082026 CEST	52788	21	192.168.2.16	187.232.88.226
May 6, 2024 04:57:38.615556955 CEST	52964	21	192.168.2.16	45.38.147.207
May 6, 2024 04:57:38.615608931 CEST	52965	2121	192.168.2.16	45.38.147.207
May 6, 2024 04:57:38.629586935 CEST	21	52901	112.180.75.15	192.168.2.16
May 6, 2024 04:57:38.630366087 CEST	2121	52890	104.165.110.236	192.168.2.16
May 6, 2024 04:57:38.631079912 CEST	52907	21	192.168.2.16	141.94.161.97
May 6, 2024 04:57:38.631099939 CEST	52790	21	192.168.2.16	70.80.186.55
May 6, 2024 04:57:38.631105900 CEST	52789	2121	192.168.2.16	187.232.88.226
May 6, 2024 04:57:38.631160021 CEST	52908	2121	192.168.2.16	141.94.161.97
May 6, 2024 04:57:38.631561995 CEST	52966	21	192.168.2.16	34.83.117.224
May 6, 2024 04:57:38.639806986 CEST	21	52949	34.128.145.40	192.168.2.16
May 6, 2024 04:57:38.640367985 CEST	21	52959	34.128.145.40	192.168.2.16
May 6, 2024 04:57:38.640435934 CEST	52959	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:38.654088020 CEST	2121	52960	34.128.145.40	192.168.2.16
May 6, 2024 04:57:38.654145956 CEST	52960	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:38.654167891 CEST	2121	52952	34.128.145.40	192.168.2.16
May 6, 2024 04:57:38.661297083 CEST	21	52837	218.27.113.126	192.168.2.16
May 6, 2024 04:57:38.668693066 CEST	21	52919	149.154.65.23	192.168.2.16
May 6, 2024 04:57:38.668848991 CEST	21	52919	149.154.65.23	192.168.2.16
May 6, 2024 04:57:38.669066906 CEST	52919	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:38.674364090 CEST	21	52804	190.32.203.69	192.168.2.16
May 6, 2024 04:57:38.676907063 CEST	2121	52840	218.27.113.126	192.168.2.16
May 6, 2024 04:57:38.679084063 CEST	52791	2121	192.168.2.16	70.80.186.55
May 6, 2024 04:57:38.680826902 CEST	2121	52902	112.180.75.15	192.168.2.16
May 6, 2024 04:57:38.690639019 CEST	21	52841	117.85.46.89	192.168.2.16
May 6, 2024 04:57:38.695056915 CEST	21	52955	47.98.154.221	192.168.2.16
May 6, 2024 04:57:38.695079088 CEST	52785	2121	192.168.2.16	110.66.102.25
May 6, 2024 04:57:38.695111990 CEST	52955	21	192.168.2.16	47.98.154.221
May 6, 2024 04:57:38.695761919 CEST	52967	2121	192.168.2.16	34.83.117.224
May 6, 2024 04:57:38.698952913 CEST	21	52953	208.106.130.31	192.168.2.16
May 6, 2024 04:57:38.698964119 CEST	21	52953	208.106.130.31	192.168.2.16
May 6, 2024 04:57:38.699013948 CEST	52953	21	192.168.2.16	208.106.130.31
May 6, 2024 04:57:38.699106932 CEST	52953	21	192.168.2.16	208.106.130.31
May 6, 2024 04:57:38.699314117 CEST	52968	21	192.168.2.16	208.106.130.31
May 6, 2024 04:57:38.703510046 CEST	21	52802	42.193.108.129	192.168.2.16
May 6, 2024 04:57:38.705914021 CEST	2121	52805	190.32.203.69	192.168.2.16
May 6, 2024 04:57:38.705950022 CEST	21	52903	202.168.242.122	192.168.2.16
May 6, 2024 04:57:38.708033085 CEST	21	52951	202.168.242.122	192.168.2.16
May 6, 2024 04:57:38.708095074 CEST	52951	21	192.168.2.16	202.168.242.122
May 6, 2024 04:57:38.711891890 CEST	21	52921	81.88.252.91	192.168.2.16
May 6, 2024 04:57:38.712029934 CEST	52921	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:38.727099895 CEST	52913	21	192.168.2.16	221.165.0.14
May 6, 2024 04:57:38.727572918 CEST	52969	21	192.168.2.16	124.63.104.1
May 6, 2024 04:57:38.731318951 CEST	21	52869	47.98.154.221	192.168.2.16
May 6, 2024 04:57:38.734989882 CEST	2121	52844	117.85.46.89	192.168.2.16
May 6, 2024 04:57:38.737555027 CEST	21	52864	182.16.189.156	192.168.2.16
May 6, 2024 04:57:38.737723112 CEST	2121	52915	182.16.189.156	192.168.2.16
May 6, 2024 04:57:38.737751961 CEST	52864	21	192.168.2.16	182.16.189.156
May 6, 2024 04:57:38.738151073 CEST	52970	2121	192.168.2.16	182.16.189.156
May 6, 2024 04:57:38.738696098 CEST	21	52956	101.43.249.26	192.168.2.16
May 6, 2024 04:57:38.738765001 CEST	52956	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:38.740051985 CEST	21	52892	101.43.249.26	192.168.2.16
May 6, 2024 04:57:38.740062952 CEST	21	52892	101.43.249.26	192.168.2.16
May 6, 2024 04:57:38.740115881 CEST	52892	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:38.743084908 CEST	52894	21	192.168.2.16	208.72.119.237
May 6, 2024 04:57:38.750093937 CEST	21	52959	34.128.145.40	192.168.2.16
May 6, 2024 04:57:38.750178099 CEST	52959	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:38.750222921 CEST	52959	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:38.750372887 CEST	52971	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:38.754978895 CEST	21	52917	87.106.26.129	192.168.2.16
May 6, 2024 04:57:38.755170107 CEST	52917	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:38.755426884 CEST	52972	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:38.759258032 CEST	52895	2121	192.168.2.16	208.72.119.237
May 6, 2024 04:57:38.759288073 CEST	2121	52803	42.193.108.129	192.168.2.16
May 6, 2024 04:57:38.763398886 CEST	2121	52960	34.128.145.40	192.168.2.16
May 6, 2024 04:57:38.763449907 CEST	52960	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:38.763514996 CEST	52960	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:38.763665915 CEST	52973	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:38.775079966 CEST	52799	2121	192.168.2.16	47.234.213.54
May 6, 2024 04:57:38.775084019 CEST	52798	21	192.168.2.16	47.234.213.54
May 6, 2024 04:57:38.776053905 CEST	21	52928	45.87.1.166	192.168.2.16
May 6, 2024 04:57:38.776181936 CEST	21	52928	45.87.1.166	192.168.2.16
May 6, 2024 04:57:38.776294947 CEST	52928	21	192.168.2.16	45.87.1.166
May 6, 2024 04:57:38.784195900 CEST	21	52964	45.38.147.207	192.168.2.16
May 6, 2024 04:57:38.791080952 CEST	52879	2121	192.168.2.16	223.242.39.72
May 6, 2024 04:57:38.807063103 CEST	52876	21	192.168.2.16	39.174.153.108
May 6, 2024 04:57:38.807718039 CEST	52878	21	192.168.2.16	223.242.39.72
May 6, 2024 04:57:38.830168962 CEST	21	52911	61.105.65.248	192.168.2.16
May 6, 2024 04:57:38.831418037 CEST	21	52916	154.210.32.21	192.168.2.16
May 6, 2024 04:57:38.831568003 CEST	21	52916	154.210.32.21	192.168.2.16
May 6, 2024 04:57:38.831687927 CEST	52916	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:38.839083910 CEST	52813	2121	192.168.2.16	99.254.163.23
May 6, 2024 04:57:38.847196102 CEST	2121	52912	61.105.65.248	192.168.2.16
May 6, 2024 04:57:38.855082989 CEST	52812	21	192.168.2.16	99.254.163.23
May 6, 2024 04:57:38.859731913 CEST	21	52959	34.128.145.40	192.168.2.16
May 6, 2024 04:57:38.860032082 CEST	21	52971	34.128.145.40	192.168.2.16
May 6, 2024 04:57:38.860102892 CEST	52971	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:38.871062040 CEST	52941	21	192.168.2.16	154.13.147.58
May 6, 2024 04:57:38.871078968 CEST	52877	2121	192.168.2.16	39.174.153.108
May 6, 2024 04:57:38.872672081 CEST	2121	52960	34.128.145.40	192.168.2.16
May 6, 2024 04:57:38.872831106 CEST	21	52954	193.124.183.222	192.168.2.16
May 6, 2024 04:57:38.872987032 CEST	52954	21	192.168.2.16	193.124.183.222
May 6, 2024 04:57:38.873153925 CEST	2121	52973	34.128.145.40	192.168.2.16
May 6, 2024 04:57:38.873209953 CEST	52973	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:38.875272036 CEST	21	52953	208.106.130.31	192.168.2.16
May 6, 2024 04:57:38.877031088 CEST	21	52968	208.106.130.31	192.168.2.16
May 6, 2024 04:57:38.877090931 CEST	52968	21	192.168.2.16	208.106.130.31
May 6, 2024 04:57:38.878417015 CEST	21	52914	103.109.6.215	192.168.2.16
May 6, 2024 04:57:38.878528118 CEST	52914	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:38.887057066 CEST	52792	21	192.168.2.16	60.130.34.64
May 6, 2024 04:57:38.887082100 CEST	52942	2121	192.168.2.16	154.13.147.58
May 6, 2024 04:57:38.887083054 CEST	52796	2121	192.168.2.16	60.130.34.64
May 6, 2024 04:57:38.887489080 CEST	52974	2121	192.168.2.16	124.63.104.1
May 6, 2024 04:57:38.928885937 CEST	21	52894	208.72.119.237	192.168.2.16
May 6, 2024 04:57:38.932179928 CEST	21	52919	149.154.65.23	192.168.2.16
May 6, 2024 04:57:38.932296038 CEST	52919	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:38.932501078 CEST	52975	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:38.945156097 CEST	2121	52895	208.72.119.237	192.168.2.16
May 6, 2024 04:57:38.951086044 CEST	52800	21	192.168.2.16	126.78.179.192
May 6, 2024 04:57:38.961625099 CEST	21	52854	168.220.94.137	192.168.2.16
May 6, 2024 04:57:38.961802006 CEST	52854	21	192.168.2.16	168.220.94.137
May 6, 2024 04:57:38.964948893 CEST	2121	52853	168.220.94.137	192.168.2.16
May 6, 2024 04:57:38.964996099 CEST	52853	2121	192.168.2.16	168.220.94.137
May 6, 2024 04:57:38.970330000 CEST	21	52971	34.128.145.40	192.168.2.16
May 6, 2024 04:57:38.970383883 CEST	52971	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:38.970429897 CEST	52971	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:38.970577002 CEST	52976	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:38.980961084 CEST	2121	52785	110.66.102.25	192.168.2.16
May 6, 2024 04:57:38.982851028 CEST	2121	52973	34.128.145.40	192.168.2.16
May 6, 2024 04:57:38.982898951 CEST	52973	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:38.982969999 CEST	52973	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:38.983072042 CEST	52817	21	192.168.2.16	121.148.201.189
May 6, 2024 04:57:38.983155012 CEST	52818	2121	192.168.2.16	121.148.201.189
May 6, 2024 04:57:38.983314991 CEST	52977	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:38.983645916 CEST	52978	21	192.168.2.16	108.145.135.55
May 6, 2024 04:57:38.983659029 CEST	52979	2121	192.168.2.16	108.145.135.55
May 6, 2024 04:57:38.983664989 CEST	21	52972	87.106.26.129	192.168.2.16
May 6, 2024 04:57:38.983727932 CEST	52972	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:38.985249996 CEST	21	52917	87.106.26.129	192.168.2.16
May 6, 2024 04:57:38.985292912 CEST	52917	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:38.990946054 CEST	21	52731	66.198.245.58	192.168.2.16
May 6, 2024 04:57:38.991044998 CEST	52731	21	192.168.2.16	66.198.245.58
May 6, 2024 04:57:38.991182089 CEST	52980	21	192.168.2.16	66.198.245.58
May 6, 2024 04:57:38.991842985 CEST	21	52921	81.88.252.91	192.168.2.16
May 6, 2024 04:57:38.991853952 CEST	21	52921	81.88.252.91	192.168.2.16
May 6, 2024 04:57:38.992048025 CEST	52981	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:38.999053001 CEST	52772	21	192.168.2.16	38.56.42.35
May 6, 2024 04:57:38.999078035 CEST	52773	2121	192.168.2.16	38.56.42.35
May 6, 2024 04:57:38.999500990 CEST	52983	2121	192.168.2.16	37.252.127.25
May 6, 2024 04:57:38.999511003 CEST	52982	21	192.168.2.16	188.214.156.147
May 6, 2024 04:57:39.001168013 CEST	52984	21	192.168.2.16	37.252.127.25
May 6, 2024 04:57:39.015533924 CEST	52985	21	192.168.2.16	173.171.113.43
May 6, 2024 04:57:39.018083096 CEST	2121	52813	99.254.163.23	192.168.2.16
May 6, 2024 04:57:39.022420883 CEST	21	52955	47.98.154.221	192.168.2.16
May 6, 2024 04:57:39.022597075 CEST	52955	21	192.168.2.16	47.98.154.221
May 6, 2024 04:57:39.031055927 CEST	52923	2121	192.168.2.16	221.165.0.14
May 6, 2024 04:57:39.031357050 CEST	52986	2121	192.168.2.16	173.171.113.43
May 6, 2024 04:57:39.034157038 CEST	21	52812	99.254.163.23	192.168.2.16
May 6, 2024 04:57:39.040175915 CEST	21	52928	45.87.1.166	192.168.2.16
May 6, 2024 04:57:39.046070099 CEST	52855	21	192.168.2.16	208.181.214.78
May 6, 2024 04:57:39.046233892 CEST	52858	2121	192.168.2.16	208.181.214.78
May 6, 2024 04:57:39.046389103 CEST	52987	21	192.168.2.16	94.12.110.147
May 6, 2024 04:57:39.057688951 CEST	2121	52564	168.220.94.137	192.168.2.16
May 6, 2024 04:57:39.057701111 CEST	21	52565	168.220.94.137	192.168.2.16
May 6, 2024 04:57:39.057737112 CEST	52564	2121	192.168.2.16	168.220.94.137
May 6, 2024 04:57:39.057761908 CEST	52565	21	192.168.2.16	168.220.94.137
May 6, 2024 04:57:39.074716091 CEST	21	52968	208.106.130.31	192.168.2.16
May 6, 2024 04:57:39.074727058 CEST	21	52968	208.106.130.31	192.168.2.16
May 6, 2024 04:57:39.074784040 CEST	52968	21	192.168.2.16	208.106.130.31
May 6, 2024 04:57:39.074871063 CEST	52968	21	192.168.2.16	208.106.130.31
May 6, 2024 04:57:39.075098991 CEST	52988	21	192.168.2.16	208.106.130.31
May 6, 2024 04:57:39.078059912 CEST	52924	21	192.168.2.16	82.55.44.250
May 6, 2024 04:57:39.078062057 CEST	52950	21	192.168.2.16	78.134.82.102
May 6, 2024 04:57:39.079910040 CEST	21	52976	34.128.145.40	192.168.2.16
May 6, 2024 04:57:39.079943895 CEST	52809	21	192.168.2.16	175.170.226.50
May 6, 2024 04:57:39.079946041 CEST	52801	2121	192.168.2.16	126.78.179.192
May 6, 2024 04:57:39.079977036 CEST	52976	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:39.080197096 CEST	21	52971	34.128.145.40	192.168.2.16
May 6, 2024 04:57:39.086817026 CEST	21	52956	101.43.249.26	192.168.2.16
May 6, 2024 04:57:39.086958885 CEST	52956	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:39.091111898 CEST	21	52941	154.13.147.58	192.168.2.16
May 6, 2024 04:57:39.092441082 CEST	2121	52973	34.128.145.40	192.168.2.16
May 6, 2024 04:57:39.092503071 CEST	2121	52977	34.128.145.40	192.168.2.16
May 6, 2024 04:57:39.092561007 CEST	52977	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:39.093713999 CEST	21	52864	182.16.189.156	192.168.2.16
May 6, 2024 04:57:39.094057083 CEST	52925	2121	192.168.2.16	82.55.44.250
May 6, 2024 04:57:39.097012997 CEST	21	52951	202.168.242.122	192.168.2.16
May 6, 2024 04:57:39.097081900 CEST	52951	21	192.168.2.16	202.168.242.122
May 6, 2024 04:57:39.097160101 CEST	52951	21	192.168.2.16	202.168.242.122
May 6, 2024 04:57:39.097378969 CEST	52989	21	192.168.2.16	202.168.242.122
May 6, 2024 04:57:39.105257988 CEST	2121	52970	182.16.189.156	192.168.2.16
May 6, 2024 04:57:39.105329037 CEST	52970	2121	192.168.2.16	182.16.189.156
May 6, 2024 04:57:39.110001087 CEST	2121	52942	154.13.147.58	192.168.2.16
May 6, 2024 04:57:39.110061884 CEST	52810	2121	192.168.2.16	175.170.226.50
May 6, 2024 04:57:39.110100031 CEST	52927	21	192.168.2.16	5.58.114.174
May 6, 2024 04:57:39.110575914 CEST	52990	2121	192.168.2.16	94.12.110.147
May 6, 2024 04:57:39.110622883 CEST	52991	21	192.168.2.16	173.199.181.149
May 6, 2024 04:57:39.122066021 CEST	2121	52879	223.242.39.72	192.168.2.16
May 6, 2024 04:57:39.126071930 CEST	52931	2121	192.168.2.16	216.239.50.93
May 6, 2024 04:57:39.126085043 CEST	52930	2121	192.168.2.16	5.58.114.174
May 6, 2024 04:57:39.126091003 CEST	52932	21	192.168.2.16	216.239.50.93
May 6, 2024 04:57:39.126240969 CEST	52933	2121	192.168.2.16	73.176.95.1
May 6, 2024 04:57:39.126271009 CEST	52934	21	192.168.2.16	73.176.95.1
May 6, 2024 04:57:39.142066002 CEST	52936	2121	192.168.2.16	201.40.217.61
May 6, 2024 04:57:39.142066002 CEST	52939	21	192.168.2.16	73.226.38.197
May 6, 2024 04:57:39.142066956 CEST	52938	2121	192.168.2.16	27.153.138.27
May 6, 2024 04:57:39.142082930 CEST	52935	21	192.168.2.16	201.40.217.61
May 6, 2024 04:57:39.142097950 CEST	52937	21	192.168.2.16	27.153.138.27
May 6, 2024 04:57:39.142101049 CEST	52901	21	192.168.2.16	112.180.75.15
May 6, 2024 04:57:39.142127991 CEST	52890	2121	192.168.2.16	104.165.110.236
May 6, 2024 04:57:39.142647028 CEST	52992	2121	192.168.2.16	173.199.181.149
May 6, 2024 04:57:39.142802954 CEST	21	52878	223.242.39.72	192.168.2.16
May 6, 2024 04:57:39.146159887 CEST	21	52954	193.124.183.222	192.168.2.16
May 6, 2024 04:57:39.146286964 CEST	21	52954	193.124.183.222	192.168.2.16
May 6, 2024 04:57:39.146439075 CEST	52954	21	192.168.2.16	193.124.183.222
May 6, 2024 04:57:39.146639109 CEST	21	52731	66.198.245.58	192.168.2.16
May 6, 2024 04:57:39.146683931 CEST	52731	21	192.168.2.16	66.198.245.58
May 6, 2024 04:57:39.146703959 CEST	21	52980	66.198.245.58	192.168.2.16
May 6, 2024 04:57:39.146763086 CEST	52980	21	192.168.2.16	66.198.245.58
May 6, 2024 04:57:39.147067070 CEST	21	52731	66.198.245.58	192.168.2.16
May 6, 2024 04:57:39.147104979 CEST	52731	21	192.168.2.16	66.198.245.58
May 6, 2024 04:57:39.158078909 CEST	52940	2121	192.168.2.16	73.226.38.197
May 6, 2024 04:57:39.159051895 CEST	52943	21	192.168.2.16	20.239.168.93
May 6, 2024 04:57:39.163366079 CEST	21	52876	39.174.153.108	192.168.2.16
May 6, 2024 04:57:39.172167063 CEST	2121	52796	60.130.34.64	192.168.2.16
May 6, 2024 04:57:39.174055099 CEST	52837	21	192.168.2.16	218.27.113.126
May 6, 2024 04:57:39.177864075 CEST	21	52916	154.210.32.21	192.168.2.16
May 6, 2024 04:57:39.177975893 CEST	52916	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:39.178138971 CEST	52993	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:39.178602934 CEST	21	52916	154.210.32.21	192.168.2.16
May 6, 2024 04:57:39.178644896 CEST	52916	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:39.182146072 CEST	21	52792	60.130.34.64	192.168.2.16
May 6, 2024 04:57:39.187621117 CEST	2121	52974	124.63.104.1	192.168.2.16
May 6, 2024 04:57:39.189632893 CEST	21	52976	34.128.145.40	192.168.2.16
May 6, 2024 04:57:39.189682961 CEST	52976	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:39.189718962 CEST	52976	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:39.189826012 CEST	52994	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:39.190052032 CEST	52946	21	192.168.2.16	199.182.223.194
May 6, 2024 04:57:39.190062046 CEST	52944	2121	192.168.2.16	20.239.168.93
May 6, 2024 04:57:39.190063000 CEST	52840	2121	192.168.2.16	218.27.113.126
May 6, 2024 04:57:39.190077066 CEST	52945	2121	192.168.2.16	199.182.223.194
May 6, 2024 04:57:39.190077066 CEST	52902	2121	192.168.2.16	112.180.75.15
May 6, 2024 04:57:39.190378904 CEST	52995	21	192.168.2.16	119.118.49.175
May 6, 2024 04:57:39.193814039 CEST	21	52919	149.154.65.23	192.168.2.16
May 6, 2024 04:57:39.193867922 CEST	52919	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:39.203005075 CEST	2121	52977	34.128.145.40	192.168.2.16
May 6, 2024 04:57:39.203069925 CEST	52977	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:39.203116894 CEST	52977	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:39.203259945 CEST	52996	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:39.204750061 CEST	21	52975	149.154.65.23	192.168.2.16
May 6, 2024 04:57:39.204813957 CEST	52975	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:39.206079960 CEST	52802	21	192.168.2.16	42.193.108.129
May 6, 2024 04:57:39.206080914 CEST	52841	21	192.168.2.16	117.85.46.89
May 6, 2024 04:57:39.206284046 CEST	52997	2121	192.168.2.16	119.118.49.175
May 6, 2024 04:57:39.222059965 CEST	52947	21	192.168.2.16	24.158.218.44
May 6, 2024 04:57:39.222060919 CEST	52815	21	192.168.2.16	124.64.94.184
May 6, 2024 04:57:39.225873947 CEST	21	52984	37.252.127.25	192.168.2.16
May 6, 2024 04:57:39.225995064 CEST	2121	52983	37.252.127.25	192.168.2.16
May 6, 2024 04:57:39.235457897 CEST	21	52972	87.106.26.129	192.168.2.16
May 6, 2024 04:57:39.235615969 CEST	52972	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:39.238089085 CEST	52844	2121	192.168.2.16	117.85.46.89
May 6, 2024 04:57:39.238584995 CEST	52998	21	192.168.2.16	190.112.14.253
May 6, 2024 04:57:39.238620996 CEST	52999	2121	192.168.2.16	190.112.14.253
May 6, 2024 04:57:39.241449118 CEST	21	52800	126.78.179.192	192.168.2.16
May 6, 2024 04:57:39.246743917 CEST	21	52772	38.56.42.35	192.168.2.16
May 6, 2024 04:57:39.251463890 CEST	2121	52773	38.56.42.35	192.168.2.16
May 6, 2024 04:57:39.251611948 CEST	2121	52890	104.165.110.236	192.168.2.16
May 6, 2024 04:57:39.252140999 CEST	21	52988	208.106.130.31	192.168.2.16
May 6, 2024 04:57:39.252197981 CEST	52988	21	192.168.2.16	208.106.130.31
May 6, 2024 04:57:39.252800941 CEST	21	52968	208.106.130.31	192.168.2.16
May 6, 2024 04:57:39.253060102 CEST	52816	2121	192.168.2.16	124.64.94.184
May 6, 2024 04:57:39.253592014 CEST	53000	21	192.168.2.16	86.122.178.216
May 6, 2024 04:57:39.253626108 CEST	53001	2121	192.168.2.16	86.122.178.216
May 6, 2024 04:57:39.255827904 CEST	2121	52877	39.174.153.108	192.168.2.16
May 6, 2024 04:57:39.260113955 CEST	21	52914	103.109.6.215	192.168.2.16
May 6, 2024 04:57:39.260234118 CEST	52914	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:39.260390043 CEST	53002	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:39.262521982 CEST	21	52981	81.88.252.91	192.168.2.16
May 6, 2024 04:57:39.262586117 CEST	52981	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:39.264750957 CEST	21	52991	173.199.181.149	192.168.2.16
May 6, 2024 04:57:39.264805079 CEST	52991	21	192.168.2.16	173.199.181.149
May 6, 2024 04:57:39.269244909 CEST	52803	2121	192.168.2.16	42.193.108.129
May 6, 2024 04:57:39.269617081 CEST	53003	21	192.168.2.16	173.190.98.65
May 6, 2024 04:57:39.269757986 CEST	53004	2121	192.168.2.16	173.190.98.65
May 6, 2024 04:57:39.285062075 CEST	52948	2121	192.168.2.16	24.158.218.44
May 6, 2024 04:57:39.285069942 CEST	52964	21	192.168.2.16	45.38.147.207
May 6, 2024 04:57:39.287894011 CEST	2121	52818	121.148.201.189	192.168.2.16
May 6, 2024 04:57:39.291038990 CEST	21	52817	121.148.201.189	192.168.2.16
May 6, 2024 04:57:39.299093962 CEST	21	52976	34.128.145.40	192.168.2.16
May 6, 2024 04:57:39.299426079 CEST	21	52994	34.128.145.40	192.168.2.16
May 6, 2024 04:57:39.299501896 CEST	52994	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:39.303344011 CEST	21	52980	66.198.245.58	192.168.2.16
May 6, 2024 04:57:39.303500891 CEST	52980	21	192.168.2.16	66.198.245.58
May 6, 2024 04:57:39.312292099 CEST	2121	52977	34.128.145.40	192.168.2.16
May 6, 2024 04:57:39.312879086 CEST	2121	52996	34.128.145.40	192.168.2.16
May 6, 2024 04:57:39.312937021 CEST	52996	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:39.317183018 CEST	21	52855	208.181.214.78	192.168.2.16
May 6, 2024 04:57:39.317212105 CEST	2121	52858	208.181.214.78	192.168.2.16
May 6, 2024 04:57:39.325757027 CEST	21	52950	78.134.82.102	192.168.2.16
May 6, 2024 04:57:39.333056927 CEST	52911	21	192.168.2.16	61.105.65.248
May 6, 2024 04:57:39.348076105 CEST	52821	21	192.168.2.16	47.204.129.166
May 6, 2024 04:57:39.348094940 CEST	52912	2121	192.168.2.16	61.105.65.248
May 6, 2024 04:57:39.348308086 CEST	53005	21	192.168.2.16	93.223.129.127
May 6, 2024 04:57:39.350197077 CEST	21	52955	47.98.154.221	192.168.2.16
May 6, 2024 04:57:39.350208044 CEST	21	52955	47.98.154.221	192.168.2.16
May 6, 2024 04:57:39.350363016 CEST	52955	21	192.168.2.16	47.98.154.221
May 6, 2024 04:57:39.363543034 CEST	53006	21	192.168.2.16	99.246.108.168
May 6, 2024 04:57:39.363739967 CEST	53007	2121	192.168.2.16	93.223.129.127
May 6, 2024 04:57:39.378340006 CEST	53008	2121	192.168.2.16	99.246.108.168
May 6, 2024 04:57:39.387201071 CEST	2121	52801	126.78.179.192	192.168.2.16
May 6, 2024 04:57:39.387500048 CEST	53009	21	192.168.2.16	98.208.231.181
May 6, 2024 04:57:39.389769077 CEST	21	52690	109.205.180.149	192.168.2.16
May 6, 2024 04:57:39.389910936 CEST	52690	21	192.168.2.16	109.205.180.149
May 6, 2024 04:57:39.390075922 CEST	53010	21	192.168.2.16	109.205.180.149
May 6, 2024 04:57:39.394098997 CEST	52824	2121	192.168.2.16	47.204.129.166
May 6, 2024 04:57:39.410078049 CEST	52826	2121	192.168.2.16	35.139.146.239
May 6, 2024 04:57:39.410095930 CEST	52825	21	192.168.2.16	35.139.146.239
May 6, 2024 04:57:39.410095930 CEST	52827	21	192.168.2.16	147.135.252.51
May 6, 2024 04:57:39.410558939 CEST	21	52994	34.128.145.40	192.168.2.16
May 6, 2024 04:57:39.410629988 CEST	52994	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:39.410736084 CEST	52994	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:39.410787106 CEST	53011	2121	192.168.2.16	98.208.231.181
May 6, 2024 04:57:39.411037922 CEST	53012	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:39.420254946 CEST	21	52991	173.199.181.149	192.168.2.16
May 6, 2024 04:57:39.420367002 CEST	52991	21	192.168.2.16	173.199.181.149
May 6, 2024 04:57:39.420588017 CEST	53013	21	192.168.2.16	120.27.149.253
May 6, 2024 04:57:39.422641039 CEST	2121	52996	34.128.145.40	192.168.2.16
May 6, 2024 04:57:39.422691107 CEST	52996	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:39.422766924 CEST	52996	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:39.422933102 CEST	53014	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:39.425065994 CEST	52828	2121	192.168.2.16	147.135.252.51
May 6, 2024 04:57:39.437055111 CEST	21	52956	101.43.249.26	192.168.2.16
May 6, 2024 04:57:39.437180996 CEST	52956	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:39.437377930 CEST	53015	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:39.441052914 CEST	52894	21	192.168.2.16	208.72.119.237
May 6, 2024 04:57:39.441086054 CEST	52830	21	192.168.2.16	23.24.208.142
May 6, 2024 04:57:39.449209929 CEST	21	52988	208.106.130.31	192.168.2.16
May 6, 2024 04:57:39.449220896 CEST	21	52988	208.106.130.31	192.168.2.16
May 6, 2024 04:57:39.449280977 CEST	52988	21	192.168.2.16	208.106.130.31
May 6, 2024 04:57:39.449402094 CEST	52988	21	192.168.2.16	208.106.130.31
May 6, 2024 04:57:39.449665070 CEST	53016	21	192.168.2.16	208.106.130.31
May 6, 2024 04:57:39.455041885 CEST	21	52964	45.38.147.207	192.168.2.16
May 6, 2024 04:57:39.455987930 CEST	21	52901	112.180.75.15	192.168.2.16
May 6, 2024 04:57:39.457057953 CEST	52957	2121	192.168.2.16	78.134.82.102
May 6, 2024 04:57:39.457082987 CEST	52895	2121	192.168.2.16	208.72.119.237
May 6, 2024 04:57:39.459606886 CEST	21	52980	66.198.245.58	192.168.2.16
May 6, 2024 04:57:39.459618092 CEST	21	52980	66.198.245.58	192.168.2.16
May 6, 2024 04:57:39.459755898 CEST	52980	21	192.168.2.16	66.198.245.58
May 6, 2024 04:57:39.460376978 CEST	21	52954	193.124.183.222	192.168.2.16
May 6, 2024 04:57:39.464510918 CEST	21	52972	87.106.26.129	192.168.2.16
May 6, 2024 04:57:39.464821100 CEST	21	52972	87.106.26.129	192.168.2.16
May 6, 2024 04:57:39.464924097 CEST	52972	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:39.466445923 CEST	21	52989	202.168.242.122	192.168.2.16
May 6, 2024 04:57:39.466509104 CEST	52989	21	192.168.2.16	202.168.242.122
May 6, 2024 04:57:39.473062038 CEST	52958	21	192.168.2.16	187.169.54.105
May 6, 2024 04:57:39.480591059 CEST	21	52975	149.154.65.23	192.168.2.16
May 6, 2024 04:57:39.480725050 CEST	52975	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:39.486417055 CEST	21	52951	202.168.242.122	192.168.2.16
May 6, 2024 04:57:39.506668091 CEST	2121	52902	112.180.75.15	192.168.2.16
May 6, 2024 04:57:39.519686937 CEST	21	52837	218.27.113.126	192.168.2.16
May 6, 2024 04:57:39.521085024 CEST	52831	2121	192.168.2.16	23.24.208.142
May 6, 2024 04:57:39.521111012 CEST	21	52994	34.128.145.40	192.168.2.16
May 6, 2024 04:57:39.521475077 CEST	21	53012	34.128.145.40	192.168.2.16
May 6, 2024 04:57:39.521543980 CEST	53012	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:39.522825956 CEST	21	52916	154.210.32.21	192.168.2.16
May 6, 2024 04:57:39.524663925 CEST	2121	53001	86.122.178.216	192.168.2.16
May 6, 2024 04:57:39.531347036 CEST	21	52993	154.210.32.21	192.168.2.16
May 6, 2024 04:57:39.531400919 CEST	52993	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:39.532779932 CEST	2121	53014	34.128.145.40	192.168.2.16
May 6, 2024 04:57:39.532919884 CEST	53014	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:39.532941103 CEST	2121	52996	34.128.145.40	192.168.2.16
May 6, 2024 04:57:39.533324003 CEST	2121	52840	218.27.113.126	192.168.2.16
May 6, 2024 04:57:39.536463022 CEST	53017	2121	192.168.2.16	120.27.149.253
May 6, 2024 04:57:39.536580086 CEST	53018	21	192.168.2.16	180.249.197.252
May 6, 2024 04:57:39.538525105 CEST	21	52981	81.88.252.91	192.168.2.16
May 6, 2024 04:57:39.538651943 CEST	52981	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:39.545375109 CEST	21	52802	42.193.108.129	192.168.2.16
May 6, 2024 04:57:39.545790911 CEST	53019	2121	192.168.2.16	180.249.197.252
May 6, 2024 04:57:39.546876907 CEST	2121	52997	119.118.49.175	192.168.2.16
May 6, 2024 04:57:39.549065113 CEST	21	52841	117.85.46.89	192.168.2.16
May 6, 2024 04:57:39.551086903 CEST	52832	21	192.168.2.16	24.28.32.247
May 6, 2024 04:57:39.567166090 CEST	52962	21	192.168.2.16	77.183.105.197
May 6, 2024 04:57:39.567167044 CEST	52961	2121	192.168.2.16	187.169.54.105
May 6, 2024 04:57:39.574511051 CEST	21	52991	173.199.181.149	192.168.2.16
May 6, 2024 04:57:39.574588060 CEST	52991	21	192.168.2.16	173.199.181.149
May 6, 2024 04:57:39.575093031 CEST	21	52991	173.199.181.149	192.168.2.16
May 6, 2024 04:57:39.575140953 CEST	52991	21	192.168.2.16	173.199.181.149
May 6, 2024 04:57:39.583061934 CEST	52834	2121	192.168.2.16	24.28.32.247
May 6, 2024 04:57:39.587029934 CEST	21	52995	119.118.49.175	192.168.2.16
May 6, 2024 04:57:39.595031023 CEST	2121	52844	117.85.46.89	192.168.2.16
May 6, 2024 04:57:39.597932100 CEST	21	53005	93.223.129.127	192.168.2.16
May 6, 2024 04:57:39.597987890 CEST	53005	21	192.168.2.16	93.223.129.127
May 6, 2024 04:57:39.599055052 CEST	52941	21	192.168.2.16	154.13.147.58
May 6, 2024 04:57:39.599368095 CEST	53020	21	192.168.2.16	119.116.143.203
May 6, 2024 04:57:39.614087105 CEST	52963	2121	192.168.2.16	77.183.105.197
May 6, 2024 04:57:39.614089966 CEST	52836	21	192.168.2.16	123.232.103.209
May 6, 2024 04:57:39.614092112 CEST	52942	2121	192.168.2.16	154.13.147.58
May 6, 2024 04:57:39.618706942 CEST	21	53002	103.109.6.215	192.168.2.16
May 6, 2024 04:57:39.618777037 CEST	53002	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:39.619704008 CEST	2121	52803	42.193.108.129	192.168.2.16
May 6, 2024 04:57:39.622929096 CEST	21	52690	109.205.180.149	192.168.2.16
May 6, 2024 04:57:39.622978926 CEST	52690	21	192.168.2.16	109.205.180.149
May 6, 2024 04:57:39.623704910 CEST	21	52690	109.205.180.149	192.168.2.16
May 6, 2024 04:57:39.623750925 CEST	52690	21	192.168.2.16	109.205.180.149
May 6, 2024 04:57:39.624051094 CEST	21	53010	109.205.180.149	192.168.2.16
May 6, 2024 04:57:39.624109030 CEST	53010	21	192.168.2.16	109.205.180.149
May 6, 2024 04:57:39.625751972 CEST	21	52988	208.106.130.31	192.168.2.16
May 6, 2024 04:57:39.627008915 CEST	21	52894	208.72.119.237	192.168.2.16
May 6, 2024 04:57:39.627109051 CEST	21	53016	208.106.130.31	192.168.2.16
May 6, 2024 04:57:39.627162933 CEST	53016	21	192.168.2.16	208.106.130.31
May 6, 2024 04:57:39.630068064 CEST	52965	2121	192.168.2.16	45.38.147.207
May 6, 2024 04:57:39.630085945 CEST	52838	2121	192.168.2.16	123.232.103.209
May 6, 2024 04:57:39.630090952 CEST	52879	2121	192.168.2.16	223.242.39.72
May 6, 2024 04:57:39.630333900 CEST	53021	2121	192.168.2.16	119.116.143.203
May 6, 2024 04:57:39.632173061 CEST	21	53012	34.128.145.40	192.168.2.16
May 6, 2024 04:57:39.632220984 CEST	53012	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:39.632287025 CEST	53012	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:39.632457018 CEST	53022	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:39.640388966 CEST	21	52914	103.109.6.215	192.168.2.16
May 6, 2024 04:57:39.640438080 CEST	21	52914	103.109.6.215	192.168.2.16
May 6, 2024 04:57:39.640484095 CEST	52914	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:39.642868042 CEST	2121	52895	208.72.119.237	192.168.2.16
May 6, 2024 04:57:39.644602060 CEST	2121	53014	34.128.145.40	192.168.2.16
May 6, 2024 04:57:39.644649982 CEST	53014	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:39.644732952 CEST	53014	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:39.644942045 CEST	53023	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:39.645932913 CEST	52966	21	192.168.2.16	34.83.117.224
May 6, 2024 04:57:39.646189928 CEST	52878	21	192.168.2.16	223.242.39.72
May 6, 2024 04:57:39.646461964 CEST	53024	21	192.168.2.16	187.247.144.164
May 6, 2024 04:57:39.654895067 CEST	21	52980	66.198.245.58	192.168.2.16
May 6, 2024 04:57:39.659228086 CEST	21	52911	61.105.65.248	192.168.2.16
May 6, 2024 04:57:39.674191952 CEST	2121	52912	61.105.65.248	192.168.2.16
May 6, 2024 04:57:39.678056002 CEST	52876	21	192.168.2.16	39.174.153.108
May 6, 2024 04:57:39.678076982 CEST	52843	21	192.168.2.16	107.4.91.127
May 6, 2024 04:57:39.678078890 CEST	52842	2121	192.168.2.16	107.4.91.127
May 6, 2024 04:57:39.679980040 CEST	21	52955	47.98.154.221	192.168.2.16
May 6, 2024 04:57:39.680118084 CEST	52955	21	192.168.2.16	47.98.154.221
May 6, 2024 04:57:39.680304050 CEST	21	52955	47.98.154.221	192.168.2.16
May 6, 2024 04:57:39.680335999 CEST	53025	21	192.168.2.16	47.98.154.221
May 6, 2024 04:57:39.680360079 CEST	52955	21	192.168.2.16	47.98.154.221
May 6, 2024 04:57:39.693445921 CEST	21	52972	87.106.26.129	192.168.2.16
May 6, 2024 04:57:39.693612099 CEST	52972	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:39.693821907 CEST	53026	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:39.694057941 CEST	52845	21	192.168.2.16	47.150.215.103
May 6, 2024 04:57:39.694057941 CEST	52846	2121	192.168.2.16	47.150.215.103
May 6, 2024 04:57:39.694149017 CEST	52974	2121	192.168.2.16	124.63.104.1
May 6, 2024 04:57:39.694152117 CEST	52847	21	192.168.2.16	86.2.56.6
May 6, 2024 04:57:39.698218107 CEST	21	52868	194.181.93.169	192.168.2.16
May 6, 2024 04:57:39.698347092 CEST	52868	21	192.168.2.16	194.181.93.169
May 6, 2024 04:57:39.698565960 CEST	53027	21	192.168.2.16	194.181.93.169
May 6, 2024 04:57:39.710093021 CEST	52848	2121	192.168.2.16	86.2.56.6
May 6, 2024 04:57:39.710093021 CEST	52967	2121	192.168.2.16	34.83.117.224
May 6, 2024 04:57:39.726061106 CEST	52850	2121	192.168.2.16	42.59.71.141
May 6, 2024 04:57:39.726069927 CEST	52983	2121	192.168.2.16	37.252.127.25
May 6, 2024 04:57:39.726079941 CEST	52851	21	192.168.2.16	104.196.244.21
May 6, 2024 04:57:39.727057934 CEST	52852	2121	192.168.2.16	104.196.244.21
May 6, 2024 04:57:39.727061033 CEST	52849	21	192.168.2.16	42.59.71.141
May 6, 2024 04:57:39.728394985 CEST	52984	21	192.168.2.16	37.252.127.25
May 6, 2024 04:57:39.741847992 CEST	21	53012	34.128.145.40	192.168.2.16
May 6, 2024 04:57:39.741982937 CEST	21	53022	34.128.145.40	192.168.2.16
May 6, 2024 04:57:39.742063999 CEST	53022	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:39.742105007 CEST	52969	21	192.168.2.16	124.63.104.1
May 6, 2024 04:57:39.742460966 CEST	53028	2121	192.168.2.16	187.247.144.164
May 6, 2024 04:57:39.744622946 CEST	2121	52970	182.16.189.156	192.168.2.16
May 6, 2024 04:57:39.745755911 CEST	53029	2121	192.168.2.16	182.16.189.156
May 6, 2024 04:57:39.752649069 CEST	21	52975	149.154.65.23	192.168.2.16
May 6, 2024 04:57:39.752912045 CEST	21	52975	149.154.65.23	192.168.2.16
May 6, 2024 04:57:39.753155947 CEST	52975	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:39.754324913 CEST	2121	53014	34.128.145.40	192.168.2.16
May 6, 2024 04:57:39.754643917 CEST	2121	53023	34.128.145.40	192.168.2.16
May 6, 2024 04:57:39.754705906 CEST	53023	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:39.759057045 CEST	52890	2121	192.168.2.16	104.165.110.236
May 6, 2024 04:57:39.759073973 CEST	52877	2121	192.168.2.16	39.174.153.108
May 6, 2024 04:57:39.785144091 CEST	21	52956	101.43.249.26	192.168.2.16
May 6, 2024 04:57:39.785155058 CEST	21	52956	101.43.249.26	192.168.2.16
May 6, 2024 04:57:39.785212040 CEST	52956	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:39.785793066 CEST	21	53015	101.43.249.26	192.168.2.16
May 6, 2024 04:57:39.785851955 CEST	53015	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:39.790079117 CEST	52818	2121	192.168.2.16	121.148.201.189
May 6, 2024 04:57:39.806057930 CEST	52817	21	192.168.2.16	121.148.201.189
May 6, 2024 04:57:39.820003986 CEST	21	52981	81.88.252.91	192.168.2.16
May 6, 2024 04:57:39.820136070 CEST	52981	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:39.821616888 CEST	21	52941	154.13.147.58	192.168.2.16
May 6, 2024 04:57:39.822057009 CEST	52859	21	192.168.2.16	61.6.0.143
May 6, 2024 04:57:39.822072029 CEST	52860	2121	192.168.2.16	61.6.0.143
May 6, 2024 04:57:39.822082996 CEST	52855	21	192.168.2.16	208.181.214.78
May 6, 2024 04:57:39.822082996 CEST	52858	2121	192.168.2.16	208.181.214.78
May 6, 2024 04:57:39.822607040 CEST	53030	2121	192.168.2.16	76.155.219.53
May 6, 2024 04:57:39.822648048 CEST	53031	21	192.168.2.16	76.155.219.53
May 6, 2024 04:57:39.823796034 CEST	21	53016	208.106.130.31	192.168.2.16
May 6, 2024 04:57:39.823808908 CEST	21	53016	208.106.130.31	192.168.2.16
May 6, 2024 04:57:39.823860884 CEST	53016	21	192.168.2.16	208.106.130.31
May 6, 2024 04:57:39.823955059 CEST	53016	21	192.168.2.16	208.106.130.31
May 6, 2024 04:57:39.824203968 CEST	53032	21	192.168.2.16	208.106.130.31
May 6, 2024 04:57:39.834903002 CEST	21	52989	202.168.242.122	192.168.2.16
May 6, 2024 04:57:39.834955931 CEST	52989	21	192.168.2.16	202.168.242.122
May 6, 2024 04:57:39.835021973 CEST	52989	21	192.168.2.16	202.168.242.122
May 6, 2024 04:57:39.835212946 CEST	53033	21	192.168.2.16	202.168.242.122
May 6, 2024 04:57:39.837937117 CEST	2121	52942	154.13.147.58	192.168.2.16
May 6, 2024 04:57:39.838056087 CEST	52950	21	192.168.2.16	78.134.82.102
May 6, 2024 04:57:39.838296890 CEST	53034	21	192.168.2.16	212.239.223.10
May 6, 2024 04:57:39.853672028 CEST	21	53022	34.128.145.40	192.168.2.16
May 6, 2024 04:57:39.853729010 CEST	53022	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:39.853768110 CEST	53022	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:39.853880882 CEST	53035	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:39.854307890 CEST	53036	2121	192.168.2.16	212.239.223.10
May 6, 2024 04:57:39.858460903 CEST	21	53010	109.205.180.149	192.168.2.16
May 6, 2024 04:57:39.858599901 CEST	53010	21	192.168.2.16	109.205.180.149
May 6, 2024 04:57:39.864753008 CEST	2121	53023	34.128.145.40	192.168.2.16
May 6, 2024 04:57:39.864804983 CEST	53023	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:39.864871979 CEST	53023	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:39.865051985 CEST	53037	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:39.868300915 CEST	2121	52890	104.165.110.236	192.168.2.16
May 6, 2024 04:57:39.870413065 CEST	53038	21	192.168.2.16	74.131.225.252
May 6, 2024 04:57:39.884844065 CEST	21	52993	154.210.32.21	192.168.2.16
May 6, 2024 04:57:39.884978056 CEST	52993	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:39.886889935 CEST	53039	2121	192.168.2.16	74.131.225.252
May 6, 2024 04:57:39.886985064 CEST	53040	21	192.168.2.16	126.117.149.148
May 6, 2024 04:57:39.887048960 CEST	53041	2121	192.168.2.16	126.117.149.148
May 6, 2024 04:57:39.918487072 CEST	53042	21	192.168.2.16	91.18.33.249
May 6, 2024 04:57:39.918488026 CEST	53043	2121	192.168.2.16	91.18.33.249
May 6, 2024 04:57:39.922635078 CEST	21	53026	87.106.26.129	192.168.2.16
May 6, 2024 04:57:39.922702074 CEST	53026	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:39.924616098 CEST	21	52972	87.106.26.129	192.168.2.16
May 6, 2024 04:57:39.924665928 CEST	52972	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:39.943281889 CEST	21	52868	194.181.93.169	192.168.2.16
May 6, 2024 04:57:39.943470001 CEST	52868	21	192.168.2.16	194.181.93.169
May 6, 2024 04:57:39.943566084 CEST	21	53027	194.181.93.169	192.168.2.16
May 6, 2024 04:57:39.943625927 CEST	53027	21	192.168.2.16	194.181.93.169
May 6, 2024 04:57:39.946618080 CEST	21	52565	168.220.94.137	192.168.2.16
May 6, 2024 04:57:39.946665049 CEST	52565	21	192.168.2.16	168.220.94.137
May 6, 2024 04:57:39.952069044 CEST	2121	52879	223.242.39.72	192.168.2.16
May 6, 2024 04:57:39.953535080 CEST	2121	52983	37.252.127.25	192.168.2.16
May 6, 2024 04:57:39.953546047 CEST	21	52984	37.252.127.25	192.168.2.16
May 6, 2024 04:57:39.963268042 CEST	21	53022	34.128.145.40	192.168.2.16
May 6, 2024 04:57:39.963413954 CEST	21	53035	34.128.145.40	192.168.2.16
May 6, 2024 04:57:39.963470936 CEST	53035	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:39.966061115 CEST	52964	21	192.168.2.16	45.38.147.207
May 6, 2024 04:57:39.966635942 CEST	52901	21	192.168.2.16	112.180.75.15
May 6, 2024 04:57:39.974443913 CEST	2121	53023	34.128.145.40	192.168.2.16
May 6, 2024 04:57:39.974608898 CEST	2121	53037	34.128.145.40	192.168.2.16
May 6, 2024 04:57:39.974658966 CEST	53037	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:39.975195885 CEST	21	52878	223.242.39.72	192.168.2.16
May 6, 2024 04:57:39.975994110 CEST	21	53002	103.109.6.215	192.168.2.16
May 6, 2024 04:57:39.976118088 CEST	53002	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:39.976449966 CEST	21	53005	93.223.129.127	192.168.2.16
May 6, 2024 04:57:39.976533890 CEST	53005	21	192.168.2.16	93.223.129.127
May 6, 2024 04:57:39.976720095 CEST	53044	21	192.168.2.16	79.150.30.103
May 6, 2024 04:57:39.982079983 CEST	52870	21	192.168.2.16	200.185.196.34
May 6, 2024 04:57:39.982392073 CEST	53045	2121	192.168.2.16	79.150.30.103
May 6, 2024 04:57:39.994117975 CEST	2121	52974	124.63.104.1	192.168.2.16
May 6, 2024 04:57:39.998061895 CEST	52979	2121	192.168.2.16	108.145.135.55
May 6, 2024 04:57:39.998063087 CEST	52978	21	192.168.2.16	108.145.135.55
May 6, 2024 04:57:39.998480082 CEST	53046	21	192.168.2.16	123.233.204.6
May 6, 2024 04:57:40.001130104 CEST	21	53016	208.106.130.31	192.168.2.16
May 6, 2024 04:57:40.001826048 CEST	21	53032	208.106.130.31	192.168.2.16
May 6, 2024 04:57:40.001884937 CEST	53032	21	192.168.2.16	208.106.130.31
May 6, 2024 04:57:40.013567924 CEST	21	52955	47.98.154.221	192.168.2.16
May 6, 2024 04:57:40.014149904 CEST	52902	2121	192.168.2.16	112.180.75.15
May 6, 2024 04:57:40.014152050 CEST	52871	2121	192.168.2.16	200.185.196.34
May 6, 2024 04:57:40.014152050 CEST	52982	21	192.168.2.16	188.214.156.147
May 6, 2024 04:57:40.014878035 CEST	21	53025	47.98.154.221	192.168.2.16
May 6, 2024 04:57:40.014935970 CEST	53025	21	192.168.2.16	47.98.154.221
May 6, 2024 04:57:40.025863886 CEST	21	52975	149.154.65.23	192.168.2.16
May 6, 2024 04:57:40.026077986 CEST	52975	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:40.026179075 CEST	53047	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:40.030060053 CEST	52985	21	192.168.2.16	173.171.113.43
May 6, 2024 04:57:40.030061960 CEST	52873	21	192.168.2.16	207.161.20.232
May 6, 2024 04:57:40.030116081 CEST	52837	21	192.168.2.16	218.27.113.126
May 6, 2024 04:57:40.030116081 CEST	53001	2121	192.168.2.16	86.122.178.216
May 6, 2024 04:57:40.033453941 CEST	21	52876	39.174.153.108	192.168.2.16
May 6, 2024 04:57:40.037009001 CEST	21	52855	208.181.214.78	192.168.2.16
May 6, 2024 04:57:40.046058893 CEST	52986	2121	192.168.2.16	173.171.113.43
May 6, 2024 04:57:40.046058893 CEST	52840	2121	192.168.2.16	218.27.113.126
May 6, 2024 04:57:40.046178102 CEST	52987	21	192.168.2.16	94.12.110.147
May 6, 2024 04:57:40.056997061 CEST	2121	52858	208.181.214.78	192.168.2.16
May 6, 2024 04:57:40.062060118 CEST	52997	2121	192.168.2.16	119.118.49.175
May 6, 2024 04:57:40.062079906 CEST	52875	2121	192.168.2.16	207.161.20.232
May 6, 2024 04:57:40.062079906 CEST	52841	21	192.168.2.16	117.85.46.89
May 6, 2024 04:57:40.062304974 CEST	53048	2121	192.168.2.16	123.233.204.6
May 6, 2024 04:57:40.073039055 CEST	21	53035	34.128.145.40	192.168.2.16
May 6, 2024 04:57:40.073103905 CEST	53035	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:40.073170900 CEST	53035	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:40.073340893 CEST	53049	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:40.078423977 CEST	53050	21	192.168.2.16	163.213.212.55
May 6, 2024 04:57:40.084279060 CEST	2121	53037	34.128.145.40	192.168.2.16
May 6, 2024 04:57:40.084330082 CEST	53037	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:40.084449053 CEST	53037	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:40.084732056 CEST	53051	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:40.085524082 CEST	21	52950	78.134.82.102	192.168.2.16
May 6, 2024 04:57:40.091449022 CEST	21	53010	109.205.180.149	192.168.2.16
May 6, 2024 04:57:40.091628075 CEST	21	53010	109.205.180.149	192.168.2.16
May 6, 2024 04:57:40.091762066 CEST	53010	21	192.168.2.16	109.205.180.149
May 6, 2024 04:57:40.094085932 CEST	52995	21	192.168.2.16	119.118.49.175
May 6, 2024 04:57:40.094659090 CEST	53052	21	192.168.2.16	187.149.53.123
May 6, 2024 04:57:40.094731092 CEST	53053	2121	192.168.2.16	163.213.212.55
May 6, 2024 04:57:40.096406937 CEST	2121	53029	182.16.189.156	192.168.2.16
May 6, 2024 04:57:40.096472979 CEST	53029	2121	192.168.2.16	182.16.189.156
May 6, 2024 04:57:40.101089954 CEST	21	52981	81.88.252.91	192.168.2.16
May 6, 2024 04:57:40.101103067 CEST	21	52981	81.88.252.91	192.168.2.16
May 6, 2024 04:57:40.101355076 CEST	53054	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:40.110086918 CEST	52844	2121	192.168.2.16	117.85.46.89
May 6, 2024 04:57:40.110475063 CEST	53055	2121	192.168.2.16	187.149.53.123
May 6, 2024 04:57:40.115628958 CEST	2121	52818	121.148.201.189	192.168.2.16
May 6, 2024 04:57:40.118869066 CEST	21	52817	121.148.201.189	192.168.2.16
May 6, 2024 04:57:40.126168013 CEST	52990	2121	192.168.2.16	94.12.110.147
May 6, 2024 04:57:40.126544952 CEST	53056	21	192.168.2.16	114.52.241.72
May 6, 2024 04:57:40.134403944 CEST	21	53015	101.43.249.26	192.168.2.16
May 6, 2024 04:57:40.134546995 CEST	53015	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:40.134743929 CEST	21	52964	45.38.147.207	192.168.2.16
May 6, 2024 04:57:40.142055035 CEST	52894	21	192.168.2.16	208.72.119.237
May 6, 2024 04:57:40.142074108 CEST	52880	21	192.168.2.16	94.194.250.167
May 6, 2024 04:57:40.142282009 CEST	52992	2121	192.168.2.16	173.199.181.149
May 6, 2024 04:57:40.142282963 CEST	53057	2121	192.168.2.16	114.52.241.72
May 6, 2024 04:57:40.143577099 CEST	2121	52877	39.174.153.108	192.168.2.16
May 6, 2024 04:57:40.157929897 CEST	2121	53041	126.117.149.148	192.168.2.16
May 6, 2024 04:57:40.158075094 CEST	52895	2121	192.168.2.16	208.72.119.237
May 6, 2024 04:57:40.174063921 CEST	52882	21	192.168.2.16	108.158.112.58
May 6, 2024 04:57:40.174065113 CEST	52912	2121	192.168.2.16	61.105.65.248
May 6, 2024 04:57:40.174066067 CEST	52911	21	192.168.2.16	61.105.65.248
May 6, 2024 04:57:40.174221039 CEST	52881	2121	192.168.2.16	94.194.250.167
May 6, 2024 04:57:40.174947977 CEST	21	53026	87.106.26.129	192.168.2.16
May 6, 2024 04:57:40.175102949 CEST	53026	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:40.182970047 CEST	21	53049	34.128.145.40	192.168.2.16
May 6, 2024 04:57:40.183024883 CEST	53049	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:40.189435005 CEST	21	53040	126.117.149.148	192.168.2.16
May 6, 2024 04:57:40.190057039 CEST	52883	2121	192.168.2.16	108.158.112.58
May 6, 2024 04:57:40.190437078 CEST	53058	21	192.168.2.16	2.220.119.31
May 6, 2024 04:57:40.193996906 CEST	2121	53037	34.128.145.40	192.168.2.16
May 6, 2024 04:57:40.195126057 CEST	2121	53051	34.128.145.40	192.168.2.16
May 6, 2024 04:57:40.195183992 CEST	53051	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:40.198901892 CEST	21	53032	208.106.130.31	192.168.2.16
May 6, 2024 04:57:40.198914051 CEST	21	53032	208.106.130.31	192.168.2.16
May 6, 2024 04:57:40.198956966 CEST	53032	21	192.168.2.16	208.106.130.31
May 6, 2024 04:57:40.199079990 CEST	53032	21	192.168.2.16	208.106.130.31
May 6, 2024 04:57:40.199306965 CEST	53059	21	192.168.2.16	208.106.130.31
May 6, 2024 04:57:40.203380108 CEST	21	52989	202.168.242.122	192.168.2.16
May 6, 2024 04:57:40.205610037 CEST	53060	2121	192.168.2.16	2.220.119.31
May 6, 2024 04:57:40.205652952 CEST	53061	21	192.168.2.16	167.56.162.214
May 6, 2024 04:57:40.221074104 CEST	52884	21	192.168.2.16	82.59.39.51
May 6, 2024 04:57:40.222982883 CEST	52886	2121	192.168.2.16	82.59.39.51
May 6, 2024 04:57:40.225522995 CEST	21	53005	93.223.129.127	192.168.2.16
May 6, 2024 04:57:40.225574970 CEST	53005	21	192.168.2.16	93.223.129.127
May 6, 2024 04:57:40.227056026 CEST	21	53033	202.168.242.122	192.168.2.16
May 6, 2024 04:57:40.227112055 CEST	53033	21	192.168.2.16	202.168.242.122
May 6, 2024 04:57:40.227351904 CEST	21	53005	93.223.129.127	192.168.2.16
May 6, 2024 04:57:40.227390051 CEST	53005	21	192.168.2.16	93.223.129.127
May 6, 2024 04:57:40.236973047 CEST	21	52993	154.210.32.21	192.168.2.16
May 6, 2024 04:57:40.237169027 CEST	21	52993	154.210.32.21	192.168.2.16
May 6, 2024 04:57:40.237451077 CEST	52993	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:40.237946033 CEST	53062	2121	192.168.2.16	167.56.162.214
May 6, 2024 04:57:40.238070011 CEST	21	53027	194.181.93.169	192.168.2.16
May 6, 2024 04:57:40.238121986 CEST	53063	21	192.168.2.16	75.182.233.27
May 6, 2024 04:57:40.238149881 CEST	53064	2121	192.168.2.16	73.152.219.120
May 6, 2024 04:57:40.238202095 CEST	53027	21	192.168.2.16	194.181.93.169
May 6, 2024 04:57:40.238203049 CEST	53065	21	192.168.2.16	73.152.219.120
May 6, 2024 04:57:40.253061056 CEST	52998	21	192.168.2.16	190.112.14.253
May 6, 2024 04:57:40.253083944 CEST	52999	2121	192.168.2.16	190.112.14.253
May 6, 2024 04:57:40.269171953 CEST	53000	21	192.168.2.16	86.122.178.216
May 6, 2024 04:57:40.269170046 CEST	53004	2121	192.168.2.16	173.190.98.65
May 6, 2024 04:57:40.269287109 CEST	53003	21	192.168.2.16	173.190.98.65
May 6, 2024 04:57:40.269687891 CEST	53066	2121	192.168.2.16	75.182.233.27
May 6, 2024 04:57:40.269856930 CEST	53067	21	192.168.2.16	123.129.225.135
May 6, 2024 04:57:40.279443026 CEST	21	52901	112.180.75.15	192.168.2.16
May 6, 2024 04:57:40.280730009 CEST	21	53047	149.154.65.23	192.168.2.16
May 6, 2024 04:57:40.280791044 CEST	53047	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:40.285531044 CEST	53068	2121	192.168.2.16	123.129.225.135
May 6, 2024 04:57:40.285546064 CEST	53069	21	192.168.2.16	47.146.240.45
May 6, 2024 04:57:40.293037891 CEST	21	53049	34.128.145.40	192.168.2.16
May 6, 2024 04:57:40.293092012 CEST	53049	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:40.293155909 CEST	53049	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:40.293315887 CEST	53070	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:40.297878027 CEST	21	52975	149.154.65.23	192.168.2.16
May 6, 2024 04:57:40.297928095 CEST	52975	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:40.301495075 CEST	2121	53001	86.122.178.216	192.168.2.16
May 6, 2024 04:57:40.305650949 CEST	2121	53051	34.128.145.40	192.168.2.16
May 6, 2024 04:57:40.305807114 CEST	53051	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:40.305807114 CEST	53051	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:40.305901051 CEST	53071	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:40.317313910 CEST	53072	2121	192.168.2.16	47.146.240.45
May 6, 2024 04:57:40.325412035 CEST	2121	52564	168.220.94.137	192.168.2.16
May 6, 2024 04:57:40.325459003 CEST	52564	2121	192.168.2.16	168.220.94.137
May 6, 2024 04:57:40.327900887 CEST	21	52894	208.72.119.237	192.168.2.16
May 6, 2024 04:57:40.330802917 CEST	2121	52902	112.180.75.15	192.168.2.16
May 6, 2024 04:57:40.331990004 CEST	21	53002	103.109.6.215	192.168.2.16
May 6, 2024 04:57:40.332103968 CEST	53002	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:40.333070993 CEST	52941	21	192.168.2.16	154.13.147.58
May 6, 2024 04:57:40.343910933 CEST	2121	52895	208.72.119.237	192.168.2.16
May 6, 2024 04:57:40.349067926 CEST	52942	2121	192.168.2.16	154.13.147.58
May 6, 2024 04:57:40.349077940 CEST	52891	21	192.168.2.16	94.12.248.226
May 6, 2024 04:57:40.349591017 CEST	53073	2121	192.168.2.16	75.176.234.86
May 6, 2024 04:57:40.349666119 CEST	53074	21	192.168.2.16	75.176.234.86
May 6, 2024 04:57:40.350156069 CEST	21	53025	47.98.154.221	192.168.2.16
May 6, 2024 04:57:40.350351095 CEST	53025	21	192.168.2.16	47.98.154.221
May 6, 2024 04:57:40.362570047 CEST	21	53054	81.88.252.91	192.168.2.16
May 6, 2024 04:57:40.362632990 CEST	53054	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:40.364440918 CEST	21	53010	109.205.180.149	192.168.2.16
May 6, 2024 04:57:40.365076065 CEST	52893	2121	192.168.2.16	94.12.248.226
May 6, 2024 04:57:40.365077972 CEST	53007	2121	192.168.2.16	93.223.129.127
May 6, 2024 04:57:40.365082979 CEST	53006	21	192.168.2.16	99.246.108.168
May 6, 2024 04:57:40.365592003 CEST	53075	21	192.168.2.16	38.145.252.110
May 6, 2024 04:57:40.365669012 CEST	53076	2121	192.168.2.16	38.145.252.110
May 6, 2024 04:57:40.374516964 CEST	21	52837	218.27.113.126	192.168.2.16
May 6, 2024 04:57:40.376552105 CEST	21	53032	208.106.130.31	192.168.2.16
May 6, 2024 04:57:40.376972914 CEST	21	53059	208.106.130.31	192.168.2.16
May 6, 2024 04:57:40.377031088 CEST	53059	21	192.168.2.16	208.106.130.31
May 6, 2024 04:57:40.381072044 CEST	53008	2121	192.168.2.16	99.246.108.168
May 6, 2024 04:57:40.381392002 CEST	53077	21	192.168.2.16	113.230.249.95
May 6, 2024 04:57:40.389162064 CEST	2121	52840	218.27.113.126	192.168.2.16
May 6, 2024 04:57:40.397058964 CEST	53009	21	192.168.2.16	98.208.231.181
May 6, 2024 04:57:40.397161007 CEST	53035	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:40.397398949 CEST	53078	2121	192.168.2.16	113.230.249.95
May 6, 2024 04:57:40.402632952 CEST	2121	52997	119.118.49.175	192.168.2.16
May 6, 2024 04:57:40.402643919 CEST	21	53049	34.128.145.40	192.168.2.16
May 6, 2024 04:57:40.402805090 CEST	21	53070	34.128.145.40	192.168.2.16
May 6, 2024 04:57:40.402874947 CEST	53070	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:40.403376102 CEST	21	53026	87.106.26.129	192.168.2.16
May 6, 2024 04:57:40.403553963 CEST	21	53026	87.106.26.129	192.168.2.16
May 6, 2024 04:57:40.403680086 CEST	53026	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:40.404869080 CEST	21	52841	117.85.46.89	192.168.2.16
May 6, 2024 04:57:40.412069082 CEST	53011	2121	192.168.2.16	98.208.231.181
May 6, 2024 04:57:40.412717104 CEST	53079	21	192.168.2.16	172.225.240.167
May 6, 2024 04:57:40.412894011 CEST	53081	2121	192.168.2.16	217.197.167.105
May 6, 2024 04:57:40.412961960 CEST	53080	2121	192.168.2.16	172.225.240.167
May 6, 2024 04:57:40.413140059 CEST	53082	21	192.168.2.16	217.197.167.105
May 6, 2024 04:57:40.415085077 CEST	2121	53071	34.128.145.40	192.168.2.16
May 6, 2024 04:57:40.415153027 CEST	53071	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:40.422394037 CEST	21	53056	114.52.241.72	192.168.2.16
May 6, 2024 04:57:40.428083897 CEST	53013	21	192.168.2.16	120.27.149.253
May 6, 2024 04:57:40.428488970 CEST	53083	21	192.168.2.16	99.238.125.228
May 6, 2024 04:57:40.434453011 CEST	2121	53048	123.233.204.6	192.168.2.16
May 6, 2024 04:57:40.444080114 CEST	52898	2121	192.168.2.16	185.151.48.204
May 6, 2024 04:57:40.444839954 CEST	53084	2121	192.168.2.16	99.238.125.228
May 6, 2024 04:57:40.444844961 CEST	53085	21	192.168.2.16	175.97.181.115
May 6, 2024 04:57:40.460248947 CEST	52983	2121	192.168.2.16	37.252.127.25
May 6, 2024 04:57:40.460253000 CEST	52879	2121	192.168.2.16	223.242.39.72
May 6, 2024 04:57:40.460253000 CEST	52984	21	192.168.2.16	37.252.127.25
May 6, 2024 04:57:40.460342884 CEST	53086	2121	192.168.2.16	175.97.181.115
May 6, 2024 04:57:40.465470076 CEST	2121	52844	117.85.46.89	192.168.2.16
May 6, 2024 04:57:40.476088047 CEST	52878	21	192.168.2.16	223.242.39.72
May 6, 2024 04:57:40.476309061 CEST	53087	21	192.168.2.16	149.3.88.64
May 6, 2024 04:57:40.480853081 CEST	2121	53057	114.52.241.72	192.168.2.16
May 6, 2024 04:57:40.482950926 CEST	21	53015	101.43.249.26	192.168.2.16
May 6, 2024 04:57:40.483120918 CEST	53015	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:40.483184099 CEST	21	53027	194.181.93.169	192.168.2.16
May 6, 2024 04:57:40.483382940 CEST	53088	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:40.483778000 CEST	21	53027	194.181.93.169	192.168.2.16
May 6, 2024 04:57:40.483911037 CEST	53027	21	192.168.2.16	194.181.93.169
May 6, 2024 04:57:40.490752935 CEST	21	52995	119.118.49.175	192.168.2.16
May 6, 2024 04:57:40.492079973 CEST	52900	21	192.168.2.16	216.117.162.236
May 6, 2024 04:57:40.499888897 CEST	2121	52912	61.105.65.248	192.168.2.16
May 6, 2024 04:57:40.500036955 CEST	21	52911	61.105.65.248	192.168.2.16
May 6, 2024 04:57:40.507534981 CEST	21	53035	34.128.145.40	192.168.2.16
May 6, 2024 04:57:40.508058071 CEST	52974	2121	192.168.2.16	124.63.104.1
May 6, 2024 04:57:40.512511015 CEST	21	53070	34.128.145.40	192.168.2.16
May 6, 2024 04:57:40.512564898 CEST	53070	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:40.512624979 CEST	53070	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:40.512782097 CEST	53089	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:40.524816036 CEST	53090	2121	192.168.2.16	149.3.88.64
May 6, 2024 04:57:40.524952888 CEST	2121	53071	34.128.145.40	192.168.2.16
May 6, 2024 04:57:40.524964094 CEST	53091	21	192.168.2.16	89.25.246.104
May 6, 2024 04:57:40.524998903 CEST	53071	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:40.525068045 CEST	53092	2121	192.168.2.16	89.25.246.104
May 6, 2024 04:57:40.525084019 CEST	53071	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:40.525253057 CEST	53093	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:40.539019108 CEST	21	53047	149.154.65.23	192.168.2.16
May 6, 2024 04:57:40.539166927 CEST	53047	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:40.540071964 CEST	52876	21	192.168.2.16	39.174.153.108
May 6, 2024 04:57:40.540074110 CEST	53018	21	192.168.2.16	180.249.197.252
May 6, 2024 04:57:40.540205956 CEST	53017	2121	192.168.2.16	120.27.149.253
May 6, 2024 04:57:40.553057909 CEST	21	52941	154.13.147.58	192.168.2.16
May 6, 2024 04:57:40.555305958 CEST	2121	53076	38.145.252.110	192.168.2.16
May 6, 2024 04:57:40.556183100 CEST	53019	2121	192.168.2.16	180.249.197.252
May 6, 2024 04:57:40.569017887 CEST	21	53075	38.145.252.110	192.168.2.16
May 6, 2024 04:57:40.572321892 CEST	53094	21	192.168.2.16	92.65.61.161
May 6, 2024 04:57:40.572501898 CEST	2121	52942	154.13.147.58	192.168.2.16
May 6, 2024 04:57:40.574006081 CEST	21	53059	208.106.130.31	192.168.2.16
May 6, 2024 04:57:40.574017048 CEST	21	53059	208.106.130.31	192.168.2.16
May 6, 2024 04:57:40.574073076 CEST	53059	21	192.168.2.16	208.106.130.31
May 6, 2024 04:57:40.574192047 CEST	53059	21	192.168.2.16	208.106.130.31
May 6, 2024 04:57:40.574429989 CEST	53095	21	192.168.2.16	208.106.130.31
May 6, 2024 04:57:40.588085890 CEST	52950	21	192.168.2.16	78.134.82.102
May 6, 2024 04:57:40.588491917 CEST	53096	2121	192.168.2.16	92.65.61.161
May 6, 2024 04:57:40.590375900 CEST	21	52993	154.210.32.21	192.168.2.16
May 6, 2024 04:57:40.590492010 CEST	52993	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:40.590640068 CEST	53097	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:40.591284037 CEST	21	52993	154.210.32.21	192.168.2.16
May 6, 2024 04:57:40.591331959 CEST	52993	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:40.604091883 CEST	52906	2121	192.168.2.16	171.239.80.64
May 6, 2024 04:57:40.604094028 CEST	53020	21	192.168.2.16	119.116.143.203
May 6, 2024 04:57:40.604260921 CEST	52905	21	192.168.2.16	171.239.80.64
May 6, 2024 04:57:40.604551077 CEST	53098	21	192.168.2.16	88.98.150.250
May 6, 2024 04:57:40.618233919 CEST	21	53033	202.168.242.122	192.168.2.16
May 6, 2024 04:57:40.618293047 CEST	53033	21	192.168.2.16	202.168.242.122
May 6, 2024 04:57:40.618352890 CEST	53033	21	192.168.2.16	202.168.242.122
May 6, 2024 04:57:40.618546963 CEST	53099	21	192.168.2.16	202.168.242.122
May 6, 2024 04:57:40.620481014 CEST	53100	2121	192.168.2.16	88.98.150.250
May 6, 2024 04:57:40.620563984 CEST	53101	21	192.168.2.16	117.110.14.62
May 6, 2024 04:57:40.622071981 CEST	21	53070	34.128.145.40	192.168.2.16
May 6, 2024 04:57:40.622448921 CEST	21	53089	34.128.145.40	192.168.2.16
May 6, 2024 04:57:40.622503042 CEST	53089	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:40.630867004 CEST	21	53054	81.88.252.91	192.168.2.16
May 6, 2024 04:57:40.630978107 CEST	53054	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:40.632327080 CEST	21	53026	87.106.26.129	192.168.2.16
May 6, 2024 04:57:40.632443905 CEST	53026	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:40.632647038 CEST	53102	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:40.634793043 CEST	2121	53093	34.128.145.40	192.168.2.16
May 6, 2024 04:57:40.634846926 CEST	53093	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:40.635116100 CEST	2121	53071	34.128.145.40	192.168.2.16
May 6, 2024 04:57:40.636065006 CEST	53021	2121	192.168.2.16	119.116.143.203
May 6, 2024 04:57:40.636081934 CEST	53051	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:40.636081934 CEST	52907	21	192.168.2.16	141.94.161.97
May 6, 2024 04:57:40.636629105 CEST	52964	21	192.168.2.16	45.38.147.207
May 6, 2024 04:57:40.636631012 CEST	52908	2121	192.168.2.16	141.94.161.97
May 6, 2024 04:57:40.638456106 CEST	21	53079	172.225.240.167	192.168.2.16
May 6, 2024 04:57:40.640742064 CEST	2121	53080	172.225.240.167	192.168.2.16
May 6, 2024 04:57:40.654056072 CEST	52877	2121	192.168.2.16	39.174.153.108
May 6, 2024 04:57:40.654079914 CEST	53024	21	192.168.2.16	187.247.144.164
May 6, 2024 04:57:40.667083025 CEST	53041	2121	192.168.2.16	126.117.149.148
May 6, 2024 04:57:40.667304039 CEST	53103	2121	192.168.2.16	117.110.14.62
May 6, 2024 04:57:40.684946060 CEST	21	52984	37.252.127.25	192.168.2.16
May 6, 2024 04:57:40.685539007 CEST	21	53025	47.98.154.221	192.168.2.16
May 6, 2024 04:57:40.685549974 CEST	21	53025	47.98.154.221	192.168.2.16
May 6, 2024 04:57:40.685703039 CEST	53025	21	192.168.2.16	47.98.154.221
May 6, 2024 04:57:40.686731100 CEST	2121	52983	37.252.127.25	192.168.2.16
May 6, 2024 04:57:40.689522028 CEST	21	53002	103.109.6.215	192.168.2.16
May 6, 2024 04:57:40.689629078 CEST	53002	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:40.689781904 CEST	53104	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:40.698071957 CEST	53040	21	192.168.2.16	126.117.149.148
May 6, 2024 04:57:40.717818975 CEST	2121	53029	182.16.189.156	192.168.2.16
May 6, 2024 04:57:40.717829943 CEST	21	52864	182.16.189.156	192.168.2.16
May 6, 2024 04:57:40.718116999 CEST	52864	21	192.168.2.16	182.16.189.156
May 6, 2024 04:57:40.718374014 CEST	53105	2121	192.168.2.16	182.16.189.156
May 6, 2024 04:57:40.718472958 CEST	53106	21	192.168.2.16	182.16.189.156
May 6, 2024 04:57:40.730082989 CEST	52913	21	192.168.2.16	221.165.0.14
May 6, 2024 04:57:40.732220888 CEST	21	53089	34.128.145.40	192.168.2.16
May 6, 2024 04:57:40.732414007 CEST	53089	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:40.732414007 CEST	53089	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:40.732464075 CEST	53107	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:40.744488001 CEST	2121	53093	34.128.145.40	192.168.2.16
May 6, 2024 04:57:40.744551897 CEST	53093	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:40.744622946 CEST	53093	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:40.744801998 CEST	53108	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:40.745661974 CEST	2121	53051	34.128.145.40	192.168.2.16
May 6, 2024 04:57:40.746099949 CEST	53028	2121	192.168.2.16	187.247.144.164
May 6, 2024 04:57:40.751211882 CEST	21	53095	208.106.130.31	192.168.2.16
May 6, 2024 04:57:40.751281023 CEST	53095	21	192.168.2.16	208.106.130.31
May 6, 2024 04:57:40.751714945 CEST	21	53059	208.106.130.31	192.168.2.16
May 6, 2024 04:57:40.761430025 CEST	53109	21	192.168.2.16	23.42.115.112
May 6, 2024 04:57:40.767002106 CEST	21	53027	194.181.93.169	192.168.2.16
May 6, 2024 04:57:40.776434898 CEST	53110	2121	192.168.2.16	23.42.115.112
May 6, 2024 04:57:40.781760931 CEST	2121	52879	223.242.39.72	192.168.2.16
May 6, 2024 04:57:40.782115936 CEST	53111	21	192.168.2.16	186.202.183.96
May 6, 2024 04:57:40.791086912 CEST	52901	21	192.168.2.16	112.180.75.15
May 6, 2024 04:57:40.793781042 CEST	21	53047	149.154.65.23	192.168.2.16
May 6, 2024 04:57:40.793791056 CEST	21	53047	149.154.65.23	192.168.2.16
May 6, 2024 04:57:40.793972969 CEST	53047	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:40.800657988 CEST	21	52878	223.242.39.72	192.168.2.16
May 6, 2024 04:57:40.805330992 CEST	21	52964	45.38.147.207	192.168.2.16
May 6, 2024 04:57:40.807226896 CEST	53001	2121	192.168.2.16	86.122.178.216
May 6, 2024 04:57:40.807766914 CEST	2121	52974	124.63.104.1	192.168.2.16
May 6, 2024 04:57:40.809031963 CEST	2121	53090	149.3.88.64	192.168.2.16
May 6, 2024 04:57:40.823199034 CEST	53031	21	192.168.2.16	76.155.219.53
May 6, 2024 04:57:40.823201895 CEST	53030	2121	192.168.2.16	76.155.219.53
May 6, 2024 04:57:40.823404074 CEST	53112	2121	192.168.2.16	186.202.183.96
May 6, 2024 04:57:40.831559896 CEST	21	53015	101.43.249.26	192.168.2.16
May 6, 2024 04:57:40.831568956 CEST	21	53015	101.43.249.26	192.168.2.16
May 6, 2024 04:57:40.831614971 CEST	53015	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:40.832007885 CEST	21	53088	101.43.249.26	192.168.2.16
May 6, 2024 04:57:40.832076073 CEST	53088	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:40.835513115 CEST	21	52950	78.134.82.102	192.168.2.16
May 6, 2024 04:57:40.838066101 CEST	52902	2121	192.168.2.16	112.180.75.15
May 6, 2024 04:57:40.838929892 CEST	21	53098	88.98.150.250	192.168.2.16
May 6, 2024 04:57:40.841986895 CEST	21	53089	34.128.145.40	192.168.2.16
May 6, 2024 04:57:40.842045069 CEST	21	53107	34.128.145.40	192.168.2.16
May 6, 2024 04:57:40.842108965 CEST	53107	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:40.852669954 CEST	2121	53100	88.98.150.250	192.168.2.16
May 6, 2024 04:57:40.853081942 CEST	53034	21	192.168.2.16	212.239.223.10
May 6, 2024 04:57:40.856583118 CEST	21	53102	87.106.26.129	192.168.2.16
May 6, 2024 04:57:40.856645107 CEST	53102	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:40.863050938 CEST	2121	53108	34.128.145.40	192.168.2.16
May 6, 2024 04:57:40.863060951 CEST	21	53026	87.106.26.129	192.168.2.16
May 6, 2024 04:57:40.863112926 CEST	53026	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:40.863123894 CEST	53108	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:40.868112087 CEST	53036	2121	192.168.2.16	212.239.223.10
May 6, 2024 04:57:40.884085894 CEST	53038	21	192.168.2.16	74.131.225.252
May 6, 2024 04:57:40.896181107 CEST	21	52876	39.174.153.108	192.168.2.16
May 6, 2024 04:57:40.899584055 CEST	21	53054	81.88.252.91	192.168.2.16
May 6, 2024 04:57:40.899715900 CEST	53054	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:40.900084972 CEST	53039	2121	192.168.2.16	74.131.225.252
May 6, 2024 04:57:40.916064024 CEST	52997	2121	192.168.2.16	119.118.49.175
May 6, 2024 04:57:40.916553020 CEST	53113	21	192.168.2.16	24.250.200.141
May 6, 2024 04:57:40.927268028 CEST	21	53097	154.210.32.21	192.168.2.16
May 6, 2024 04:57:40.927345037 CEST	53097	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:40.932063103 CEST	53042	21	192.168.2.16	91.18.33.249
May 6, 2024 04:57:40.932068110 CEST	53043	2121	192.168.2.16	91.18.33.249
May 6, 2024 04:57:40.932080984 CEST	53056	21	192.168.2.16	114.52.241.72
May 6, 2024 04:57:40.937973022 CEST	2121	53041	126.117.149.148	192.168.2.16
May 6, 2024 04:57:40.942430973 CEST	21	52993	154.210.32.21	192.168.2.16
May 6, 2024 04:57:40.948085070 CEST	53048	2121	192.168.2.16	123.233.204.6
May 6, 2024 04:57:40.948920012 CEST	21	53095	208.106.130.31	192.168.2.16
May 6, 2024 04:57:40.948931932 CEST	21	53095	208.106.130.31	192.168.2.16
May 6, 2024 04:57:40.948983908 CEST	53095	21	192.168.2.16	208.106.130.31
May 6, 2024 04:57:40.949052095 CEST	53095	21	192.168.2.16	208.106.130.31
May 6, 2024 04:57:40.949268103 CEST	53114	21	192.168.2.16	208.106.130.31
May 6, 2024 04:57:40.954956055 CEST	21	53107	34.128.145.40	192.168.2.16
May 6, 2024 04:57:40.955003977 CEST	53107	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:40.955045938 CEST	53107	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:40.955168962 CEST	53115	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:40.972935915 CEST	2121	53108	34.128.145.40	192.168.2.16
May 6, 2024 04:57:40.973078966 CEST	53108	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:40.973164082 CEST	53108	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:40.973347902 CEST	53116	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:40.981170893 CEST	53044	21	192.168.2.16	79.150.30.103
May 6, 2024 04:57:40.987430096 CEST	21	53099	202.168.242.122	192.168.2.16
May 6, 2024 04:57:40.987493992 CEST	53099	21	192.168.2.16	202.168.242.122
May 6, 2024 04:57:40.996084929 CEST	53057	2121	192.168.2.16	114.52.241.72
May 6, 2024 04:57:40.996087074 CEST	52995	21	192.168.2.16	119.118.49.175
May 6, 2024 04:57:40.996093988 CEST	53045	2121	192.168.2.16	79.150.30.103
May 6, 2024 04:57:40.997014046 CEST	21	53111	186.202.183.96	192.168.2.16
May 6, 2024 04:57:40.997064114 CEST	53111	21	192.168.2.16	186.202.183.96
May 6, 2024 04:57:41.000417948 CEST	21	53040	126.117.149.148	192.168.2.16
May 6, 2024 04:57:41.009350061 CEST	21	53033	202.168.242.122	192.168.2.16
May 6, 2024 04:57:41.009444952 CEST	21	53033	202.168.242.122	192.168.2.16
May 6, 2024 04:57:41.009490013 CEST	53033	21	192.168.2.16	202.168.242.122
May 6, 2024 04:57:41.012084961 CEST	53046	21	192.168.2.16	123.233.204.6
May 6, 2024 04:57:41.012105942 CEST	52911	21	192.168.2.16	61.105.65.248
May 6, 2024 04:57:41.012109995 CEST	52912	2121	192.168.2.16	61.105.65.248
May 6, 2024 04:57:41.028482914 CEST	21	53025	47.98.154.221	192.168.2.16
May 6, 2024 04:57:41.028619051 CEST	53025	21	192.168.2.16	47.98.154.221
May 6, 2024 04:57:41.028822899 CEST	21	53025	47.98.154.221	192.168.2.16
May 6, 2024 04:57:41.028867006 CEST	53025	21	192.168.2.16	47.98.154.221
May 6, 2024 04:57:41.028867960 CEST	53117	21	192.168.2.16	47.98.154.221
May 6, 2024 04:57:41.038077116 CEST	2121	53112	186.202.183.96	192.168.2.16
May 6, 2024 04:57:41.038115978 CEST	21	53104	103.109.6.215	192.168.2.16
May 6, 2024 04:57:41.038124084 CEST	53112	2121	192.168.2.16	186.202.183.96
May 6, 2024 04:57:41.038172960 CEST	53104	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:41.038728952 CEST	2121	52877	39.174.153.108	192.168.2.16
May 6, 2024 04:57:41.044070959 CEST	52923	2121	192.168.2.16	221.165.0.14
May 6, 2024 04:57:41.045396090 CEST	21	53002	103.109.6.215	192.168.2.16
May 6, 2024 04:57:41.045475006 CEST	21	53002	103.109.6.215	192.168.2.16
May 6, 2024 04:57:41.045516014 CEST	53002	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:41.049381971 CEST	21	53047	149.154.65.23	192.168.2.16
May 6, 2024 04:57:41.049508095 CEST	53047	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:41.049706936 CEST	53118	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:41.060064077 CEST	52941	21	192.168.2.16	154.13.147.58
May 6, 2024 04:57:41.060091019 CEST	53076	2121	192.168.2.16	38.145.252.110
May 6, 2024 04:57:41.060513973 CEST	53119	21	192.168.2.16	51.198.140.33
May 6, 2024 04:57:41.060614109 CEST	53120	2121	192.168.2.16	24.250.200.141
May 6, 2024 04:57:41.064560890 CEST	21	53107	34.128.145.40	192.168.2.16
May 6, 2024 04:57:41.064789057 CEST	21	53115	34.128.145.40	192.168.2.16
May 6, 2024 04:57:41.064846992 CEST	53115	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:41.065871954 CEST	2121	53105	182.16.189.156	192.168.2.16
May 6, 2024 04:57:41.065927029 CEST	53105	2121	192.168.2.16	182.16.189.156
May 6, 2024 04:57:41.074469090 CEST	21	52864	182.16.189.156	192.168.2.16
May 6, 2024 04:57:41.075154066 CEST	21	53106	182.16.189.156	192.168.2.16
May 6, 2024 04:57:41.075212955 CEST	53106	21	192.168.2.16	182.16.189.156
May 6, 2024 04:57:41.076080084 CEST	53093	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:41.076097012 CEST	53075	21	192.168.2.16	38.145.252.110
May 6, 2024 04:57:41.076524019 CEST	52942	2121	192.168.2.16	154.13.147.58
May 6, 2024 04:57:41.078480959 CEST	2121	53001	86.122.178.216	192.168.2.16
May 6, 2024 04:57:41.082881927 CEST	2121	53108	34.128.145.40	192.168.2.16
May 6, 2024 04:57:41.082962990 CEST	2121	53116	34.128.145.40	192.168.2.16
May 6, 2024 04:57:41.083024979 CEST	53116	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:41.092926025 CEST	53050	21	192.168.2.16	163.213.212.55
May 6, 2024 04:57:41.092988968 CEST	52924	21	192.168.2.16	82.55.44.250
May 6, 2024 04:57:41.103718042 CEST	21	52901	112.180.75.15	192.168.2.16
May 6, 2024 04:57:41.104090929 CEST	21	53102	87.106.26.129	192.168.2.16
May 6, 2024 04:57:41.104274035 CEST	53102	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:41.108064890 CEST	52925	2121	192.168.2.16	82.55.44.250
May 6, 2024 04:57:41.108064890 CEST	53053	2121	192.168.2.16	163.213.212.55
May 6, 2024 04:57:41.108079910 CEST	53052	21	192.168.2.16	187.149.53.123
May 6, 2024 04:57:41.108424902 CEST	53121	2121	192.168.2.16	51.198.140.33
May 6, 2024 04:57:41.124082088 CEST	53055	2121	192.168.2.16	187.149.53.123
May 6, 2024 04:57:41.124104023 CEST	52927	21	192.168.2.16	5.58.114.174
May 6, 2024 04:57:41.124411106 CEST	53122	21	192.168.2.16	82.32.25.232
May 6, 2024 04:57:41.125436068 CEST	21	53095	208.106.130.31	192.168.2.16
May 6, 2024 04:57:41.125597000 CEST	21	53114	208.106.130.31	192.168.2.16
May 6, 2024 04:57:41.125658989 CEST	53114	21	192.168.2.16	208.106.130.31
May 6, 2024 04:57:41.140064955 CEST	52930	2121	192.168.2.16	5.58.114.174
May 6, 2024 04:57:41.140065908 CEST	53079	21	192.168.2.16	172.225.240.167
May 6, 2024 04:57:41.140067101 CEST	52931	2121	192.168.2.16	216.239.50.93
May 6, 2024 04:57:41.140084028 CEST	52932	21	192.168.2.16	216.239.50.93
May 6, 2024 04:57:41.140088081 CEST	52934	21	192.168.2.16	73.176.95.1
May 6, 2024 04:57:41.140089035 CEST	52933	2121	192.168.2.16	73.176.95.1
May 6, 2024 04:57:41.154999971 CEST	2121	52902	112.180.75.15	192.168.2.16
May 6, 2024 04:57:41.156063080 CEST	52936	2121	192.168.2.16	201.40.217.61
May 6, 2024 04:57:41.156078100 CEST	52939	21	192.168.2.16	73.226.38.197
May 6, 2024 04:57:41.156079054 CEST	52937	21	192.168.2.16	27.153.138.27
May 6, 2024 04:57:41.156080008 CEST	52938	2121	192.168.2.16	27.153.138.27
May 6, 2024 04:57:41.156080008 CEST	52935	21	192.168.2.16	201.40.217.61
May 6, 2024 04:57:41.156213999 CEST	53080	2121	192.168.2.16	172.225.240.167
May 6, 2024 04:57:41.172075033 CEST	52940	2121	192.168.2.16	73.226.38.197
May 6, 2024 04:57:41.172076941 CEST	52943	21	192.168.2.16	20.239.168.93
May 6, 2024 04:57:41.172334909 CEST	53123	2121	192.168.2.16	82.32.25.232
May 6, 2024 04:57:41.174561024 CEST	21	53115	34.128.145.40	192.168.2.16
May 6, 2024 04:57:41.174612999 CEST	53115	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:41.174699068 CEST	53115	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:41.174705029 CEST	21	53054	81.88.252.91	192.168.2.16
May 6, 2024 04:57:41.174715996 CEST	21	53054	81.88.252.91	192.168.2.16
May 6, 2024 04:57:41.175105095 CEST	53124	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:41.175106049 CEST	53125	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:41.179802895 CEST	21	53088	101.43.249.26	192.168.2.16
May 6, 2024 04:57:41.179990053 CEST	53088	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:41.188083887 CEST	52984	21	192.168.2.16	37.252.127.25
May 6, 2024 04:57:41.188085079 CEST	52983	2121	192.168.2.16	37.252.127.25
May 6, 2024 04:57:41.192692995 CEST	2121	53093	34.128.145.40	192.168.2.16
May 6, 2024 04:57:41.194016933 CEST	2121	53116	34.128.145.40	192.168.2.16
May 6, 2024 04:57:41.194067955 CEST	53116	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:41.194129944 CEST	53116	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:41.194302082 CEST	53126	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:41.204066992 CEST	52946	21	192.168.2.16	199.182.223.194
May 6, 2024 04:57:41.204070091 CEST	52944	2121	192.168.2.16	20.239.168.93
May 6, 2024 04:57:41.204437971 CEST	52945	2121	192.168.2.16	199.182.223.194
May 6, 2024 04:57:41.204440117 CEST	53058	21	192.168.2.16	2.220.119.31
May 6, 2024 04:57:41.220087051 CEST	53060	2121	192.168.2.16	2.220.119.31
May 6, 2024 04:57:41.220505953 CEST	53127	21	192.168.2.16	69.242.195.128
May 6, 2024 04:57:41.220506907 CEST	53061	21	192.168.2.16	167.56.162.214
May 6, 2024 04:57:41.227610111 CEST	2121	53076	38.145.252.110	192.168.2.16
May 6, 2024 04:57:41.227783918 CEST	21	53056	114.52.241.72	192.168.2.16
May 6, 2024 04:57:41.236068964 CEST	52947	21	192.168.2.16	24.158.218.44
May 6, 2024 04:57:41.236690998 CEST	53128	2121	192.168.2.16	69.242.195.128
May 6, 2024 04:57:41.252069950 CEST	53063	21	192.168.2.16	75.182.233.27
May 6, 2024 04:57:41.252070904 CEST	53064	2121	192.168.2.16	73.152.219.120
May 6, 2024 04:57:41.252085924 CEST	53062	2121	192.168.2.16	167.56.162.214
May 6, 2024 04:57:41.252088070 CEST	53065	21	192.168.2.16	73.152.219.120
May 6, 2024 04:57:41.256774902 CEST	2121	52997	119.118.49.175	192.168.2.16
May 6, 2024 04:57:41.257247925 CEST	21	53075	38.145.252.110	192.168.2.16
May 6, 2024 04:57:41.265604019 CEST	21	53097	154.210.32.21	192.168.2.16
May 6, 2024 04:57:41.265830994 CEST	53097	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:41.280088902 CEST	21	52941	154.13.147.58	192.168.2.16
May 6, 2024 04:57:41.284064054 CEST	53066	2121	192.168.2.16	75.182.233.27
May 6, 2024 04:57:41.284317970 CEST	21	53115	34.128.145.40	192.168.2.16
May 6, 2024 04:57:41.284348965 CEST	53067	21	192.168.2.16	123.129.225.135
May 6, 2024 04:57:41.285518885 CEST	21	53124	34.128.145.40	192.168.2.16
May 6, 2024 04:57:41.285589933 CEST	53124	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:41.299453974 CEST	2121	52942	154.13.147.58	192.168.2.16
May 6, 2024 04:57:41.300061941 CEST	52948	2121	192.168.2.16	24.158.218.44
May 6, 2024 04:57:41.300077915 CEST	53069	21	192.168.2.16	47.146.240.45
May 6, 2024 04:57:41.300081968 CEST	53068	2121	192.168.2.16	123.129.225.135
May 6, 2024 04:57:41.300465107 CEST	53129	21	192.168.2.16	189.85.166.218
May 6, 2024 04:57:41.303697109 CEST	2121	53116	34.128.145.40	192.168.2.16
May 6, 2024 04:57:41.303911924 CEST	2121	53126	34.128.145.40	192.168.2.16
May 6, 2024 04:57:41.303986073 CEST	53126	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:41.304217100 CEST	21	53047	149.154.65.23	192.168.2.16
May 6, 2024 04:57:41.304260969 CEST	53047	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:41.305342913 CEST	21	53118	149.154.65.23	192.168.2.16
May 6, 2024 04:57:41.305394888 CEST	53118	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:41.316075087 CEST	52974	2121	192.168.2.16	124.63.104.1
May 6, 2024 04:57:41.316076994 CEST	52964	21	192.168.2.16	45.38.147.207
May 6, 2024 04:57:41.316077948 CEST	53090	2121	192.168.2.16	149.3.88.64
May 6, 2024 04:57:41.316603899 CEST	53130	2121	192.168.2.16	189.85.166.218
May 6, 2024 04:57:41.319719076 CEST	2121	53048	123.233.204.6	192.168.2.16
May 6, 2024 04:57:41.323920012 CEST	21	53114	208.106.130.31	192.168.2.16
May 6, 2024 04:57:41.324017048 CEST	21	53114	208.106.130.31	192.168.2.16
May 6, 2024 04:57:41.324054956 CEST	53114	21	192.168.2.16	208.106.130.31
May 6, 2024 04:57:41.324069977 CEST	53114	21	192.168.2.16	208.106.130.31
May 6, 2024 04:57:41.324275017 CEST	53131	21	192.168.2.16	208.106.130.31
May 6, 2024 04:57:41.328186035 CEST	21	53102	87.106.26.129	192.168.2.16
May 6, 2024 04:57:41.328414917 CEST	21	53102	87.106.26.129	192.168.2.16
May 6, 2024 04:57:41.328577995 CEST	53102	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:41.332057953 CEST	53072	2121	192.168.2.16	47.146.240.45
May 6, 2024 04:57:41.332350969 CEST	53132	21	192.168.2.16	222.226.177.2
May 6, 2024 04:57:41.334511995 CEST	2121	53057	114.52.241.72	192.168.2.16
May 6, 2024 04:57:41.338260889 CEST	21	52911	61.105.65.248	192.168.2.16
May 6, 2024 04:57:41.338743925 CEST	2121	52912	61.105.65.248	192.168.2.16
May 6, 2024 04:57:41.348094940 CEST	53098	21	192.168.2.16	88.98.150.250
May 6, 2024 04:57:41.348097086 CEST	52950	21	192.168.2.16	78.134.82.102
May 6, 2024 04:57:41.356060982 CEST	53074	21	192.168.2.16	75.176.234.86
May 6, 2024 04:57:41.356201887 CEST	21	53099	202.168.242.122	192.168.2.16
May 6, 2024 04:57:41.356256962 CEST	53099	21	192.168.2.16	202.168.242.122
May 6, 2024 04:57:41.356313944 CEST	53099	21	192.168.2.16	202.168.242.122
May 6, 2024 04:57:41.356726885 CEST	53133	21	192.168.2.16	202.168.242.122
May 6, 2024 04:57:41.363065004 CEST	53073	2121	192.168.2.16	75.176.234.86
May 6, 2024 04:57:41.363096952 CEST	53100	2121	192.168.2.16	88.98.150.250
May 6, 2024 04:57:41.363101006 CEST	21	53025	47.98.154.221	192.168.2.16
May 6, 2024 04:57:41.363497019 CEST	53134	2121	192.168.2.16	222.226.177.2
May 6, 2024 04:57:41.363571882 CEST	53135	21	192.168.2.16	24.20.217.203
May 6, 2024 04:57:41.365997076 CEST	21	53079	172.225.240.167	192.168.2.16
May 6, 2024 04:57:41.373781919 CEST	21	53117	47.98.154.221	192.168.2.16
May 6, 2024 04:57:41.373843908 CEST	53117	21	192.168.2.16	47.98.154.221
May 6, 2024 04:57:41.379293919 CEST	53136	2121	192.168.2.16	24.20.217.203
May 6, 2024 04:57:41.383955002 CEST	2121	53080	172.225.240.167	192.168.2.16
May 6, 2024 04:57:41.386584997 CEST	21	53104	103.109.6.215	192.168.2.16
May 6, 2024 04:57:41.386694908 CEST	53104	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:41.392795086 CEST	21	52995	119.118.49.175	192.168.2.16
May 6, 2024 04:57:41.395062923 CEST	53077	21	192.168.2.16	113.230.249.95
May 6, 2024 04:57:41.395807981 CEST	53137	21	192.168.2.16	97.124.40.223
May 6, 2024 04:57:41.395915031 CEST	53138	2121	192.168.2.16	97.124.40.223
May 6, 2024 04:57:41.395915031 CEST	53139	21	192.168.2.16	111.70.8.82
May 6, 2024 04:57:41.396070957 CEST	21	53124	34.128.145.40	192.168.2.16
May 6, 2024 04:57:41.396127939 CEST	53124	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:41.396176100 CEST	53124	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:41.396337032 CEST	53140	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:41.411101103 CEST	53078	2121	192.168.2.16	113.230.249.95
May 6, 2024 04:57:41.412828922 CEST	21	52984	37.252.127.25	192.168.2.16
May 6, 2024 04:57:41.413616896 CEST	2121	53126	34.128.145.40	192.168.2.16
May 6, 2024 04:57:41.413686037 CEST	53126	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:41.413743019 CEST	53126	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:41.413896084 CEST	53141	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:41.414768934 CEST	2121	52983	37.252.127.25	192.168.2.16
May 6, 2024 04:57:41.427221060 CEST	53082	21	192.168.2.16	217.197.167.105
May 6, 2024 04:57:41.427227020 CEST	53081	2121	192.168.2.16	217.197.167.105
May 6, 2024 04:57:41.427428961 CEST	53142	2121	192.168.2.16	111.70.8.82
May 6, 2024 04:57:41.443089008 CEST	53083	21	192.168.2.16	99.238.125.228
May 6, 2024 04:57:41.443499088 CEST	53041	2121	192.168.2.16	126.117.149.148
May 6, 2024 04:57:41.443500042 CEST	53143	21	192.168.2.16	84.133.1.144
May 6, 2024 04:57:41.444436073 CEST	21	53125	81.88.252.91	192.168.2.16
May 6, 2024 04:57:41.444505930 CEST	53125	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:41.459068060 CEST	53084	2121	192.168.2.16	99.238.125.228
May 6, 2024 04:57:41.459934950 CEST	53085	21	192.168.2.16	175.97.181.115
May 6, 2024 04:57:41.473062038 CEST	52957	2121	192.168.2.16	78.134.82.102
May 6, 2024 04:57:41.473285913 CEST	52958	21	192.168.2.16	187.169.54.105
May 6, 2024 04:57:41.475080967 CEST	53086	2121	192.168.2.16	175.97.181.115
May 6, 2024 04:57:41.484760046 CEST	21	52964	45.38.147.207	192.168.2.16
May 6, 2024 04:57:41.485165119 CEST	53144	2121	192.168.2.16	84.133.1.144
May 6, 2024 04:57:41.491179943 CEST	53087	21	192.168.2.16	149.3.88.64
May 6, 2024 04:57:41.503976107 CEST	21	53114	208.106.130.31	192.168.2.16
May 6, 2024 04:57:41.504404068 CEST	21	53131	208.106.130.31	192.168.2.16
May 6, 2024 04:57:41.504462004 CEST	53131	21	192.168.2.16	208.106.130.31
May 6, 2024 04:57:41.507062912 CEST	53040	21	192.168.2.16	126.117.149.148
May 6, 2024 04:57:41.509253979 CEST	21	53140	34.128.145.40	192.168.2.16
May 6, 2024 04:57:41.509306908 CEST	53140	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:41.509387016 CEST	21	53124	34.128.145.40	192.168.2.16
May 6, 2024 04:57:41.523169041 CEST	2121	53126	34.128.145.40	192.168.2.16
May 6, 2024 04:57:41.523360014 CEST	53145	21	192.168.2.16	45.58.44.238
May 6, 2024 04:57:41.523449898 CEST	2121	53141	34.128.145.40	192.168.2.16
May 6, 2024 04:57:41.523505926 CEST	53141	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:41.527637005 CEST	21	53088	101.43.249.26	192.168.2.16
May 6, 2024 04:57:41.527757883 CEST	53088	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:41.527951002 CEST	53146	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:41.539077044 CEST	53091	21	192.168.2.16	89.25.246.104
May 6, 2024 04:57:41.539077997 CEST	53092	2121	192.168.2.16	89.25.246.104
May 6, 2024 04:57:41.553035021 CEST	21	53102	87.106.26.129	192.168.2.16
May 6, 2024 04:57:41.553162098 CEST	53102	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:41.553352118 CEST	53147	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:41.554600954 CEST	53148	2121	192.168.2.16	45.58.44.238
May 6, 2024 04:57:41.564923048 CEST	21	53118	149.154.65.23	192.168.2.16
May 6, 2024 04:57:41.565082073 CEST	53118	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:41.570096016 CEST	52962	21	192.168.2.16	77.183.105.197
May 6, 2024 04:57:41.570097923 CEST	52961	2121	192.168.2.16	187.169.54.105
May 6, 2024 04:57:41.570331097 CEST	53149	21	192.168.2.16	96.247.204.60
May 6, 2024 04:57:41.582521915 CEST	21	53098	88.98.150.250	192.168.2.16
May 6, 2024 04:57:41.586066008 CEST	53094	21	192.168.2.16	92.65.61.161
May 6, 2024 04:57:41.586190939 CEST	53001	2121	192.168.2.16	86.122.178.216
May 6, 2024 04:57:41.594964981 CEST	2121	53100	88.98.150.250	192.168.2.16
May 6, 2024 04:57:41.595535994 CEST	21	52950	78.134.82.102	192.168.2.16
May 6, 2024 04:57:41.600987911 CEST	2121	53090	149.3.88.64	192.168.2.16
May 6, 2024 04:57:41.602092981 CEST	53096	2121	192.168.2.16	92.65.61.161
May 6, 2024 04:57:41.602404118 CEST	53150	2121	192.168.2.16	96.247.204.60
May 6, 2024 04:57:41.602484941 CEST	21	53097	154.210.32.21	192.168.2.16
May 6, 2024 04:57:41.602587938 CEST	21	53097	154.210.32.21	192.168.2.16
May 6, 2024 04:57:41.602714062 CEST	53097	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:41.616002083 CEST	2121	52974	124.63.104.1	192.168.2.16
May 6, 2024 04:57:41.618083000 CEST	52963	2121	192.168.2.16	77.183.105.197
May 6, 2024 04:57:41.618563890 CEST	21	53140	34.128.145.40	192.168.2.16
May 6, 2024 04:57:41.618582010 CEST	53151	21	192.168.2.16	172.93.226.61
May 6, 2024 04:57:41.618583918 CEST	53152	2121	192.168.2.16	172.93.226.61
May 6, 2024 04:57:41.618608952 CEST	53140	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:41.618659973 CEST	53140	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:41.618805885 CEST	53153	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:41.619921923 CEST	21	53132	222.226.177.2	192.168.2.16
May 6, 2024 04:57:41.633325100 CEST	2121	53141	34.128.145.40	192.168.2.16
May 6, 2024 04:57:41.633374929 CEST	53141	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:41.633435965 CEST	53141	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:41.633600950 CEST	53154	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:41.634068966 CEST	53101	21	192.168.2.16	117.110.14.62
May 6, 2024 04:57:41.634072065 CEST	52965	2121	192.168.2.16	45.38.147.207
May 6, 2024 04:57:41.650073051 CEST	52966	21	192.168.2.16	34.83.117.224
May 6, 2024 04:57:41.650958061 CEST	2121	53134	222.226.177.2	192.168.2.16
May 6, 2024 04:57:41.666567087 CEST	53155	21	192.168.2.16	64.60.94.229
May 6, 2024 04:57:41.666634083 CEST	53156	2121	192.168.2.16	64.60.94.229
May 6, 2024 04:57:41.682096958 CEST	53103	2121	192.168.2.16	117.110.14.62
May 6, 2024 04:57:41.682666063 CEST	53157	21	192.168.2.16	183.4.9.108
May 6, 2024 04:57:41.682729959 CEST	53158	21	192.168.2.16	46.153.227.117
May 6, 2024 04:57:41.682838917 CEST	53159	2121	192.168.2.16	183.4.9.108
May 6, 2024 04:57:41.698581934 CEST	53160	2121	192.168.2.16	46.153.227.117
May 6, 2024 04:57:41.698853970 CEST	21	53131	208.106.130.31	192.168.2.16
May 6, 2024 04:57:41.698868990 CEST	21	53131	208.106.130.31	192.168.2.16
May 6, 2024 04:57:41.698920965 CEST	53131	21	192.168.2.16	208.106.130.31
May 6, 2024 04:57:41.698973894 CEST	53131	21	192.168.2.16	208.106.130.31
May 6, 2024 04:57:41.699170113 CEST	53161	21	192.168.2.16	208.106.130.31
May 6, 2024 04:57:41.714096069 CEST	52967	2121	192.168.2.16	34.83.117.224
May 6, 2024 04:57:41.714216948 CEST	2121	53041	126.117.149.148	192.168.2.16
May 6, 2024 04:57:41.714299917 CEST	21	53125	81.88.252.91	192.168.2.16
May 6, 2024 04:57:41.714473963 CEST	53125	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:41.714786053 CEST	53162	21	192.168.2.16	195.224.228.187
May 6, 2024 04:57:41.714804888 CEST	53163	21	192.168.2.16	90.180.171.146
May 6, 2024 04:57:41.714931965 CEST	53164	2121	192.168.2.16	195.224.228.187
May 6, 2024 04:57:41.715055943 CEST	53165	2121	192.168.2.16	90.180.171.146
May 6, 2024 04:57:41.717245102 CEST	2121	53105	182.16.189.156	192.168.2.16
May 6, 2024 04:57:41.717334986 CEST	21	52864	182.16.189.156	192.168.2.16
May 6, 2024 04:57:41.717381001 CEST	52864	21	192.168.2.16	182.16.189.156
May 6, 2024 04:57:41.717382908 CEST	21	53106	182.16.189.156	192.168.2.16
May 6, 2024 04:57:41.717542887 CEST	53106	21	192.168.2.16	182.16.189.156
May 6, 2024 04:57:41.717690945 CEST	53166	2121	192.168.2.16	182.16.189.156
May 6, 2024 04:57:41.719320059 CEST	21	53117	47.98.154.221	192.168.2.16
May 6, 2024 04:57:41.719471931 CEST	53117	21	192.168.2.16	47.98.154.221
May 6, 2024 04:57:41.724858046 CEST	21	53099	202.168.242.122	192.168.2.16
May 6, 2024 04:57:41.727973938 CEST	21	53153	34.128.145.40	192.168.2.16
May 6, 2024 04:57:41.728059053 CEST	53153	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:41.728626013 CEST	21	53140	34.128.145.40	192.168.2.16
May 6, 2024 04:57:41.731092930 CEST	53076	2121	192.168.2.16	38.145.252.110
May 6, 2024 04:57:41.731093884 CEST	53056	21	192.168.2.16	114.52.241.72
May 6, 2024 04:57:41.732947111 CEST	21	53133	202.168.242.122	192.168.2.16
May 6, 2024 04:57:41.733006001 CEST	53133	21	192.168.2.16	202.168.242.122
May 6, 2024 04:57:41.734843016 CEST	21	53104	103.109.6.215	192.168.2.16
May 6, 2024 04:57:41.734944105 CEST	53104	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:41.742856979 CEST	2121	53154	34.128.145.40	192.168.2.16
May 6, 2024 04:57:41.742902994 CEST	53154	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:41.743031979 CEST	2121	53141	34.128.145.40	192.168.2.16
May 6, 2024 04:57:41.746103048 CEST	52969	21	192.168.2.16	124.63.104.1
May 6, 2024 04:57:41.762056112 CEST	52997	2121	192.168.2.16	119.118.49.175
May 6, 2024 04:57:41.762085915 CEST	53109	21	192.168.2.16	23.42.115.112
May 6, 2024 04:57:41.762085915 CEST	53075	21	192.168.2.16	38.145.252.110
May 6, 2024 04:57:41.777071953 CEST	53110	2121	192.168.2.16	23.42.115.112
May 6, 2024 04:57:41.779006958 CEST	21	53102	87.106.26.129	192.168.2.16
May 6, 2024 04:57:41.779056072 CEST	53102	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:41.781487942 CEST	21	53147	87.106.26.129	192.168.2.16
May 6, 2024 04:57:41.781547070 CEST	53147	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:41.793080091 CEST	53111	21	192.168.2.16	186.202.183.96
May 6, 2024 04:57:41.809602022 CEST	53167	21	192.168.2.16	200.101.247.27
May 6, 2024 04:57:41.809680939 CEST	53168	2121	192.168.2.16	200.101.247.27
May 6, 2024 04:57:41.809766054 CEST	21	53040	126.117.149.148	192.168.2.16
May 6, 2024 04:57:41.821861029 CEST	21	53118	149.154.65.23	192.168.2.16
May 6, 2024 04:57:41.821942091 CEST	21	53118	149.154.65.23	192.168.2.16
May 6, 2024 04:57:41.822161913 CEST	53118	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:41.825086117 CEST	53048	2121	192.168.2.16	123.233.204.6
May 6, 2024 04:57:41.825162888 CEST	53112	2121	192.168.2.16	186.202.183.96
May 6, 2024 04:57:41.825186014 CEST	52853	2121	192.168.2.16	168.220.94.137
May 6, 2024 04:57:41.825273037 CEST	52854	21	192.168.2.16	168.220.94.137
May 6, 2024 04:57:41.825622082 CEST	53169	2121	192.168.2.16	168.220.94.137
May 6, 2024 04:57:41.825655937 CEST	53170	21	192.168.2.16	168.220.94.137
May 6, 2024 04:57:41.837552071 CEST	21	53153	34.128.145.40	192.168.2.16
May 6, 2024 04:57:41.837608099 CEST	53153	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:41.837665081 CEST	53153	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:41.837830067 CEST	53171	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:41.840087891 CEST	53057	2121	192.168.2.16	114.52.241.72
May 6, 2024 04:57:41.850958109 CEST	21	53155	64.60.94.229	192.168.2.16
May 6, 2024 04:57:41.852396011 CEST	2121	53154	34.128.145.40	192.168.2.16
May 6, 2024 04:57:41.852444887 CEST	53154	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:41.852510929 CEST	53154	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:41.852706909 CEST	53172	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:41.856776953 CEST	2121	53001	86.122.178.216	192.168.2.16
May 6, 2024 04:57:41.860085964 CEST	2121	53156	64.60.94.229	192.168.2.16
May 6, 2024 04:57:41.867995024 CEST	21	53146	101.43.249.26	192.168.2.16
May 6, 2024 04:57:41.868067026 CEST	53146	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:41.872087955 CEST	53079	21	192.168.2.16	172.225.240.167
May 6, 2024 04:57:41.875191927 CEST	21	53131	208.106.130.31	192.168.2.16
May 6, 2024 04:57:41.875276089 CEST	21	53088	101.43.249.26	192.168.2.16
May 6, 2024 04:57:41.875313044 CEST	21	53088	101.43.249.26	192.168.2.16
May 6, 2024 04:57:41.875360012 CEST	53088	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:41.876801968 CEST	21	53161	208.106.130.31	192.168.2.16
May 6, 2024 04:57:41.876854897 CEST	53161	21	192.168.2.16	208.106.130.31
May 6, 2024 04:57:41.888086081 CEST	53080	2121	192.168.2.16	172.225.240.167
May 6, 2024 04:57:41.898787975 CEST	2121	53076	38.145.252.110	192.168.2.16
May 6, 2024 04:57:41.904244900 CEST	52995	21	192.168.2.16	119.118.49.175
May 6, 2024 04:57:41.920061111 CEST	52984	21	192.168.2.16	37.252.127.25
May 6, 2024 04:57:41.920080900 CEST	52983	2121	192.168.2.16	37.252.127.25
May 6, 2024 04:57:41.920116901 CEST	53113	21	192.168.2.16	24.250.200.141
May 6, 2024 04:57:41.934829950 CEST	2121	53169	168.220.94.137	192.168.2.16
May 6, 2024 04:57:41.934844017 CEST	21	53170	168.220.94.137	192.168.2.16
May 6, 2024 04:57:41.934890032 CEST	53169	2121	192.168.2.16	168.220.94.137
May 6, 2024 04:57:41.934914112 CEST	53170	21	192.168.2.16	168.220.94.137
May 6, 2024 04:57:41.936968088 CEST	2121	52853	168.220.94.137	192.168.2.16
May 6, 2024 04:57:41.937617064 CEST	21	52854	168.220.94.137	192.168.2.16
May 6, 2024 04:57:41.940028906 CEST	21	53097	154.210.32.21	192.168.2.16
May 6, 2024 04:57:41.940145969 CEST	53097	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:41.940304995 CEST	53173	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:41.940848112 CEST	21	53097	154.210.32.21	192.168.2.16
May 6, 2024 04:57:41.940890074 CEST	53097	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:41.943228960 CEST	21	53075	38.145.252.110	192.168.2.16
May 6, 2024 04:57:41.946928024 CEST	21	53153	34.128.145.40	192.168.2.16
May 6, 2024 04:57:41.947463036 CEST	21	53171	34.128.145.40	192.168.2.16
May 6, 2024 04:57:41.947520971 CEST	53171	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:41.961771011 CEST	2121	53154	34.128.145.40	192.168.2.16
May 6, 2024 04:57:41.961920023 CEST	2121	53172	34.128.145.40	192.168.2.16
May 6, 2024 04:57:41.961978912 CEST	53172	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:41.968626976 CEST	53174	21	192.168.2.16	112.103.58.173
May 6, 2024 04:57:41.987909079 CEST	21	53125	81.88.252.91	192.168.2.16
May 6, 2024 04:57:41.993195057 CEST	21	53125	81.88.252.91	192.168.2.16
May 6, 2024 04:57:41.993334055 CEST	53125	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:41.994976997 CEST	21	52928	45.87.1.166	192.168.2.16
May 6, 2024 04:57:41.994999886 CEST	2121	53160	46.153.227.117	192.168.2.16
May 6, 2024 04:57:41.995127916 CEST	52928	21	192.168.2.16	45.87.1.166
May 6, 2024 04:57:41.995295048 CEST	53175	21	192.168.2.16	45.87.1.166
May 6, 2024 04:57:42.000096083 CEST	52978	21	192.168.2.16	108.145.135.55
May 6, 2024 04:57:42.000123978 CEST	52979	2121	192.168.2.16	108.145.135.55
May 6, 2024 04:57:42.000332117 CEST	53176	2121	192.168.2.16	112.103.58.173
May 6, 2024 04:57:42.008296013 CEST	21	53111	186.202.183.96	192.168.2.16
May 6, 2024 04:57:42.008353949 CEST	53111	21	192.168.2.16	186.202.183.96
May 6, 2024 04:57:42.016083002 CEST	52982	21	192.168.2.16	188.214.156.147
May 6, 2024 04:57:42.016357899 CEST	53177	21	192.168.2.16	79.46.34.6
May 6, 2024 04:57:42.027029991 CEST	21	53056	114.52.241.72	192.168.2.16
May 6, 2024 04:57:42.033123016 CEST	21	53147	87.106.26.129	192.168.2.16
May 6, 2024 04:57:42.033278942 CEST	53147	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:42.034152985 CEST	52985	21	192.168.2.16	173.171.113.43
May 6, 2024 04:57:42.048297882 CEST	52986	2121	192.168.2.16	173.171.113.43
May 6, 2024 04:57:42.048299074 CEST	52987	21	192.168.2.16	94.12.110.147
May 6, 2024 04:57:42.048347950 CEST	53178	2121	192.168.2.16	79.46.34.6
May 6, 2024 04:57:42.057176113 CEST	21	53171	34.128.145.40	192.168.2.16
May 6, 2024 04:57:42.057230949 CEST	53171	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:42.057282925 CEST	53171	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:42.057432890 CEST	53179	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:42.064102888 CEST	53120	2121	192.168.2.16	24.250.200.141
May 6, 2024 04:57:42.064389944 CEST	21	53117	47.98.154.221	192.168.2.16
May 6, 2024 04:57:42.064402103 CEST	21	53117	47.98.154.221	192.168.2.16
May 6, 2024 04:57:42.064559937 CEST	53117	21	192.168.2.16	47.98.154.221
May 6, 2024 04:57:42.066059113 CEST	53119	21	192.168.2.16	51.198.140.33
May 6, 2024 04:57:42.071280956 CEST	2121	53172	34.128.145.40	192.168.2.16
May 6, 2024 04:57:42.071336985 CEST	53172	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:42.071388006 CEST	53172	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:42.071532011 CEST	53180	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:42.073035002 CEST	2121	53166	182.16.189.156	192.168.2.16
May 6, 2024 04:57:42.073096991 CEST	53166	2121	192.168.2.16	182.16.189.156
May 6, 2024 04:57:42.074057102 CEST	21	53106	182.16.189.156	192.168.2.16
May 6, 2024 04:57:42.074109077 CEST	21	53161	208.106.130.31	192.168.2.16
May 6, 2024 04:57:42.074120045 CEST	21	53161	208.106.130.31	192.168.2.16
May 6, 2024 04:57:42.074161053 CEST	53161	21	192.168.2.16	208.106.130.31
May 6, 2024 04:57:42.074245930 CEST	53161	21	192.168.2.16	208.106.130.31
May 6, 2024 04:57:42.074445963 CEST	53181	21	192.168.2.16	208.106.130.31
May 6, 2024 04:57:42.079075098 CEST	21	53118	149.154.65.23	192.168.2.16
May 6, 2024 04:57:42.079195976 CEST	53118	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:42.079360962 CEST	53182	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:42.084656000 CEST	21	53104	103.109.6.215	192.168.2.16
May 6, 2024 04:57:42.084790945 CEST	53104	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:42.084979057 CEST	53183	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:42.096085072 CEST	53098	21	192.168.2.16	88.98.150.250
May 6, 2024 04:57:42.096458912 CEST	53100	2121	192.168.2.16	88.98.150.250
May 6, 2024 04:57:42.097888947 CEST	21	53079	172.225.240.167	192.168.2.16
May 6, 2024 04:57:42.102696896 CEST	2121	52997	119.118.49.175	192.168.2.16
May 6, 2024 04:57:42.109049082 CEST	21	53133	202.168.242.122	192.168.2.16
May 6, 2024 04:57:42.109117985 CEST	53133	21	192.168.2.16	202.168.242.122
May 6, 2024 04:57:42.109283924 CEST	53133	21	192.168.2.16	202.168.242.122
May 6, 2024 04:57:42.109508991 CEST	53184	21	192.168.2.16	202.168.242.122
May 6, 2024 04:57:42.112066984 CEST	53121	2121	192.168.2.16	51.198.140.33
May 6, 2024 04:57:42.112085104 CEST	53090	2121	192.168.2.16	149.3.88.64
May 6, 2024 04:57:42.115688086 CEST	2121	53080	172.225.240.167	192.168.2.16
May 6, 2024 04:57:42.128087044 CEST	53122	21	192.168.2.16	82.32.25.232
May 6, 2024 04:57:42.128089905 CEST	52974	2121	192.168.2.16	124.63.104.1
May 6, 2024 04:57:42.128089905 CEST	52990	2121	192.168.2.16	94.12.110.147
May 6, 2024 04:57:42.128354073 CEST	53132	21	192.168.2.16	222.226.177.2
May 6, 2024 04:57:42.128355980 CEST	53185	21	192.168.2.16	121.204.151.213
May 6, 2024 04:57:42.144081116 CEST	52992	2121	192.168.2.16	173.199.181.149
May 6, 2024 04:57:42.144798040 CEST	21	52984	37.252.127.25	192.168.2.16
May 6, 2024 04:57:42.146553040 CEST	2121	52983	37.252.127.25	192.168.2.16
May 6, 2024 04:57:42.160082102 CEST	53134	2121	192.168.2.16	222.226.177.2
May 6, 2024 04:57:42.160989046 CEST	53186	2121	192.168.2.16	121.204.151.213
May 6, 2024 04:57:42.161078930 CEST	53187	21	192.168.2.16	82.44.78.193
May 6, 2024 04:57:42.161227942 CEST	53189	21	192.168.2.16	80.182.30.176
May 6, 2024 04:57:42.161257982 CEST	53188	2121	192.168.2.16	82.44.78.193
May 6, 2024 04:57:42.166867018 CEST	21	53171	34.128.145.40	192.168.2.16
May 6, 2024 04:57:42.167048931 CEST	21	53179	34.128.145.40	192.168.2.16
May 6, 2024 04:57:42.167109966 CEST	53179	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:42.176090956 CEST	53123	2121	192.168.2.16	82.32.25.232
May 6, 2024 04:57:42.176348925 CEST	53190	2121	192.168.2.16	80.182.30.176
May 6, 2024 04:57:42.178484917 CEST	2121	53057	114.52.241.72	192.168.2.16
May 6, 2024 04:57:42.180625916 CEST	2121	53172	34.128.145.40	192.168.2.16
May 6, 2024 04:57:42.181548119 CEST	2121	53180	34.128.145.40	192.168.2.16
May 6, 2024 04:57:42.182933092 CEST	53180	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:42.192413092 CEST	53191	21	192.168.2.16	79.46.151.127
May 6, 2024 04:57:42.196990013 CEST	2121	53048	123.233.204.6	192.168.2.16
May 6, 2024 04:57:42.208395958 CEST	53192	2121	192.168.2.16	79.46.151.127
May 6, 2024 04:57:42.208487034 CEST	21	53146	101.43.249.26	192.168.2.16
May 6, 2024 04:57:42.208697081 CEST	53146	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:42.218199968 CEST	21	52928	45.87.1.166	192.168.2.16
May 6, 2024 04:57:42.218461990 CEST	52928	21	192.168.2.16	45.87.1.166
May 6, 2024 04:57:42.220700979 CEST	21	53175	45.87.1.166	192.168.2.16
May 6, 2024 04:57:42.221204042 CEST	53175	21	192.168.2.16	45.87.1.166
May 6, 2024 04:57:42.224066973 CEST	53041	2121	192.168.2.16	126.117.149.148
May 6, 2024 04:57:42.224086046 CEST	53127	21	192.168.2.16	69.242.195.128
May 6, 2024 04:57:42.231367111 CEST	21	53111	186.202.183.96	192.168.2.16
May 6, 2024 04:57:42.233232021 CEST	53111	21	192.168.2.16	186.202.183.96
May 6, 2024 04:57:42.233422995 CEST	53193	21	192.168.2.16	78.202.202.219
May 6, 2024 04:57:42.240092039 CEST	53128	2121	192.168.2.16	69.242.195.128
May 6, 2024 04:57:42.251669884 CEST	21	53161	208.106.130.31	192.168.2.16
May 6, 2024 04:57:42.252163887 CEST	21	53181	208.106.130.31	192.168.2.16
May 6, 2024 04:57:42.255079031 CEST	53181	21	192.168.2.16	208.106.130.31
May 6, 2024 04:57:42.256176949 CEST	52999	2121	192.168.2.16	190.112.14.253
May 6, 2024 04:57:42.256179094 CEST	52998	21	192.168.2.16	190.112.14.253
May 6, 2024 04:57:42.261451006 CEST	21	53147	87.106.26.129	192.168.2.16
May 6, 2024 04:57:42.261604071 CEST	21	53147	87.106.26.129	192.168.2.16
May 6, 2024 04:57:42.261759043 CEST	53147	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:42.272219896 CEST	53000	21	192.168.2.16	86.122.178.216
May 6, 2024 04:57:42.272221088 CEST	53004	2121	192.168.2.16	173.190.98.65
May 6, 2024 04:57:42.272222042 CEST	53003	21	192.168.2.16	173.190.98.65
May 6, 2024 04:57:42.273724079 CEST	21	53125	81.88.252.91	192.168.2.16
May 6, 2024 04:57:42.273740053 CEST	21	53125	81.88.252.91	192.168.2.16
May 6, 2024 04:57:42.274023056 CEST	53194	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:42.276693106 CEST	21	53097	154.210.32.21	192.168.2.16
May 6, 2024 04:57:42.276864052 CEST	21	53179	34.128.145.40	192.168.2.16
May 6, 2024 04:57:42.277194023 CEST	53179	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:42.277247906 CEST	53179	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:42.277417898 CEST	53195	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:42.283440113 CEST	21	53173	154.210.32.21	192.168.2.16
May 6, 2024 04:57:42.283525944 CEST	53173	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:42.288124084 CEST	52839	21	192.168.2.16	92.205.10.177
May 6, 2024 04:57:42.288566113 CEST	53196	21	192.168.2.16	92.205.10.177
May 6, 2024 04:57:42.293015003 CEST	2121	53180	34.128.145.40	192.168.2.16
May 6, 2024 04:57:42.293070078 CEST	53180	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:42.293122053 CEST	53180	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:42.293262959 CEST	53197	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:42.300965071 CEST	21	52995	119.118.49.175	192.168.2.16
May 6, 2024 04:57:42.304095030 CEST	53129	21	192.168.2.16	189.85.166.218
May 6, 2024 04:57:42.320084095 CEST	53040	21	192.168.2.16	126.117.149.148
May 6, 2024 04:57:42.321166992 CEST	53130	2121	192.168.2.16	189.85.166.218
May 6, 2024 04:57:42.328649044 CEST	2121	53100	88.98.150.250	192.168.2.16
May 6, 2024 04:57:42.330284119 CEST	21	53098	88.98.150.250	192.168.2.16
May 6, 2024 04:57:42.334964037 CEST	21	53182	149.154.65.23	192.168.2.16
May 6, 2024 04:57:42.335217953 CEST	21	53118	149.154.65.23	192.168.2.16
May 6, 2024 04:57:42.335294962 CEST	53118	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:42.335309029 CEST	53182	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:42.336486101 CEST	53198	2121	192.168.2.16	78.202.202.219
May 6, 2024 04:57:42.352380991 CEST	53155	21	192.168.2.16	64.60.94.229
May 6, 2024 04:57:42.352653027 CEST	53199	21	192.168.2.16	93.217.65.214
May 6, 2024 04:57:42.368067980 CEST	53001	2121	192.168.2.16	86.122.178.216
May 6, 2024 04:57:42.368083954 CEST	53135	21	192.168.2.16	24.20.217.203
May 6, 2024 04:57:42.368083954 CEST	53007	2121	192.168.2.16	93.223.129.127
May 6, 2024 04:57:42.368087053 CEST	53006	21	192.168.2.16	99.246.108.168
May 6, 2024 04:57:42.368669033 CEST	53156	2121	192.168.2.16	64.60.94.229
May 6, 2024 04:57:42.384078979 CEST	53136	2121	192.168.2.16	24.20.217.203
May 6, 2024 04:57:42.384079933 CEST	53008	2121	192.168.2.16	99.246.108.168
May 6, 2024 04:57:42.386977911 CEST	21	53195	34.128.145.40	192.168.2.16
May 6, 2024 04:57:42.387059927 CEST	53195	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:42.387590885 CEST	21	53179	34.128.145.40	192.168.2.16
May 6, 2024 04:57:42.395983934 CEST	2121	53090	149.3.88.64	192.168.2.16
May 6, 2024 04:57:42.400103092 CEST	53009	21	192.168.2.16	98.208.231.181
May 6, 2024 04:57:42.400105000 CEST	53138	2121	192.168.2.16	97.124.40.223
May 6, 2024 04:57:42.400995970 CEST	53137	21	192.168.2.16	97.124.40.223
May 6, 2024 04:57:42.401012897 CEST	53139	21	192.168.2.16	111.70.8.82
May 6, 2024 04:57:42.401012897 CEST	53076	2121	192.168.2.16	38.145.252.110
May 6, 2024 04:57:42.402470112 CEST	2121	53197	34.128.145.40	192.168.2.16
May 6, 2024 04:57:42.403073072 CEST	53197	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:42.403129101 CEST	2121	53180	34.128.145.40	192.168.2.16
May 6, 2024 04:57:42.415849924 CEST	21	53132	222.226.177.2	192.168.2.16
May 6, 2024 04:57:42.416105986 CEST	53011	2121	192.168.2.16	98.208.231.181
May 6, 2024 04:57:42.418091059 CEST	21	53117	47.98.154.221	192.168.2.16
May 6, 2024 04:57:42.418456078 CEST	21	53117	47.98.154.221	192.168.2.16
May 6, 2024 04:57:42.418498039 CEST	53117	21	192.168.2.16	47.98.154.221
May 6, 2024 04:57:42.418541908 CEST	53117	21	192.168.2.16	47.98.154.221
May 6, 2024 04:57:42.418848991 CEST	53200	21	192.168.2.16	47.98.154.221
May 6, 2024 04:57:42.428075075 CEST	2121	52974	124.63.104.1	192.168.2.16
May 6, 2024 04:57:42.429507971 CEST	53201	2121	192.168.2.16	93.217.65.214
May 6, 2024 04:57:42.432090998 CEST	53142	2121	192.168.2.16	111.70.8.82
May 6, 2024 04:57:42.432097912 CEST	53013	21	192.168.2.16	120.27.149.253
May 6, 2024 04:57:42.432868958 CEST	21	53104	103.109.6.215	192.168.2.16
May 6, 2024 04:57:42.432915926 CEST	21	53104	103.109.6.215	192.168.2.16
May 6, 2024 04:57:42.433181047 CEST	53104	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:42.447673082 CEST	2121	53134	222.226.177.2	192.168.2.16
May 6, 2024 04:57:42.448087931 CEST	53075	21	192.168.2.16	38.145.252.110
May 6, 2024 04:57:42.448137045 CEST	53143	21	192.168.2.16	84.133.1.144
May 6, 2024 04:57:42.448509932 CEST	53202	21	192.168.2.16	182.227.231.106
May 6, 2024 04:57:42.448765039 CEST	21	53111	186.202.183.96	192.168.2.16
May 6, 2024 04:57:42.448899031 CEST	21	53111	186.202.183.96	192.168.2.16
May 6, 2024 04:57:42.448952913 CEST	53111	21	192.168.2.16	186.202.183.96
May 6, 2024 04:57:42.449278116 CEST	21	53181	208.106.130.31	192.168.2.16
May 6, 2024 04:57:42.449290037 CEST	21	53181	208.106.130.31	192.168.2.16
May 6, 2024 04:57:42.449341059 CEST	53181	21	192.168.2.16	208.106.130.31
May 6, 2024 04:57:42.449409962 CEST	53181	21	192.168.2.16	208.106.130.31
May 6, 2024 04:57:42.449599028 CEST	53203	21	192.168.2.16	208.106.130.31
May 6, 2024 04:57:42.452584028 CEST	21	53175	45.87.1.166	192.168.2.16
May 6, 2024 04:57:42.453243017 CEST	53175	21	192.168.2.16	45.87.1.166
May 6, 2024 04:57:42.467904091 CEST	21	53183	103.109.6.215	192.168.2.16
May 6, 2024 04:57:42.467982054 CEST	53183	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:42.480596066 CEST	53204	21	192.168.2.16	216.117.162.236
May 6, 2024 04:57:42.485059977 CEST	21	53133	202.168.242.122	192.168.2.16
May 6, 2024 04:57:42.486114979 CEST	21	53185	121.204.151.213	192.168.2.16
May 6, 2024 04:57:42.490236998 CEST	21	53147	87.106.26.129	192.168.2.16
May 6, 2024 04:57:42.490391016 CEST	53147	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:42.490638971 CEST	53205	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:42.494921923 CEST	2121	53041	126.117.149.148	192.168.2.16
May 6, 2024 04:57:42.494940996 CEST	21	53184	202.168.242.122	192.168.2.16
May 6, 2024 04:57:42.495008945 CEST	53184	21	192.168.2.16	202.168.242.122
May 6, 2024 04:57:42.496092081 CEST	53144	2121	192.168.2.16	84.133.1.144
May 6, 2024 04:57:42.496093035 CEST	53160	2121	192.168.2.16	46.153.227.117
May 6, 2024 04:57:42.499334097 CEST	21	53195	34.128.145.40	192.168.2.16
May 6, 2024 04:57:42.500231981 CEST	53195	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:42.500291109 CEST	53195	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:42.500453949 CEST	53206	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:42.507977962 CEST	2121	53186	121.204.151.213	192.168.2.16
May 6, 2024 04:57:42.511358023 CEST	21	53196	92.205.10.177	192.168.2.16
May 6, 2024 04:57:42.512613058 CEST	53196	21	192.168.2.16	92.205.10.177
May 6, 2024 04:57:42.513314009 CEST	2121	53197	34.128.145.40	192.168.2.16
May 6, 2024 04:57:42.513920069 CEST	53197	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:42.513988018 CEST	53197	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:42.514153957 CEST	53207	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:42.528095961 CEST	53145	21	192.168.2.16	45.58.44.238
May 6, 2024 04:57:42.528095961 CEST	53056	21	192.168.2.16	114.52.241.72
May 6, 2024 04:57:42.538149118 CEST	21	53155	64.60.94.229	192.168.2.16
May 6, 2024 04:57:42.539593935 CEST	21	53194	81.88.252.91	192.168.2.16
May 6, 2024 04:57:42.540441990 CEST	53194	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:42.544123888 CEST	53018	21	192.168.2.16	180.249.197.252
May 6, 2024 04:57:42.544126034 CEST	53017	2121	192.168.2.16	120.27.149.253
May 6, 2024 04:57:42.548177004 CEST	21	52954	193.124.183.222	192.168.2.16
May 6, 2024 04:57:42.548362970 CEST	52954	21	192.168.2.16	193.124.183.222
May 6, 2024 04:57:42.548648119 CEST	53208	21	192.168.2.16	193.124.183.222
May 6, 2024 04:57:42.548970938 CEST	21	53146	101.43.249.26	192.168.2.16
May 6, 2024 04:57:42.549110889 CEST	53146	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:42.549326897 CEST	53209	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:42.553478956 CEST	2121	53156	64.60.94.229	192.168.2.16
May 6, 2024 04:57:42.553669930 CEST	21	52839	92.205.10.177	192.168.2.16
May 6, 2024 04:57:42.560081959 CEST	53148	2121	192.168.2.16	45.58.44.238
May 6, 2024 04:57:42.560785055 CEST	53019	2121	192.168.2.16	180.249.197.252
May 6, 2024 04:57:42.569221973 CEST	2121	53076	38.145.252.110	192.168.2.16
May 6, 2024 04:57:42.576083899 CEST	53149	21	192.168.2.16	96.247.204.60
May 6, 2024 04:57:42.592550993 CEST	53210	2121	192.168.2.16	182.227.231.106
May 6, 2024 04:57:42.592633963 CEST	53211	21	192.168.2.16	78.34.28.9
May 6, 2024 04:57:42.599551916 CEST	21	53182	149.154.65.23	192.168.2.16
May 6, 2024 04:57:42.600143909 CEST	53182	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:42.608077049 CEST	53020	21	192.168.2.16	119.116.143.203
May 6, 2024 04:57:42.608079910 CEST	53079	21	192.168.2.16	172.225.240.167
May 6, 2024 04:57:42.608135939 CEST	53150	2121	192.168.2.16	96.247.204.60
May 6, 2024 04:57:42.608208895 CEST	52997	2121	192.168.2.16	119.118.49.175
May 6, 2024 04:57:42.609741926 CEST	21	53206	34.128.145.40	192.168.2.16
May 6, 2024 04:57:42.609824896 CEST	53206	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:42.609844923 CEST	21	53195	34.128.145.40	192.168.2.16
May 6, 2024 04:57:42.622473001 CEST	21	53040	126.117.149.148	192.168.2.16
May 6, 2024 04:57:42.623120070 CEST	2121	53197	34.128.145.40	192.168.2.16
May 6, 2024 04:57:42.623703003 CEST	2121	53207	34.128.145.40	192.168.2.16
May 6, 2024 04:57:42.623754978 CEST	53207	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:42.624083996 CEST	53080	2121	192.168.2.16	172.225.240.167
May 6, 2024 04:57:42.624082088 CEST	53152	2121	192.168.2.16	172.93.226.61
May 6, 2024 04:57:42.624500036 CEST	53151	21	192.168.2.16	172.93.226.61
May 6, 2024 04:57:42.624500036 CEST	53212	2121	192.168.2.16	78.34.28.9
May 6, 2024 04:57:42.624592066 CEST	53213	21	192.168.2.16	175.172.107.98
May 6, 2024 04:57:42.626060009 CEST	21	53203	208.106.130.31	192.168.2.16
May 6, 2024 04:57:42.626463890 CEST	53203	21	192.168.2.16	208.106.130.31
May 6, 2024 04:57:42.627155066 CEST	21	53181	208.106.130.31	192.168.2.16
May 6, 2024 04:57:42.628321886 CEST	21	53173	154.210.32.21	192.168.2.16
May 6, 2024 04:57:42.629241943 CEST	21	53075	38.145.252.110	192.168.2.16
May 6, 2024 04:57:42.629270077 CEST	53173	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:42.638780117 CEST	2121	53001	86.122.178.216	192.168.2.16
May 6, 2024 04:57:42.640258074 CEST	53021	2121	192.168.2.16	119.116.143.203
May 6, 2024 04:57:42.656094074 CEST	53024	21	192.168.2.16	187.247.144.164
May 6, 2024 04:57:42.656384945 CEST	53214	2121	192.168.2.16	175.172.107.98
May 6, 2024 04:57:42.678704977 CEST	21	53175	45.87.1.166	192.168.2.16
May 6, 2024 04:57:42.678879976 CEST	21	53175	45.87.1.166	192.168.2.16
May 6, 2024 04:57:42.678994894 CEST	53175	21	192.168.2.16	45.87.1.166
May 6, 2024 04:57:42.684334040 CEST	21	52839	92.205.10.177	192.168.2.16
May 6, 2024 04:57:42.684391022 CEST	52839	21	192.168.2.16	92.205.10.177
May 6, 2024 04:57:42.684432030 CEST	21	52839	92.205.10.177	192.168.2.16
May 6, 2024 04:57:42.684478045 CEST	52839	21	192.168.2.16	92.205.10.177
May 6, 2024 04:57:42.685226917 CEST	21	52839	92.205.10.177	192.168.2.16
May 6, 2024 04:57:42.688071012 CEST	53057	2121	192.168.2.16	114.52.241.72
May 6, 2024 04:57:42.688112020 CEST	53158	21	192.168.2.16	46.153.227.117
May 6, 2024 04:57:42.688113928 CEST	52839	21	192.168.2.16	92.205.10.177
May 6, 2024 04:57:42.688175917 CEST	53157	21	192.168.2.16	183.4.9.108
May 6, 2024 04:57:42.688337088 CEST	53159	2121	192.168.2.16	183.4.9.108
May 6, 2024 04:57:42.698364973 CEST	2121	53166	182.16.189.156	192.168.2.16
May 6, 2024 04:57:42.698730946 CEST	53215	2121	192.168.2.16	182.16.189.156
May 6, 2024 04:57:42.704081059 CEST	53048	2121	192.168.2.16	123.233.204.6
May 6, 2024 04:57:42.708051920 CEST	21	53106	182.16.189.156	192.168.2.16
May 6, 2024 04:57:42.708259106 CEST	53106	21	192.168.2.16	182.16.189.156
May 6, 2024 04:57:42.718810081 CEST	21	53205	87.106.26.129	192.168.2.16
May 6, 2024 04:57:42.718878031 CEST	53205	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:42.719295979 CEST	21	53206	34.128.145.40	192.168.2.16
May 6, 2024 04:57:42.719350100 CEST	53206	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:42.719398975 CEST	53206	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:42.719568968 CEST	53216	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:42.720088959 CEST	53162	21	192.168.2.16	195.224.228.187
May 6, 2024 04:57:42.720088959 CEST	53163	21	192.168.2.16	90.180.171.146
May 6, 2024 04:57:42.720103979 CEST	53164	2121	192.168.2.16	195.224.228.187
May 6, 2024 04:57:42.720107079 CEST	53165	2121	192.168.2.16	90.180.171.146
May 6, 2024 04:57:42.720523119 CEST	21	53147	87.106.26.129	192.168.2.16
May 6, 2024 04:57:42.720825911 CEST	53147	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:42.733608007 CEST	2121	53207	34.128.145.40	192.168.2.16
May 6, 2024 04:57:42.734107971 CEST	53207	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:42.734169960 CEST	53207	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:42.734338999 CEST	53217	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:42.736542940 CEST	53218	21	192.168.2.16	86.16.194.130
May 6, 2024 04:57:42.736692905 CEST	21	53196	92.205.10.177	192.168.2.16
May 6, 2024 04:57:42.736870050 CEST	53196	21	192.168.2.16	92.205.10.177
May 6, 2024 04:57:42.752104998 CEST	53028	2121	192.168.2.16	187.247.144.164
May 6, 2024 04:57:42.755644083 CEST	21	53200	47.98.154.221	192.168.2.16
May 6, 2024 04:57:42.755733967 CEST	53200	21	192.168.2.16	47.98.154.221
May 6, 2024 04:57:42.763351917 CEST	21	53117	47.98.154.221	192.168.2.16
May 6, 2024 04:57:42.771251917 CEST	21	53202	182.227.231.106	192.168.2.16
May 6, 2024 04:57:42.792023897 CEST	2121	53160	46.153.227.117	192.168.2.16
May 6, 2024 04:57:42.816107988 CEST	52995	21	192.168.2.16	119.118.49.175
May 6, 2024 04:57:42.816119909 CEST	53167	21	192.168.2.16	200.101.247.27
May 6, 2024 04:57:42.816132069 CEST	53168	2121	192.168.2.16	200.101.247.27
May 6, 2024 04:57:42.819397926 CEST	21	53194	81.88.252.91	192.168.2.16
May 6, 2024 04:57:42.820197105 CEST	53194	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:42.822581053 CEST	21	52954	193.124.183.222	192.168.2.16
May 6, 2024 04:57:42.822752953 CEST	21	53208	193.124.183.222	192.168.2.16
May 6, 2024 04:57:42.822809935 CEST	52954	21	192.168.2.16	193.124.183.222
May 6, 2024 04:57:42.822844982 CEST	53208	21	192.168.2.16	193.124.183.222
May 6, 2024 04:57:42.823952913 CEST	21	53056	114.52.241.72	192.168.2.16
May 6, 2024 04:57:42.824137926 CEST	21	53203	208.106.130.31	192.168.2.16
May 6, 2024 04:57:42.824203968 CEST	21	53203	208.106.130.31	192.168.2.16
May 6, 2024 04:57:42.824275970 CEST	53203	21	192.168.2.16	208.106.130.31
May 6, 2024 04:57:42.824301958 CEST	53203	21	192.168.2.16	208.106.130.31
May 6, 2024 04:57:42.824573994 CEST	53219	21	192.168.2.16	208.106.130.31
May 6, 2024 04:57:42.828576088 CEST	21	53206	34.128.145.40	192.168.2.16
May 6, 2024 04:57:42.828785896 CEST	21	53216	34.128.145.40	192.168.2.16
May 6, 2024 04:57:42.828879118 CEST	53216	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:42.832120895 CEST	53031	21	192.168.2.16	76.155.219.53
May 6, 2024 04:57:42.832122087 CEST	53100	2121	192.168.2.16	88.98.150.250
May 6, 2024 04:57:42.835467100 CEST	21	53079	172.225.240.167	192.168.2.16
May 6, 2024 04:57:42.836421013 CEST	53030	2121	192.168.2.16	76.155.219.53
May 6, 2024 04:57:42.844697952 CEST	2121	53207	34.128.145.40	192.168.2.16
May 6, 2024 04:57:42.844844103 CEST	2121	53217	34.128.145.40	192.168.2.16
May 6, 2024 04:57:42.844899893 CEST	53217	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:42.848089933 CEST	53098	21	192.168.2.16	88.98.150.250
May 6, 2024 04:57:42.851011038 CEST	21	53027	194.181.93.169	192.168.2.16
May 6, 2024 04:57:42.851583958 CEST	21	53183	103.109.6.215	192.168.2.16
May 6, 2024 04:57:42.851640940 CEST	2121	53080	172.225.240.167	192.168.2.16
May 6, 2024 04:57:42.851741076 CEST	53183	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:42.851800919 CEST	53027	21	192.168.2.16	194.181.93.169
May 6, 2024 04:57:42.852065086 CEST	53220	21	192.168.2.16	194.181.93.169
May 6, 2024 04:57:42.857129097 CEST	21	53182	149.154.65.23	192.168.2.16
May 6, 2024 04:57:42.857270956 CEST	21	53182	149.154.65.23	192.168.2.16
May 6, 2024 04:57:42.857758999 CEST	53182	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:42.864084005 CEST	53034	21	192.168.2.16	212.239.223.10
May 6, 2024 04:57:42.880084991 CEST	53036	2121	192.168.2.16	212.239.223.10
May 6, 2024 04:57:42.880464077 CEST	21	53184	202.168.242.122	192.168.2.16
May 6, 2024 04:57:42.881201982 CEST	53184	21	192.168.2.16	202.168.242.122
May 6, 2024 04:57:42.881270885 CEST	53184	21	192.168.2.16	202.168.242.122
May 6, 2024 04:57:42.881505966 CEST	53221	21	192.168.2.16	202.168.242.122
May 6, 2024 04:57:42.889218092 CEST	21	53146	101.43.249.26	192.168.2.16
May 6, 2024 04:57:42.889230013 CEST	21	53146	101.43.249.26	192.168.2.16
May 6, 2024 04:57:42.889282942 CEST	53146	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:42.896102905 CEST	53090	2121	192.168.2.16	149.3.88.64
May 6, 2024 04:57:42.896105051 CEST	53038	21	192.168.2.16	74.131.225.252
May 6, 2024 04:57:42.897567034 CEST	21	53209	101.43.249.26	192.168.2.16
May 6, 2024 04:57:42.899415016 CEST	21	52110	188.214.156.147	192.168.2.16
May 6, 2024 04:57:42.899487972 CEST	53209	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:42.899487972 CEST	52110	21	192.168.2.16	188.214.156.147
May 6, 2024 04:57:42.911705971 CEST	2121	53210	182.227.231.106	192.168.2.16
May 6, 2024 04:57:42.912082911 CEST	53039	2121	192.168.2.16	74.131.225.252
May 6, 2024 04:57:42.928087950 CEST	53132	21	192.168.2.16	222.226.177.2
May 6, 2024 04:57:42.938175917 CEST	21	53216	34.128.145.40	192.168.2.16
May 6, 2024 04:57:42.938863039 CEST	53216	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:42.938924074 CEST	53216	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:42.939105988 CEST	53222	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:42.944070101 CEST	53043	2121	192.168.2.16	91.18.33.249
May 6, 2024 04:57:42.944097996 CEST	53042	21	192.168.2.16	91.18.33.249
May 6, 2024 04:57:42.948522091 CEST	21	53175	45.87.1.166	192.168.2.16
May 6, 2024 04:57:42.948791027 CEST	2121	52997	119.118.49.175	192.168.2.16
May 6, 2024 04:57:42.949327946 CEST	53223	2121	192.168.2.16	86.16.194.130
May 6, 2024 04:57:42.954586029 CEST	2121	53217	34.128.145.40	192.168.2.16
May 6, 2024 04:57:42.954665899 CEST	53217	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:42.954751015 CEST	53217	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:42.954938889 CEST	53224	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:42.959068060 CEST	53134	2121	192.168.2.16	222.226.177.2
May 6, 2024 04:57:42.959695101 CEST	21	53196	92.205.10.177	192.168.2.16
May 6, 2024 04:57:42.959789038 CEST	21	53196	92.205.10.177	192.168.2.16
May 6, 2024 04:57:42.960364103 CEST	53196	21	192.168.2.16	92.205.10.177
May 6, 2024 04:57:42.970345020 CEST	21	53205	87.106.26.129	192.168.2.16
May 6, 2024 04:57:42.970491886 CEST	53205	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:42.974087000 CEST	53174	21	192.168.2.16	112.103.58.173
May 6, 2024 04:57:42.974493980 CEST	21	53173	154.210.32.21	192.168.2.16
May 6, 2024 04:57:42.974670887 CEST	21	53173	154.210.32.21	192.168.2.16
May 6, 2024 04:57:42.975668907 CEST	53173	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:42.989083052 CEST	53044	21	192.168.2.16	79.150.30.103
May 6, 2024 04:57:43.000585079 CEST	21	53203	208.106.130.31	192.168.2.16
May 6, 2024 04:57:43.002599955 CEST	21	53219	208.106.130.31	192.168.2.16
May 6, 2024 04:57:43.004057884 CEST	53185	21	192.168.2.16	121.204.151.213
May 6, 2024 04:57:43.004075050 CEST	53041	2121	192.168.2.16	126.117.149.148
May 6, 2024 04:57:43.004075050 CEST	53176	2121	192.168.2.16	112.103.58.173
May 6, 2024 04:57:43.004096985 CEST	53219	21	192.168.2.16	208.106.130.31
May 6, 2024 04:57:43.005084991 CEST	53045	2121	192.168.2.16	79.150.30.103
May 6, 2024 04:57:43.021085024 CEST	53186	2121	192.168.2.16	121.204.151.213
May 6, 2024 04:57:43.021086931 CEST	53177	21	192.168.2.16	79.46.34.6
May 6, 2024 04:57:43.021087885 CEST	53046	21	192.168.2.16	123.233.204.6
May 6, 2024 04:57:43.026670933 CEST	2121	53057	114.52.241.72	192.168.2.16
May 6, 2024 04:57:43.037466049 CEST	53225	21	192.168.2.16	196.51.230.145
May 6, 2024 04:57:43.051114082 CEST	21	53216	34.128.145.40	192.168.2.16
May 6, 2024 04:57:43.051126957 CEST	21	53222	34.128.145.40	192.168.2.16
May 6, 2024 04:57:43.051208973 CEST	53222	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:43.053081036 CEST	53155	21	192.168.2.16	64.60.94.229
May 6, 2024 04:57:43.053093910 CEST	53178	2121	192.168.2.16	79.46.34.6
May 6, 2024 04:57:43.054593086 CEST	2121	53215	182.16.189.156	192.168.2.16
May 6, 2024 04:57:43.055516005 CEST	53215	2121	192.168.2.16	182.16.189.156
May 6, 2024 04:57:43.065146923 CEST	2121	53224	34.128.145.40	192.168.2.16
May 6, 2024 04:57:43.065208912 CEST	53224	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:43.065447092 CEST	2121	53217	34.128.145.40	192.168.2.16
May 6, 2024 04:57:43.065601110 CEST	2121	53100	88.98.150.250	192.168.2.16
May 6, 2024 04:57:43.065896034 CEST	21	53106	182.16.189.156	192.168.2.16
May 6, 2024 04:57:43.069139957 CEST	53156	2121	192.168.2.16	64.60.94.229
May 6, 2024 04:57:43.069536924 CEST	53226	2121	192.168.2.16	196.51.230.145
May 6, 2024 04:57:43.075974941 CEST	2121	53048	123.233.204.6	192.168.2.16
May 6, 2024 04:57:43.085062027 CEST	53076	2121	192.168.2.16	38.145.252.110
May 6, 2024 04:57:43.085227013 CEST	21	53098	88.98.150.250	192.168.2.16
May 6, 2024 04:57:43.085341930 CEST	53227	21	192.168.2.16	65.34.57.148
May 6, 2024 04:57:43.087588072 CEST	21	53194	81.88.252.91	192.168.2.16
May 6, 2024 04:57:43.087862968 CEST	53194	21	192.168.2.16	81.88.252.91
May 6, 2024 04:57:43.095082045 CEST	21	53220	194.181.93.169	192.168.2.16
May 6, 2024 04:57:43.095238924 CEST	21	53200	47.98.154.221	192.168.2.16
May 6, 2024 04:57:43.095321894 CEST	53220	21	192.168.2.16	194.181.93.169
May 6, 2024 04:57:43.095525980 CEST	53200	21	192.168.2.16	47.98.154.221
May 6, 2024 04:57:43.096807003 CEST	21	53027	194.181.93.169	192.168.2.16
May 6, 2024 04:57:43.096868038 CEST	53027	21	192.168.2.16	194.181.93.169
May 6, 2024 04:57:43.100083113 CEST	53050	21	192.168.2.16	163.213.212.55
May 6, 2024 04:57:43.100348949 CEST	53228	2121	192.168.2.16	65.34.57.148
May 6, 2024 04:57:43.102879047 CEST	21	53208	193.124.183.222	192.168.2.16
May 6, 2024 04:57:43.103660107 CEST	53208	21	192.168.2.16	193.124.183.222
May 6, 2024 04:57:43.114882946 CEST	21	53182	149.154.65.23	192.168.2.16
May 6, 2024 04:57:43.115134954 CEST	53182	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:43.115355015 CEST	53229	21	192.168.2.16	149.154.65.23
May 6, 2024 04:57:43.116095066 CEST	53053	2121	192.168.2.16	163.213.212.55
May 6, 2024 04:57:43.116122007 CEST	53052	21	192.168.2.16	187.149.53.123
May 6, 2024 04:57:43.117064953 CEST	53230	21	192.168.2.16	47.151.189.85
May 6, 2024 04:57:43.117187977 CEST	53231	2121	192.168.2.16	47.151.189.85
May 6, 2024 04:57:43.117326975 CEST	53232	21	192.168.2.16	104.32.108.198
May 6, 2024 04:57:43.117391109 CEST	53233	2121	192.168.2.16	104.32.108.198
May 6, 2024 04:57:43.117461920 CEST	53234	21	192.168.2.16	47.252.93.45
May 6, 2024 04:57:43.132092953 CEST	53040	21	192.168.2.16	126.117.149.148
May 6, 2024 04:57:43.132097006 CEST	53055	2121	192.168.2.16	187.149.53.123
May 6, 2024 04:57:43.132203102 CEST	53075	21	192.168.2.16	38.145.252.110
May 6, 2024 04:57:43.132767916 CEST	53235	2121	192.168.2.16	47.252.93.45
May 6, 2024 04:57:43.132869005 CEST	53236	21	192.168.2.16	108.158.99.55
May 6, 2024 04:57:43.132961988 CEST	53237	21	192.168.2.16	68.47.6.75
May 6, 2024 04:57:43.132987022 CEST	53238	2121	192.168.2.16	108.158.99.55
May 6, 2024 04:57:43.133007050 CEST	53239	2121	192.168.2.16	68.47.6.75
May 6, 2024 04:57:43.148427010 CEST	53240	21	192.168.2.16	65.229.128.169
May 6, 2024 04:57:43.161057949 CEST	21	53222	34.128.145.40	192.168.2.16
May 6, 2024 04:57:43.161123037 CEST	53222	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:43.161178112 CEST	53222	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:43.161334038 CEST	53241	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:43.164072990 CEST	53188	2121	192.168.2.16	82.44.78.193
May 6, 2024 04:57:43.164088964 CEST	53187	21	192.168.2.16	82.44.78.193
May 6, 2024 04:57:43.164091110 CEST	53189	21	192.168.2.16	80.182.30.176
May 6, 2024 04:57:43.164369106 CEST	53242	2121	192.168.2.16	65.229.128.169
May 6, 2024 04:57:43.174376965 CEST	2121	53224	34.128.145.40	192.168.2.16
May 6, 2024 04:57:43.174433947 CEST	53224	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:43.174494028 CEST	53224	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:43.174647093 CEST	53243	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:43.180092096 CEST	53190	2121	192.168.2.16	80.182.30.176
May 6, 2024 04:57:43.180798054 CEST	53244	21	192.168.2.16	187.217.226.221
May 6, 2024 04:57:43.180901051 CEST	53245	2121	192.168.2.16	187.217.226.221
May 6, 2024 04:57:43.181019068 CEST	53246	21	192.168.2.16	126.105.17.253
May 6, 2024 04:57:43.181960106 CEST	2121	53090	149.3.88.64	192.168.2.16
May 6, 2024 04:57:43.196084023 CEST	53191	21	192.168.2.16	79.46.151.127
May 6, 2024 04:57:43.198688984 CEST	21	53205	87.106.26.129	192.168.2.16
May 6, 2024 04:57:43.198851109 CEST	21	53205	87.106.26.129	192.168.2.16
May 6, 2024 04:57:43.198993921 CEST	53205	21	192.168.2.16	87.106.26.129
May 6, 2024 04:57:43.199374914 CEST	21	53219	208.106.130.31	192.168.2.16
May 6, 2024 04:57:43.199385881 CEST	21	53219	208.106.130.31	192.168.2.16
May 6, 2024 04:57:43.199429989 CEST	53219	21	192.168.2.16	208.106.130.31
May 6, 2024 04:57:43.199497938 CEST	53219	21	192.168.2.16	208.106.130.31
May 6, 2024 04:57:43.199672937 CEST	53247	21	192.168.2.16	208.106.130.31
May 6, 2024 04:57:43.212085962 CEST	53192	2121	192.168.2.16	79.46.151.127
May 6, 2024 04:57:43.212097883 CEST	53058	21	192.168.2.16	2.220.119.31
May 6, 2024 04:57:43.212894917 CEST	21	52995	119.118.49.175	192.168.2.16
May 6, 2024 04:57:43.217168093 CEST	21	53132	222.226.177.2	192.168.2.16
May 6, 2024 04:57:43.219822884 CEST	21	53225	196.51.230.145	192.168.2.16
May 6, 2024 04:57:43.223696947 CEST	21	53196	92.205.10.177	192.168.2.16
May 6, 2024 04:57:43.228082895 CEST	53060	2121	192.168.2.16	2.220.119.31
May 6, 2024 04:57:43.228166103 CEST	53061	21	192.168.2.16	167.56.162.214
May 6, 2024 04:57:43.228533030 CEST	53248	21	192.168.2.16	218.152.253.197
May 6, 2024 04:57:43.228593111 CEST	53249	2121	192.168.2.16	126.105.17.253
May 6, 2024 04:57:43.234781027 CEST	21	53183	103.109.6.215	192.168.2.16
May 6, 2024 04:57:43.234894037 CEST	53183	21	192.168.2.16	103.109.6.215
May 6, 2024 04:57:43.238881111 CEST	21	53155	64.60.94.229	192.168.2.16
May 6, 2024 04:57:43.244226933 CEST	53193	21	192.168.2.16	78.202.202.219
May 6, 2024 04:57:43.246576071 CEST	2121	53134	222.226.177.2	192.168.2.16
May 6, 2024 04:57:43.248439074 CEST	21	53209	101.43.249.26	192.168.2.16
May 6, 2024 04:57:43.248599052 CEST	53209	21	192.168.2.16	101.43.249.26
May 6, 2024 04:57:43.252496958 CEST	2121	53076	38.145.252.110	192.168.2.16
May 6, 2024 04:57:43.252788067 CEST	2121	53226	196.51.230.145	192.168.2.16
May 6, 2024 04:57:43.252851963 CEST	53250	2121	192.168.2.16	218.152.253.197
May 6, 2024 04:57:43.253241062 CEST	2121	53156	64.60.94.229	192.168.2.16
May 6, 2024 04:57:43.254257917 CEST	21	53221	202.168.242.122	192.168.2.16
May 6, 2024 04:57:43.254317045 CEST	53221	21	192.168.2.16	202.168.242.122
May 6, 2024 04:57:43.260061026 CEST	53063	21	192.168.2.16	75.182.233.27
May 6, 2024 04:57:43.260075092 CEST	53064	2121	192.168.2.16	73.152.219.120
May 6, 2024 04:57:43.260078907 CEST	53065	21	192.168.2.16	73.152.219.120
May 6, 2024 04:57:43.266062021 CEST	53062	2121	192.168.2.16	167.56.162.214
May 6, 2024 04:57:43.267183065 CEST	21	53184	202.168.242.122	192.168.2.16
May 6, 2024 04:57:43.270747900 CEST	21	53222	34.128.145.40	192.168.2.16
May 6, 2024 04:57:43.270845890 CEST	21	53241	34.128.145.40	192.168.2.16
May 6, 2024 04:57:43.270906925 CEST	53241	21	192.168.2.16	34.128.145.40
May 6, 2024 04:57:43.274975061 CEST	2121	53041	126.117.149.148	192.168.2.16
May 6, 2024 04:57:43.276093960 CEST	53202	21	192.168.2.16	182.227.231.106
May 6, 2024 04:57:43.276590109 CEST	53251	21	192.168.2.16	189.230.97.238
May 6, 2024 04:57:43.283695936 CEST	2121	53224	34.128.145.40	192.168.2.16
May 6, 2024 04:57:43.284329891 CEST	2121	53243	34.128.145.40	192.168.2.16
May 6, 2024 04:57:43.284387112 CEST	53243	2121	192.168.2.16	34.128.145.40
May 6, 2024 04:57:43.292069912 CEST	53066	2121	192.168.2.16	75.182.233.27
May 6, 2024 04:57:43.292424917 CEST	53067	21	192.168.2.16	123.129.225.135
May 6, 2024 04:57:43.292429924 CEST	53160	2121	192.168.2.16	46.153.227.117
May 6, 2024 04:57:43.292429924 CEST	53252	2121	192.168.2.16	189.230.97.238
May 6, 2024 04:57:43.308088064 CEST	53068	2121	192.168.2.16	123.129.225.135
May 6, 2024 04:57:43.308088064 CEST	53069	21	192.168.2.16	47.146.240.45
May 6, 2024 04:57:43.313266039 CEST	21	53075	38.145.252.110	192.168.2.16
May 6, 2024 04:57:43.319267988 CEST	21	53173	154.210.32.21	192.168.2.16
May 6, 2024 04:57:43.319390059 CEST	53173	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:43.319547892 CEST	53253	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:43.320003033 CEST	21	53173	154.210.32.21	192.168.2.16
May 6, 2024 04:57:43.320059061 CEST	53173	21	192.168.2.16	154.210.32.21
May 6, 2024 04:57:43.324095011 CEST	53056	21	192.168.2.16	114.52.241.72
May 6, 2024 04:57:43.324296951 CEST	53254	21	192.168.2.16	162.253.17.194

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
May 6, 2024 04:56:34.715773106 CEST	192.168.2.16	1.1.1.1	0x7300	Standard query (0)	dht.transmissionbt.com	A (IP address)	IN (0x0001)	false
May 6, 2024 04:56:34.791558981 CEST	192.168.2.16	1.1.1.1	0x72c7	Standard query (0)	xmr.crypto-pool.fr	A (IP address)	IN (0x0001)	false
May 6, 2024 04:56:34.842082024 CEST	192.168.2.16	1.1.1.1	0x4d77	Standard query (0)	router.bittorrent.com	A (IP address)	IN (0x0001)	false
May 6, 2024 04:56:34.954051971 CEST	192.168.2.16	1.1.1.1	0x48ea	Standard query (0)	router.utorrent.com	A (IP address)	IN (0x0001)	false
May 6, 2024 04:56:35.065952063 CEST	192.168.2.16	1.1.1.1	0x470c	Standard query (0)	bttracker.debian.org	A (IP address)	IN (0x0001)	false
May 6, 2024 04:56:40.783502102 CEST	192.168.2.16	1.1.1.1	0x7b15	Standard query (0)	xmr.crypto-pool.fr	A (IP address)	IN (0x0001)	false
May 6, 2024 04:56:46.819586992 CEST	192.168.2.16	1.1.1.1	0x7d2d	Standard query (0)	xmr.crypto-pool.fr	A (IP address)	IN (0x0001)	false
May 6, 2024 04:56:52.859699965 CEST	192.168.2.16	1.1.1.1	0x7aae	Standard query (0)	xmr.crypto-pool.fr	A (IP address)	IN (0x0001)	false
May 6, 2024 04:56:58.944561958 CEST	192.168.2.16	1.1.1.1	0x3a7e	Standard query (0)	xmr.crypto-pool.fr	A (IP address)	IN (0x0001)	false
May 6, 2024 04:57:04.961551905 CEST	192.168.2.16	1.1.1.1	0xa07f	Standard query (0)	xmr.crypto-pool.fr	A (IP address)	IN (0x0001)	false
May 6, 2024 04:57:10.992542982 CEST	192.168.2.16	1.1.1.1	0xe20a	Standard query (0)	xmr.crypto-pool.fr	A (IP address)	IN (0x0001)	false
May 6, 2024 04:57:17.033899069 CEST	192.168.2.16	1.1.1.1	0x267b	Standard query (0)	xmr.crypto-pool.fr	A (IP address)	IN (0x0001)	false
May 6, 2024 04:57:23.093904018 CEST	192.168.2.16	1.1.1.1	0xf19b	Standard query (0)	xmr.crypto-pool.fr	A (IP address)	IN (0x0001)	false
May 6, 2024 04:57:29.151623964 CEST	192.168.2.16	1.1.1.1	0xf0ea	Standard query (0)	xmr.crypto-pool.fr	A (IP address)	IN (0x0001)	false
May 6, 2024 04:57:35.223803043 CEST	192.168.2.16	1.1.1.1	0xef7e	Standard query (0)	xmr.crypto-pool.fr	A (IP address)	IN (0x0001)	false
May 6, 2024 04:57:41.268687963 CEST	192.168.2.16	1.1.1.1	0xbe7a	Standard query (0)	xmr.crypto-pool.fr	A (IP address)	IN (0x0001)	false
May 6, 2024 04:57:47.294562101 CEST	192.168.2.16	1.1.1.1	0xa31b	Standard query (0)	xmr.crypto-pool.fr	A (IP address)	IN (0x0001)	false
May 6, 2024 04:57:52.554251909 CEST	192.168.2.16	1.1.1.1	0x97fb	Standard query (0)	xmr.crypto-pool.fr	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
May 6, 2024 04:56:34.825766087 CEST	1.1.1.1	192.168.2.16	0x7300	No error (0)	dht.transmissionbt.com		87.98.162.88	A (IP address)	IN (0x0001)	false
May 6, 2024 04:56:34.825766087 CEST	1.1.1.1	192.168.2.16	0x7300	No error (0)	dht.transmissionbt.com		212.129.33.59	A (IP address)	IN (0x0001)	false
May 6, 2024 04:56:34.952796936 CEST	1.1.1.1	192.168.2.16	0x4d77	No error (0)	router.bittorrent.com		67.215.246.10	A (IP address)	IN (0x0001)	false
May 6, 2024 04:56:35.064773083 CEST	1.1.1.1	192.168.2.16	0x48ea	No error (0)	router.utorrent.com		82.221.103.244	A (IP address)	IN (0x0001)	false
May 6, 2024 04:56:35.177058935 CEST	1.1.1.1	192.168.2.16	0x470c	No error (0)	bttracker.debian.org	bttracker.acc.umu.se		CNAME (Canonical name)	IN (0x0001)	false
May 6, 2024 04:56:35.177058935 CEST	1.1.1.1	192.168.2.16	0x470c	No error (0)	bttracker.acc.umu.se		130.239.18.158	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.16	50126	34.128.145.40	2121	1764	C:\Users\user\HelpPane.exe

Timestamp	Bytes transferred	Direction	Data
May 6, 2024 04:56:46.212869883 CEST	18	OUT	GET / HTTP/1.1

Target ID:	0
Start time:	04:55:48
Start date:	06/05/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
Imagebase:	0x7ff6f6240000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	04:55:59
Start date:	06/05/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	04:56:05
Start date:	06/05/2024
Path:	C:\Program Files\7-Zip\7zG.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\" -ad -an -ai#7zMap16652:184:7zEvent5233
Imagebase:	0xc40000
File size:	700'416 bytes
MD5 hash:	50F289DF0C19484E970849AAC4E6F977
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	04:56:06
Start date:	06/05/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k NetworkService -p
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	04:56:06
Start date:	06/05/2024
Path:	C:\Windows\System32\SgrmBroker.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\SgrmBroker.exe
Imagebase:	0x7ff7648e0000
File size:	329'504 bytes
MD5 hash:	3BA1A18A0DC30A0545E7765CB97D8E63
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	04:56:06
Start date:	06/05/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	04:56:06
Start date:	06/05/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	10
Start time:	04:56:06
Start date:	06/05/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\svchost.exe -k UnistackSvcGroup
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	12
Start time:	04:56:06
Start date:	06/05/2024
Path:	C:\Windows\System32\svchost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc
Imagebase:	0x7ff62c440000
File size:	55'320 bytes
MD5 hash:	B7F884C1B74A263F746EE12A5F7C9F6A
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	04:56:19
Start date:	06/05/2024
Path:	C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe"
Imagebase:	0x3b0000
File size:	6'271'268 bytes
MD5 hash:	A9D4007C9419A6E8D55805B8F8F52DE0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 0000000E.00000003.1405690614.00000000024AF000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	04:56:20
Start date:	06/05/2024
Path:	C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe"
Imagebase:	0x3b0000
File size:	6'271'268 bytes
MD5 hash:	A9D4007C9419A6E8D55805B8F8F52DE0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	04:56:20
Start date:	06/05/2024
Path:	C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe"
Imagebase:	0x3b0000
File size:	6'271'268 bytes
MD5 hash:	A9D4007C9419A6E8D55805B8F8F52DE0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000012.00000003.1422207868.000000000151D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000012.00000003.1422400569.000000000151E000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	04:56:21
Start date:	06/05/2024
Path:	C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe"
Imagebase:	0x3b0000
File size:	6'271'268 bytes
MD5 hash:	A9D4007C9419A6E8D55805B8F8F52DE0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	04:56:22
Start date:	06/05/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c copy /y C:\Users\user\Desktop\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca\5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.exe C:\Users\user\HelpPane.exe
Imagebase:	0xf20000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	04:56:22
Start date:	06/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	04:56:23
Start date:	06/05/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c C:\Users\user\HelpPane.exe --startup auto install
Imagebase:	0xf20000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	04:56:23
Start date:	06/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	04:56:23
Start date:	06/05/2024
Path:	C:\Users\user\HelpPane.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\HelpPane.exe --startup auto install
Imagebase:	0x2c0000
File size:	6'271'268 bytes
MD5 hash:	A9D4007C9419A6E8D55805B8F8F52DE0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	25
Start time:	04:56:24
Start date:	06/05/2024
Path:	C:\Users\user\HelpPane.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\HelpPane.exe --startup auto install
Imagebase:	0x2c0000
File size:	6'271'268 bytes
MD5 hash:	A9D4007C9419A6E8D55805B8F8F52DE0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	04:56:26
Start date:	06/05/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c C:\Users\user\HelpPane.exe start
Imagebase:	0xf20000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	04:56:26
Start date:	06/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	04:56:26
Start date:	06/05/2024
Path:	C:\Users\user\HelpPane.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\HelpPane.exe start
Imagebase:	0x2c0000
File size:	6'271'268 bytes
MD5 hash:	A9D4007C9419A6E8D55805B8F8F52DE0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	29
Start time:	04:56:27
Start date:	06/05/2024
Path:	C:\Users\user\HelpPane.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\HelpPane.exe start
Imagebase:	0x7ff62c440000
File size:	6'271'268 bytes
MD5 hash:	A9D4007C9419A6E8D55805B8F8F52DE0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	30
Start time:	04:56:28
Start date:	06/05/2024
Path:	C:\Users\user\HelpPane.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\HelpPane.exe"
Imagebase:	0x2c0000
File size:	6'271'268 bytes
MD5 hash:	A9D4007C9419A6E8D55805B8F8F52DE0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	31
Start time:	04:56:28
Start date:	06/05/2024
Path:	C:\Users\user\HelpPane.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\HelpPane.exe"
Imagebase:	0x2c0000
File size:	6'271'268 bytes
MD5 hash:	A9D4007C9419A6E8D55805B8F8F52DE0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	32
Start time:	04:56:29
Start date:	06/05/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c taskkill /pid 2284 /f
Imagebase:	0xf20000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	33
Start time:	04:56:29
Start date:	06/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	04:56:29
Start date:	06/05/2024
Path:	C:\Windows\SysWOW64\taskkill.exe
Wow64 process (32bit):	true
Commandline:	taskkill /pid 2284 /f
Imagebase:	0x680000
File size:	74'240 bytes
MD5 hash:	CA313FD7E6C2A778FFD21CFB5C1C56CD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	04:56:29
Start date:	06/05/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c copy /y C:\Windows\TEMP\_MEI70~1\xmrig.exe C:\Windows\TEMP\xmrig.exe
Imagebase:	0xf20000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000023.00000003.1504992076.0000000000C15000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	36
Start time:	04:56:29
Start date:	06/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	37
Start time:	04:56:30
Start date:	06/05/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c copy /y C:\Windows\TEMP\_MEI70~1\config.json C:\Windows\TEMP\config.json
Imagebase:	0xf20000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000025.00000002.1507947087.0000000000EF0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000025.00000002.1508063957.000000000311C000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	38
Start time:	04:56:30
Start date:	06/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	04:56:33
Start date:	06/05/2024
Path:	C:\Windows\Temp\xmrig.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\TEMP\xmrig.exe
Imagebase:	0x400000
File size:	1'905'664 bytes
MD5 hash:	13BDD9CD9F7E51746172996262B5A873
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000028.00000002.2395762565.0000000001500000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000028.00000002.2393808878.0000000000CCE000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000028.00000002.2393514571.00000000009B5000.00000004.00000001.01000000.0000004C.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000028.00000002.2396216239.00000000018A2000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000028.00000002.2393808878.0000000000CE3000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000028.00000000.1545522218.00000000009B0000.00000008.00000001.01000000.0000004C.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: 00000028.00000002.2357701679.0000000000401000.00000040.00000001.01000000.0000004C.sdmp, Author: Joe Security Rule: JoeSecurity_Xmrig, Description: Yara detected Xmrig cryptocurrency miner, Source: C:\Windows\Temp\xmrig.exe, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	41
Start time:	04:56:34
Start date:	06/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	42
Start time:	04:56:34
Start date:	06/05/2024
Path:	C:\Windows\SysWOW64\netsh.exe
Wow64 process (32bit):	true
Commandline:	netsh firewall add allowedprogram C:\Users\user\HelpPane.exe "MyApp" ENABLE
Imagebase:	0x1470000
File size:	82'432 bytes
MD5 hash:	4E89A1A088BE715D6C946E55AB07C7DF
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	43
Start time:	04:56:34
Start date:	06/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	04:56:34
Start date:	06/05/2024
Path:	C:\Windows\System32\spoolsv.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\spoolsv.exe
Imagebase:	0x7ff719eb0000
File size:	842'752 bytes
MD5 hash:	0D4B1E3E4488E9BDC035F23E1F4FE22F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	45
Start time:	04:57:07
Start date:	06/05/2024
Path:	C:\Program Files\Windows Defender\MpCmdRun.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Imagebase:	0x7ff710890000
File size:	468'120 bytes
MD5 hash:	B3676839B2EE96983F9ED735CD044159
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	46
Start time:	04:57:07
Start date:	06/05/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6684c0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	35.2%
Total number of Nodes:	227
Total number of Limit Nodes:	27

Executed Functions

Function 1ECB2380 Relevance: 29.9, APIs: 13, Strings: 4, Instructions: 178
servicethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PyArg_ParseTuple.PYTHON27 ref: 1ECB23AC
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?,?,?,?,?,?), ref: 1ECB23C9
PyEval_SaveThread.PYTHON27(?,?,?,?,?,?,?,?,?,?,?), ref: 1ECB23E8
EnumServicesStatusW.ADVAPI32(?,?,?,?,00000004,?,?,?), ref: 1ECB2419
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?), ref: 1ECB241B
EnumServicesStatusW.ADVAPI32(?,?,?,00000000,?,?,?,?), ref: 1ECB2461
PyEval_RestoreThread.PYTHON27(00000000,?,?,?,?,?,?,?,?,?,?,?), ref: 1ECB2466
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(EnumServicesStatus,00000000,?,?,?,?,?,?,?,?,?), ref: 1ECB2483

Strings

EnumServicesStatus, xrefs: 1ECB247E
O|ll:EnumServicesStatus, xrefs: 1ECB2396
OO(lllllll), xrefs: 1ECB24EF
0, xrefs: 1ECB239C

Memory Dump Source

Source File: 0000000F.00000002.1435001879.000000001ECB1000.00000040.00000001.01000000.00000011.sdmp, Offset: 1ECB0000, based on PE: true

Associated: 0000000F.00000002.1434980425.000000001ECB0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBA000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBD000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435097428.000000001ECBF000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435120797.000000001ECC0000.00000004.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ecb0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: EnumEval_ServicesStatusThreadU_object@@$Arg_ErrorError@@LastObject_ParseRestoreSaveTupleWin_
String ID: 0$EnumServicesStatus$OO(lllllll)$O|ll:EnumServicesStatus
API String ID: 1025248867-2016693928
Opcode ID: 0b03b4dd298480746dab193ef9616f4446b0e1c5bd339f2cc7a0596e764d27cd
Instruction ID: f55656690ffe5bdfa154091b3a3c2009565f33b51d787ada61ba05523790a12a
Opcode Fuzzy Hash: 0b03b4dd298480746dab193ef9616f4446b0e1c5bd339f2cc7a0596e764d27cd
Instruction Fuzzy Hash: 5C5139B2604201AFD304CF64DD84D6BB7E9FF88754F044A1CF99993244E774EA09CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 10002D19 Relevance: 28.4, APIs: 12, Strings: 4, Instructions: 394
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PyArg_Parse.PYTHON27(?,1000845C,?,?), ref: 10002D61

Part of subcall function 10002640: PyArg_Parse.PYTHON27(?,10008278,?,?), ref: 10002657

Strings

Input strings must be a multiple of %i in length, xrefs: 10002DB2
Unknown ciphertext feedback mode %i; this shouldn't happen, xrefs: 1000317B
Input strings must be a multiple of the segment size %i in length, xrefs: 10002DEE
No memory available in _AES decrypt, xrefs: 10002E21

Memory Dump Source

Source File: 0000000F.00000002.1433244269.0000000010001000.00000040.00000001.01000000.0000000A.sdmp, Offset: 10000000, based on PE: true

Associated: 0000000F.00000002.1433191412.0000000010000000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.1433244269.0000000010008000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.1433244269.000000001000A000.00000040.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.1433485515.000000001000B000.00000080.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.1433570485.000000001000D000.00000004.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_10000000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Parse
String ID: Input strings must be a multiple of %i in length$Input strings must be a multiple of the segment size %i in length$No memory available in _AES decrypt$Unknown ciphertext feedback mode %i; this shouldn't happen
API String ID: 2808742207-4241125248
Opcode ID: 2c437d121ba1ec8d3907c33f08ba3072411fecc45d02418a6c230e76c9ae3ece
Instruction ID: 50dd2ec2cec88198311dfcbaffbbaa73ac7af56e5f088be47caa55b611f03536
Opcode Fuzzy Hash: 2c437d121ba1ec8d3907c33f08ba3072411fecc45d02418a6c230e76c9ae3ece
Instruction Fuzzy Hash: 47E1F4B55083929FD314CF28C88095BBBE5FFC9244F058A6DF8868731AE731E959CB91

Uniqueness

Uniqueness Score: -1.00%

Function 03252190 Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 194
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PyList_New.PYTHON27 ref: 032521A7
PyErr_SetFromWindowsErr.PYTHON27(00000000), ref: 032521D5
PyErr_SetString.PYTHON27(?,GetSystemInfo() failed to retrieve CPU count), ref: 03252207
PyErr_NoMemory.PYTHON27 ref: 03252232
NtQuerySystemInformation.NTDLL(00000008,00000000,?,00000000), ref: 03252243
73BB3B4E.MSVCR90(?), ref: 032523A7

Strings

NtQuerySystemInformation(SystemProcessorPerformanceInformation), xrefs: 0325224D
(ddddd), xrefs: 03252319
GetSystemInfo() failed to retrieve CPU count, xrefs: 03252201
GetActiveProcessorCount() not available; using GetSystemInfo(), xrefs: 032521E3

Memory Dump Source

Source File: 0000000F.00000002.1423676562.0000000003251000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03250000, based on PE: true

Associated: 0000000F.00000002.1423656216.0000000003250000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423775563.0000000003263000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3250000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Err_$FromInformationList_MemoryQueryStringSystemWindows
String ID: (ddddd)$GetActiveProcessorCount() not available; using GetSystemInfo()$GetSystemInfo() failed to retrieve CPU count$NtQuerySystemInformation(SystemProcessorPerformanceInformation)
API String ID: 744806155-2733789981
Opcode ID: e3ef45a9a0d1e30be233951a63fe38be95fce7265d61dd3eb848a0738a706dfe
Instruction ID: 618b91f8924eebb7c094aed08e26bf495b078dd41f032d44c7839788d85c5664
Opcode Fuzzy Hash: e3ef45a9a0d1e30be233951a63fe38be95fce7265d61dd3eb848a0738a706dfe
Instruction Fuzzy Hash: A5613772A00306EBD320FE51F84855677A4FB54760B254E18FC49D2295FB72DB95CBC2

Uniqueness

Uniqueness Score: -1.00%

Function 03256F10 Relevance: 12.3, APIs: 3, Strings: 4, Instructions: 74
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LookupPrivilegeValueA.ADVAPI32 ref: 03256F23
AdjustTokenPrivileges.KERNELBASE ref: 03256F7E

Part of subcall function 03251090: GetLastError.KERNEL32 ref: 032510B2
Part of subcall function 03251090: PyErr_SetFromWindowsErrWithFilename.PYTHON27(00000000), ref: 032510B9

Strings

AdjustTokenPrivileges, xrefs: 03256FDD
SeDebugPrivilege, xrefs: 03256F18
AdjustTokenPrivileges, xrefs: 03256F84
LookupPrivilegeValue, xrefs: 03256F2D

Memory Dump Source

Source File: 0000000F.00000002.1423676562.0000000003251000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03250000, based on PE: true

Associated: 0000000F.00000002.1423656216.0000000003250000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423775563.0000000003263000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3250000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: AdjustErr_ErrorFilenameFromLastLookupPrivilegePrivilegesTokenValueWindowsWith
String ID: AdjustTokenPrivileges$AdjustTokenPrivileges$LookupPrivilegeValue$SeDebugPrivilege
API String ID: 2462482343-530743942
Opcode ID: c9bb5ec44afd62db1190809990a4f164aa6548e582c346e409f30d23a1206022
Instruction ID: 7354abcccc783870f9178213e53e4a58c1634e27978d55c800b8001978c92af8
Opcode Fuzzy Hash: c9bb5ec44afd62db1190809990a4f164aa6548e582c346e409f30d23a1206022
Instruction Fuzzy Hash: 362186B5518301AFE704DF15D981BABB7E4AB84704F44491DFC95C6280F3B5EB888B93

Uniqueness

Uniqueness Score: -1.00%

Function 032520B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 69
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemTimes.KERNEL32(?,?,?), ref: 032520C2
PyErr_SetFromWindowsErr.PYTHON27(00000000,?,?,?), ref: 032520CC
Py_BuildValue.PYTHON27((ddd),?,?,?,?,?,?), ref: 0325217E

Strings

(ddd), xrefs: 03252179

Memory Dump Source

Source File: 0000000F.00000002.1423676562.0000000003251000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03250000, based on PE: true

Associated: 0000000F.00000002.1423656216.0000000003250000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423775563.0000000003263000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3250000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: BuildErr_FromSystemTimesValueWindows
String ID: (ddd)
API String ID: 2325294781-2401937087
Opcode ID: 39c65581cd2b898c4894537e03a7c55d47b7d63ce6997dc89538d25705a5a287
Instruction ID: 2938c2b7f3deb5b1729b50b9ef830512698b13eebc4202efb7d925185f4c2c84
Opcode Fuzzy Hash: 39c65581cd2b898c4894537e03a7c55d47b7d63ce6997dc89538d25705a5a287
Instruction Fuzzy Hash: E7218376B15702E7C710FE11F15855A77E4FAA8B80F61CD4CF84991166FB32CAA88AC2

Uniqueness

Uniqueness Score: -1.00%

Function 03277890 Relevance: 2.4, APIs: 1, Instructions: 891memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(-00001000,00001000,00000004,?,00000000), ref: 03278443

Memory Dump Source

Source File: 0000000F.00000002.1423840792.0000000003276000.00000040.00000001.01000000.00000010.sdmp, Offset: 03270000, based on PE: true

Associated: 0000000F.00000002.1423816017.0000000003270000.00000002.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1423840792.0000000003271000.00000040.00000001.01000000.00000010.sdmpDownload File
Associated: 0000000F.00000002.1423901124.0000000003279000.00000004.00000001.01000000.00000010.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3270000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: e9c2c8f7aefed1c0c2036d8c93b0d7b17e8785a6a5f5bfb0217ad58d092bfac7
Instruction ID: fdbd6032d1197993fb74ed7df86a67cbb26db9bb8d5543f369cbeae1261631c6
Opcode Fuzzy Hash: e9c2c8f7aefed1c0c2036d8c93b0d7b17e8785a6a5f5bfb0217ad58d092bfac7
Instruction Fuzzy Hash: 9C72AC316283558FD324CF2CC88466ABBE1FF85344F194A2DE9A9CB351E771D985CB82

Uniqueness

Uniqueness Score: -1.00%

Function 1E7C0FA0 Relevance: 2.4, APIs: 1, Instructions: 891memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(-00001000,00001000,00000004,?,00000000), ref: 1E7C1B53

Memory Dump Source

Source File: 0000000F.00000002.1434058873.000000001E7C0000.00000080.00000001.01000000.00000012.sdmp, Offset: 1E7A0000, based on PE: true

Associated: 0000000F.00000002.1433597392.000000001E7A0000.00000002.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000F.00000002.1433643030.000000001E7A1000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000F.00000002.1433643030.000000001E7B9000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000F.00000002.1433643030.000000001E7BE000.00000040.00000001.01000000.00000012.sdmpDownload File
Associated: 0000000F.00000002.1434087512.000000001E7C2000.00000004.00000001.01000000.00000012.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e7a0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 6d262b0c71f9c015816c5508a544d64cbae02a1b5ee422ee9a3a9f2d910439d2
Instruction ID: 12bd7e40b6dfd77b3012bca56022bbc4e9473bc772901fbb0fb185de61f08eb0
Opcode Fuzzy Hash: 6d262b0c71f9c015816c5508a544d64cbae02a1b5ee422ee9a3a9f2d910439d2
Instruction Fuzzy Hash: 9D7269316183968FE314CF28C88069ABBF6EF85344F154A3DE9A58B361E771D945CF42

Uniqueness

Uniqueness Score: -1.00%

Function 1E7DB690 Relevance: 2.4, APIs: 1, Instructions: 885memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(-00001000,00001000,00000004,?,00000000), ref: 1E7DC23A

Memory Dump Source

Source File: 0000000F.00000002.1434284534.000000001E7DB000.00000080.00000001.01000000.00000015.sdmp, Offset: 1E7D0000, based on PE: true

Associated: 0000000F.00000002.1434197225.000000001E7D0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000F.00000002.1434219289.000000001E7D1000.00000040.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000F.00000002.1434219289.000000001E7DA000.00000040.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000F.00000002.1434310614.000000001E7DD000.00000004.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e7d0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 9bc948fdda5b165c38df29802323b91b469eb35267962a1661ce76142fac560f
Instruction ID: 828b2c0d9c01f0a839a0f5a1475ada5bdd3b3ddaedd5b51ad723f9ff2392e3b3
Opcode Fuzzy Hash: 9bc948fdda5b165c38df29802323b91b469eb35267962a1661ce76142fac560f
Instruction Fuzzy Hash: 8A729C756083958FE314CF28C88066ABBE2FF85344F154A2DE9A5CB361E771E949CF42

Uniqueness

Uniqueness Score: -1.00%

Function 1E8DF120 Relevance: 2.4, APIs: 1, Instructions: 885memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(-00001000,00001000,00000004,?,00000000), ref: 1E8DFCCA

Memory Dump Source

Source File: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: e3896eae8dbcb9b17e679b07a241242372fbc8b2553d0fb01bcdc42c31cda9f4
Instruction ID: b4903fa70e46c38d5f5413635802a70aef28782e4a3959fc976c48017fb7ad85
Opcode Fuzzy Hash: e3896eae8dbcb9b17e679b07a241242372fbc8b2553d0fb01bcdc42c31cda9f4
Instruction Fuzzy Hash: 63729E316083958FD314CF28C88069ABBE2FF89344F154A2DE9E5CB391E771D989DB42

Uniqueness

Uniqueness Score: -1.00%

Function 1E9BA490 Relevance: 2.4, APIs: 1, Instructions: 885memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNEL32(-00001000,00001000,00000004,?,00000000), ref: 1E9BB03A

Memory Dump Source

Source File: 0000000F.00000002.1434933477.000000001E9BA000.00000080.00000001.01000000.00000014.sdmp, Offset: 1E9B0000, based on PE: true

Associated: 0000000F.00000002.1434649357.000000001E9B0000.00000002.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1434686478.000000001E9B1000.00000040.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1434686478.000000001E9B6000.00000040.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1434686478.000000001E9B9000.00000040.00000001.01000000.00000014.sdmpDownload File
Associated: 0000000F.00000002.1434959724.000000001E9BC000.00000004.00000001.01000000.00000014.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e9b0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: d6fe2c051e9207c9d65aa850eec9f39adf8cd91593811e8fdb3df9740fc50181
Instruction ID: 0ca98ba06f2fca5a4cb6b297f03cb1ba8bfab491c8d97ec4390fd3668d8d0b84
Opcode Fuzzy Hash: d6fe2c051e9207c9d65aa850eec9f39adf8cd91593811e8fdb3df9740fc50181
Instruction Fuzzy Hash: 9B72BC716083958FD324CF28C880A9ABBE2FF85345F154A2DE9A5CB350E7B5D985CF42

Uniqueness

Uniqueness Score: -1.00%

Function 03257FF0 Relevance: 1.5, APIs: 1, Instructions: 12
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNEL32(0325DB80,032559E9), ref: 0325800D

Memory Dump Source

Source File: 0000000F.00000002.1423676562.0000000003251000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03250000, based on PE: true

Associated: 0000000F.00000002.1423656216.0000000003250000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423775563.0000000003263000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3250000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 295204e6738a4fa50967e76b8d8173c724b33645b30ab05337c5723b5afe52b7
Instruction ID: 614a2a1ac3b8adfc7658b79cc67e9039a80fde0beab1e78c45dd1b0bcbd04ee7
Opcode Fuzzy Hash: 295204e6738a4fa50967e76b8d8173c724b33645b30ab05337c5723b5afe52b7
Instruction Fuzzy Hash: 0BC04C783F03435ADA10F67D591C21A21855B44596F8444A0FD11C8445FFB4C7C08650

Uniqueness

Uniqueness Score: -1.00%

Function 1E8CB540 Relevance: 313.7, APIs: 92, Strings: 87, Instructions: 409
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Py_InitModule4.PYTHON27(win32api,1E8D70B8,00000000,00000000,000003F5), ref: 1E8CB563
PyModule_GetDict.PYTHON27(00000000), ref: 1E8CB578
PyDict_SetItemString.PYTHON27(00000000,error), ref: 1E8CB5A1
PyInt_FromLong.PYTHON27(000000F6), ref: 1E8CB5AB
PyDict_SetItemString.PYTHON27(00000000,STD_INPUT_HANDLE,00000000), ref: 1E8CB5B4
PyInt_FromLong.PYTHON27(000000F5), ref: 1E8CB5B8
PyDict_SetItemString.PYTHON27(00000000,STD_OUTPUT_HANDLE,00000000), ref: 1E8CB5C1
PyInt_FromLong.PYTHON27(000000F4), ref: 1E8CB5C5
PyDict_SetItemString.PYTHON27(00000000,STD_ERROR_HANDLE,00000000), ref: 1E8CB5CE
PyType_Ready.PYTHON27(?), ref: 1E8CB5D5
PyDict_SetItemString.PYTHON27(00000000,PyDISPLAY_DEVICEType,?), ref: 1E8CB5F2
PyModule_AddIntConstant.PYTHON27(00000000,NameUnknown,00000000), ref: 1E8CB60E
PyModule_AddIntConstant.PYTHON27(00000000,NameFullyQualifiedDN,00000001), ref: 1E8CB618
PyModule_AddIntConstant.PYTHON27(00000000,NameSamCompatible,00000002), ref: 1E8CB622
PyModule_AddIntConstant.PYTHON27(00000000,NameDisplay,00000003), ref: 1E8CB62C
PyModule_AddIntConstant.PYTHON27(00000000,NameUniqueId,00000006), ref: 1E8CB636
PyModule_AddIntConstant.PYTHON27(00000000,NameCanonical,00000007), ref: 1E8CB640
PyModule_AddIntConstant.PYTHON27(00000000,NameUserPrincipal,00000008), ref: 1E8CB64D
PyModule_AddIntConstant.PYTHON27(00000000,NameCanonicalEx,00000009), ref: 1E8CB657
PyModule_AddIntConstant.PYTHON27(00000000,NameServicePrincipal,0000000A), ref: 1E8CB661
PyModule_AddIntConstant.PYTHON27(00000000,REG_NOTIFY_CHANGE_NAME,00000001), ref: 1E8CB66B
PyModule_AddIntConstant.PYTHON27(00000000,REG_NOTIFY_CHANGE_ATTRIBUTES,00000002), ref: 1E8CB675
PyModule_AddIntConstant.PYTHON27(00000000,REG_NOTIFY_CHANGE_LAST_SET,00000004), ref: 1E8CB67F
PyModule_AddIntConstant.PYTHON27(00000000,REG_NOTIFY_CHANGE_SECURITY,00000008), ref: 1E8CB68C
PyModule_AddIntConstant.PYTHON27(00000000,VOS_DOS,00010000), ref: 1E8CB699
PyModule_AddIntConstant.PYTHON27(00000000,VOS_NT,00040000), ref: 1E8CB6A6
PyModule_AddIntConstant.PYTHON27(00000000,VOS__WINDOWS16,00000001), ref: 1E8CB6B0
PyModule_AddIntConstant.PYTHON27(00000000,VOS__WINDOWS32,00000004), ref: 1E8CB6BA
PyModule_AddIntConstant.PYTHON27(00000000,VOS_OS216,00020000), ref: 1E8CB6C7
PyModule_AddIntConstant.PYTHON27(00000000,VOS_OS232,00030000), ref: 1E8CB6D7
PyModule_AddIntConstant.PYTHON27(00000000,VOS__PM16,00000002), ref: 1E8CB6E1
PyModule_AddIntConstant.PYTHON27(00000000,VOS__PM32,00000003), ref: 1E8CB6EB
PyModule_AddIntConstant.PYTHON27(00000000,VOS_UNKNOWN,00000000), ref: 1E8CB6F5
PyModule_AddIntConstant.PYTHON27(00000000,VOS_DOS_WINDOWS16,00010001), ref: 1E8CB702
PyModule_AddIntConstant.PYTHON27(00000000,VOS_DOS_WINDOWS32,00010004), ref: 1E8CB70F
PyModule_AddIntConstant.PYTHON27(00000000,VOS_NT_WINDOWS32,00040004), ref: 1E8CB71F
PyModule_AddIntConstant.PYTHON27(00000000,VOS_OS216_PM16,00020002), ref: 1E8CB72C
PyModule_AddIntConstant.PYTHON27(00000000,VOS_OS232_PM32,00030003), ref: 1E8CB739
PyModule_AddIntConstant.PYTHON27(00000000,VFT_UNKNOWN,00000000), ref: 1E8CB743
PyModule_AddIntConstant.PYTHON27(00000000,VFT_APP,00000001), ref: 1E8CB74D
PyModule_AddIntConstant.PYTHON27(00000000,VFT_DLL,00000002), ref: 1E8CB757
PyModule_AddIntConstant.PYTHON27(00000000,VFT_DRV,00000003), ref: 1E8CB764
PyModule_AddIntConstant.PYTHON27(00000000,VFT_FONT,00000004), ref: 1E8CB76E
PyModule_AddIntConstant.PYTHON27(00000000,VFT_VXD,00000005), ref: 1E8CB778
PyModule_AddIntConstant.PYTHON27(00000000,VFT_STATIC_LIB,00000007), ref: 1E8CB782
PyModule_AddIntConstant.PYTHON27(00000000,VS_FF_DEBUG,00000001), ref: 1E8CB78C
PyModule_AddIntConstant.PYTHON27(00000000,VS_FF_INFOINFERRED,00000010), ref: 1E8CB796
PyModule_AddIntConstant.PYTHON27(00000000,VS_FF_PATCHED,00000004), ref: 1E8CB7A3
PyModule_AddIntConstant.PYTHON27(00000000,VS_FF_PRERELEASE,00000002), ref: 1E8CB7AD
PyModule_AddIntConstant.PYTHON27(00000000,VS_FF_PRIVATEBUILD,00000008), ref: 1E8CB7B7
PyModule_AddIntConstant.PYTHON27(00000000,VS_FF_SPECIALBUILD,00000020), ref: 1E8CB7C1
GetModuleHandleA.KERNEL32(secur32.dll), ref: 1E8CB7D1
LoadLibraryA.KERNEL32(secur32.dll), ref: 1E8CB7EA
GetProcAddress.KERNEL32(00000000,GetUserNameExW), ref: 1E8CB7F8
GetProcAddress.KERNEL32(00000000,GetComputerObjectNameW), ref: 1E8CB805
GetModuleHandleA.KERNEL32(kernel32.dll), ref: 1E8CB811
LoadLibraryA.KERNEL32(kernel32.dll), ref: 1E8CB81E
GetProcAddress.KERNEL32(00000000,GetComputerNameExW), ref: 1E8CB830
GetProcAddress.KERNEL32(00000000,GetLongPathNameA), ref: 1E8CB83D
GetProcAddress.KERNEL32(00000000,GetLongPathNameW), ref: 1E8CB84A
GetProcAddress.KERNEL32(00000000,GetHandleInformation), ref: 1E8CB857
GetProcAddress.KERNEL32(00000000,SetHandleInformation), ref: 1E8CB864
GetProcAddress.KERNEL32(00000000,GlobalMemoryStatusEx), ref: 1E8CB871
GetProcAddress.KERNEL32(00000000,GetSystemFileCacheSize), ref: 1E8CB87E
GetProcAddress.KERNEL32(00000000,SetSystemFileCacheSize), ref: 1E8CB88B
GetProcAddress.KERNEL32(00000000,GetDllDirectoryW), ref: 1E8CB898
GetProcAddress.KERNEL32(00000000,SetDllDirectoryW), ref: 1E8CB8A5
GetProcAddress.KERNEL32(00000000,SetSystemPowerState), ref: 1E8CB8B2
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 1E8CB8BF
GetModuleHandleA.KERNEL32(user32.dll), ref: 1E8CB8CB
LoadLibraryA.KERNEL32(user32.dll), ref: 1E8CB8D8
GetProcAddress.KERNEL32(00000000,EnumDisplayMonitors), ref: 1E8CB8E6
GetProcAddress.KERNEL32(00000000,EnumDisplayDevicesA), ref: 1E8CB8F3
GetProcAddress.KERNEL32(00000000,ChangeDisplaySettingsExA), ref: 1E8CB900
GetProcAddress.KERNEL32(00000000,MonitorFromWindow), ref: 1E8CB90D
GetProcAddress.KERNEL32(00000000,MonitorFromRect), ref: 1E8CB91A
GetProcAddress.KERNEL32(00000000,MonitorFromPoint), ref: 1E8CB927
GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 1E8CB934
GetProcAddress.KERNEL32(00000000,EnumDisplaySettingsExA), ref: 1E8CB941
GetProcAddress.KERNEL32(00000000,GetLastInputInfo), ref: 1E8CB94E
GetModuleHandleA.KERNEL32(Advapi32.dll), ref: 1E8CB95A
LoadLibraryA.KERNEL32(Advapi32.dll), ref: 1E8CB967
GetProcAddress.KERNEL32(00000000,RegRestoreKeyW), ref: 1E8CB979
GetProcAddress.KERNEL32(00000000,RegSaveKeyExW), ref: 1E8CB986
GetProcAddress.KERNEL32(00000000,RegCreateKeyTransactedW), ref: 1E8CB993
GetProcAddress.KERNEL32(00000000,RegOpenKeyTransactedW), ref: 1E8CB9A0
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 1E8CB9AD
GetProcAddress.KERNEL32(00000000,RegDeleteKeyTransactedW), ref: 1E8CB9BA
GetProcAddress.KERNEL32(00000000,RegCopyTreeW), ref: 1E8CB9C7
GetProcAddress.KERNEL32(00000000,RegDeleteTreeW), ref: 1E8CB9D4
GetProcAddress.KERNEL32(00000000,RegOpenCurrentUser), ref: 1E8CB9E1
GetProcAddress.KERNEL32(00000000,RegOverridePredefKey), ref: 1E8CB9EE

Strings

VS_FF_PATCHED, xrefs: 1E8CB79D
VS_FF_SPECIALBUILD, xrefs: 1E8CB7BB
VOS_OS232, xrefs: 1E8CB6D1
SetSystemFileCacheSize, xrefs: 1E8CB880
SetHandleInformation, xrefs: 1E8CB859
EnumDisplaySettingsExA, xrefs: 1E8CB936
GetMonitorInfoA, xrefs: 1E8CB929
RegDeleteTreeW, xrefs: 1E8CB9C9
GetSystemFileCacheSize, xrefs: 1E8CB873
VOS_OS216, xrefs: 1E8CB6C1
GetLastInputInfo, xrefs: 1E8CB943
kernel32.dll, xrefs: 1E8CB819
VS_FF_INFOINFERRED, xrefs: 1E8CB790
STD_INPUT_HANDLE, xrefs: 1E8CB5AE
VFT_UNKNOWN, xrefs: 1E8CB73D
VFT_DLL, xrefs: 1E8CB751
VFT_APP, xrefs: 1E8CB747
REG_NOTIFY_CHANGE_LAST_SET, xrefs: 1E8CB679
RegDeleteKeyTransactedW, xrefs: 1E8CB9AF
VOS_OS216_PM16, xrefs: 1E8CB726
error, xrefs: 1E8CB59B
SetSystemPowerState, xrefs: 1E8CB8A7
VFT_STATIC_LIB, xrefs: 1E8CB77C
GetLongPathNameA, xrefs: 1E8CB832
GlobalMemoryStatusEx, xrefs: 1E8CB866
RegCreateKeyTransactedW, xrefs: 1E8CB988
REG_NOTIFY_CHANGE_SECURITY, xrefs: 1E8CB686
NameDisplay, xrefs: 1E8CB626
RegCopyTreeW, xrefs: 1E8CB9BC
VS_FF_PRERELEASE, xrefs: 1E8CB7A7
GetDllDirectoryW, xrefs: 1E8CB88D
Advapi32.dll, xrefs: 1E8CB955
VFT_FONT, xrefs: 1E8CB768
GetNativeSystemInfo, xrefs: 1E8CB8B4
NameUserPrincipal, xrefs: 1E8CB647
REG_NOTIFY_CHANGE_NAME, xrefs: 1E8CB665
VOS_UNKNOWN, xrefs: 1E8CB6EF
secur32.dll, xrefs: 1E8CB7E5
SetDllDirectoryW, xrefs: 1E8CB89A
RegDeleteKeyExW, xrefs: 1E8CB9A2
EnumDisplayDevicesA, xrefs: 1E8CB8E8
Advapi32.dll, xrefs: 1E8CB962
RegOpenCurrentUser, xrefs: 1E8CB9D6
NameCanonical, xrefs: 1E8CB63A
MonitorFromRect, xrefs: 1E8CB90F
GetUserNameExW, xrefs: 1E8CB7F2
VOS_NT, xrefs: 1E8CB6A0
NameUnknown, xrefs: 1E8CB608
VOS_DOS_WINDOWS32, xrefs: 1E8CB709
user32.dll, xrefs: 1E8CB8D3
VOS_DOS, xrefs: 1E8CB693
VOS__WINDOWS16, xrefs: 1E8CB6AA
VOS__WINDOWS32, xrefs: 1E8CB6B4
NameCanonicalEx, xrefs: 1E8CB651
VOS__PM32, xrefs: 1E8CB6E5
user32.dll, xrefs: 1E8CB8C6
PyDISPLAY_DEVICEType, xrefs: 1E8CB5EC
RegOverridePredefKey, xrefs: 1E8CB9E3
VOS_OS232_PM32, xrefs: 1E8CB733
VS_FF_DEBUG, xrefs: 1E8CB786
NameFullyQualifiedDN, xrefs: 1E8CB612
NameUniqueId, xrefs: 1E8CB630
VOS__PM16, xrefs: 1E8CB6DB
STD_OUTPUT_HANDLE, xrefs: 1E8CB5BB
NameSamCompatible, xrefs: 1E8CB61C
GetComputerObjectNameW, xrefs: 1E8CB7FA
NameServicePrincipal, xrefs: 1E8CB65B
STD_ERROR_HANDLE, xrefs: 1E8CB5C8
MonitorFromPoint, xrefs: 1E8CB91C
GetHandleInformation, xrefs: 1E8CB84C
ChangeDisplaySettingsExA, xrefs: 1E8CB8F5
VFT_DRV, xrefs: 1E8CB75E
EnumDisplayMonitors, xrefs: 1E8CB8E0
RegRestoreKeyW, xrefs: 1E8CB973
MonitorFromWindow, xrefs: 1E8CB902
VOS_NT_WINDOWS32, xrefs: 1E8CB719
RegSaveKeyExW, xrefs: 1E8CB97B
REG_NOTIFY_CHANGE_ATTRIBUTES, xrefs: 1E8CB66F
secur32.dll, xrefs: 1E8CB7CC
VOS_DOS_WINDOWS16, xrefs: 1E8CB6FC
GetComputerNameExW, xrefs: 1E8CB82A
win32api, xrefs: 1E8CB55E
kernel32.dll, xrefs: 1E8CB80C
RegOpenKeyTransactedW, xrefs: 1E8CB995
VFT_VXD, xrefs: 1E8CB772
VS_FF_PRIVATEBUILD, xrefs: 1E8CB7B1
GetLongPathNameW, xrefs: 1E8CB83F

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Module_$Constant$AddressProc$Dict_ItemString$HandleLibraryLoadModule$FromInt_Long$DictInitModule4ReadyType_
String ID: Advapi32.dll$Advapi32.dll$ChangeDisplaySettingsExA$EnumDisplayDevicesA$EnumDisplayMonitors$EnumDisplaySettingsExA$GetComputerNameExW$GetComputerObjectNameW$GetDllDirectoryW$GetHandleInformation$GetLastInputInfo$GetLongPathNameA$GetLongPathNameW$GetMonitorInfoA$GetNativeSystemInfo$GetSystemFileCacheSize$GetUserNameExW$GlobalMemoryStatusEx$MonitorFromPoint$MonitorFromRect$MonitorFromWindow$NameCanonical$NameCanonicalEx$NameDisplay$NameFullyQualifiedDN$NameSamCompatible$NameServicePrincipal$NameUniqueId$NameUnknown$NameUserPrincipal$PyDISPLAY_DEVICEType$REG_NOTIFY_CHANGE_ATTRIBUTES$REG_NOTIFY_CHANGE_LAST_SET$REG_NOTIFY_CHANGE_NAME$REG_NOTIFY_CHANGE_SECURITY$RegCopyTreeW$RegCreateKeyTransactedW$RegDeleteKeyExW$RegDeleteKeyTransactedW$RegDeleteTreeW$RegOpenCurrentUser$RegOpenKeyTransactedW$RegOverridePredefKey$RegRestoreKeyW$RegSaveKeyExW$STD_ERROR_HANDLE$STD_INPUT_HANDLE$STD_OUTPUT_HANDLE$SetDllDirectoryW$SetHandleInformation$SetSystemFileCacheSize$SetSystemPowerState$VFT_APP$VFT_DLL$VFT_DRV$VFT_FONT$VFT_STATIC_LIB$VFT_UNKNOWN$VFT_VXD$VOS_DOS$VOS_DOS_WINDOWS16$VOS_DOS_WINDOWS32$VOS_NT$VOS_NT_WINDOWS32$VOS_OS216$VOS_OS216_PM16$VOS_OS232$VOS_OS232_PM32$VOS_UNKNOWN$VOS__PM16$VOS__PM32$VOS__WINDOWS16$VOS__WINDOWS32$VS_FF_DEBUG$VS_FF_INFOINFERRED$VS_FF_PATCHED$VS_FF_PRERELEASE$VS_FF_PRIVATEBUILD$VS_FF_SPECIALBUILD$error$kernel32.dll$kernel32.dll$secur32.dll$secur32.dll$user32.dll$user32.dll$win32api
API String ID: 2582702285-985789483
Opcode ID: ead2e87ef3a4f544397b7777cb638994a51bd0e8cfd7cb7cab4ddda1ef9f3e25
Instruction ID: 1f9d42c9a3b336967154572d110ad678d9a1698f697250cb1efe152d7487b895
Opcode Fuzzy Hash: ead2e87ef3a4f544397b7777cb638994a51bd0e8cfd7cb7cab4ddda1ef9f3e25
Instruction Fuzzy Hash: E8B19571941B6876D22237764C89FDFBDA9FFD2B64F010326F508B2381DE78850989A9

Uniqueness

Uniqueness Score: -1.00%

Function 1ECB3D00 Relevance: 22.8, APIs: 11, Strings: 2, Instructions: 99
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PyArg_ParseTuple.PYTHON27(?,OOl:OpenSCManager,?,?,?), ref: 1ECB3D2F
?PyWinObject_AsWCHAR@@YAHPAU_object@@PAPA_WHPAK@Z.PYWINTYPES27(?,?,00000001,00000000), ref: 1ECB3D55
?PyWinObject_AsWCHAR@@YAHPAU_object@@PAPA_WHPAK@Z.PYWINTYPES27(?,?,00000001,00000000), ref: 1ECB3D6B

Strings

OOl:OpenSCManager, xrefs: 1ECB3D19
OpenSCManager, xrefs: 1ECB3DBF

Memory Dump Source

Source File: 0000000F.00000002.1435001879.000000001ECB1000.00000040.00000001.01000000.00000011.sdmp, Offset: 1ECB0000, based on PE: true

Associated: 0000000F.00000002.1434980425.000000001ECB0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBA000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBD000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435097428.000000001ECBF000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435120797.000000001ECC0000.00000004.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ecb0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_U_object@@$Arg_ParseTuple
String ID: OOl:OpenSCManager$OpenSCManager
API String ID: 1248562531-1952627657
Opcode ID: 66dcbcb519fdc23cccf6af2a444bd2ed14421ae6063d3bb570269975d64d819c
Instruction ID: b3a073d5f566fc5d7ae25265f7a5d5f3a984a049d57e3083ca290d963a08920a
Opcode Fuzzy Hash: 66dcbcb519fdc23cccf6af2a444bd2ed14421ae6063d3bb570269975d64d819c
Instruction Fuzzy Hash: FB2161B25142119FD300DF68DDC089BB7A8EFC8A90F444A6DFD4593201E635D9098BA3

Uniqueness

Uniqueness Score: -1.00%

Function 032570D0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 03257000: GetCurrentProcess.KERNEL32(?,00000000,?,032570D6), ref: 0325700B
Part of subcall function 03257000: OpenProcessToken.ADVAPI32(00000000,00000028,00000000,?,00000000,?,032570D6), ref: 03257021
Part of subcall function 03257000: GetLastError.KERNEL32(?,00000000,?,032570D6), ref: 03257027
Part of subcall function 03257000: ImpersonateSelf.ADVAPI32(00000002,?,00000000,?,032570D6), ref: 03257036

GetLastError.KERNEL32(032559F6), ref: 032570E9
PyErr_WarnEx.PYTHON27(?,psutil module couldn't set SE DEBUG mode for this process; please file an issue against psutil bug tracker,00000001), ref: 03257103
PyErr_Clear.PYTHON27 ref: 0325710C
RevertToSelf.KERNELBASE(032559F6), ref: 0325712E
FindCloseChangeNotification.KERNEL32(00000000), ref: 03257135

Strings

SeDebugPrivilege, xrefs: 03257118
psutil module couldn't set SE DEBUG mode for this process; please file an issue against psutil bug tracker, xrefs: 032570DC, 032570FD

Memory Dump Source

Source File: 0000000F.00000002.1423676562.0000000003251000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03250000, based on PE: true

Associated: 0000000F.00000002.1423656216.0000000003250000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423775563.0000000003263000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3250000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Err_ErrorLastProcessSelf$ChangeClearCloseCurrentFindImpersonateNotificationOpenRevertTokenWarn
String ID: SeDebugPrivilege$psutil module couldn't set SE DEBUG mode for this process; please file an issue against psutil bug tracker
API String ID: 10321130-1858787864
Opcode ID: 3829a8cb8e7183a40f4cf35c7224c028d31f9ea39b08ccec76a1bcf7a79cc632
Instruction ID: d108cfe9bf03092022a638c41a628f4b5c3b9449594ce9eb9ab2680d6e8675bc
Opcode Fuzzy Hash: 3829a8cb8e7183a40f4cf35c7224c028d31f9ea39b08ccec76a1bcf7a79cc632
Instruction Fuzzy Hash: 8EF08235A60301DBD652FBB8BC4D62E32619B95A50B448464FC02C914AEFB1D3C0CA12

Uniqueness

Uniqueness Score: -1.00%

Function 03257BE0 Relevance: 10.5, APIs: 7, Instructions: 40
librarythreadloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PyEval_SaveThread.PYTHON27(?,00000000,?,03257CAF,ntdll.dll,NtQuerySystemInformation,03257FF5,032559E9), ref: 03257BE3
LoadLibraryA.KERNEL32(?,?,00000000,?,03257CAF,ntdll.dll,NtQuerySystemInformation,03257FF5,032559E9), ref: 03257BF0
PyEval_RestoreThread.PYTHON27(00000000,?,00000000,?,03257CAF,ntdll.dll,NtQuerySystemInformation,03257FF5,032559E9), ref: 03257BF9
PyErr_SetFromWindowsErrWithFilename.PYTHON27(00000000,?,032559E9), ref: 03257C08
GetProcAddress.KERNEL32(00000000,?), ref: 03257C1D
PyErr_SetFromWindowsErrWithFilename.PYTHON27(00000000,?), ref: 03257C29
FreeLibrary.KERNEL32(00000000), ref: 03257C33

Memory Dump Source

Source File: 0000000F.00000002.1423676562.0000000003251000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03250000, based on PE: true

Associated: 0000000F.00000002.1423656216.0000000003250000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423775563.0000000003263000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3250000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Err_Eval_FilenameFromLibraryThreadWindowsWith$AddressFreeLoadProcRestoreSave
String ID:
API String ID: 568911590-0
Opcode ID: 07934c1d0444689c46486baf178611c0aa8e1de170a014721b00697b1c9dd68d
Instruction ID: 20f26917d17732606c04dccc26192530cf17cd1e25fbc915e4240a90219dff65
Opcode Fuzzy Hash: 07934c1d0444689c46486baf178611c0aa8e1de170a014721b00697b1c9dd68d
Instruction Fuzzy Hash: E3F05E72511321AFCB10BBB9BC4C85F3BACEE856677088825F909D2104D7348A959AB6

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 03252CC0 Relevance: 109.4, APIs: 50, Strings: 12, Instructions: 885COMMON

Download Yara Rule

APIs

PyLong_FromLong.PYTHON27(00000002), ref: 03252CE6
PyLong_FromLong.PYTHON27(00000017), ref: 03252CF0
PyLong_FromLong.PYTHON27(00000001), ref: 03252CF8
PyLong_FromLong.PYTHON27(00000002), ref: 03252D00
PyArg_ParseTuple.PYTHON27(?,lOO,?,?,?), ref: 03252D24
PySequence_Check.PYTHON27(?), ref: 03252D40
PySequence_Check.PYTHON27(?), ref: 03252D52
PyList_New.PYTHON27(00000000), ref: 03252E41
PySequence_Contains.PYTHON27(?,00000000), ref: 03252E5E
PySequence_Contains.PYTHON27(?,?), ref: 03252E76
PyTuple_New.PYTHON27(?), ref: 03252EEA
RtlIpv4AddressToStringA.NTDLL(?,?), ref: 03252F06
Py_BuildValue.PYTHON27((si),?,00000000), ref: 03252F2D
RtlIpv4AddressToStringA.NTDLL(?,?), ref: 03252F63
Py_BuildValue.PYTHON27((si),?,00000002), ref: 03252F8B
PyTuple_New.PYTHON27(00000000), ref: 03252F98
Py_BuildValue.PYTHON27((iiiNNiI),000000FF,00000002,00000001,00000000,?,00000002,?), ref: 03252FC6
PyList_Append.PYTHON27(?,00000000), ref: 03252FDF
73BB3B4E.MSVCR90(?), ref: 03253017
PySequence_Contains.PYTHON27(?,?), ref: 03253040
PySequence_Contains.PYTHON27(?,?), ref: 03253058
RtlIpv6AddressToStringA.NTDLL(?,?), ref: 03253138
Py_BuildValue.PYTHON27((si),?,00000000), ref: 0325315F
RtlIpv6AddressToStringA.NTDLL(?,?), ref: 032531DA
Py_BuildValue.PYTHON27((si),?,?), ref: 03253202
PyTuple_New.PYTHON27(00000000), ref: 0325320F
Py_BuildValue.PYTHON27((iiiNNiI),000000FF,00000017,00000001,00000000,?,00000002,?), ref: 0325323D
PyList_Append.PYTHON27(?,00000000), ref: 03253256
73BB3B4E.MSVCR90(?), ref: 0325329A
PySequence_Contains.PYTHON27(?,00000000), ref: 032532C3
PySequence_Contains.PYTHON27(?,00000000), ref: 032532D7
PyTuple_New.PYTHON27(?), ref: 0325334A
PyTuple_New.PYTHON27(00000000,00000080,?), ref: 032533AB
Py_BuildValue.PYTHON27((iiiNNiI),000000FF,00000002,00000002,00000000,00000000), ref: 032533C1
PyList_Append.PYTHON27(?,00000000), ref: 032533DA
73BB3B4E.MSVCR90(?), ref: 03253412
PySequence_Contains.PYTHON27(?,?), ref: 0325343B
PySequence_Contains.PYTHON27(?,00000000), ref: 0325344F
73BB3B4E.MSVCR90(?), ref: 03253707
PyErr_SetString.PYTHON27(?,arg 2 or 3 is not a sequence), ref: 03253777

Strings

(iiiNNiI), xrefs: 03252FC1
(si), xrefs: 03252F86
(si), xrefs: 0325315A
(iiiNNiI), xrefs: 032533BC
(si), xrefs: 03253388
arg 2 or 3 is not a sequence, xrefs: 03253771
(si), xrefs: 0325353A
(si), xrefs: 032531FD
(iiiNNiI), xrefs: 0325357B
lOO, xrefs: 03252D1A
(iiiNNiI), xrefs: 03253238
(si), xrefs: 03252F28

Memory Dump Source

Source File: 0000000F.00000002.1423676562.0000000003251000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03250000, based on PE: true

Associated: 0000000F.00000002.1423656216.0000000003250000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423775563.0000000003263000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3250000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Sequence_$Contains$BuildValue$StringTuple_$AddressFromList_LongLong_$Append$CheckIpv4Ipv6$Arg_Err_ParseTuple
String ID: (iiiNNiI)$(iiiNNiI)$(iiiNNiI)$(iiiNNiI)$(si)$(si)$(si)$(si)$(si)$(si)$arg 2 or 3 is not a sequence$lOO
API String ID: 881133558-215568841
Opcode ID: 0cc162e58598655d0eed2525be9e8cd22f5e20e586b2739d1f5eaa2e485d6f10
Instruction ID: dab9ddd68c5bacc0da9c3462f41ae54a94c3a0e4b4ee9a799e78889e2f54307b
Opcode Fuzzy Hash: 0cc162e58598655d0eed2525be9e8cd22f5e20e586b2739d1f5eaa2e485d6f10
Instruction Fuzzy Hash: A862A3B59143029FDB14DF64D884A6AB7E4FF84324F14862CFE6587380E734EA95CB92

Uniqueness

Uniqueness Score: -1.00%

Function 1ECB2570 Relevance: 68.6, APIs: 22, Strings: 17, Instructions: 307COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON27(?,EnumServicesStatusEx does not exist on this platform), ref: 1ECB25D2
?PyWinObject_FreeWCHAR@@YAXPA_W@Z.PYWINTYPES27(?,?,?,?,?,?,?,?,?,?,?,?,EnumServicesStatusEx does not exist on this platform), ref: 1ECB25E5
PyArg_ParseTuple.PYTHON27(?,O&|kkOk:EnumServicesStatusEx,1E7A4080,?,?,?,00000003,?), ref: 1ECB2629
?PyWinObject_FreeWCHAR@@YAXPA_W@Z.PYWINTYPES27 ref: 1ECB2643

Strings

CheckPoint, xrefs: 1ECB27A7
0, xrefs: 1ECB2594
Unsupported information level, xrefs: 1ECB266B
ControlsAccepted, xrefs: 1ECB27C2
ServiceSpecificExitCode, xrefs: 1ECB27B0
EnumServicesStatusEx does not exist on this platform, xrefs: 1ECB25CC
WaitHint, xrefs: 1ECB279E
ProcessId, xrefs: 1ECB2795
DisplayName, xrefs: 1ECB27DD
O&|kkOk:EnumServicesStatusEx, xrefs: 1ECB2623
ServiceFlags, xrefs: 1ECB278C
EnumServicesStatusEx, xrefs: 1ECB28D1
CurrentState, xrefs: 1ECB27C8
Win32ExitCode, xrefs: 1ECB27B9
ServiceType, xrefs: 1ECB27CE
ServiceName, xrefs: 1ECB27E9
{s:N, s:N, s:k, s:k, s:k, s:k, s:k, s:k, s:k, s:k, s:k}, xrefs: 1ECB27EE

Memory Dump Source

Source File: 0000000F.00000002.1435001879.000000001ECB1000.00000040.00000001.01000000.00000011.sdmp, Offset: 1ECB0000, based on PE: true

Associated: 0000000F.00000002.1434980425.000000001ECB0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBA000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBD000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435097428.000000001ECBF000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435120797.000000001ECC0000.00000004.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ecb0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: FreeObject_$Arg_Err_ParseStringTuple
String ID: 0$CheckPoint$ControlsAccepted$CurrentState$DisplayName$EnumServicesStatusEx$EnumServicesStatusEx does not exist on this platform$O&|kkOk:EnumServicesStatusEx$ProcessId$ServiceFlags$ServiceName$ServiceSpecificExitCode$ServiceType$Unsupported information level$WaitHint$Win32ExitCode${s:N, s:N, s:k, s:k, s:k, s:k, s:k, s:k, s:k, s:k, s:k}
API String ID: 2900418210-68542743
Opcode ID: dd1ba2ca752b37a922a256a6c4cd3bc644622d62a1136382ab47bd1c87ac5ba1
Instruction ID: 639677ab81b0ed4fbf6d6a1b2ec06f78bc9034d9f0ae3ea351652c4b7cee4f9d
Opcode Fuzzy Hash: dd1ba2ca752b37a922a256a6c4cd3bc644622d62a1136382ab47bd1c87ac5ba1
Instruction Fuzzy Hash: 13C116B2904341ABD714CF58CD84A5BB7EABF88BA4F044B2CF9A583254D735E905CB92

Uniqueness

Uniqueness Score: -1.00%

Function 03256100 Relevance: 52.8, APIs: 14, Strings: 16, Instructions: 280COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00001410,00000000,00000001,?,00000000,?,00000000), ref: 03256130
GetCurrentProcess.KERNEL32(?,?,00000000), ref: 0325614F
IsWow64Process.KERNEL32(00000000,?,00000000), ref: 0325615C
IsWow64Process.KERNEL32(00000000,?,?,00000000), ref: 0325616C
PyErr_Clear.PYTHON27(?,?,?,00000000), ref: 032561AE
PyErr_Clear.PYTHON27(?,?,?,00000000), ref: 032561E6
CloseHandle.KERNEL32(00000000,?,?,00000000), ref: 03256488
73BB3B4E.MSVCR90(00000000,?,?,00000000), ref: 03256493

Part of subcall function 032510D0: PyObject_CallFunction.PYTHON27(?,(is),0000000D,00000000,0325D7E0), ref: 0325110A
Part of subcall function 032510D0: PyErr_SetObject.PYTHON27(00000000,00000000,?,(is),0000000D,00000000,0325D7E0), ref: 0325111C

Part of subcall function 03257BE0: PyEval_SaveThread.PYTHON27(?,00000000,?,03257CAF,ntdll.dll,NtQuerySystemInformation,03257FF5,032559E9), ref: 03257BE3
Part of subcall function 03257BE0: LoadLibraryA.KERNEL32(?,?,00000000,?,03257CAF,ntdll.dll,NtQuerySystemInformation,03257FF5,032559E9), ref: 03257BF0
Part of subcall function 03257BE0: PyEval_RestoreThread.PYTHON27(00000000,?,00000000,?,03257CAF,ntdll.dll,NtQuerySystemInformation,03257FF5,032559E9), ref: 03257BF9
Part of subcall function 03257BE0: PyErr_SetFromWindowsErrWithFilename.PYTHON27(00000000,?,032559E9), ref: 03257C08

Strings

can't query 64-bit process in 32-bit-WoW mode, xrefs: 032561B4
NtWow64ReadVirtualMemory64(ProcessParameters), xrefs: 0325627E
ReadProcessMemory, xrefs: 0325644D
NtQueryInformationProcess(ProcessBasicInformation), xrefs: 03256314
NtWow64ReadVirtualMemory64, xrefs: 032561CB
can't query 64-bit process in 32-bit-WoW mode, xrefs: 032563BE
NtWow64QueryInformationProcess64, xrefs: 03256193
ntdll.dll, xrefs: 032561D0
ReadProcessMemory, xrefs: 03256342
can't query 64-bit process in 32-bit-WoW mode, xrefs: 032561EC
NtWow64QueryInformationProcess64(ProcessBasicInformation), xrefs: 03256215
IsWow64Process, xrefs: 0325647A
ReadProcessMemory(ProcessParameters), xrefs: 03256361
NtWow64ReadVirtualMemory64, xrefs: 03256432
ntdll.dll, xrefs: 03256198
NtWow64ReadVirtualMemory64, xrefs: 03256248

Memory Dump Source

Source File: 0000000F.00000002.1423676562.0000000003251000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03250000, based on PE: true

Associated: 0000000F.00000002.1423656216.0000000003250000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423775563.0000000003263000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3250000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Err_Process$ClearEval_ThreadWow64$CallCloseCurrentFilenameFromFunctionHandleLibraryLoadObjectObject_OpenRestoreSaveWindowsWith
String ID: IsWow64Process$NtQueryInformationProcess(ProcessBasicInformation)$NtWow64QueryInformationProcess64$NtWow64QueryInformationProcess64(ProcessBasicInformation)$NtWow64ReadVirtualMemory64$NtWow64ReadVirtualMemory64$NtWow64ReadVirtualMemory64$NtWow64ReadVirtualMemory64(ProcessParameters)$ReadProcessMemory$ReadProcessMemory$ReadProcessMemory(ProcessParameters)$can't query 64-bit process in 32-bit-WoW mode$can't query 64-bit process in 32-bit-WoW mode$can't query 64-bit process in 32-bit-WoW mode$ntdll.dll$ntdll.dll
API String ID: 586966080-721633947
Opcode ID: b059c6f62114192aab7f2fbc924528b7f5b187eba7143b84732860287a2788d8
Instruction ID: 2f76bbb77be09805f941a24f2ca7cb077af32f28dae0d096586bd5d1bcd6df92
Opcode Fuzzy Hash: b059c6f62114192aab7f2fbc924528b7f5b187eba7143b84732860287a2788d8
Instruction Fuzzy Hash: 2291D371664342EBD730EF50AC49F7F77A8AB80B01F44952DFD8496244E7B09BC58BA2

Uniqueness

Uniqueness Score: -1.00%

Function 03256970 Relevance: 52.7, APIs: 29, Strings: 1, Instructions: 243memorynativeCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 0325699E
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 032569A9
RtlInitializeCriticalSection.NTDLL(0325DBC0), ref: 032569B5
RtlEnterCriticalSection.NTDLL(0325DBC0), ref: 032569CA
PyList_New.PYTHON27(00000000), ref: 032569EF
GetProcessHeap.KERNEL32(00000000,00000000), ref: 03256A0A
HeapFree.KERNEL32(00000000), ref: 03256A0D
GetProcessHeap.KERNEL32(00000008,00010000), ref: 03256A18
RtlAllocateHeap.NTDLL(00000000), ref: 03256A1B
NtQuerySystemInformation.NTDLL(00000040,00000000,00010000,?), ref: 03256A30
PyErr_NoMemory.PYTHON27 ref: 03256A54
GetProcessHeap.KERNEL32(00000000,00000000), ref: 03256BFF
HeapFree.KERNEL32(00000000), ref: 03256C02
CloseHandle.KERNEL32(00000000), ref: 03256C24
GetProcessHeap.KERNEL32(00000000,00000000), ref: 03256C36
HeapFree.KERNEL32(00000000), ref: 03256C39
RtlLeaveCriticalSection.NTDLL(0325DBC0), ref: 03256C67

Strings

NtQuerySystemInformation(SystemExtendedHandleInformation), xrefs: 03256A41

Memory Dump Source

Source File: 0000000F.00000002.1423676562.0000000003251000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03250000, based on PE: true

Associated: 0000000F.00000002.1423656216.0000000003250000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423775563.0000000003263000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3250000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Heap$Process$CriticalFreeSection$CreateEvent$AllocateCloseEnterErr_HandleInformationInitializeLeaveList_MemoryQuerySystem
String ID: NtQuerySystemInformation(SystemExtendedHandleInformation)
API String ID: 1998073440-3808510385
Opcode ID: 6bb41237a0478fae3f353720cd022c2323dcb5bda1ba20d30fab77241898a160
Instruction ID: 384f9599701cf2e26ff324785fcdb80850a7bb9be5fcb3755f0a2f8fd2c59a82
Opcode Fuzzy Hash: 6bb41237a0478fae3f353720cd022c2323dcb5bda1ba20d30fab77241898a160
Instruction Fuzzy Hash: 068160B15103429FCB10FFA4B88C92ABBE8EB44315F88D52DF94293255D7349BC5CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 032541B0 Relevance: 47.6, APIs: 23, Strings: 4, Instructions: 307threadCOMMON

Download Yara Rule

APIs

PyList_New.PYTHON27(00000000), ref: 032541E6
SetErrorMode.KERNEL32(00000001,?,00000410), ref: 03254208
PyArg_ParseTuple.PYTHON27(?,0325B728,?,?,00000410), ref: 03254224
PyObject_IsTrue.PYTHON27(?), ref: 0325423A
PyEval_SaveThread.PYTHON27 ref: 03254247
GetLogicalDriveStringsA.KERNEL32(000000FE,?), ref: 03254259
PyEval_RestoreThread.PYTHON27(00000000), ref: 03254262
PyErr_SetFromWindowsErr.PYTHON27(00000000), ref: 03254270
SetErrorMode.KERNEL32(?), ref: 0325454A

Strings

A:\, xrefs: 032542EE
,compressed, xrefs: 03254398
(ssss), xrefs: 03254421
(ssss), xrefs: 032544D0

Memory Dump Source

Source File: 0000000F.00000002.1423676562.0000000003251000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03250000, based on PE: true

Associated: 0000000F.00000002.1423656216.0000000003250000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423775563.0000000003263000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3250000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: ErrorEval_ModeThread$Arg_DriveErr_FromList_LogicalObject_ParseRestoreSaveStringsTrueTupleWindows
String ID: (ssss)$(ssss)$,compressed$A:\
API String ID: 1855366723-68049997
Opcode ID: cae35c19bfb81f29c845036e2ac926c70ec30822637f7edd8bd4e3fe62ddd6ac
Instruction ID: b2650fc2c2b479b236f393554f7a428d45dcd5ff1c1ea2fc6ae9122a0af032ac
Opcode Fuzzy Hash: cae35c19bfb81f29c845036e2ac926c70ec30822637f7edd8bd4e3fe62ddd6ac
Instruction Fuzzy Hash: D3A10671554302AFC320EF61EC88FABB7A8AF84714F084A18FD5986190E775D7C9CB92

Uniqueness

Uniqueness Score: -1.00%

Function 03256C80 Relevance: 38.7, APIs: 21, Strings: 1, Instructions: 201memoryfilenativeCOMMON

Download Yara Rule

APIs

PyList_New.PYTHON27(00000000), ref: 03256CB7
GetProcessHeap.KERNEL32(00000000,00000000), ref: 03256CDE
HeapFree.KERNEL32(00000000), ref: 03256CE5
GetProcessHeap.KERNEL32(00000008,00010000), ref: 03256CF0
RtlAllocateHeap.NTDLL(00000000), ref: 03256CF7
NtQuerySystemInformation.NTDLL(00000040,00000000,00010000,?), ref: 03256D0C
CloseHandle.KERNEL32(?), ref: 03256D3D
GetProcessHeap.KERNEL32(00000000,00000000), ref: 03256D56
HeapFree.KERNEL32(00000000), ref: 03256D5D
PyErr_NoMemory.PYTHON27 ref: 03256D94
GetCurrentProcess.KERNEL32(?,00000000,00000001,00000002), ref: 03256DD5
DuplicateHandle.KERNEL32(?,00000000,00000000), ref: 03256DE4
CreateFileMappingA.KERNEL32(?,00000000,00000002,00000000,00000000,00000000), ref: 03256E01
MapViewOfFile.KERNEL32(00000000,00000004,00000000,00000000,00000001), ref: 03256E1A
GetCurrentProcess.KERNEL32(00000000,?,00000104), ref: 03256E31
GetMappedFileNameA.PSAPI(00000000), ref: 03256E34
PyUnicodeUCS2_FromWideChar.PYTHON27(?,00000000,00000000), ref: 03256E4A
PyList_Append.PYTHON27(?,00000000), ref: 03256E5F

Strings

NtQuerySystemInformation(SystemExtendedHandleInformation), xrefs: 03256D1D

Memory Dump Source

Source File: 0000000F.00000002.1423676562.0000000003251000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03250000, based on PE: true

Associated: 0000000F.00000002.1423656216.0000000003250000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423775563.0000000003263000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3250000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Heap$Process$File$CurrentFreeHandleList_$AllocateAppendCharCloseCreateDuplicateErr_FromInformationMappedMappingMemoryNameQuerySystemUnicodeViewWide
String ID: NtQuerySystemInformation(SystemExtendedHandleInformation)
API String ID: 3366806375-3808510385
Opcode ID: 07fc6fcc6622a784527da640c9064f733ea623d755570b25310ab8699987cf0e
Instruction ID: 469ca772169b5a7dbc5ba82f14f1953cf2f3eef803433dd684e60ca6389af024
Opcode Fuzzy Hash: 07fc6fcc6622a784527da640c9064f733ea623d755570b25310ab8699987cf0e
Instruction Fuzzy Hash: 5F61F5705553029BD720EF64E84CF6BBBE8AF84B10F48891CFD45A7280D7B5DA84CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 03255650 Relevance: 36.9, APIs: 15, Strings: 6, Instructions: 192nativeCOMMON

Download Yara Rule

APIs

PyErr_SetFromWindowsErr.PYTHON27(00000000), ref: 03255680
PyErr_SetString.PYTHON27(?,GetSystemInfo() failed to retrieve CPU count), ref: 032556B7
PyErr_NoMemory.PYTHON27 ref: 032556E4
NtQuerySystemInformation.NTDLL(00000002,00000000,00000004,00000000), ref: 032556F5
73BB3B4E.MSVCR90(?), ref: 032557AD
73BB3B4E.MSVCR90(?), ref: 032557BB
73BB3B4E.MSVCR90(00000000), ref: 032557C5
73BB3B4E.MSVCR90(?), ref: 0325581A
73BB3B4E.MSVCR90(?), ref: 03255821
73BB3B4E.MSVCR90(00000000), ref: 03255824
Py_BuildValue.PYTHON27(kkkk,?,?,?,?), ref: 03255849

Strings

NtQuerySystemInformation(SystemInterruptInformation), xrefs: 0325573C
NtQuerySystemInformation(SystemPerformanceInformation), xrefs: 032556FF
GetSystemInfo() failed to retrieve CPU count, xrefs: 032556B1
GetActiveProcessorCount() not available; using GetSystemInfo(), xrefs: 03255693
kkkk, xrefs: 03255844
NtQuerySystemInformation(SystemProcessorPerformanceInformation), xrefs: 03255790

Memory Dump Source

Source File: 0000000F.00000002.1423676562.0000000003251000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03250000, based on PE: true

Associated: 0000000F.00000002.1423656216.0000000003250000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423775563.0000000003263000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3250000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Err_$BuildFromInformationMemoryQueryStringSystemValueWindows
String ID: GetActiveProcessorCount() not available; using GetSystemInfo()$GetSystemInfo() failed to retrieve CPU count$NtQuerySystemInformation(SystemInterruptInformation)$NtQuerySystemInformation(SystemPerformanceInformation)$NtQuerySystemInformation(SystemProcessorPerformanceInformation)$kkkk
API String ID: 918436300-3520883961
Opcode ID: c436660262d5be9733cf5dc249e48aa1491f796aa48b085a1f3077bd260591ff
Instruction ID: 30b9de4c81be4126e2f270ab21aa8a3f6fd6e6f2a5cc400dbc471574d1925c5b
Opcode Fuzzy Hash: c436660262d5be9733cf5dc249e48aa1491f796aa48b085a1f3077bd260591ff
Instruction Fuzzy Hash: DE510671614305DFD710EF68EC88A6BB7A9EFC5614F194429FC0B97200DB70EB84CAA2

Uniqueness

Uniqueness Score: -1.00%

Function 1E7D2D10 Relevance: 35.2, APIs: 8, Strings: 12, Instructions: 191COMMON

Download Yara Rule

APIs

GetCommandLineW.KERNEL32(?), ref: 1E7D2D1F
CommandLineToArgvW.SHELL32(00000000), ref: 1E7D2D26
GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 1E7D2D55
GetModuleHandleW.KERNEL32(00000000,000003F8,?,00000100), ref: 1E7D2E14
LoadStringW.USER32(00000000), ref: 1E7D2E1B
PythonService_PrepareToHostSingle.SERVICEMANAGER(00000000), ref: 1E7D2E6E

Strings

install, xrefs: 1E7D2DD2
NOTE: You do not start the service using this program - start the, xrefs: 1E7D2F3E
register, xrefs: 1E7D2DB9
debug, xrefs: 1E7D2DEB
-debug servicename [parms] - debug the Python service., xrefs: 1E7D2F37
-register - register the EXE - this should generally not be necessary., xrefs: 1E7D2F30
service using Control Panel, or 'net start service_name', xrefs: 1E7D2F45
Could not start the service - error %d, xrefs: 1E7D2F6C
Debugging service %s - press Ctrl+C to stop., xrefs: 1E7D2E57
Options:, xrefs: 1E7D2F29
%s - Python Service Manager, xrefs: 1E7D2F22
-debug requires a service name, xrefs: 1E7D2E33

Memory Dump Source

Source File: 0000000F.00000002.1434219289.000000001E7D1000.00000040.00000001.01000000.00000015.sdmp, Offset: 1E7D0000, based on PE: true

Associated: 0000000F.00000002.1434197225.000000001E7D0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000F.00000002.1434219289.000000001E7DA000.00000040.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000F.00000002.1434284534.000000001E7DB000.00000080.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000F.00000002.1434310614.000000001E7DD000.00000004.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e7d0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: CommandLineModule$ArgvFileHandleHostLoadNamePreparePythonService_SingleString
String ID: NOTE: You do not start the service using this program - start the$ -debug servicename [parms] - debug the Python service.$ -register - register the EXE - this should generally not be necessary.$%s - Python Service Manager$-debug requires a service name$Could not start the service - error %d$Debugging service %s - press Ctrl+C to stop.$Options:$debug$install$register$service using Control Panel, or 'net start service_name'
API String ID: 2141616646-3465821732
Opcode ID: 0c209cb0a07809eac29ffe921249373ea5d861b9ab09d69a4b0f3f8510fb3ed4
Instruction ID: 2d81218cd37cf45ac419674f32153682bfb02e2f244039142e5b6c8237a5b481
Opcode Fuzzy Hash: 0c209cb0a07809eac29ffe921249373ea5d861b9ab09d69a4b0f3f8510fb3ed4
Instruction Fuzzy Hash: 9951D671A003659FF7109BA4EC88BEB3BADFB48B21F444625ED44D6254E731940DCBA2

Uniqueness

Uniqueness Score: -1.00%

Function 03253F40 Relevance: 33.4, APIs: 14, Strings: 5, Instructions: 181fileCOMMON

Download Yara Rule

APIs

PyDict_New.PYTHON27 ref: 03253F46
CreateFileA.KERNEL32(?,00000000,00000003,00000000,00000003,00000000,00000000), ref: 03253F8D
DeviceIoControl.KERNEL32(00000000,00070020,00000000,00000000,?,00000058,?,00000000), ref: 03253FBD
GetLastError.KERNEL32 ref: 03253FC7
DeviceIoControl.KERNEL32(00000000,00070020,00000000,00000000,?,00000058,?,00000000), ref: 03253FFC
__aulldiv.LIBCMT ref: 03254033
__aulldiv.LIBCMT ref: 0325404B
Py_BuildValue.PYTHON27((IILLKK),?,?,?,?,00000000,?,00000000,?,?,?,00989680,00000000,00000000,?,?), ref: 03254075

Strings

DeviceIoControl -> ERROR_NOT_SUPPORTED; ignore PhysicalDrive%i, xrefs: 032540D3
\\.\PhysicalDrive%d, xrefs: 03253F61
(IILLKK), xrefs: 03254070
PhysicalDrive%i, xrefs: 03254007
DeviceIoControl -> ERROR_INVALID_FUNCTION; ignore PhysicalDrive%i, xrefs: 032540C4

Memory Dump Source

Source File: 0000000F.00000002.1423676562.0000000003251000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03250000, based on PE: true

Associated: 0000000F.00000002.1423656216.0000000003250000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423775563.0000000003263000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3250000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: ControlDevice__aulldiv$BuildCreateDict_ErrorFileLastValue
String ID: (IILLKK)$DeviceIoControl -> ERROR_INVALID_FUNCTION; ignore PhysicalDrive%i$DeviceIoControl -> ERROR_NOT_SUPPORTED; ignore PhysicalDrive%i$PhysicalDrive%i$\\.\PhysicalDrive%d
API String ID: 2026795684-2668205038
Opcode ID: a4cf9998e2642f606cda277e7f085fedebb00eafa142bd16086d921ed9cdc0c5
Instruction ID: bc53fd5e10dee958bb7718c0987c335e66220208c4abf14010306a41dc49d2a1
Opcode Fuzzy Hash: a4cf9998e2642f606cda277e7f085fedebb00eafa142bd16086d921ed9cdc0c5
Instruction Fuzzy Hash: DF512971254300ABD620EB61EC49F6BB3ACEB84B10F108A08FE55D6184D771EAC5C762

Uniqueness

Uniqueness Score: -1.00%

Function 03257320 Relevance: 30.0, APIs: 14, Strings: 3, Instructions: 234serviceCOMMON

Download Yara Rule

APIs

PyList_New.PYTHON27(00000000), ref: 03257337
OpenSCManagerA.ADVAPI32(00000000,00000000,00000004), ref: 03257352
EnumServicesStatusExW.ADVAPI32(00000000,00000000,00000030,00000003,00000000,00000000,?,?,?,00000000), ref: 03257395
GetLastError.KERNEL32 ref: 032573A1
73BB3B4E.MSVCR90(00000000), ref: 032573B3
EnumServicesStatusExW.ADVAPI32(?,00000000,00000030,00000003,00000000,?,?,?,?,00000000), ref: 032573EA
PyUnicodeUCS2_FromWideChar.PYTHON27 ref: 03257437
PyUnicodeUCS2_FromWideChar.PYTHON27(?,?), ref: 03257461
Py_BuildValue.PYTHON27((OO),00000000,00000000), ref: 03257477

Part of subcall function 03251090: GetLastError.KERNEL32 ref: 032510B2
Part of subcall function 03251090: PyErr_SetFromWindowsErrWithFilename.PYTHON27(00000000), ref: 032510B9

Strings

,, xrefs: 032574D9
(OO), xrefs: 03257472
OpenSCManager, xrefs: 03257360

Memory Dump Source

Source File: 0000000F.00000002.1423676562.0000000003251000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03250000, based on PE: true

Associated: 0000000F.00000002.1423656216.0000000003250000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423775563.0000000003263000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3250000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: From$CharEnumErrorLastServicesStatusUnicodeWide$BuildErr_FilenameList_ManagerOpenValueWindowsWith
String ID: (OO)$,$OpenSCManager
API String ID: 2902223218-1263985291
Opcode ID: 10e17cefdc5de8ecd5690ef4cc555df58b725e5098d66f89489ee18f58efe2e6
Instruction ID: bea6e511c3b3699208195ee7fd813068ec679fee7b0a6e15f8f21426c380ed63
Opcode Fuzzy Hash: 10e17cefdc5de8ecd5690ef4cc555df58b725e5098d66f89489ee18f58efe2e6
Instruction Fuzzy Hash: B37172B29543029FC710DF68DC8495BB7E8FF88624F184A28FD5997240D734EB85CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 03251E30 Relevance: 28.1, APIs: 12, Strings: 4, Instructions: 107memorynativeCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,00008000), ref: 03251E42
RtlAllocateHeap.NTDLL(00000000), ref: 03251E45
NtQueryVirtualMemory.NTDLL(?,00000000,00000001,00000000,00008000,00000000), ref: 03251E5A
GetProcessHeap.KERNEL32(00000000,00000000), ref: 03251E73
HeapFree.KERNEL32(00000000), ref: 03251E76
GetProcessHeap.KERNEL32(00000008,00008000), ref: 03251E97
RtlAllocateHeap.NTDLL(00000000), ref: 03251E9A
NtQueryVirtualMemory.NTDLL(?,00000000,00000001,00000000,00008000,00000000), ref: 03251EAF
PyErr_SetString.PYTHON27(00000000,NtQueryVirtualMemory bufsize is too large), ref: 03251EEC
PyErr_Clear.PYTHON27 ref: 03251F1F

Part of subcall function 03257C40: PyErr_SetFromWindowsErrWithFilename.PYTHON27(00000000,?), ref: 03257C87

GetProcessHeap.KERNEL32(00000000,00000000), ref: 03251F36
HeapFree.KERNEL32(00000000), ref: 03251F39

Strings

NtQueryVirtualMemory increase bufsize %zd, xrefs: 03251E7F
NtQueryVirtualMemory(MemoryWorkingSetInformation), xrefs: 03251F25
NtQueryVirtualMemory bufsize is too large, xrefs: 03251EE6
", xrefs: 03251EC7

Memory Dump Source

Source File: 0000000F.00000002.1423676562.0000000003251000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03250000, based on PE: true

Associated: 0000000F.00000002.1423656216.0000000003250000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423775563.0000000003263000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3250000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Heap$Process$Err_$AllocateFreeMemoryQueryVirtual$ClearFilenameFromStringWindowsWith
String ID: "$NtQueryVirtualMemory bufsize is too large$NtQueryVirtualMemory increase bufsize %zd$NtQueryVirtualMemory(MemoryWorkingSetInformation)
API String ID: 1319032550-4102764982
Opcode ID: 51260625c3ac7137bd47163108d8475c2323338b59baa0f2b4645fd814734ebe
Instruction ID: 6eacfb4aac88cd8b960145c25e1fa004877821bb60ac432549d720511ca2c1e5
Opcode Fuzzy Hash: 51260625c3ac7137bd47163108d8475c2323338b59baa0f2b4645fd814734ebe
Instruction Fuzzy Hash: C931F776760310BBDA10F7B6BC4DF4F3768DB85A51F044060FE05D6181DAB6A6D08271

Uniqueness

Uniqueness Score: -1.00%

Function 032564B0 Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 137nativeCOMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON27(?,requires Windows 8.1+,?,00000000,?,00000000,?,03256674,?,?), ref: 032564D5
NtQueryInformationProcess.NTDLL(00000000,0000003C,00000000,00000000,?), ref: 03256528
CloseHandle.KERNEL32(00000000,?,?,?,?,03251B15,?,00000000), ref: 032565E9
73BB3B4E.MSVCR90(00000000,?,?,?,?,?,?,03251B15,?,00000000), ref: 03256614
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,03251B15,?,00000000), ref: 0325661E

Strings

NtQueryInformationProcess(ProcessBasicInformation) -> STATUS_NOT_FOUND translated into PermissionError, xrefs: 03256535
NtQueryInformationProcess(ProcessCommandLineInformation), xrefs: 03256599
NtQueryInformationProcess(ProcessBasicInformation), xrefs: 03256559
requires Windows 8.1+, xrefs: 032564CF

Memory Dump Source

Source File: 0000000F.00000002.1423676562.0000000003251000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03250000, based on PE: true

Associated: 0000000F.00000002.1423656216.0000000003250000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423775563.0000000003263000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3250000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: CloseHandle$Err_InformationProcessQueryString
String ID: NtQueryInformationProcess(ProcessBasicInformation)$NtQueryInformationProcess(ProcessBasicInformation) -> STATUS_NOT_FOUND translated into PermissionError$NtQueryInformationProcess(ProcessCommandLineInformation)$requires Windows 8.1+
API String ID: 3724660651-279392319
Opcode ID: ee6f43c3bce60ec46b2ac20c3511a6201016e8ec60b537f7feac0a9cb0443045
Instruction ID: cdb03b13f731ebe22f3db8122aa983d6b07991265a1106a7a7158591a6e76187
Opcode Fuzzy Hash: ee6f43c3bce60ec46b2ac20c3511a6201016e8ec60b537f7feac0a9cb0443045
Instruction Fuzzy Hash: B541E8751A03029FDB20EFA4AC4CF2B7798EB44616F489558FD06DB249DBB0DBC4C661

Uniqueness

Uniqueness Score: -1.00%

Function 03253C20 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 80threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,0325B5E4,?), ref: 03253C3A
PyEval_SaveThread.PYTHON27 ref: 03253C43
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 03253C5F
PyErr_Clear.PYTHON27 ref: 03253C67
PyArg_ParseTuple.PYTHON27(?,0325B5E8,?), ref: 03253C78
PyEval_SaveThread.PYTHON27 ref: 03253C81
GetDiskFreeSpaceExA.KERNEL32(?,?,?,?), ref: 03253C9D
PyEval_RestoreThread.PYTHON27(00000000), ref: 03253CA6
PyErr_SetFromWindowsErrWithFilename.PYTHON27(00000000,?), ref: 03253CB9
Py_BuildValue.PYTHON27((LL),?,?,?,?), ref: 03253CE1

Strings

(LL), xrefs: 03253CDC

Memory Dump Source

Source File: 0000000F.00000002.1423676562.0000000003251000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03250000, based on PE: true

Associated: 0000000F.00000002.1423656216.0000000003250000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423775563.0000000003263000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3250000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_Thread$Arg_DiskErr_FreeParseSaveSpaceTuple$BuildClearFilenameFromRestoreValueWindowsWith
String ID: (LL)
API String ID: 379473955-591180812
Opcode ID: d46d383f40aaa710ae8fb3287a029ffffa0a224dc2046c43bf1a16b1029efb77
Instruction ID: a7e86a441e6171d92a136fd7dff7adb18d999b2043515b6284ef8dc8762dbf2d
Opcode Fuzzy Hash: d46d383f40aaa710ae8fb3287a029ffffa0a224dc2046c43bf1a16b1029efb77
Instruction Fuzzy Hash: 5C217176614302AFC700EB58EC48DAF77ACAEC4255F448959FD49C3215E730EB898BA2

Uniqueness

Uniqueness Score: -1.00%

Function 1ECB1D10 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 98COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,OllO:CreateDesktop,?,?,?,?), ref: 1ECB1D51
?PyWinObject_AsSECURITY_ATTRIBUTES@@YAHPAU_object@@PAPAU_SECURITY_ATTRIBUTES@@H@Z.PYWINTYPES27(?,?,00000001), ref: 1ECB1D7C
?PyWinObject_AsWCHAR@@YAHPAU_object@@PAPA_WHPAK@Z.PYWINTYPES27(?,?,00000000,00000000), ref: 1ECB1D95
CreateDesktopW.USER32(?,00000000,00000000,?,?,?), ref: 1ECB1DB9
GetLastError.KERNEL32 ref: 1ECB1DC5
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(CreateDesktop,00000000), ref: 1ECB1DD1
?PyWinObject_FreeWCHAR@@YAXPA_W@Z.PYWINTYPES27(?), ref: 1ECB1E12

Strings

OllO:CreateDesktop, xrefs: 1ECB1D43
CreateDesktop, xrefs: 1ECB1DCC

Memory Dump Source

Source File: 0000000F.00000002.1435001879.000000001ECB1000.00000040.00000001.01000000.00000011.sdmp, Offset: 1ECB0000, based on PE: true

Associated: 0000000F.00000002.1434980425.000000001ECB0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBA000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBD000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435097428.000000001ECBF000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435120797.000000001ECC0000.00000004.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ecb0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_U_object@@$Arg_CreateDesktopErrorError@@FreeLastParseTupleWin_
String ID: CreateDesktop$OllO:CreateDesktop
API String ID: 4141961932-961470432
Opcode ID: f22c882e6e627d17cc605d3cf72568083c16f9997865580347a721cf194a28f1
Instruction ID: 560c325b5795d951e902eae2ca547fa94f541b5313f2a9e13ab5a54fad554c34
Opcode Fuzzy Hash: f22c882e6e627d17cc605d3cf72568083c16f9997865580347a721cf194a28f1
Instruction Fuzzy Hash: 73316BB6514241AFD200DF69CC88E9BBBE9FBC8790F004B2DF899C2245D734D504CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 03254E20 Relevance: 15.1, APIs: 10, Instructions: 140processCOMMON

Download Yara Rule

APIs

PyDict_New.PYTHON27 ref: 03254E2A
CreateToolhelp32Snapshot.KERNEL32(00000002,00000000), ref: 03254E61
PyErr_SetFromWindowsErr.PYTHON27(00000000,00000002,00000000), ref: 03254E73

Memory Dump Source

Source File: 0000000F.00000002.1423676562.0000000003251000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03250000, based on PE: true

Associated: 0000000F.00000002.1423656216.0000000003250000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423775563.0000000003263000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3250000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: CreateDict_Err_FromSnapshotToolhelp32Windows
String ID:
API String ID: 4291761330-0
Opcode ID: 327b741ad02f893b6c919561ab18df4ec5a4b171538c89c07163f1c640108127
Instruction ID: dc6d38c44022dc7776105cb3d1d74ac961fab5e99aad3030290c9e6f06d80947
Opcode Fuzzy Hash: 327b741ad02f893b6c919561ab18df4ec5a4b171538c89c07163f1c640108127
Instruction Fuzzy Hash: 0241D8726503029BD710EE65EC459BBF3A8AF81730F144668FD2487280E779EE96C7D2

Uniqueness

Uniqueness Score: -1.00%

Function 1ECB40C0 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 47threadserviceCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1ECB40D9
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(00000000,?), ref: 1ECB40F5
PyEval_SaveThread.PYTHON27 ref: 1ECB4104
DeleteService.ADVAPI32(?), ref: 1ECB4111
PyEval_RestoreThread.PYTHON27(00000000), ref: 1ECB411A
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(DeleteService,00000000), ref: 1ECB4130

Strings

O:DeleteService, xrefs: 1ECB40CB
DeleteService, xrefs: 1ECB412B

Memory Dump Source

Source File: 0000000F.00000002.1435001879.000000001ECB1000.00000040.00000001.01000000.00000011.sdmp, Offset: 1ECB0000, based on PE: true

Associated: 0000000F.00000002.1434980425.000000001ECB0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBA000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBD000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435097428.000000001ECBF000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435120797.000000001ECC0000.00000004.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ecb0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_ThreadU_object@@$Arg_DeleteError@@Object_ParseRestoreSaveServiceTupleWin_
String ID: DeleteService$O:DeleteService
API String ID: 3235966919-349379177
Opcode ID: a1e6ff49cb72a64be40c6a3175e25e5f25d018febb9b09377eff622c53eb1460
Instruction ID: 28fd0db5641beb8c15a6f36db48eae1adb411b6058cd47c6d9373bfbcfde22a2
Opcode Fuzzy Hash: a1e6ff49cb72a64be40c6a3175e25e5f25d018febb9b09377eff622c53eb1460
Instruction Fuzzy Hash: DD01DB75904111ABC700ABB4ED88A5A77F8FF84786F444568FC59C3305F6349528CB63

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C36D0 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 38threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,:GetKeyboardState), ref: 1E8C36E0
PyEval_SaveThread.PYTHON27 ref: 1E8C36F6
GetKeyboardState.USER32(?), ref: 1E8C3703
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C370C
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(GetKeyboardState,00000000), ref: 1E8C3722

Strings

:GetKeyboardState, xrefs: 1E8C36DA
GetKeyboardState, xrefs: 1E8C371D

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_Thread$Arg_Error@@KeyboardParseRestoreSaveStateTupleU_object@@Win_
String ID: :GetKeyboardState$GetKeyboardState
API String ID: 1157968067-1769397567
Opcode ID: 1f1bd790c7372c09806477578173d050df1f93d1c4d7ccecc80fd94c8bee8187
Instruction ID: 48ad963fa3774aaeb1fcec795a9a6fc6922ccef167c4dcb3e8d0ebca6e7ff971
Opcode Fuzzy Hash: 1f1bd790c7372c09806477578173d050df1f93d1c4d7ccecc80fd94c8bee8187
Instruction Fuzzy Hash: 91F02BB58101106FF7115778DC4DBD936E4AFCA342F444028F94DC3250F67992D9C6A6

Uniqueness

Uniqueness Score: -1.00%

Function 1ECB2120 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 85serviceCOMMON

Download Yara Rule

APIs

?PyWinObject_AsMultipleString@@YAHPAU_object@@PAPA_WHPAK@Z.PYWINTYPES27(?,00000001,00000001,00000000), ref: 1ECB2137
CreateServiceW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1ECB2195
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(CreateService,00000000), ref: 1ECB21A5
?PyWinObject_FreeMultipleString@@YAXPA_W@Z.PYWINTYPES27(?), ref: 1ECB21B5
Py_BuildValue.PYTHON27(1ECB68F0,00000000,?), ref: 1ECB21DD
?PyWinObject_FreeMultipleString@@YAXPA_W@Z.PYWINTYPES27(?), ref: 1ECB21F8

Strings

CreateService, xrefs: 1ECB21A0

Memory Dump Source

Source File: 0000000F.00000002.1435001879.000000001ECB1000.00000040.00000001.01000000.00000011.sdmp, Offset: 1ECB0000, based on PE: true

Associated: 0000000F.00000002.1434980425.000000001ECB0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBA000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBD000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435097428.000000001ECBF000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435120797.000000001ECC0000.00000004.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ecb0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: MultipleObject_String@@$FreeU_object@@$BuildCreateError@@ServiceValueWin_
String ID: CreateService
API String ID: 2540436138-1592570254
Opcode ID: bed57e0ad650c9ae3b497d096fc44bea740dfa0dafd5d44b08c8fe562eecca57
Instruction ID: 2466697ea5b530e6d9105b9c957727fb8e75a7d8af0bc8d409f22febf4cc1a86
Opcode Fuzzy Hash: bed57e0ad650c9ae3b497d096fc44bea740dfa0dafd5d44b08c8fe562eecca57
Instruction Fuzzy Hash: 18212FB6A04250BFD644DB58DD85D5BB7E9EFC8A84F408A2CF949D7204E630ED14CBA3

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C3FA0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 43threadshutdownCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1E8C3FBE
PyEval_SaveThread.PYTHON27 ref: 1E8C3FD1
ExitWindowsEx.USER32(?,?), ref: 1E8C3FE3
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C3FEC
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(ExitWindowsEx,00000000), ref: 1E8C4002

Strings

ExitWindowsEx, xrefs: 1E8C3FFD
l|l:ExitWindowsEx, xrefs: 1E8C3FB0

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_Thread$Arg_Error@@ExitParseRestoreSaveTupleU_object@@Win_Windows
String ID: ExitWindowsEx$l|l:ExitWindowsEx
API String ID: 3021837756-971244237
Opcode ID: 2436d2e7006b9566f82b069f2262604896c8fbdf75b42250d489b91fa1415abf
Instruction ID: a34edb42c5f777f0cf17c5f07cc594015ebbe24b4ca3b149641c7582bcbdce91
Opcode Fuzzy Hash: 2436d2e7006b9566f82b069f2262604896c8fbdf75b42250d489b91fa1415abf
Instruction Fuzzy Hash: 7F016D79510211AFE710AB68EC89A9A77E5FF8A246F444528F90DC3311E730965ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C3F10 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 42threadshutdownCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1E8C3F36
PyEval_SaveThread.PYTHON27 ref: 1E8C3F49
ExitWindowsEx.USER32(00000000,000000FF), ref: 1E8C3F55
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C3F5E
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(ExitWindows,00000000), ref: 1E8C3F74

Strings

|ll:ExitWindows, xrefs: 1E8C3F20
ExitWindows, xrefs: 1E8C3F6F

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_Thread$Arg_Error@@ExitParseRestoreSaveTupleU_object@@Win_Windows
String ID: ExitWindows$|ll:ExitWindows
API String ID: 3021837756-1358875516
Opcode ID: 0186c55a2f9f1139ce75f1dcb95c2bfc9a55c86e2fc380342bf209ede13b6a87
Instruction ID: e7e7743ccd33f2baab1a28fbcf05ddcecb0fd66027da7c1c11bb924a5c9ce6ed
Opcode Fuzzy Hash: 0186c55a2f9f1139ce75f1dcb95c2bfc9a55c86e2fc380342bf209ede13b6a87
Instruction Fuzzy Hash: A001D1758002116FE700AB68DC8DB8A3AE4BF86756F400628F91DC3290E731925ECBA2

Uniqueness

Uniqueness Score: -1.00%

Function 03255CD0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 93nativeCOMMON

Download Yara Rule

APIs

PyErr_NoMemory.PYTHON27 ref: 03255CEF
NtQuerySystemInformation.NTDLL(00000005,00000000,?,?), ref: 03255D0F
73BB3B4E.MSVCR90(00000000), ref: 03255D24
PyErr_NoMemory.PYTHON27 ref: 03255D36

Strings

NtQuerySystemInformation(SystemProcessInformation), xrefs: 03255D47

Memory Dump Source

Source File: 0000000F.00000002.1423676562.0000000003251000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03250000, based on PE: true

Associated: 0000000F.00000002.1423656216.0000000003250000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423775563.0000000003263000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3250000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Err_Memory$InformationQuerySystem
String ID: NtQuerySystemInformation(SystemProcessInformation)
API String ID: 3727291697-862403119
Opcode ID: 60d26d35110d06234364576696038536692fb050257f7663de24f85c60d91a6b
Instruction ID: 9a08e82ec1432f4fd8059b0f76a729639e4dd78bf95dd6583af74e004094905c
Opcode Fuzzy Hash: 60d26d35110d06234364576696038536692fb050257f7663de24f85c60d91a6b
Instruction Fuzzy Hash: AF21C7B36163119FD714DB68FC48A5FB3D9EB85621F28852EFC06C7200D375DAC58AA2

Uniqueness

Uniqueness Score: -1.00%

Function 03252420 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,0325B43C,?,?), ref: 03252437

Strings

NtSuspend|ResumeProcess, xrefs: 03252494

Memory Dump Source

Source File: 0000000F.00000002.1423676562.0000000003251000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03250000, based on PE: true

Associated: 0000000F.00000002.1423656216.0000000003250000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423775563.0000000003263000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3250000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_ParseTuple
String ID: NtSuspend|ResumeProcess
API String ID: 3371842430-3321992817
Opcode ID: f6ef72cbc6436a089b2fe54172e5678e583863c26db07facd221e5fdb4fa3cef
Instruction ID: 848b7bea912d84d9fcce93ce163a70f7382f9f2bfc751f10cc4486b668629a57
Opcode Fuzzy Hash: f6ef72cbc6436a089b2fe54172e5678e583863c26db07facd221e5fdb4fa3cef
Instruction Fuzzy Hash: 2101963A910311EBCA10F768FC4D99B37A8AF80A13F488464FC49C2245E77597D9C6F2

Uniqueness

Uniqueness Score: -1.00%

Function 03251F60 Relevance: 9.1, APIs: 6, Instructions: 75COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,0325B3D0), ref: 03251F71
CloseHandle.KERNEL32(00000000), ref: 03251FB2

Memory Dump Source

Source File: 0000000F.00000002.1423676562.0000000003251000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03250000, based on PE: true

Associated: 0000000F.00000002.1423656216.0000000003250000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423775563.0000000003263000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3250000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_CloseHandleParseTuple
String ID:
API String ID: 860947779-0
Opcode ID: d4567421c50f8ad274afa43cea269bbd6c24014034da3d87c85bcf9411f6b76d
Instruction ID: f8287cdd0531bba2ae6b81503aaab4cb5235700fed4e59273a9ab9491ca6fc18
Opcode Fuzzy Hash: d4567421c50f8ad274afa43cea269bbd6c24014034da3d87c85bcf9411f6b76d
Instruction Fuzzy Hash: F111B771610302AFEB10EF74EC48B5BB7DCEB44654F484428FD49D2205E775EA94CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 03253890 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,0325B584), ref: 032538A1

Strings

NtQueryInformationProcess, xrefs: 032538EF

Memory Dump Source

Source File: 0000000F.00000002.1423676562.0000000003251000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03250000, based on PE: true

Associated: 0000000F.00000002.1423656216.0000000003250000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423775563.0000000003263000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3250000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_ParseTuple
String ID: NtQueryInformationProcess
API String ID: 3371842430-2781105232
Opcode ID: fd83f467c76dd549b96937297eae6dff3a59fc9cc70912ff69a3bacff50de0d3
Instruction ID: 8c9d61f0c72aefe6281033bb55da0416bc4672f024ccf1150ab2c97cad9ead67
Opcode Fuzzy Hash: fd83f467c76dd549b96937297eae6dff3a59fc9cc70912ff69a3bacff50de0d3
Instruction Fuzzy Hash: EB01D43AA503016BDA10FA64BC4EFAF3398AF80A52F844428FD4496240E775979C86F2

Uniqueness

Uniqueness Score: -1.00%

Function 1E8CAC20 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 46threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,iii|ii:mouse_event,?,?,?,?,00000000), ref: 1E8CAC4E
PyEval_SaveThread.PYTHON27 ref: 1E8CAC60
mouse_event.USER32(?,?,?,?,?), ref: 1E8CAC81
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8CAC88

Strings

iii|ii:mouse_event, xrefs: 1E8CAC48

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_Thread$Arg_ParseRestoreSaveTuplemouse_event
String ID: iii|ii:mouse_event
API String ID: 4142462086-1652421241
Opcode ID: ff9e408f9d5683d0f1e40c81926191970d4f1d532a43076ca3a7909c1845b389
Instruction ID: aa16ff061ef39b80c041c10c26fde0e194b2e1682255fb014bbb3da9c71a1abd
Opcode Fuzzy Hash: ff9e408f9d5683d0f1e40c81926191970d4f1d532a43076ca3a7909c1845b389
Instruction Fuzzy Hash: 6201E9B5114211AFD304DF68C884CDBB7E8BF89644F408A5DF98AC3221E730DA498BA2

Uniqueness

Uniqueness Score: -1.00%

Function 1E8CABA0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 42threadkeyboardCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,ii|ii:keybd_event,?,?,?,00000000), ref: 1E8CABC9
PyEval_SaveThread.PYTHON27 ref: 1E8CABDB
keybd_event.USER32(?,?,?,?), ref: 1E8CABF7
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8CABFE

Strings

ii|ii:keybd_event, xrefs: 1E8CABC3

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_Thread$Arg_ParseRestoreSaveTuplekeybd_event
String ID: ii|ii:keybd_event
API String ID: 4180502297-3699675051
Opcode ID: 500b97fe0f8c6e0c2e5846bffd81f578796a14595d97af1f9cfcfe93af5543b3
Instruction ID: 0037d59b6443572b68409b2efae1b077a229377bd7f96aee561783e2a34d68b6
Opcode Fuzzy Hash: 500b97fe0f8c6e0c2e5846bffd81f578796a14595d97af1f9cfcfe93af5543b3
Instruction Fuzzy Hash: 48012CB5504211AFE300EF68C888CEB77E9FF89205F40895DF98DC3211E730D9458B92

Uniqueness

Uniqueness Score: -1.00%

Function 1E7D1C30 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 23threadCOMMON

Download Yara Rule

APIs

PyEval_SaveThread.PYTHON27 ref: 1E7D1C32
StartServiceCtrlDispatcherW.ADVAPI32(1E7D6668), ref: 1E7D1C3F
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E7D1C48
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(StartServiceCtrlDispatcher,00000000), ref: 1E7D1C5E

Strings

StartServiceCtrlDispatcher, xrefs: 1E7D1C59

Memory Dump Source

Source File: 0000000F.00000002.1434219289.000000001E7D1000.00000040.00000001.01000000.00000015.sdmp, Offset: 1E7D0000, based on PE: true

Associated: 0000000F.00000002.1434197225.000000001E7D0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000F.00000002.1434219289.000000001E7DA000.00000040.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000F.00000002.1434284534.000000001E7DB000.00000080.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000F.00000002.1434310614.000000001E7DD000.00000004.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e7d0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_Thread$CtrlDispatcherError@@RestoreSaveServiceStartU_object@@Win_
String ID: StartServiceCtrlDispatcher
API String ID: 2400602890-2621514527
Opcode ID: 8b72551999f2f67c814e2b0c824661ca917f85b4c348ab544d32a2e2d19575b5
Instruction ID: ce7e3b0e78a959fc0d8fc7300b472d482542af8c477bb02bc493ce7c1982daab
Opcode Fuzzy Hash: 8b72551999f2f67c814e2b0c824661ca917f85b4c348ab544d32a2e2d19575b5
Instruction Fuzzy Hash: 3BE04F3A6002309BEB105768EDCCBD937B8FB9D352F040165EE05E3310E6359509CB65

Uniqueness

Uniqueness Score: -1.00%

Function 03253920 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,0325B5A8,?,?), ref: 03253937

Strings

NtSetInformationProcess, xrefs: 03253983

Memory Dump Source

Source File: 0000000F.00000002.1423676562.0000000003251000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03250000, based on PE: true

Associated: 0000000F.00000002.1423656216.0000000003250000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423775563.0000000003263000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3250000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_ParseTuple
String ID: NtSetInformationProcess
API String ID: 3371842430-1892905377
Opcode ID: ddbefc5f159e86612b352609a60567d574e52aebad78a5494b8c6c7695fc49e4
Instruction ID: c922e01622c1ef92b6814e2622c842bab68208425493baf31c5d5b66c545a628
Opcode Fuzzy Hash: ddbefc5f159e86612b352609a60567d574e52aebad78a5494b8c6c7695fc49e4
Instruction Fuzzy Hash: 9101887A550310ABCB10FA58FC4DEEB37A8AB85A13F844468FE44D6200F775979DC6A1

Uniqueness

Uniqueness Score: -1.00%

Function 03257AA0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 43serviceCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,0325D4B0), ref: 03257AAF
StartServiceA.ADVAPI32(00000000,00000000,00000000), ref: 03257ADD
CloseServiceHandle.ADVAPI32(00000000), ref: 03257AF5

Strings

StartService, xrefs: 03257AE7

Memory Dump Source

Source File: 0000000F.00000002.1423676562.0000000003251000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03250000, based on PE: true

Associated: 0000000F.00000002.1423656216.0000000003250000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423775563.0000000003263000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3250000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Service$Arg_CloseHandleParseStartTuple
String ID: StartService
API String ID: 2343249381-99420325
Opcode ID: e5998ccda6e61494d53c471dea0299c8c4b0c6989641d0e5e0fcd7473034251f
Instruction ID: 6c7e02c4860bc842ed852a2fd9261fdea8b254eaef5672b5b2a32b870a6c7ab1
Opcode Fuzzy Hash: e5998ccda6e61494d53c471dea0299c8c4b0c6989641d0e5e0fcd7473034251f
Instruction Fuzzy Hash: B6F04072360301ABD620E724BC08FAB33A89B00716F148414FD06DA68AEB74E3C0D692

Uniqueness

Uniqueness Score: -1.00%

Function 03256880 Relevance: 4.5, APIs: 3, Instructions: 23nativesynchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 03256898
NtQueryObject.NTDLL(00000000,00000001,00000000,00000000,0325D820), ref: 032568B5
SetEvent.KERNEL32(00000000), ref: 032568C7

Memory Dump Source

Source File: 0000000F.00000002.1423676562.0000000003251000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03250000, based on PE: true

Associated: 0000000F.00000002.1423656216.0000000003250000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423775563.0000000003263000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3250000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object$EventQuerySingleWait
String ID:
API String ID: 263510574-0
Opcode ID: 9966528e2f0a2bbe1266273af4084bcf41df4f2abff06cb5f537ce370d58e391
Instruction ID: 00ed87909c8ea2368590133096f7ef865602a12a434bc22372f0decd1352b402
Opcode Fuzzy Hash: 9966528e2f0a2bbe1266273af4084bcf41df4f2abff06cb5f537ce370d58e391
Instruction Fuzzy Hash: ACE01275524310ABC600FB94FC4CD6573FDE78D720310C61AB911D33A8C6B0AA868B60

Uniqueness

Uniqueness Score: -1.00%

Function 6CBEC1D0 Relevance: 2.8, Strings: 2, Instructions: 299COMMON

Download Yara Rule

Strings

C:\build27\cpython\externals\openssl-1.0.2j\crypto\rsa\rsa_oaep.c, xrefs: 6CBEC2A3, 6CBEC474, 6CBEC498
C:\build27\cpython\externals\openssl-1.0.2j\crypto\evp\evp_lib.c, xrefs: 6CBEC254

Memory Dump Source

Source File: 0000000F.00000002.1435325332.000000006CBC1000.00000040.00000001.01000000.0000000E.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 0000000F.00000002.1435141262.000000006CBC0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCAB000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCBE000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436271764.000000006CCC4000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436295892.000000006CCC6000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6cbc0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID:
String ID: C:\build27\cpython\externals\openssl-1.0.2j\crypto\evp\evp_lib.c$C:\build27\cpython\externals\openssl-1.0.2j\crypto\rsa\rsa_oaep.c
API String ID: 0-1612841875
Opcode ID: 83926589b38d9b6a5463a1e8d6ac0c8d56f8a4bcc603ef4465388f1833f62b39
Instruction ID: 348ea199b734710652a668e63bb5bb3184a7c314e4098ea557d394edab19d5c3
Opcode Fuzzy Hash: 83926589b38d9b6a5463a1e8d6ac0c8d56f8a4bcc603ef4465388f1833f62b39
Instruction Fuzzy Hash: C6A1C0716083419FD710DF28C881A6EBBF4EF89758F044A2DF9989B780EB30D905CB92

Uniqueness

Uniqueness Score: -1.00%

Function 03261ED0 Relevance: 2.1, Strings: 1, Instructions: 891COMMON

Download Yara Rule

Strings

y(ProcessParameters), xrefs: 03261EDC, 03261F0A, 03261F18

Memory Dump Source

Source File: 0000000F.00000002.1423676562.000000000325F000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03250000, based on PE: true

Associated: 0000000F.00000002.1423656216.0000000003250000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.0000000003251000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423775563.0000000003263000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3250000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID:
String ID: y(ProcessParameters)
API String ID: 0-2902218424
Opcode ID: 5e0330653f88a5be91f43349d03b363117d302f88ee8727ffdb9930f4cf2565f
Instruction ID: 59d0937a0ef5688ffe49a72a52411301549ed9742cce22b36306175184e16359
Opcode Fuzzy Hash: 5e0330653f88a5be91f43349d03b363117d302f88ee8727ffdb9930f4cf2565f
Instruction Fuzzy Hash: 6D729B31628356CFD324CF28C88066ABBE1FF89344F194A6DE9E58B351E771D985CB42

Uniqueness

Uniqueness Score: -1.00%

Function 6CBF6CC0 Relevance: 1.8, Strings: 1, Instructions: 529COMMON

Download Yara Rule

Strings

C:\build27\cpython\externals\openssl-1.0.2j\crypto\bn\bn_exp.c, xrefs: 6CBF6E2A, 6CBF723B

Memory Dump Source

Source File: 0000000F.00000002.1435325332.000000006CBC1000.00000040.00000001.01000000.0000000E.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 0000000F.00000002.1435141262.000000006CBC0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCAB000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCBE000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436271764.000000006CCC4000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436295892.000000006CCC6000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6cbc0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID:
String ID: C:\build27\cpython\externals\openssl-1.0.2j\crypto\bn\bn_exp.c
API String ID: 0-3519926966
Opcode ID: 2510b5a0c3c7767d00da17b9d761a86f141c20b297dc0123fb737b90678f7ff8
Instruction ID: 9589d7c7715741c720613c06b78c0527bb6a0636ed5aba6ec554b73720639db4
Opcode Fuzzy Hash: 2510b5a0c3c7767d00da17b9d761a86f141c20b297dc0123fb737b90678f7ff8
Instruction Fuzzy Hash: 49026075E002499BDB04CF98D881AEEB7B9EF48304F144169ED25E7740E771EA1ECBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6CBCE8E0 Relevance: 1.7, Strings: 1, Instructions: 403COMMON

Download Yara Rule

Strings

C:\build27\cpython\externals\openssl-1.0.2j\crypto\asn1\a_object.c, xrefs: 6CBCE94E, 6CBCEBA7, 6CBCEC89, 6CBCECFC, 6CBCED0F, 6CBCED25, 6CBCED3D

Memory Dump Source

Source File: 0000000F.00000002.1435325332.000000006CBC1000.00000040.00000001.01000000.0000000E.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 0000000F.00000002.1435141262.000000006CBC0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCAB000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCBE000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436271764.000000006CCC4000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436295892.000000006CCC6000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6cbc0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID:
String ID: C:\build27\cpython\externals\openssl-1.0.2j\crypto\asn1\a_object.c
API String ID: 0-1902588201
Opcode ID: d5d0020ee17f3b3dac38807a1531ed426828990210d6fa4cbad4ce987c43b3d6
Instruction ID: fdbb95bf014ceaed169a4cfe7653de8ecb421245f84a60911a761873cae216f9
Opcode Fuzzy Hash: d5d0020ee17f3b3dac38807a1531ed426828990210d6fa4cbad4ce987c43b3d6
Instruction Fuzzy Hash: E0D1BF31B01299CBDB14CFA8D8827AEB7B1FF45314F144169E856AB780DB35E905CBE2

Uniqueness

Uniqueness Score: -1.00%

Function 03257EE0 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

RtlGetVersion.NTDLL ref: 03257EFE

Memory Dump Source

Source File: 0000000F.00000002.1423676562.0000000003251000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03250000, based on PE: true

Associated: 0000000F.00000002.1423656216.0000000003250000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423775563.0000000003263000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3250000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 9b75bd55d7ebeeaab83d41d663a03bf337892be6d577a76e19e97f0bec5e0719
Instruction ID: e8fa58127227b07f6d8f178a116ed1bfbc2dd68f41d18248451ddaf240ed2908
Opcode Fuzzy Hash: 9b75bd55d7ebeeaab83d41d663a03bf337892be6d577a76e19e97f0bec5e0719
Instruction Fuzzy Hash: 1E11A7B09A03029BDB24DA34F98A3E536D9A741710F944D64F924C62D0E3BEC3D88683

Uniqueness

Uniqueness Score: -1.00%

Function 1E7D15A0 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

StartServiceCtrlDispatcherW.ADVAPI32(1E7D6668), ref: 1E7D15A5

Memory Dump Source

Source File: 0000000F.00000002.1434219289.000000001E7D1000.00000040.00000001.01000000.00000015.sdmp, Offset: 1E7D0000, based on PE: true

Associated: 0000000F.00000002.1434197225.000000001E7D0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000F.00000002.1434219289.000000001E7DA000.00000040.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000F.00000002.1434284534.000000001E7DB000.00000080.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000F.00000002.1434310614.000000001E7DD000.00000004.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e7d0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: CtrlDispatcherServiceStart
String ID:
API String ID: 3789849863-0
Opcode ID: a043a6b7e736b7813249c9d26f281d7e54b2f6c9450f8e3fae4b26e8fab88533
Instruction ID: 6db4fe0cd53c7df4022da3d2787cea3136ee9f5d0a364c697b61e7f73f6b75c5
Opcode Fuzzy Hash: a043a6b7e736b7813249c9d26f281d7e54b2f6c9450f8e3fae4b26e8fab88533
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 6CBF4B40 Relevance: 1.0, Instructions: 982COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1435325332.000000006CBC1000.00000040.00000001.01000000.0000000E.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 0000000F.00000002.1435141262.000000006CBC0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCAB000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCBE000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436271764.000000006CCC4000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436295892.000000006CCC6000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6cbc0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e58607040b2524b64905958759feb980b52e4b2595ef7dae8fe5ae723da282db
Instruction ID: ba87fb32a91545ab5b7ecbdb4fbef772e1e088c27cddf83ab2e4e918e63d760c
Opcode Fuzzy Hash: e58607040b2524b64905958759feb980b52e4b2595ef7dae8fe5ae723da282db
Instruction Fuzzy Hash: 31C26075E112788FDB64CF68D8547AEFBB0EB8A300F5581E9D95873240CA35AB94CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6CC22780 Relevance: 1.0, Instructions: 952COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1435325332.000000006CBC1000.00000040.00000001.01000000.0000000E.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 0000000F.00000002.1435141262.000000006CBC0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCAB000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCBE000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436271764.000000006CCC4000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436295892.000000006CCC6000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6cbc0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 33d18a2763942aa56573bb460ed5b26408378f1d1e1776455b50c430f60a6b4f
Instruction ID: 9906d8e09fc87b184eafa01dce72a545bb252a54d1633cb278688ee8107a6860
Opcode Fuzzy Hash: 33d18a2763942aa56573bb460ed5b26408378f1d1e1776455b50c430f60a6b4f
Instruction Fuzzy Hash: 47728D70A147018FD714CF29C494A1AB7F4BF89328F148A6DE895CBB51F738E949CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6CBF4BDC Relevance: .9, Instructions: 928COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1435325332.000000006CBC1000.00000040.00000001.01000000.0000000E.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 0000000F.00000002.1435141262.000000006CBC0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCAB000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCBE000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436271764.000000006CCC4000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436295892.000000006CCC6000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6cbc0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a2c1e4000eb4b0960085619856f3104a4701555fb628723df504f65768792565
Instruction ID: d4f25dde4d88c78b17e0438c152e1bb0d49635a5a0463f1bdafd1fc2ed3c519b
Opcode Fuzzy Hash: a2c1e4000eb4b0960085619856f3104a4701555fb628723df504f65768792565
Instruction Fuzzy Hash: E3B25075E112788FDFA4CB68D8947AEFBB0EB4A300F5581E5D95873240CA35AB94CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6CBF4C18 Relevance: .9, Instructions: 914COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1435325332.000000006CBC1000.00000040.00000001.01000000.0000000E.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 0000000F.00000002.1435141262.000000006CBC0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCAB000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCBE000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436271764.000000006CCC4000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436295892.000000006CCC6000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6cbc0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8e86ddc5d210bebebf03fdfec2e2802dfdc1792d5703e0803928b776b1a6b5b7
Instruction ID: 07d3ea7d4a91ac690112e54cce7c7039cf599e7a62f1cab40c1dc2af91d2c2dd
Opcode Fuzzy Hash: 8e86ddc5d210bebebf03fdfec2e2802dfdc1792d5703e0803928b776b1a6b5b7
Instruction Fuzzy Hash: 7CB25175E112788FDFA4CB68D8547AEFBB0EB8A300F5581E5C95873240CA35AB94CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6CBDE6E0 Relevance: .6, Instructions: 649COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1435325332.000000006CBC1000.00000040.00000001.01000000.0000000E.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 0000000F.00000002.1435141262.000000006CBC0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCAB000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCBE000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436271764.000000006CCC4000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436295892.000000006CCC6000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6cbc0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10b08b646254ca64b6fbe269085196a6c446c38c2793d9ca9834a3c443d3e587
Instruction ID: 42036aa451b833e6c9369a1096d2ac7fc10bbb238133969a4dd51fc9cd315df6
Opcode Fuzzy Hash: 10b08b646254ca64b6fbe269085196a6c446c38c2793d9ca9834a3c443d3e587
Instruction Fuzzy Hash: 3E329632D046658BDB19CF66C8D40ADFBF2EAC8314B1A81ADD8A577242C97D2907CBD4

Uniqueness

Uniqueness Score: -1.00%

Function 6CC6ABC0 Relevance: .6, Instructions: 598COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1435325332.000000006CBC1000.00000040.00000001.01000000.0000000E.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 0000000F.00000002.1435141262.000000006CBC0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCAB000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCBE000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436271764.000000006CCC4000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436295892.000000006CCC6000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6cbc0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4d6c9128871f1856d39bcc1edb13b036d26e4810c246a284f6b4713b95345826
Instruction ID: c26c2e24eaa31bb49b85a5c2aa925e41860d42df730bacf2cd573bd3927a44f2
Opcode Fuzzy Hash: 4d6c9128871f1856d39bcc1edb13b036d26e4810c246a284f6b4713b95345826
Instruction Fuzzy Hash: C92273735417044BE318CE2ECC815C2B3E3AFD822475F857EC926CB796EEB9A6174548

Uniqueness

Uniqueness Score: -1.00%

Function 6CC6CB40 Relevance: .5, Instructions: 495COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1435325332.000000006CBC1000.00000040.00000001.01000000.0000000E.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 0000000F.00000002.1435141262.000000006CBC0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCAB000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCBE000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436271764.000000006CCC4000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436295892.000000006CCC6000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6cbc0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c6f0661ae402c251bb7aa3b29fdd1d95f9c7beb0754af4f0f47e36c34fd6e3ca
Instruction ID: 13e52785b5e926f7da01e6b3b98aebeeee360324ef4a49f1df3ec9ecb9fdd7c0
Opcode Fuzzy Hash: c6f0661ae402c251bb7aa3b29fdd1d95f9c7beb0754af4f0f47e36c34fd6e3ca
Instruction Fuzzy Hash: 7902BD711197088FC756EE1DD59031AF3E2FFC8308F198A2CD68587B64E739A9198F82

Uniqueness

Uniqueness Score: -1.00%

Function 6CC56170 Relevance: .5, Instructions: 451COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1435325332.000000006CBC1000.00000040.00000001.01000000.0000000E.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 0000000F.00000002.1435141262.000000006CBC0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCAB000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCBE000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436271764.000000006CCC4000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436295892.000000006CCC6000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6cbc0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2043497b724ef4fc8a79aea2010f21fe1111487122cecce1150fea278572ad0
Instruction ID: d4734090fc2c86bb1c8016740510bb0f7febb04abd1745e74dacaca17b2cde12
Opcode Fuzzy Hash: d2043497b724ef4fc8a79aea2010f21fe1111487122cecce1150fea278572ad0
Instruction Fuzzy Hash: FBE19233E1093547E711CEAACC84349BBB39BC9350F6F8760D954A7386D6B4AD12D6D0

Uniqueness

Uniqueness Score: -1.00%

Function 6CBDE160 Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1435325332.000000006CBC1000.00000040.00000001.01000000.0000000E.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 0000000F.00000002.1435141262.000000006CBC0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCAB000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCBE000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436271764.000000006CCC4000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436295892.000000006CCC6000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6cbc0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13ce52140f15a5d5f53c170eec2c14942177f1b6eb300f6b6f7279efabdbcb61
Instruction ID: 80ff9746a78d3681e372c5fc92d9d32f802a7979edbb6dc7f02a95f70ee36ba9
Opcode Fuzzy Hash: 13ce52140f15a5d5f53c170eec2c14942177f1b6eb300f6b6f7279efabdbcb61
Instruction Fuzzy Hash: 9BA1A51025D2D28BD32ACA3D489126DFFD6DBF71007548A9EE8C3C7B87D5A094A6C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 6CC5626B Relevance: .3, Instructions: 338COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1435325332.000000006CBC1000.00000040.00000001.01000000.0000000E.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 0000000F.00000002.1435141262.000000006CBC0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCAB000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCBE000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436271764.000000006CCC4000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436295892.000000006CCC6000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6cbc0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd6191f88391ef3e6cbd9d8406a5fbe5a1f24e9b07c6978520f4cca23c7a18c6
Instruction ID: 67004535cf2dfd0da1ee59e0974a2e887191b1b9e348d4c2e6ecdf29a74007a7
Opcode Fuzzy Hash: cd6191f88391ef3e6cbd9d8406a5fbe5a1f24e9b07c6978520f4cca23c7a18c6
Instruction Fuzzy Hash: 0AC15433F51A218BEB01CE99CC843487BB3E7C9314F6E8764DA54AB395D6B4E912C6D0

Uniqueness

Uniqueness Score: -1.00%

Function 6CC58C90 Relevance: .3, Instructions: 302COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1435325332.000000006CBC1000.00000040.00000001.01000000.0000000E.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 0000000F.00000002.1435141262.000000006CBC0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCAB000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCBE000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436271764.000000006CCC4000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436295892.000000006CCC6000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6cbc0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91e53650e455d912fd5151db5f0b202d55b72e4ddbcdbac398031af6cd7335d1
Instruction ID: 34d72bc16509775ae44a1bf3d03831e747ea1385d8cfe1735d2eb80f345bed1a
Opcode Fuzzy Hash: 91e53650e455d912fd5151db5f0b202d55b72e4ddbcdbac398031af6cd7335d1
Instruction Fuzzy Hash: D5D1AE75A093419FC348CF29C490A5BFBE1BFCC314F958A2EF99A87250D771A915CB82

Uniqueness

Uniqueness Score: -1.00%

Function 6CC40A60 Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1435325332.000000006CBC1000.00000040.00000001.01000000.0000000E.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 0000000F.00000002.1435141262.000000006CBC0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCAB000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCBE000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436271764.000000006CCC4000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436295892.000000006CCC6000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6cbc0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38f9f76e98714b46020176592f511c83f684a508fa78e5441ebc3319196fd9d0
Instruction ID: 5bfab858aec33f91404a15114c94e655ddd4a1660547e4ceea5a114d247d19d5
Opcode Fuzzy Hash: 38f9f76e98714b46020176592f511c83f684a508fa78e5441ebc3319196fd9d0
Instruction Fuzzy Hash: 1891C075A40A56DBDB04CF6DC4807AAB7F2FF99318F24C269C816DB748E731A951CB80

Uniqueness

Uniqueness Score: -1.00%

Function 6CC74F70 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1435325332.000000006CBC1000.00000040.00000001.01000000.0000000E.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 0000000F.00000002.1435141262.000000006CBC0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCAB000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCBE000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436271764.000000006CCC4000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436295892.000000006CCC6000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6cbc0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53bd5c4dcf4593fcde91ff7bda5ab98feadbae097eaea0b90a490f42027e7b83
Instruction ID: b608d30d029a08182739e1781ec9d70ce62bef42a425dbe4f72770ecb0118d77
Opcode Fuzzy Hash: 53bd5c4dcf4593fcde91ff7bda5ab98feadbae097eaea0b90a490f42027e7b83
Instruction Fuzzy Hash: 05918B20D1CF9943E6228F3E85411A3B7A1FFBE308B55DB0AEDD476912EB21B6D55280

Uniqueness

Uniqueness Score: -1.00%

Function 6CBF6A80 Relevance: .2, Instructions: 223COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1435325332.000000006CBC1000.00000040.00000001.01000000.0000000E.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 0000000F.00000002.1435141262.000000006CBC0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCAB000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCBE000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436271764.000000006CCC4000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436295892.000000006CCC6000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6cbc0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 81c0c6962ee41076d76d5119597b004a4bc63ef0d12fab4c3e58c9b898c6ef15
Instruction ID: 86eea73e9701ecfa71c1f26beae3d3bd73ce9cec94680f76fbe21290bfd507fc
Opcode Fuzzy Hash: 81c0c6962ee41076d76d5119597b004a4bc63ef0d12fab4c3e58c9b898c6ef15
Instruction Fuzzy Hash: DB818176E1161A8BCB08CF68C49069EB7F1FF88314F148269DD16EB744DB35EA06CB90

Uniqueness

Uniqueness Score: -1.00%

Function 6CBE0930 Relevance: .2, Instructions: 215COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1435325332.000000006CBC1000.00000040.00000001.01000000.0000000E.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 0000000F.00000002.1435141262.000000006CBC0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCAB000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCBE000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436271764.000000006CCC4000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436295892.000000006CCC6000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6cbc0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e52b0ea67d865786fae2e36d39ba8192fcfeed195c64e1ec1c69fd3e6b65c2a1
Instruction ID: 75e25318866c466a92bb9df44ff7fb26d95a3946d039605b55c02c3622b310a5
Opcode Fuzzy Hash: e52b0ea67d865786fae2e36d39ba8192fcfeed195c64e1ec1c69fd3e6b65c2a1
Instruction Fuzzy Hash: 34714535A003C89BDB05CEA8E8D07EEBBB2FF89748F24816DC89957741DB705609CB51

Uniqueness

Uniqueness Score: -1.00%

Function 6CC587D0 Relevance: .2, Instructions: 213COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1435325332.000000006CBC1000.00000040.00000001.01000000.0000000E.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 0000000F.00000002.1435141262.000000006CBC0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCAB000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCBE000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436271764.000000006CCC4000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436295892.000000006CCC6000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6cbc0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 495c635de7b49e89fc712ca75500143bc87befc295c973d215a6a08025e130b4
Instruction ID: cf1db8af27b923f9e9e99527c3c9a0168e7f9428fe7b6049131117bce19dea32
Opcode Fuzzy Hash: 495c635de7b49e89fc712ca75500143bc87befc295c973d215a6a08025e130b4
Instruction Fuzzy Hash: 0171E671A0424A9FCB14CF69C4809AFBFB5EF9A318F15826EEC959B305D234D921CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 6CC56B40 Relevance: .2, Instructions: 212COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1435325332.000000006CBC1000.00000040.00000001.01000000.0000000E.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 0000000F.00000002.1435141262.000000006CBC0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCAB000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCBE000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436271764.000000006CCC4000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436295892.000000006CCC6000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6cbc0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 137e3d4e9875e87cf4ed1cb13578530de00829aa4136c96c912c4b051a8981f4
Instruction ID: d826c50e0aed61256b431b686287c05ef3f4f06b953dc03eb566a0150b28303c
Opcode Fuzzy Hash: 137e3d4e9875e87cf4ed1cb13578530de00829aa4136c96c912c4b051a8981f4
Instruction Fuzzy Hash: 1481C071A006098FDB18CFA8C491AEEFBF5FF48310F54866DD89A97741E730A914CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 6CC58000 Relevance: .2, Instructions: 203COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1435325332.000000006CBC1000.00000040.00000001.01000000.0000000E.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 0000000F.00000002.1435141262.000000006CBC0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCAB000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCBE000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436271764.000000006CCC4000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436295892.000000006CCC6000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6cbc0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98eaccaa024265fa51fbdefacc16cf36a05f5bf2a0bf3299c53ea82fb2c06e04
Instruction ID: 356e0f9334555d47bbffdfa6a9d599b07973786453497355cb5623ed6d121e00
Opcode Fuzzy Hash: 98eaccaa024265fa51fbdefacc16cf36a05f5bf2a0bf3299c53ea82fb2c06e04
Instruction Fuzzy Hash: 92816A71810608DFCB14CF69C884AABBBF4FF49304F548A5EE55ACBA41E731A665CF90

Uniqueness

Uniqueness Score: -1.00%

Function 6CC56F80 Relevance: .2, Instructions: 188COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1435325332.000000006CBC1000.00000040.00000001.01000000.0000000E.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 0000000F.00000002.1435141262.000000006CBC0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCAB000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCBE000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436271764.000000006CCC4000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436295892.000000006CCC6000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6cbc0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c875a613c31c9416a29a57f42c19080019f43bb2608b2665351a9ef5f99c00bc
Instruction ID: 2d0b22c1f14358294b41827ac7a3a3737f54ad17bd08796efa9d2fcaa6ee52d2
Opcode Fuzzy Hash: c875a613c31c9416a29a57f42c19080019f43bb2608b2665351a9ef5f99c00bc
Instruction Fuzzy Hash: 2F611771A102098FDB15CFB8C8906EEFBF5FF89314F54862EE446A3641E730A955CB64

Uniqueness

Uniqueness Score: -1.00%

Function 6CC56D60 Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1435325332.000000006CBC1000.00000040.00000001.01000000.0000000E.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 0000000F.00000002.1435141262.000000006CBC0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCAB000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCBE000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436271764.000000006CCC4000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436295892.000000006CCC6000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6cbc0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ff6093b39f0d2abc5ed8759532fe0bd7665e2a2b4577f0f50d7087ef6d4e4e21
Instruction ID: f68d1ad857ba55201603371d36f34d87cfa74260c891e070bdd12a43877d061b
Opcode Fuzzy Hash: ff6093b39f0d2abc5ed8759532fe0bd7665e2a2b4577f0f50d7087ef6d4e4e21
Instruction Fuzzy Hash: 9061BC70A006099FCB14CFB9C8819AEBBF5FF49314B54856DD85AE7741E630A914CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 6CC567F0 Relevance: .2, Instructions: 181COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1435325332.000000006CBC1000.00000040.00000001.01000000.0000000E.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 0000000F.00000002.1435141262.000000006CBC0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCAB000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCBE000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436271764.000000006CCC4000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436295892.000000006CCC6000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6cbc0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88a242272a0e022b6244fad712eb583f37e7caadbf8c3f07756a235e1e492e76
Instruction ID: 33bf3e5190bb1c8dd7feebdcabc9c79e5c4ce6a3e4b3cac660e3d888be17dda1
Opcode Fuzzy Hash: 88a242272a0e022b6244fad712eb583f37e7caadbf8c3f07756a235e1e492e76
Instruction Fuzzy Hash: C0618431A052899FCB05CFAD88805EDFFF1EF9A200F5881AED895E7342D6345A15CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6CBD0060 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1435325332.000000006CBC1000.00000040.00000001.01000000.0000000E.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 0000000F.00000002.1435141262.000000006CBC0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCAB000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCBE000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436271764.000000006CCC4000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436295892.000000006CCC6000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6cbc0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aeb811474239b217e549ee0875f4ebe0a232bce4851b24dd826fa48c0d60da61
Instruction ID: 6486bfde2e9f8dcbaa824517d2cfb361246887a880677bdcae809d589c75ec03
Opcode Fuzzy Hash: aeb811474239b217e549ee0875f4ebe0a232bce4851b24dd826fa48c0d60da61
Instruction Fuzzy Hash: F741D71020D2D29BD7168E3E4890759BFD98FA2100B18869EE8C28B787C4A4D995C7F1

Uniqueness

Uniqueness Score: -1.00%

Function 6CBD0100 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1435325332.000000006CBC1000.00000040.00000001.01000000.0000000E.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 0000000F.00000002.1435141262.000000006CBC0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCAB000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCBE000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436271764.000000006CCC4000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436295892.000000006CCC6000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6cbc0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aeb811474239b217e549ee0875f4ebe0a232bce4851b24dd826fa48c0d60da61
Instruction ID: 6486bfde2e9f8dcbaa824517d2cfb361246887a880677bdcae809d589c75ec03
Opcode Fuzzy Hash: aeb811474239b217e549ee0875f4ebe0a232bce4851b24dd826fa48c0d60da61
Instruction Fuzzy Hash: F741D71020D2D29BD7168E3E4890759BFD98FA2100B18869EE8C28B787C4A4D995C7F1

Uniqueness

Uniqueness Score: -1.00%

Function 6CC5808C Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1435325332.000000006CBC1000.00000040.00000001.01000000.0000000E.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 0000000F.00000002.1435141262.000000006CBC0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCAB000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCBE000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436271764.000000006CCC4000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436295892.000000006CCC6000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6cbc0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 01fe9192251d73c00455ca9b672a32da2572d9e0f453116005d11857e080967c
Instruction ID: 62f50dcaad20001db0e85611b2c294c9a27939383337de8c86022baba6e0d8b4
Opcode Fuzzy Hash: 01fe9192251d73c00455ca9b672a32da2572d9e0f453116005d11857e080967c
Instruction Fuzzy Hash: 83515BB1810608EFCB14CF69C884AAFBBF4FF49308F548A5DE55A9B641D331A664CF91

Uniqueness

Uniqueness Score: -1.00%

Function 6CC6E2E0 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1435325332.000000006CBC1000.00000040.00000001.01000000.0000000E.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 0000000F.00000002.1435141262.000000006CBC0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCAB000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCBE000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436271764.000000006CCC4000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436295892.000000006CCC6000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6cbc0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c2e318854a03473e686e4354b79fd8f1e59947713a68c91e0d593ac150dc887
Instruction ID: 06696667c33436bdc6ff252dee42d8295cdc9b8e2ba89d0dd2dc0a79871009da
Opcode Fuzzy Hash: 7c2e318854a03473e686e4354b79fd8f1e59947713a68c91e0d593ac150dc887
Instruction Fuzzy Hash: 2F510C226257BA46DBC3CA3EC45047EB7E1BE89206B45055BDCD0F3281D73EDA09B7A0

Uniqueness

Uniqueness Score: -1.00%

Function 6CBD6B40 Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1435325332.000000006CBC1000.00000040.00000001.01000000.0000000E.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 0000000F.00000002.1435141262.000000006CBC0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCAB000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCBE000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436271764.000000006CCC4000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436295892.000000006CCC6000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6cbc0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbb5b12f6d034d8352a61b0ad6bbfa657134a24ff716dad7a5d3fb48ecb8244d
Instruction ID: 56a75c25b20e0e88519cd2b0da7b105c9eee96c016210fd8e6018187bbb0f0ea
Opcode Fuzzy Hash: fbb5b12f6d034d8352a61b0ad6bbfa657134a24ff716dad7a5d3fb48ecb8244d
Instruction Fuzzy Hash: 79516176A01A018FD708CF2AC481546F7A3FFDD31032AC699C5499B32AD730F952DAD4

Uniqueness

Uniqueness Score: -1.00%

Function 6CBDDCB0 Relevance: .1, Instructions: 149COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1435325332.000000006CBC1000.00000040.00000001.01000000.0000000E.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 0000000F.00000002.1435141262.000000006CBC0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCAB000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCBE000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436271764.000000006CCC4000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436295892.000000006CCC6000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6cbc0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6d86ea061bf875fb59d31786c0b9427c929edf6e5c9985865d22c15f3edadc04
Instruction ID: 5fbf8c2134518221a99c789347441328862b52ce278cc559e2a3b2ab9fb782c6
Opcode Fuzzy Hash: 6d86ea061bf875fb59d31786c0b9427c929edf6e5c9985865d22c15f3edadc04
Instruction Fuzzy Hash: F541B71021D2D25BD71A8E3E4CD075ABFDA8FB3100B58869EE8C29B787D4A4D5A5C3F1

Uniqueness

Uniqueness Score: -1.00%

Function 6CBD0190 Relevance: .1, Instructions: 137COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1435325332.000000006CBC1000.00000040.00000001.01000000.0000000E.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 0000000F.00000002.1435141262.000000006CBC0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCAB000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCBE000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436271764.000000006CCC4000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436295892.000000006CCC6000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6cbc0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ac248ec34589ad2aa4dedb5067334f433d60fcbaad76a8cbcea691f0ccaa072e
Instruction ID: 36bf46f7b20e5c14db1cb8fd2b9c1c9c621bafa882771d2845aa193e81ca7449
Opcode Fuzzy Hash: ac248ec34589ad2aa4dedb5067334f433d60fcbaad76a8cbcea691f0ccaa072e
Instruction Fuzzy Hash: 2D41D61025D3D19BD7158E3D4C80B6AFFDACFA7200B18459EE8C68B787C5A4D995C3B1

Uniqueness

Uniqueness Score: -1.00%

Function 6CC72660 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1435325332.000000006CBC1000.00000040.00000001.01000000.0000000E.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 0000000F.00000002.1435141262.000000006CBC0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCAB000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCBE000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436271764.000000006CCC4000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436295892.000000006CCC6000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6cbc0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b20fe642ec5b4cb11803d6e9bb87505ea858999ed9ac68427f5554963a1f99d
Instruction ID: 0a4329f4938364f0a84c475d1f4647e11685ed6def6465915886706690947756
Opcode Fuzzy Hash: 9b20fe642ec5b4cb11803d6e9bb87505ea858999ed9ac68427f5554963a1f99d
Instruction Fuzzy Hash: 91314F73A156248BD360CE779D40187BAD3A7C4774F1BC569EC88EB206DA34D80A9BC2

Uniqueness

Uniqueness Score: -1.00%

Function 6CC72790 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1435325332.000000006CBC1000.00000040.00000001.01000000.0000000E.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 0000000F.00000002.1435141262.000000006CBC0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCAB000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCBE000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436271764.000000006CCC4000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436295892.000000006CCC6000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6cbc0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 452534584f84d5ce309bc2c87595391735ec22847325f68e55e57b46e27a5387
Instruction ID: 709264c57e64a2d91733dc4d11be53aba958f6037f97d3fb10931cb6582185e4
Opcode Fuzzy Hash: 452534584f84d5ce309bc2c87595391735ec22847325f68e55e57b46e27a5387
Instruction Fuzzy Hash: CA314F73A156248BD360CE779D40187BAD3A7C4674F1BC569EC88EB206DA34D80A9BC2

Uniqueness

Uniqueness Score: -1.00%

Function 6CC56A70 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.1435325332.000000006CBC1000.00000040.00000001.01000000.0000000E.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 0000000F.00000002.1435141262.000000006CBC0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCAB000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCBE000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436271764.000000006CCC4000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436295892.000000006CCC6000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6cbc0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 705ccb465ac7c5667ba70349e13c7e00a0dae5bb84549d02dde1d5ec76afba2c
Instruction ID: 91e3c5fd22b695a4e16a13cc9ae43732d365fbfdb6673b585de9a1f626d74fbe
Opcode Fuzzy Hash: 705ccb465ac7c5667ba70349e13c7e00a0dae5bb84549d02dde1d5ec76afba2c
Instruction Fuzzy Hash: F9212331149BC14BD3318E3EC88065BBBF4EB4A220F540B6DD8C687A43E761EA69C356

Uniqueness

Uniqueness Score: -1.00%

Function 032559B0 Relevance: 140.2, APIs: 40, Strings: 40, Instructions: 211COMMON

Download Yara Rule

APIs

Py_InitModule4.PYTHON27(_psutil_windows,0325C600,00000000,00000000,000003F5), ref: 032559C4

Part of subcall function 032570D0: GetLastError.KERNEL32(032559F6), ref: 032570E9
Part of subcall function 032570D0: PyErr_WarnEx.PYTHON27(?,psutil module couldn't set SE DEBUG mode for this process; please file an issue against psutil bug tracker,00000001), ref: 03257103
Part of subcall function 032570D0: PyErr_Clear.PYTHON27 ref: 0325710C

PyErr_NewException.PYTHON27(_psutil_windows.Error,00000000,00000000), ref: 03255A0C
PyErr_NewException.PYTHON27(_psutil_windows.TimeoutExpired,00000000,00000000), ref: 03255A3C
PyModule_AddObject.PYTHON27(00000000,TimeoutExpired,00000001), ref: 03255A52
PyErr_NewException.PYTHON27(_psutil_windows.TimeoutAbandoned,00000000,00000000), ref: 03255A5D
PyModule_AddObject.PYTHON27(00000000,TimeoutAbandoned,00000001), ref: 03255A6D
PyModule_AddIntConstant.PYTHON27(00000000,version,00000233), ref: 03255A80
PyModule_AddIntConstant.PYTHON27(00000000,ABOVE_NORMAL_PRIORITY_CLASS,00008000), ref: 03255A8D
PyModule_AddIntConstant.PYTHON27(00000000,BELOW_NORMAL_PRIORITY_CLASS,00004000), ref: 03255A9D
PyModule_AddIntConstant.PYTHON27(00000000,HIGH_PRIORITY_CLASS,00000080), ref: 03255AAA
PyModule_AddIntConstant.PYTHON27(00000000,IDLE_PRIORITY_CLASS,00000040), ref: 03255AB4
PyModule_AddIntConstant.PYTHON27(00000000,NORMAL_PRIORITY_CLASS,00000020), ref: 03255ABE
PyModule_AddIntConstant.PYTHON27(00000000,REALTIME_PRIORITY_CLASS,00000100), ref: 03255ACB
PyModule_AddIntConstant.PYTHON27(00000000,MIB_TCP_STATE_CLOSED,00000001), ref: 03255AD5
PyModule_AddIntConstant.PYTHON27(00000000,MIB_TCP_STATE_CLOSING,00000009), ref: 03255AE2
PyModule_AddIntConstant.PYTHON27(00000000,MIB_TCP_STATE_CLOSE_WAIT,00000008), ref: 03255AEC
PyModule_AddIntConstant.PYTHON27(00000000,MIB_TCP_STATE_LISTEN,00000002), ref: 03255AF6
PyModule_AddIntConstant.PYTHON27(00000000,MIB_TCP_STATE_ESTAB,00000005), ref: 03255B00
PyModule_AddIntConstant.PYTHON27(00000000,MIB_TCP_STATE_SYN_SENT,00000003), ref: 03255B0A
PyModule_AddIntConstant.PYTHON27(00000000,MIB_TCP_STATE_SYN_RCVD,00000004), ref: 03255B14
PyModule_AddIntConstant.PYTHON27(00000000,MIB_TCP_STATE_FIN_WAIT1,00000006), ref: 03255B21
PyModule_AddIntConstant.PYTHON27(00000000,MIB_TCP_STATE_FIN_WAIT2,00000007), ref: 03255B2B
PyModule_AddIntConstant.PYTHON27(00000000,MIB_TCP_STATE_LAST_ACK,0000000A), ref: 03255B35
PyModule_AddIntConstant.PYTHON27(00000000,MIB_TCP_STATE_TIME_WAIT,0000000B), ref: 03255B3F

Strings

MIB_TCP_STATE_DELETE_TCB, xrefs: 03255B4D
HIGH_PRIORITY_CLASS, xrefs: 03255AA4
ERROR_ACCESS_DENIED, xrefs: 03255B71
REALTIME_PRIORITY_CLASS, xrefs: 03255AC5
TimeoutExpired, xrefs: 03255A47
MIB_TCP_STATE_FIN_WAIT2, xrefs: 03255B25
_psutil_windows.TimeoutExpired, xrefs: 03255A37
WINDOWS_VISTA, xrefs: 03255BC5
MIB_TCP_STATE_LISTEN, xrefs: 03255AF0
MIB_TCP_STATE_LAST_ACK, xrefs: 03255B2F
MIB_TCP_STATE_SYN_SENT, xrefs: 03255B04
WINDOWS_7, xrefs: 03255BCF
WINDOWS_XP, xrefs: 03255BB1
version, xrefs: 03255A7A
MIB_TCP_STATE_SYN_RCVD, xrefs: 03255B0E
MIB_TCP_STATE_TIME_WAIT, xrefs: 03255B43
ABOVE_NORMAL_PRIORITY_CLASS, xrefs: 03255A87
TimeoutAbandoned, xrefs: 03255A62
MIB_TCP_STATE_FIN_WAIT1, xrefs: 03255B1B
NORMAL_PRIORITY_CLASS, xrefs: 03255AB8
PSUTIL_CONN_NONE, xrefs: 03255B5D
WINDOWS_8, xrefs: 03255BD9
MIB_TCP_STATE_ESTAB, xrefs: 03255AFA
_psutil_windows.TimeoutAbandoned, xrefs: 03255A58
WINDOWS_10, xrefs: 03255BF0
MIB_TCP_STATE_CLOSING, xrefs: 03255ADC
_psutil_windows, xrefs: 032559BF
MIB_TCP_STATE_TIME_WAIT, xrefs: 03255B39
_psutil_windows.Error, xrefs: 03255A07
WINDOWS_8_1, xrefs: 03255BE6
INFINITE, xrefs: 03255B67
MIB_TCP_STATE_CLOSED, xrefs: 03255ACF
WINDOWS_SERVER_2003, xrefs: 03255BBB
BELOW_NORMAL_PRIORITY_CLASS, xrefs: 03255A97
ERROR_SERVICE_DOES_NOT_EXIST, xrefs: 03255B88
ERROR_PRIVILEGE_NOT_HELD, xrefs: 03255B95
MIB_TCP_STATE_CLOSE_WAIT, xrefs: 03255AE6
WINVER, xrefs: 03255BA7
IDLE_PRIORITY_CLASS, xrefs: 03255AAE
ERROR_INVALID_NAME, xrefs: 03255B7B

Memory Dump Source

Source File: 0000000F.00000002.1423676562.0000000003251000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03250000, based on PE: true

Associated: 0000000F.00000002.1423656216.0000000003250000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423775563.0000000003263000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3250000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Module_$Constant$Err_$Exception$Object$ClearErrorInitLastModule4Warn
String ID: ABOVE_NORMAL_PRIORITY_CLASS$BELOW_NORMAL_PRIORITY_CLASS$ERROR_ACCESS_DENIED$ERROR_INVALID_NAME$ERROR_PRIVILEGE_NOT_HELD$ERROR_SERVICE_DOES_NOT_EXIST$HIGH_PRIORITY_CLASS$IDLE_PRIORITY_CLASS$INFINITE$MIB_TCP_STATE_CLOSED$MIB_TCP_STATE_CLOSE_WAIT$MIB_TCP_STATE_CLOSING$MIB_TCP_STATE_DELETE_TCB$MIB_TCP_STATE_ESTAB$MIB_TCP_STATE_FIN_WAIT1$MIB_TCP_STATE_FIN_WAIT2$MIB_TCP_STATE_LAST_ACK$MIB_TCP_STATE_LISTEN$MIB_TCP_STATE_SYN_RCVD$MIB_TCP_STATE_SYN_SENT$MIB_TCP_STATE_TIME_WAIT$MIB_TCP_STATE_TIME_WAIT$NORMAL_PRIORITY_CLASS$PSUTIL_CONN_NONE$REALTIME_PRIORITY_CLASS$TimeoutAbandoned$TimeoutExpired$WINDOWS_10$WINDOWS_7$WINDOWS_8$WINDOWS_8_1$WINDOWS_SERVER_2003$WINDOWS_VISTA$WINDOWS_XP$WINVER$_psutil_windows$_psutil_windows.Error$_psutil_windows.TimeoutAbandoned$_psutil_windows.TimeoutExpired$version
API String ID: 3572930849-2349806778
Opcode ID: 7b0919462adfe93fbc63b5e4ca9655e261708d7f1e1f45993ca0742da062d6ba
Instruction ID: 9298a6d41371a13bbf02da0e3a1f30edf4655dd63588fb57119347cab4bfc69e
Opcode Fuzzy Hash: 7b0919462adfe93fbc63b5e4ca9655e261708d7f1e1f45993ca0742da062d6ba
Instruction Fuzzy Hash: 98511C607E17753EE122F6255C0BF9F29489FD2F15F024000FE20799C2BAF857C289AA

Uniqueness

Uniqueness Score: -1.00%

Function 1E8CB250 Relevance: 128.0, APIs: 38, Strings: 35, Instructions: 245COMMON

Download Yara Rule

APIs

?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(GetPwrCapabilities,00000000,?), ref: 1E8CB268
PyLong_FromUnsignedLong.PYTHON27(?,?,?,?,?,?), ref: 1E8CB284
PyLong_FromUnsignedLong.PYTHON27(?,Capacity,00000000,?), ref: 1E8CB294
Py_BuildValue.PYTHON27({s:N, s:N},Granularity,00000000), ref: 1E8CB2AA
PyLong_FromUnsignedLong.PYTHON27(?), ref: 1E8CB2B3
PyLong_FromUnsignedLong.PYTHON27(?,Capacity,00000000), ref: 1E8CB2C3
Py_BuildValue.PYTHON27({s:N, s:N},Granularity,00000000), ref: 1E8CB2D3
PyLong_FromUnsignedLong.PYTHON27(?), ref: 1E8CB2DE
PyLong_FromUnsignedLong.PYTHON27(?,Capacity,00000000), ref: 1E8CB2EE
Py_BuildValue.PYTHON27({s:N, s:N},Granularity,00000000), ref: 1E8CB2FE
PyInt_FromLong.PYTHON27(?), ref: 1E8CB30D
PyInt_FromLong.PYTHON27(?,DefaultLowLatencyWake,00000000), ref: 1E8CB31D
PyInt_FromLong.PYTHON27(?,MinDeviceWakeState,00000000), ref: 1E8CB32D
PyInt_FromLong.PYTHON27(?,RtcWake,00000000), ref: 1E8CB33D
PyInt_FromLong.PYTHON27(?,SoftLidWake,00000000), ref: 1E8CB34D
Py_BuildValue.PYTHON27(NNN,00000000,?,00000000,AcOnLineWake,00000000), ref: 1E8CB364
PyBool_FromLong.PYTHON27(?,BatteryScale,00000000), ref: 1E8CB37B

Strings

BatteriesAreShortTerm, xrefs: 1E8CB386
FastSystemS4, xrefs: 1E8CB3D3
DiskSpinDown, xrefs: 1E8CB3B9
MinDeviceWakeState, xrefs: 1E8CB327
VideoDimPresent, xrefs: 1E8CB45F
SystemS2, xrefs: 1E8CB4D7
BatteryScale, xrefs: 1E8CB375
SystemS5, xrefs: 1E8CB49B
LidPresent, xrefs: 1E8CB4FF
spare3, xrefs: 1E8CB3A2
UpsPresent, xrefs: 1E8CB437
ProcessorThrottle, xrefs: 1E8CB40F
{s:N, s:N}, xrefs: 1E8CB2A5, 1E8CB2CE, 1E8CB2F9
SleepButtonPresent, xrefs: 1E8CB513
SystemS4, xrefs: 1E8CB4AF
FullWake, xrefs: 1E8CB473
spare2, xrefs: 1E8CB3BF
PowerButtonPresent, xrefs: 1E8CB51F
ThermalControl, xrefs: 1E8CB423
GetPwrCapabilities, xrefs: 1E8CB263
ProcessorMaxThrottle, xrefs: 1E8CB3E7
HiberFilePresent, xrefs: 1E8CB487
ProcessorMinThrottle, xrefs: 1E8CB3FB
ApmPresent, xrefs: 1E8CB44B
{s:N, s:N, s:N, s:N, s:N, s:N, s:N, s:N, s:N, s:N, s:N, s:N, s:N, s:N, s:N, s:N, s:N, s:N, s:O, s:N, s:O, s:N, s:N, s:O, s:N, s:N, s:N, s:N, s:N}, xrefs: 1E8CB524
SystemS3, xrefs: 1E8CB4C3
AcOnLineWake, xrefs: 1E8CB357
SystemBatteriesPresent, xrefs: 1E8CB39C
RtcWake, xrefs: 1E8CB337
Granularity, xrefs: 1E8CB2A0, 1E8CB2C9, 1E8CB2F4
SystemS1, xrefs: 1E8CB4EB
DefaultLowLatencyWake, xrefs: 1E8CB317
NNN, xrefs: 1E8CB35F
Capacity, xrefs: 1E8CB28E, 1E8CB2BD, 1E8CB2E8
SoftLidWake, xrefs: 1E8CB347

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: FromLong$Long_Unsigned$Int_$BuildValue$Bool_Error@@U_object@@Win_
String ID: AcOnLineWake$ApmPresent$BatteriesAreShortTerm$BatteryScale$Capacity$DefaultLowLatencyWake$DiskSpinDown$FastSystemS4$FullWake$GetPwrCapabilities$Granularity$HiberFilePresent$LidPresent$MinDeviceWakeState$NNN$PowerButtonPresent$ProcessorMaxThrottle$ProcessorMinThrottle$ProcessorThrottle$RtcWake$SleepButtonPresent$SoftLidWake$SystemBatteriesPresent$SystemS1$SystemS2$SystemS3$SystemS4$SystemS5$ThermalControl$UpsPresent$VideoDimPresent$spare2$spare3${s:N, s:N, s:N, s:N, s:N, s:N, s:N, s:N, s:N, s:N, s:N, s:N, s:N, s:N, s:N, s:N, s:N, s:N, s:O, s:N, s:O, s:N, s:N, s:O, s:N, s:N, s:N, s:N, s:N}${s:N, s:N}
API String ID: 3791411757-3975806661
Opcode ID: 325b512e5e23083aab4f39e2a315ceee7c4453a264b930062d8ccf9dbf65e2e1
Instruction ID: fe4623a950b00ab38fe6e83f5c1b7273cba0da8d9e1c641f58765eac47cee08c
Opcode Fuzzy Hash: 325b512e5e23083aab4f39e2a315ceee7c4453a264b930062d8ccf9dbf65e2e1
Instruction Fuzzy Hash: 1661C9D08083A07BE115637D5C50DFB7ADDAF85829F044A2AFDC9E2312D429D6185BB7

Uniqueness

Uniqueness Score: -1.00%

Function 1E8CA870 Relevance: 80.8, APIs: 25, Strings: 21, Instructions: 271threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,OO:GetFileVersionInfo,?,?), ref: 1E8CA8AA
?PyWinObject_AsWCHAR@@YAHPAU_object@@PAPA_WHPAK@Z.PYWINTYPES27(?,?,00000000,00000000), ref: 1E8CA8CF
?PyWinObject_AsWCHAR@@YAHPAU_object@@PAPA_WHPAK@Z.PYWINTYPES27(?,?,00000000,00000000), ref: 1E8CA8E8
PyEval_SaveThread.PYTHON27 ref: 1E8CA8FD
PyEval_RestoreThread.PYTHON27(00000000,?,?), ref: 1E8CA919
GetLastError.KERNEL32 ref: 1E8CA922
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(GetFileVersionInfo:VerQueryValue,00000000), ref: 1E8CAB4B
?PyWinObject_FreeWCHAR@@YAXPA_W@Z.PYWINTYPES27(?), ref: 1E8CAB65
?PyWinObject_FreeWCHAR@@YAXPA_W@Z.PYWINTYPES27(?), ref: 1E8CAB73
73BB3B4E.MSVCR90(?), ref: 1E8CAB82

Strings

FileFlagsMask, xrefs: 1E8CAA45
GetFileVersionInfo:VerQueryValue, xrefs: 1E8CA9D3
GetFileVersionInfo:VerQueryValue, xrefs: 1E8CAB46
FileSubtype, xrefs: 1E8CAA21
FileOS, xrefs: 1E8CAA33
GetFileVersionInfo:VerQueryValue, xrefs: 1E8CAAB4
ProductVersionLS, xrefs: 1E8CAA4E
FileFlags, xrefs: 1E8CAA3C
GetFileVersionInfo, xrefs: 1E8CA94E
FileVersionMS, xrefs: 1E8CAA65
{u:l,u:l,u:l,u:l,u:l,u:l,u:l,u:l,u:l,u:l,u:l,u:N}, xrefs: 1E8CAA76
GetFileVersionInfo, xrefs: 1E8CA981
FileType, xrefs: 1E8CAA2A
OO:GetFileVersionInfo, xrefs: 1E8CA884
ProductVersionMS, xrefs: 1E8CAA57
Signature, xrefs: 1E8CAA71
\VarFileInfo\Translation, xrefs: 1E8CAA93
StrucVersion, xrefs: 1E8CAA6B
FileDate, xrefs: 1E8CAA18
GetFileVersionInfo:GetFileVersionInfoSize, xrefs: 1E8CA929
FileVersionLS, xrefs: 1E8CAA5F

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_$U_object@@$Eval_FreeThread$Arg_ErrorError@@LastParseRestoreSaveTupleWin_
String ID: FileDate$FileFlags$FileFlagsMask$FileOS$FileSubtype$FileType$FileVersionLS$FileVersionMS$GetFileVersionInfo$GetFileVersionInfo$GetFileVersionInfo:GetFileVersionInfoSize$GetFileVersionInfo:VerQueryValue$GetFileVersionInfo:VerQueryValue$GetFileVersionInfo:VerQueryValue$OO:GetFileVersionInfo$ProductVersionLS$ProductVersionMS$Signature$StrucVersion$\VarFileInfo\Translation${u:l,u:l,u:l,u:l,u:l,u:l,u:l,u:l,u:l,u:l,u:l,u:N}
API String ID: 970476554-2183921110
Opcode ID: ba923d75c1137d56856e311f5d3f9c612986a419d3d027ef258ca7351dfc7324
Instruction ID: 5b275fd66b0ec0943417363ba66f8e038fdfc02222d3c9b4e664b40811026da9
Opcode Fuzzy Hash: ba923d75c1137d56856e311f5d3f9c612986a419d3d027ef258ca7351dfc7324
Instruction Fuzzy Hash: 1C914BB1504312AFE310DF69CD84D9BB7E9BF8A644F004B19FA8A93351D730E949CB62

Uniqueness

Uniqueness Score: -1.00%

Function 03257CA0 Relevance: 71.9, APIs: 7, Strings: 34, Instructions: 151COMMON

Download Yara Rule

APIs

Part of subcall function 03257BE0: PyEval_SaveThread.PYTHON27(?,00000000,?,03257CAF,ntdll.dll,NtQuerySystemInformation,03257FF5,032559E9), ref: 03257BE3
Part of subcall function 03257BE0: LoadLibraryA.KERNEL32(?,?,00000000,?,03257CAF,ntdll.dll,NtQuerySystemInformation,03257FF5,032559E9), ref: 03257BF0
Part of subcall function 03257BE0: PyEval_RestoreThread.PYTHON27(00000000,?,00000000,?,03257CAF,ntdll.dll,NtQuerySystemInformation,03257FF5,032559E9), ref: 03257BF9
Part of subcall function 03257BE0: PyErr_SetFromWindowsErrWithFilename.PYTHON27(00000000,?,032559E9), ref: 03257C08

GetModuleHandleA.KERNEL32(ntdll.dll,?,00000000,?,03257FF5,032559E9), ref: 03257CCF
PyErr_SetFromWindowsErrWithFilename.PYTHON27(00000000,NtQueryInformationProcess,?,00000000,?,03257FF5,032559E9), ref: 03257CFB
GetModuleHandleA.KERNEL32(ntdll.dll,?,00000000,?,03257FF5,032559E9), ref: 03257D14
PyErr_SetFromWindowsErrWithFilename.PYTHON27(00000000,NtSetInformationProcess,?,00000000,?,03257FF5,032559E9), ref: 03257D34

Strings

RtlNtStatusToDosErrorNoTeb, xrefs: 03257E4F
kernel32, xrefs: 03257EAF
ntdll.dll, xrefs: 03257CA5
NtQueryVirtualMemory, xrefs: 03257E34
NtResumeProcess, xrefs: 03257E19
RtlIpv6AddressToStringA, xrefs: 03257E73
iphlpapi.dll, xrefs: 03257DAA
ntdll, xrefs: 03257E54
WinStationQueryInformationW, xrefs: 03257D48
ntdll, xrefs: 03257E03
GetActiveProcessorCount, xrefs: 03257E96
NtSetInformationProcess, xrefs: 03257D21, 03257D2D
GetExtendedUdpTable, xrefs: 03257DC4
winsta.dll, xrefs: 03257D4D
kernel32, xrefs: 03257E9B
RtlIpv4AddressToStringA, xrefs: 03257D86
GetLogicalProcessorInformationEx, xrefs: 03257EAA
ntdll.dll, xrefs: 03257DE8
ntdll, xrefs: 03257E1E
NtQuerySystemInformation, xrefs: 03257CA0
ntdll.dll, xrefs: 03257D8B
NtSuspendProcess, xrefs: 03257DFE
GetTickCount64, xrefs: 03257E82
ntdll.dll, xrefs: 03257E78
ntdll.dll, xrefs: 03257CCA, 03257CE1
GetExtendedTcpTable, xrefs: 03257DA5
NtQueryInformationProcess, xrefs: 03257CE8, 03257CF4
kernel32, xrefs: 03257E87
RtlGetVersion, xrefs: 03257DE3
ntdll.dll, xrefs: 03257D0F, 03257D1A
ntdll.dll, xrefs: 03257D6C
iphlpapi.dll, xrefs: 03257DC9
ntdll, xrefs: 03257E39
NtQueryObject, xrefs: 03257D67

Memory Dump Source

Source File: 0000000F.00000002.1423676562.0000000003251000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03250000, based on PE: true

Associated: 0000000F.00000002.1423656216.0000000003250000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423775563.0000000003263000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3250000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Err_FilenameFromWindowsWith$Eval_HandleModuleThread$LibraryLoadRestoreSave
String ID: GetActiveProcessorCount$GetExtendedTcpTable$GetExtendedUdpTable$GetLogicalProcessorInformationEx$GetTickCount64$NtQueryInformationProcess$NtQueryObject$NtQuerySystemInformation$NtQueryVirtualMemory$NtResumeProcess$NtSetInformationProcess$NtSuspendProcess$RtlGetVersion$RtlIpv4AddressToStringA$RtlIpv6AddressToStringA$RtlNtStatusToDosErrorNoTeb$WinStationQueryInformationW$iphlpapi.dll$iphlpapi.dll$kernel32$kernel32$kernel32$ntdll$ntdll$ntdll$ntdll$ntdll.dll$ntdll.dll$ntdll.dll$ntdll.dll$ntdll.dll$ntdll.dll$ntdll.dll$winsta.dll
API String ID: 3545709012-3537588484
Opcode ID: 9fb90af7c8833c4837fe567a1f4e4a29a9c7f409b1f5a636dc13dc93ad77a3e3
Instruction ID: 2a3fd57be29b14006950ddf80d9584812f436fb29a14bd4a1aa0b8cfe66f8543
Opcode Fuzzy Hash: 9fb90af7c8833c4837fe567a1f4e4a29a9c7f409b1f5a636dc13dc93ad77a3e3
Instruction Fuzzy Hash: 354110A5FF53036FCA10FA7D7C17A1E79845B20A4A7594021FC24E5607FAF0D7C18AA2

Uniqueness

Uniqueness Score: -1.00%

Function 1E7D11E0 Relevance: 64.9, APIs: 19, Strings: 18, Instructions: 139libraryloaderCOMMON

Download Yara Rule

APIs

Py_InitModule4.PYTHON27(servicemanager,1E7D6280,00000000,00000000,000003F5), ref: 1E7D1203
PyModule_GetDict.PYTHON27(00000000), ref: 1E7D1218
PyErr_NewException.PYTHON27(servicemanager.startup_error,00000000,00000000), ref: 1E7D1234
PyDict_SetItemString.PYTHON27(00000000,startup_error,00000000), ref: 1E7D1251
PyModule_AddIntConstant.PYTHON27(00000000,COINIT_MULTITHREADED,00000000), ref: 1E7D1265
PyModule_AddIntConstant.PYTHON27(00000000,COINIT_APARTMENTTHREADED,00000002), ref: 1E7D127B
PyModule_AddIntConstant.PYTHON27(00000000,COINIT_DISABLE_OLE1DDE,00000004), ref: 1E7D1291
PyModule_AddIntConstant.PYTHON27(00000000,COINIT_SPEED_OVER_MEMORY,00000008), ref: 1E7D12A7
PyModule_AddIntConstant.PYTHON27(00000000,PYS_SERVICE_STARTING,40001000), ref: 1E7D12C0
PyModule_AddIntConstant.PYTHON27(00000000,PYS_SERVICE_STARTED,40001002), ref: 1E7D12D9
PyModule_AddIntConstant.PYTHON27(00000000,PYS_SERVICE_STOPPING,40001003), ref: 1E7D12F2
PyModule_AddIntConstant.PYTHON27(00000000,PYS_SERVICE_STOPPED,40001004), ref: 1E7D130B
PyModule_AddIntConstant.PYTHON27(00000000,EVENTLOG_ERROR_TYPE,00000001), ref: 1E7D1321
PyModule_AddIntConstant.PYTHON27(00000000,EVENTLOG_INFORMATION_TYPE,00000004), ref: 1E7D1333
PyModule_AddIntConstant.PYTHON27(00000000,EVENTLOG_WARNING_TYPE,00000002), ref: 1E7D1345
PyModule_AddIntConstant.PYTHON27(00000000,EVENTLOG_AUDIT_SUCCESS,00000008), ref: 1E7D1357
PyModule_AddIntConstant.PYTHON27(00000000,EVENTLOG_AUDIT_FAILURE,00000010), ref: 1E7D1369
LoadLibraryW.KERNEL32(advapi32), ref: 1E7D1378
GetProcAddress.KERNEL32(00000000,RegisterServiceCtrlHandlerExW), ref: 1E7D1388

Strings

RegisterServiceCtrlHandlerExW, xrefs: 1E7D1382
COINIT_DISABLE_OLE1DDE, xrefs: 1E7D128B
COINIT_MULTITHREADED, xrefs: 1E7D125F
advapi32, xrefs: 1E7D1373
PYS_SERVICE_STOPPING, xrefs: 1E7D12EC
EVENTLOG_AUDIT_FAILURE, xrefs: 1E7D1363
EVENTLOG_AUDIT_SUCCESS, xrefs: 1E7D1351
servicemanager.startup_error, xrefs: 1E7D122F
EVENTLOG_ERROR_TYPE, xrefs: 1E7D131B
COINIT_SPEED_OVER_MEMORY, xrefs: 1E7D12A1
PYS_SERVICE_STARTED, xrefs: 1E7D12D3
EVENTLOG_WARNING_TYPE, xrefs: 1E7D133F
servicemanager, xrefs: 1E7D11FE
PYS_SERVICE_STOPPED, xrefs: 1E7D1305
PYS_SERVICE_STARTING, xrefs: 1E7D12BA
startup_error, xrefs: 1E7D124B
EVENTLOG_INFORMATION_TYPE, xrefs: 1E7D132D
COINIT_APARTMENTTHREADED, xrefs: 1E7D1275

Memory Dump Source

Source File: 0000000F.00000002.1434219289.000000001E7D1000.00000040.00000001.01000000.00000015.sdmp, Offset: 1E7D0000, based on PE: true

Associated: 0000000F.00000002.1434197225.000000001E7D0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000F.00000002.1434219289.000000001E7DA000.00000040.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000F.00000002.1434284534.000000001E7DB000.00000080.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000F.00000002.1434310614.000000001E7DD000.00000004.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e7d0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Module_$Constant$AddressDictDict_Err_ExceptionInitItemLibraryLoadModule4ProcString
String ID: COINIT_APARTMENTTHREADED$COINIT_DISABLE_OLE1DDE$COINIT_MULTITHREADED$COINIT_SPEED_OVER_MEMORY$EVENTLOG_AUDIT_FAILURE$EVENTLOG_AUDIT_SUCCESS$EVENTLOG_ERROR_TYPE$EVENTLOG_INFORMATION_TYPE$EVENTLOG_WARNING_TYPE$PYS_SERVICE_STARTED$PYS_SERVICE_STARTING$PYS_SERVICE_STOPPED$PYS_SERVICE_STOPPING$RegisterServiceCtrlHandlerExW$advapi32$servicemanager$servicemanager.startup_error$startup_error
API String ID: 4250939807-1999790513
Opcode ID: 269920bb323bdf795eaf6d09170fb44872a7b05e6f3c487e5184d03f28a8e6e9
Instruction ID: 5903a4d7448f47a931db4ae6b242e3ba41dc8ee4dc82b40455f72c6f67718f31
Opcode Fuzzy Hash: 269920bb323bdf795eaf6d09170fb44872a7b05e6f3c487e5184d03f28a8e6e9
Instruction Fuzzy Hash: 8F315EA0D4171036F8212229ED95FDD3159BF86739F260310FDBAF1AF0F765826E189A

Uniqueness

Uniqueness Score: -1.00%

Function 1ECB3960 Relevance: 52.7, APIs: 24, Strings: 6, Instructions: 208COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON27(?,QueryServiceConfig2 is not available on this operating system), ref: 1ECB397B
PyArg_ParseTuple.PYTHON27(?,Ol:QueryServiceConfig2,?,?), ref: 1ECB39A3
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?), ref: 1ECB39BA
QueryServiceConfig2W.ADVAPI32(?,?,00000000,00000000,?), ref: 1ECB39D8
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(QueryServiceConfig2,00000000), ref: 1ECB39EC

Strings

Ol:QueryServiceConfig2, xrefs: 1ECB3999
QueryServiceConfig2 is not available on this operating system, xrefs: 1ECB3975
QueryServiceConfig2, xrefs: 1ECB3B71
QueryServiceConfig2, xrefs: 1ECB39E7
QueryServiceConfig2: Unable to allocate buffer of %d bytes, xrefs: 1ECB3A1A
QueryServiceConfig2: Level %d is not supported, xrefs: 1ECB3B4F

Memory Dump Source

Source File: 0000000F.00000002.1435001879.000000001ECB1000.00000040.00000001.01000000.00000011.sdmp, Offset: 1ECB0000, based on PE: true

Associated: 0000000F.00000002.1434980425.000000001ECB0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBA000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBD000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435097428.000000001ECBF000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435120797.000000001ECC0000.00000004.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ecb0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: U_object@@$Arg_Config2Err_Error@@Object_ParseQueryServiceStringTupleWin_
String ID: Ol:QueryServiceConfig2$QueryServiceConfig2$QueryServiceConfig2$QueryServiceConfig2 is not available on this operating system$QueryServiceConfig2: Level %d is not supported$QueryServiceConfig2: Unable to allocate buffer of %d bytes
API String ID: 870244828-845235006
Opcode ID: a437d1e0093a697cf70caedd735532ddfc763d10f4ca18276cc695251ad1bc5f
Instruction ID: cf5ce63d65afe6ed55863543227a3263fa29df8c4aefd7ad414a4abc7831cdf9
Opcode Fuzzy Hash: a437d1e0093a697cf70caedd735532ddfc763d10f4ca18276cc695251ad1bc5f
Instruction Fuzzy Hash: 20512F75A001219BD700AB6CEC8989F37A9EFC4699B4849B5FC59C3301E631D51DCBA7

Uniqueness

Uniqueness Score: -1.00%

Function 1ECB17B0 Relevance: 52.7, APIs: 21, Strings: 9, Instructions: 198COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,Ol:GetUserObjectInformation,?,?), ref: 1ECB17CE
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?), ref: 1ECB17EC
PyErr_Format.PYTHON27(00000000,GetUserObjectInformation unable to allocate %d bytes,00000080), ref: 1ECB1824

Strings

Type of information is not supported yet, xrefs: 1ECB19A0
Flags, xrefs: 1ECB1956
GetUserObjectInformation unable to allocate %d bytes, xrefs: 1ECB181E
{s:N,s:N,s:l}, xrefs: 1ECB1975
GetUserObjectInformation unable to allocate %d bytes, xrefs: 1ECB1884
Inherit, xrefs: 1ECB1970
Reserved, xrefs: 1ECB1964
GetUserObjectInformation, xrefs: 1ECB18BD
Ol:GetUserObjectInformation, xrefs: 1ECB17C2

Memory Dump Source

Source File: 0000000F.00000002.1435001879.000000001ECB1000.00000040.00000001.01000000.00000011.sdmp, Offset: 1ECB0000, based on PE: true

Associated: 0000000F.00000002.1434980425.000000001ECB0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBA000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBD000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435097428.000000001ECBF000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435120797.000000001ECC0000.00000004.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ecb0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Err_FormatObject_ParseTupleU_object@@
String ID: Flags$GetUserObjectInformation$GetUserObjectInformation unable to allocate %d bytes$GetUserObjectInformation unable to allocate %d bytes$Inherit$Ol:GetUserObjectInformation$Reserved$Type of information is not supported yet${s:N,s:N,s:l}
API String ID: 3520361810-299945797
Opcode ID: fed82c80ddc54e0a9ae090ead1b65575f7bb4cbecbcc827f36d8891878267d5d
Instruction ID: bbc1e8316eb68e9e2e75e08b8e4c1a47f11a7720a7683486959ea9b14ae7d71e
Opcode Fuzzy Hash: fed82c80ddc54e0a9ae090ead1b65575f7bb4cbecbcc827f36d8891878267d5d
Instruction Fuzzy Hash: 3C51B9726002259FD300EF69ED85CAB73A8FFC4695F4409A9FD59C3301E632E91C87A6

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C22A0 Relevance: 49.3, APIs: 23, Strings: 5, Instructions: 270windowCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,|k:FormatMessageA,?), ref: 1E8C22E1
GetLastError.KERNEL32 ref: 1E8C22F5
?PyWin_GetErrorMessageModule@@YAPAUHINSTANCE__@@K@Z.PYWINTYPES27(?), ref: 1E8C2304
FormatMessageA.KERNEL32(00001200,00000000,?,00000000,?,00000200,00000000), ref: 1E8C232A
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(FormatMessage,00000000), ref: 1E8C233A
PyString_FromString.PYTHON27(?), ref: 1E8C235B
PyErr_Clear.PYTHON27 ref: 1E8C2375
PyArg_ParseTuple.PYTHON27(?,kOkkO:FormatMessageA,?,?,?,?,?), ref: 1E8C23A7
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?), ref: 1E8C23C6
?PyWinSequence_Tuple@@YAPAU_object@@PAU1@PAK@Z.PYWINTYPES27(?,?), ref: 1E8C241A
PyErr_NoMemory.PYTHON27 ref: 1E8C244B
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27 ref: 1E8C2574
73BB3B4E.MSVCR90(?), ref: 1E8C2584
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C2591
LocalFree.KERNEL32(?), ref: 1E8C25A2

Strings

FormatMessage, xrefs: 1E8C2335
FormatMessageA, xrefs: 1E8C253D
|k:FormatMessageA, xrefs: 1E8C22D2
kOkkO:FormatMessageA, xrefs: 1E8C23A1
Access violation (probably due to missing string inserts), xrefs: 1E8C251E

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: FreeObject_U_object@@$Arg_Err_ErrorMessageParseString@@TupleWin_$ClearE__@@Error@@FormatFromLastLocalMemoryModule@@Sequence_StringString_Tuple@@
String ID: Access violation (probably due to missing string inserts)$FormatMessage$FormatMessageA$kOkkO:FormatMessageA$|k:FormatMessageA
API String ID: 1473980708-3451784028
Opcode ID: 0730011bb21f8ad9fedbdc8bc4b238ce8b6026eacf1902867429009cf6a16e9f
Instruction ID: 91bdc100aeeefbecb065028d99f9e2b3a8c3ba916e58ab92beff2b696f31c99a
Opcode Fuzzy Hash: 0730011bb21f8ad9fedbdc8bc4b238ce8b6026eacf1902867429009cf6a16e9f
Instruction Fuzzy Hash: 64A150B1D00619AFDB00CFD8DDD4AEEB7B9FB4A715F104229E909A3280E735E945CB61

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C25E0 Relevance: 49.3, APIs: 23, Strings: 5, Instructions: 270windowCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,|k:FormatMessageW,?), ref: 1E8C2621
GetLastError.KERNEL32 ref: 1E8C2635
?PyWin_GetErrorMessageModule@@YAPAUHINSTANCE__@@K@Z.PYWINTYPES27(?), ref: 1E8C2644
FormatMessageW.KERNEL32(00001200,00000000,?,00000000,?,00000200,00000000), ref: 1E8C266A
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(FormatMessageW,00000000), ref: 1E8C267A
?PyWinObject_FromOLECHAR@@YAPAU_object@@PB_W@Z.PYWINTYPES27(?), ref: 1E8C269B
PyErr_Clear.PYTHON27 ref: 1E8C26B5
PyArg_ParseTuple.PYTHON27(?,kOkkO:FormatMessageW,?,?,?,?,?), ref: 1E8C26E7
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?), ref: 1E8C2706
?PyWinSequence_Tuple@@YAPAU_object@@PAU1@PAK@Z.PYWINTYPES27(?,?), ref: 1E8C275A
PyErr_NoMemory.PYTHON27 ref: 1E8C278B
?PyWinObject_FreeWCHAR@@YAXPA_W@Z.PYWINTYPES27 ref: 1E8C28B4
73BB3B4E.MSVCR90(?), ref: 1E8C28C4
?PyWinObject_FreeWCHAR@@YAXPA_W@Z.PYWINTYPES27(?), ref: 1E8C28D1
LocalFree.KERNEL32(?), ref: 1E8C28E2

Strings

|k:FormatMessageW, xrefs: 1E8C2612
Access violation (probably due to missing string inserts), xrefs: 1E8C285E
FormatMessageW, xrefs: 1E8C287D
kOkkO:FormatMessageW, xrefs: 1E8C26E1
FormatMessageW, xrefs: 1E8C2675

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_U_object@@$Free$Arg_Err_ErrorMessageParseTupleWin_$ClearE__@@Error@@FormatFromLastLocalMemoryModule@@Sequence_Tuple@@
String ID: Access violation (probably due to missing string inserts)$FormatMessageW$FormatMessageW$kOkkO:FormatMessageW$|k:FormatMessageW
API String ID: 652389039-1434402131
Opcode ID: cbe3b316b06982b133cb3bf2466ebf138717d64250bd9f18bd7724153822be9f
Instruction ID: fe210d190c1b17abc1063bd217850ede2ee94dc8c4077c859cb28b5469b0122f
Opcode Fuzzy Hash: cbe3b316b06982b133cb3bf2466ebf138717d64250bd9f18bd7724153822be9f
Instruction Fuzzy Hash: F8A13CB1D00619AFDB00DFD8DCC8ADEB7B9FF49715F148229E90AA3280D735A945CB61

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C7BE0 Relevance: 49.2, APIs: 13, Strings: 15, Instructions: 196COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1E8C7C02
?PyWinObject_AsHKEY@@YAHPAU_object@@PAPAUHKEY__@@@Z.PYWINTYPES27(?,?), ref: 1E8C7C1F
PyErr_Format.PYTHON27(?,Unable to allocate %d bytes,?,?,?,?,?,?,?), ref: 1E8C7C5C

Strings

RegQueryInfoKeyW, xrefs: 1E8C7D3A
Unable to allocate %d bytes, xrefs: 1E8C7C56
SubKeys, xrefs: 1E8C7DBB
MaxValueNameLen, xrefs: 1E8C7D95
cbSecurityDescriptor, xrefs: 1E8C7D81
MaxValueLen, xrefs: 1E8C7D8B
Reserved, xrefs: 1E8C7DC1
{s:N,s:O,s:k,s:k,s:k,s:k,s:k,s:k,s:k,s:N}, xrefs: 1E8C7DD7
O:RegQueryInfoKeyW, xrefs: 1E8C7BEC
MaxClassLen, xrefs: 1E8C7DAB
MaxSubKeyLen, xrefs: 1E8C7DB5
Values, xrefs: 1E8C7D9F
LastWriteTime, xrefs: 1E8C7D77
Unable to allocate %d bytes, xrefs: 1E8C7CE7
Class, xrefs: 1E8C7DD2

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Err_FormatObject_ParseTupleU_object@@Y__@@@
String ID: Class$LastWriteTime$MaxClassLen$MaxSubKeyLen$MaxValueLen$MaxValueNameLen$O:RegQueryInfoKeyW$RegQueryInfoKeyW$Reserved$SubKeys$Unable to allocate %d bytes$Unable to allocate %d bytes$Values$cbSecurityDescriptor${s:N,s:O,s:k,s:k,s:k,s:k,s:k,s:k,s:k,s:N}
API String ID: 274238381-1446190885
Opcode ID: f7148374d31ccb5bb8de1875cddfbd1e4d64d273bf8a8d7315229dd23639e3f3
Instruction ID: 662718d085845bf8f0eed041ac1736266c3e259192c3984da04671fec559da94
Opcode Fuzzy Hash: f7148374d31ccb5bb8de1875cddfbd1e4d64d273bf8a8d7315229dd23639e3f3
Instruction Fuzzy Hash: 0C513DB2104301AFD304DB94DC84DEBB3E9EFC9615F444A1DF94AD3210E675EA498BA6

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C4A80 Relevance: 49.2, APIs: 21, Strings: 7, Instructions: 161threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,O:GetShortPathName,?), ref: 1E8C4A95
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,00000000,00000000,00000000), ref: 1E8C4AC9
PyEval_SaveThread.PYTHON27 ref: 1E8C4ADA
GetShortPathNameA.KERNEL32(?,?,00000105), ref: 1E8C4AF1
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C4AFA
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C4B05
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(GetShortPathName,00000000), ref: 1E8C4B18

Strings

GetShortPathNameW, xrefs: 1E8C4BB6
GetShortPathName, xrefs: 1E8C4B13
Short path name changed between calls, xrefs: 1E8C4C1C
O:GetShortPathName, xrefs: 1E8C4A8F
The pathname would be too big!!!, xrefs: 1E8C4B34
GetShortPathNameW, xrefs: 1E8C4C04
GetShortPathNameW, xrefs: 1E8C4C17

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_Object_String@@ThreadU_object@@$Arg_Error@@FreeNameParsePathRestoreSaveShortTupleWin_
String ID: GetShortPathName$GetShortPathNameW$GetShortPathNameW$GetShortPathNameW$O:GetShortPathName$Short path name changed between calls$The pathname would be too big!!!
API String ID: 3904419379-2788351225
Opcode ID: 563944333bc86684f6cc98ea2c43ea83b26193e953867e591ec0208d0ce7bc0f
Instruction ID: d07dbab827821a420eb10c67b48e37fe3b03978bc4099b52c525bfbe2ac54379
Opcode Fuzzy Hash: 563944333bc86684f6cc98ea2c43ea83b26193e953867e591ec0208d0ce7bc0f
Instruction Fuzzy Hash: E141F275900211AFE3109BADDC8DEDB7BE9FFC6351F404628F949D3210EA34D589CAA6

Uniqueness

Uniqueness Score: -1.00%

Function 032528B0 Relevance: 47.5, APIs: 24, Strings: 3, Instructions: 264COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,0325B4B0,?), ref: 032528D7
OpenProcessToken.ADVAPI32(00000000,00000008,?), ref: 03252910
CloseHandle.KERNEL32(00000000), ref: 03252928
CloseHandle.KERNEL32(?), ref: 03252937
73BB3B4E.MSVCR90(00000000), ref: 0325294C
73BB3B4E.MSVCR90(00000000), ref: 03252B47
73BB3B4E.MSVCR90(00000000), ref: 03252B51

Strings

OpenProcessToken, xrefs: 0325291A
LookupAccountSidW, xrefs: 03252A70
GetTokenInformation, xrefs: 032529C9

Memory Dump Source

Source File: 0000000F.00000002.1423676562.0000000003251000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03250000, based on PE: true

Associated: 0000000F.00000002.1423656216.0000000003250000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423775563.0000000003263000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3250000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: CloseHandle$Arg_OpenParseProcessTokenTuple
String ID: GetTokenInformation$LookupAccountSidW$OpenProcessToken
API String ID: 1358469895-966322916
Opcode ID: d689c4394a5f33957f8fadec9d7fa1da68f8753a5e8bbdbec070a540ea706cb4
Instruction ID: 7e0c44590bbd4fc4bdfc3563b24a98554ed6c1179c6ee0ed998088c090b04853
Opcode Fuzzy Hash: d689c4394a5f33957f8fadec9d7fa1da68f8753a5e8bbdbec070a540ea706cb4
Instruction Fuzzy Hash: D281A771514306DBC710EF64AC88A6B77ACAF84624F194928FC45D7284E774EB85CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C4420 Relevance: 47.4, APIs: 25, Strings: 2, Instructions: 195COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,OOO|O,?,?,?,?), ref: 1E8C4467
PyInt_AsLong.PYTHON27(?), ref: 1E8C4484
PyErr_Occurred.PYTHON27 ref: 1E8C449E
PyErr_Clear.PYTHON27 ref: 1E8C44AE
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,?,00000001,00000000), ref: 1E8C44BF
PyErr_Clear.PYTHON27 ref: 1E8C44C8
PyErr_SetString.PYTHON27(?,Default value must be a string or int), ref: 1E8C44D7

Strings

Default value must be a string or int, xrefs: 1E8C44D1
OOO|O, xrefs: 1E8C444E

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Err_$Clear$Arg_Int_LongObject_OccurredParseStringString@@TupleU_object@@
String ID: Default value must be a string or int$OOO|O
API String ID: 314853312-3533590036
Opcode ID: 0c630ff95b386399c63bcc1be2bcdf483acd4842cf2beacb50568fa6e1c1b080
Instruction ID: 866c6d57171c27d6dae183ee5ffcdf551c87006d0c6f6c3732bb3b9c1619fe65
Opcode Fuzzy Hash: 0c630ff95b386399c63bcc1be2bcdf483acd4842cf2beacb50568fa6e1c1b080
Instruction Fuzzy Hash: 15516172504311AFE300DBA9CC88CAB77E9EFC9714F004A1DF999C3250E635E985CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C55D0 Relevance: 45.7, APIs: 19, Strings: 7, Instructions: 180COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1E8C55EF
PyTuple_Size.PYTHON27(?,?,?,?,OO:SetSysColors,?,?), ref: 1E8C562E
PyTuple_Size.PYTHON27(?,?,?,?,OO:SetSysColors,?,?), ref: 1E8C5637
PyErr_Format.PYTHON27(?,SetSysColors: Unable to allocate array of %d ints,00000000,?,?,?,?,OO:SetSysColors,?,?), ref: 1E8C5672

Strings

SetSysColors: Arguments must be equal length tuples of ints, xrefs: 1E8C57C9
SetSysColors: Unable to allocate array of %d ints, xrefs: 1E8C566C
SetSysColors: Unable to allocate array of %d COLORREF's, xrefs: 1E8C569F
RGB value must be an int, xrefs: 1E8C57A6
OO:SetSysColors, xrefs: 1E8C55E1
Color element must be an int, xrefs: 1E8C575F
SetSysColors, xrefs: 1E8C5742

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: SizeTuple_$Arg_Err_FormatParseTuple
String ID: Color element must be an int$OO:SetSysColors$RGB value must be an int$SetSysColors$SetSysColors: Arguments must be equal length tuples of ints$SetSysColors: Unable to allocate array of %d COLORREF's$SetSysColors: Unable to allocate array of %d ints
API String ID: 1720882371-50870979
Opcode ID: 3b02fabd3a1577af96772786c9eba540fda36b64e5fd2993400b88cb223379ef
Instruction ID: ca18ab362921ee1c0bb8cb6bb856d94585df45f2b3c165249c0ed05c6bd143ab
Opcode Fuzzy Hash: 3b02fabd3a1577af96772786c9eba540fda36b64e5fd2993400b88cb223379ef
Instruction Fuzzy Hash: 5151BE74600312AFE700DF68CCC89DBB7E9FF86658F144629EC4993350E731E5968BA2

Uniqueness

Uniqueness Score: -1.00%

Function 1ECB36F0 Relevance: 43.9, APIs: 21, Strings: 4, Instructions: 189COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON27(?,ChangeServiceConfig2 is not available on this operating system), ref: 1ECB3709
PyArg_ParseTuple.PYTHON27(?,OlO:ChangeServiceConfig2,?,?,?), ref: 1ECB3731
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?), ref: 1ECB3748

Strings

OlO:ChangeServiceConfig2, xrefs: 1ECB372B
Info type %d is not supported, xrefs: 1ECB3929
ChangeServiceConfig2 is not available on this operating system, xrefs: 1ECB3703
ChangeServiceConfig2, xrefs: 1ECB38FD

Memory Dump Source

Source File: 0000000F.00000002.1435001879.000000001ECB1000.00000040.00000001.01000000.00000011.sdmp, Offset: 1ECB0000, based on PE: true

Associated: 0000000F.00000002.1434980425.000000001ECB0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBA000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBD000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435097428.000000001ECBF000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435120797.000000001ECC0000.00000004.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ecb0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Err_Object_ParseStringTupleU_object@@
String ID: ChangeServiceConfig2$ChangeServiceConfig2 is not available on this operating system$Info type %d is not supported$OlO:ChangeServiceConfig2
API String ID: 2332810667-3635990688
Opcode ID: 636e29c074808a2cb512101a2e0b860a16d74a1bfda32313cb535fc9508af3f9
Instruction ID: ce227abd864c7cdfaada8492be9b387477a6409cfe99a409780f9795e0c71a66
Opcode Fuzzy Hash: 636e29c074808a2cb512101a2e0b860a16d74a1bfda32313cb535fc9508af3f9
Instruction Fuzzy Hash: 53618DB5904352AFD704DF68CD889AB77A8FF88785F044A5CF89583241E771E948CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1ECB4150 Relevance: 40.5, APIs: 22, Strings: 1, Instructions: 246COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,OOOOOOOOOiOOO:CreateService,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1ECB41F2
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?), ref: 1ECB4210
?PyWinObject_AsWCHAR@@YAHPAU_object@@PAPA_WHPAK@Z.PYWINTYPES27(?,?,00000000,00000000), ref: 1ECB4230
?PyWinObject_AsWCHAR@@YAHPAU_object@@PAPA_WHPAK@Z.PYWINTYPES27(?,?,00000000,00000000), ref: 1ECB4245

Strings

OOOOOOOOOiOOO:CreateService, xrefs: 1ECB419E

Memory Dump Source

Source File: 0000000F.00000002.1435001879.000000001ECB1000.00000040.00000001.01000000.00000011.sdmp, Offset: 1ECB0000, based on PE: true

Associated: 0000000F.00000002.1434980425.000000001ECB0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBA000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBD000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435097428.000000001ECBF000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435120797.000000001ECC0000.00000004.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ecb0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_U_object@@$Arg_ParseTuple
String ID: OOOOOOOOOiOOO:CreateService
API String ID: 1248562531-1971915303
Opcode ID: 47c2ff375f4d2a4faaf21d641130cf0add2c35821982f0a058c273d6334e5537
Instruction ID: 4633c31f1e1b539ef9f264d592755276aae228a5ae6146154070326aa6674a84
Opcode Fuzzy Hash: 47c2ff375f4d2a4faaf21d641130cf0add2c35821982f0a058c273d6334e5537
Instruction Fuzzy Hash: 66811BB2518351AFD300DBA8CC90A9FF7EDBFC8654F044A1EFA95C3254E671D9048BA2

Uniqueness

Uniqueness Score: -1.00%

Function 1E8CC020 Relevance: 38.8, APIs: 14, Strings: 8, Instructions: 283COMMON

Download Yara Rule

APIs

PyString_AsString.PYTHON27(?), ref: 1E8CC029
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,?,00000000,?), ref: 1E8CC08D
PyErr_Format.PYTHON27(?,DeviceName must be a string of length %d or less,00000020), ref: 1E8CC0B2
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?,?,DeviceName must be a string of length %d or less,00000020), ref: 1E8CC0BD

Strings

DeviceKey, xrefs: 1E8CC246
DeviceKey must be a string of length %d or less, xrefs: 1E8CC2AC
DeviceName must be a string of length %d or less, xrefs: 1E8CC0AC
DeviceID, xrefs: 1E8CC1A8
DeviceName, xrefs: 1E8CC046
DeviceID must be a string of length %d or less, xrefs: 1E8CC20B
DeviceString, xrefs: 1E8CC10D
DeviceString must be a string of length %d or less, xrefs: 1E8CC170

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_String@@$Err_FormatFreeStringString_U_object@@
String ID: DeviceID$DeviceID must be a string of length %d or less$DeviceKey$DeviceKey must be a string of length %d or less$DeviceName$DeviceName must be a string of length %d or less$DeviceString$DeviceString must be a string of length %d or less
API String ID: 1691780610-851127861
Opcode ID: e7d362bbee63d23e9cb31101050fd120032209054b2c46cafae86f6d8d420e83
Instruction ID: 57839b9d2b3b03c60261ac5d534e8de085662155be3af66b6b6f98416df89dce
Opcode Fuzzy Hash: e7d362bbee63d23e9cb31101050fd120032209054b2c46cafae86f6d8d420e83
Instruction Fuzzy Hash: 6F9148326142425FD308DF389C94AEB77AAAFC3624F484B5DF899972C1E731E409C792

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C8FE0 Relevance: 38.7, APIs: 19, Strings: 3, Instructions: 175COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,OOO|O:WriteProfileVal,?,?,?,?), ref: 1E8C9021
PyInt_AsLong.PYTHON27(?), ref: 1E8C903B
PyErr_Occurred.PYTHON27 ref: 1E8C9055
PyErr_Clear.PYTHON27 ref: 1E8C9065
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,?,00000001,00000000), ref: 1E8C9076
PyErr_Clear.PYTHON27 ref: 1E8C907F
PyErr_SetString.PYTHON27(?,Value must be a string or int), ref: 1E8C908E

Strings

Value must be a string or int, xrefs: 1E8C9088
OOO|O:WriteProfileVal, xrefs: 1E8C9008
Write[Private]ProfileString, xrefs: 1E8C9150

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Err_$Clear$Arg_Int_LongObject_OccurredParseStringString@@TupleU_object@@
String ID: OOO|O:WriteProfileVal$Value must be a string or int$Write[Private]ProfileString
API String ID: 314853312-3239610536
Opcode ID: 9bd543fb0bb2693b964fb08c13214587cd983dcca678592682d8ceddf79342d1
Instruction ID: c5a87d8024d727e32bf20f6b3a51110f7dc20915d0f630dff585575a9b1fe9f0
Opcode Fuzzy Hash: 9bd543fb0bb2693b964fb08c13214587cd983dcca678592682d8ceddf79342d1
Instruction Fuzzy Hash: 8F517FB2504305AFD300DFA5DC88C9BB7E9FFC9254F444A5EF949C3250E636E9498BA2

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C6CD0 Relevance: 37.0, APIs: 15, Strings: 6, Instructions: 203registryCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,O:RegEnumKeyExW,?), ref: 1E8C6CED
?PyWinObject_AsHKEY@@YAHPAU_object@@PAPAUHKEY__@@@Z.PYWINTYPES27(?,?), ref: 1E8C6D0B
RegQueryInfoKeyA.ADVAPI32(?,00000000,00000000,00000000,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 1E8C6D34
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(RegEnumKeyExW:RegQueryInfoKey,00000000), ref: 1E8C6D44

Strings

RegEnumKeyExW, xrefs: 1E8C6EA6
RegEnumKeyExW: Unable to allocate %d bytes, xrefs: 1E8C6D7F
RegEnumKeyExW:RegQueryInfoKey, xrefs: 1E8C6D3F
NiNN, xrefs: 1E8C6E64
O:RegEnumKeyExW, xrefs: 1E8C6CDF
RegEnumKeyExW: Unable to allocate %d bytes, xrefs: 1E8C6DBE

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: U_object@@$Arg_Error@@InfoObject_ParseQueryTupleWin_Y__@@@
String ID: NiNN$O:RegEnumKeyExW$RegEnumKeyExW$RegEnumKeyExW: Unable to allocate %d bytes$RegEnumKeyExW: Unable to allocate %d bytes$RegEnumKeyExW:RegQueryInfoKey
API String ID: 1520217418-704844618
Opcode ID: e5026f728197450dbd1f8ece34f7a60e625618ad7478c080a045ac77d56d35ed
Instruction ID: 203f10f3e30f06ca2bd27b151b061ca228ac92a8f133e8578242330bfe9de6d4
Opcode Fuzzy Hash: e5026f728197450dbd1f8ece34f7a60e625618ad7478c080a045ac77d56d35ed
Instruction Fuzzy Hash: EF514AB1504315AFD300DF64DC88DABB7E9FBC5658F144A2DF94A87240E731E94A8BA2

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C6AA0 Relevance: 37.0, APIs: 15, Strings: 6, Instructions: 201registryCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,O:RegEnumKeyEx,?), ref: 1E8C6AC1
?PyWinObject_AsHKEY@@YAHPAU_object@@PAPAUHKEY__@@@Z.PYWINTYPES27(?,?), ref: 1E8C6ADF
RegQueryInfoKeyA.ADVAPI32(?,00000000,00000000,00000000,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 1E8C6B08
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(RegEnumKeyEx:RegQueryInfoKey,00000000), ref: 1E8C6B18

Strings

RegEnumKeyEx: Unable to allocate %d bytes, xrefs: 1E8C6B4F
RegEnumKeyEx, xrefs: 1E8C6C76
NiNN, xrefs: 1E8C6C34
O:RegEnumKeyEx, xrefs: 1E8C6AAF
RegEnumKeyEx: Unable to allocate %d bytes, xrefs: 1E8C6B8B
RegEnumKeyEx:RegQueryInfoKey, xrefs: 1E8C6B13

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: U_object@@$Arg_Error@@InfoObject_ParseQueryTupleWin_Y__@@@
String ID: NiNN$O:RegEnumKeyEx$RegEnumKeyEx$RegEnumKeyEx: Unable to allocate %d bytes$RegEnumKeyEx: Unable to allocate %d bytes$RegEnumKeyEx:RegQueryInfoKey
API String ID: 1520217418-2384111254
Opcode ID: ee31b4cc67bc9afb9ee70da214bfdb31a56435eac02c5bfadcc92d4e3a19b566
Instruction ID: 089519cba3826a4f619de2f5f5c6f83fe1b23fee422071a5a33a251ff1b42960
Opcode Fuzzy Hash: ee31b4cc67bc9afb9ee70da214bfdb31a56435eac02c5bfadcc92d4e3a19b566
Instruction Fuzzy Hash: 7F517AB1514305AFD300DF64DC88DAB77E9FBC9658F044A2DF84A83340D731EA4A8BA2

Uniqueness

Uniqueness Score: -1.00%

Function 03254590 Relevance: 35.3, APIs: 14, Strings: 6, Instructions: 281COMMON

Download Yara Rule

APIs

PyList_New.PYTHON27(00000000), ref: 032545AF
74E524A0.WTSAPI32(?,00000000,00000000,00000001,?,?), ref: 03254619
74E524A0.WTSAPI32(?,00000000,00000000,00000001,?,?), ref: 03254627
Py_BuildValue.PYTHON27(0325B7B4,?), ref: 032546BD
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 03254730

Part of subcall function 03251090: GetLastError.KERNEL32 ref: 032510B2
Part of subcall function 03251090: PyErr_SetFromWindowsErrWithFilename.PYTHON27(00000000), ref: 032510B9

74E524A0.WTSAPI32(?,?), ref: 0325489A
74E524A0.WTSAPI32(?,?), ref: 032548A8
74E524A0.WTSAPI32(?,?), ref: 032548B6

Strings

%u.%u.%u.%u, xrefs: 032546A1
WTSQuerySessionInformation, xrefs: 03254828
WinStationQueryInformationW, xrefs: 0325482F
OOd, xrefs: 03254776
WTSQuerySessionInformationW, xrefs: 03254821
WTSEnumerateSessions, xrefs: 032545DD

Memory Dump Source

Source File: 0000000F.00000002.1423676562.0000000003251000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03250000, based on PE: true

Associated: 0000000F.00000002.1423656216.0000000003250000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423775563.0000000003263000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3250000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: E524$BuildErr_ErrorFilenameFromLastList_Unothrow_t@std@@@ValueWindowsWith__ehfuncinfo$??2@
String ID: %u.%u.%u.%u$OOd$WTSEnumerateSessions$WTSQuerySessionInformation$WTSQuerySessionInformationW$WinStationQueryInformationW
API String ID: 991490466-3117540829
Opcode ID: c07a94973cc6d901b71bdded73a782787b5e56d06f5eb1cf8d2f822a7f3d3111
Instruction ID: 32fd035cc970754449b5a03585089e35c93d5d018f906f12ca1ef48faac9797a
Opcode Fuzzy Hash: c07a94973cc6d901b71bdded73a782787b5e56d06f5eb1cf8d2f822a7f3d3111
Instruction Fuzzy Hash: ED91B072614341AFD750EB65DC48E6BF7E8AB84614F08861CFD549B280E7B4EBC1CB52

Uniqueness

Uniqueness Score: -1.00%

Function 1ECB2F00 Relevance: 35.1, APIs: 15, Strings: 5, Instructions: 146COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,Ol:QueryServiceObjectSecurity,?,?), ref: 1ECB2F22
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?), ref: 1ECB2F40
PyErr_Format.PYTHON27(00000000,QueryServiceObjectSecurity: unable to allocate %d bytes,00000014), ref: 1ECB2F72

Strings

QueryServiceObjectSecurity: unable to allocate %d bytes, xrefs: 1ECB2F6C
Ol:QueryServiceObjectSecurity, xrefs: 1ECB2F14
QueryServiceObjectSecurity, xrefs: 1ECB3014
QueryServiceObjectSecurity, xrefs: 1ECB3035
QueryServiceObjectSecurity: unable to reallocatate %d bytes, xrefs: 1ECB2FD7

Memory Dump Source

Source File: 0000000F.00000002.1435001879.000000001ECB1000.00000040.00000001.01000000.00000011.sdmp, Offset: 1ECB0000, based on PE: true

Associated: 0000000F.00000002.1434980425.000000001ECB0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBA000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBD000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435097428.000000001ECBF000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435120797.000000001ECC0000.00000004.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ecb0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Err_FormatObject_ParseTupleU_object@@
String ID: Ol:QueryServiceObjectSecurity$QueryServiceObjectSecurity$QueryServiceObjectSecurity$QueryServiceObjectSecurity: unable to allocate %d bytes$QueryServiceObjectSecurity: unable to reallocatate %d bytes
API String ID: 3520361810-1520417761
Opcode ID: 51753f554c8c1c5b12c60c99f8758190f47ffc878a52938b9efcb74aefa555da
Instruction ID: e13ea62ceb7dcc43eba3d7de1cfc58321f38f5d1a9fe7efb78d9d1278ff055f6
Opcode Fuzzy Hash: 51753f554c8c1c5b12c60c99f8758190f47ffc878a52938b9efcb74aefa555da
Instruction Fuzzy Hash: BA41D4B26142129BC304DF69ECC0C9BB7A9FF84AA5F440969FE45C3201E635E91986B7

Uniqueness

Uniqueness Score: -1.00%

Function 032577E0 Relevance: 35.1, APIs: 17, Strings: 3, Instructions: 126serviceCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,0325D434,?), ref: 032577F9
QueryServiceStatusEx.ADVAPI32(00000000,00000000,00000000,00000000,?), ref: 03257838
GetLastError.KERNEL32 ref: 03257840
CloseServiceHandle.ADVAPI32(00000000), ref: 0325784A
Py_BuildValue.PYTHON27(0325D438,0325D824), ref: 0325785A

Strings

(sk), xrefs: 032578D5
QueryServiceStatusEx, xrefs: 032578B9
QueryServiceStatusEx, xrefs: 03257878

Memory Dump Source

Source File: 0000000F.00000002.1423676562.0000000003251000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03250000, based on PE: true

Associated: 0000000F.00000002.1423656216.0000000003250000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423775563.0000000003263000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3250000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Service$Arg_BuildCloseErrorHandleLastParseQueryStatusTupleValue
String ID: (sk)$QueryServiceStatusEx$QueryServiceStatusEx
API String ID: 740867558-3645801062
Opcode ID: 283ad0129f0f029c2d985e5a4b805e0aaac3fbf98d99d04eb7b40445714499b1
Instruction ID: 10ce72d92c3446c455b8ecf529344d45f4ef8e9f41a3d150a424a9d83e4d5df0
Opcode Fuzzy Hash: 283ad0129f0f029c2d985e5a4b805e0aaac3fbf98d99d04eb7b40445714499b1
Instruction Fuzzy Hash: 9931F232661312ABCA10FB69BC8DA7F7B6CEB81A55F044428FD05C6104E771D784C6B2

Uniqueness

Uniqueness Score: -1.00%

Function 03251580 Relevance: 35.1, APIs: 15, Strings: 5, Instructions: 121COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,0325B160,?,?), ref: 03251597

Strings

WaitForSingleObject, xrefs: 03251628
WaitForSingleObject() -> WAIT_ABANDONED, xrefs: 03251664
GetExitCodeProcess, xrefs: 032516A3
WaitForSingleObject() returned WAIT_ABANDONED, xrefs: 03251674
WaitForSingleObject() returned WAIT_TIMEOUT, xrefs: 0325163D

Memory Dump Source

Source File: 0000000F.00000002.1423676562.0000000003251000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03250000, based on PE: true

Associated: 0000000F.00000002.1423656216.0000000003250000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423775563.0000000003263000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3250000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_ParseTuple
String ID: GetExitCodeProcess$WaitForSingleObject$WaitForSingleObject() -> WAIT_ABANDONED$WaitForSingleObject() returned WAIT_ABANDONED$WaitForSingleObject() returned WAIT_TIMEOUT
API String ID: 3371842430-19038427
Opcode ID: 3fdc988be159b0ce71dfff9b63ebcab71d0809451988f28f7ab8e9e672b92fc2
Instruction ID: 982be848ac4faa195b705666faee0f5cb9ff52f4819dee102811aaf8ede3f316
Opcode Fuzzy Hash: 3fdc988be159b0ce71dfff9b63ebcab71d0809451988f28f7ab8e9e672b92fc2
Instruction Fuzzy Hash: 93318076611311AFDB00FB68BC8DAAF3358AB44A15F48C460FD0AC1645E735A7E88A93

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C9DD0 Relevance: 35.1, APIs: 15, Strings: 5, Instructions: 118COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,OOO|H:LoadResource,?,?,?,?), ref: 1E8C9E00
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?), ref: 1E8C9E1D
?PyWinObject_AsResourceIdA@@YAHPAU_object@@PAPADH@Z.PYWINTYPES27(?,?,00000000), ref: 1E8C9E3F
?PyWinObject_AsResourceIdA@@YAHPAU_object@@PAPADH@Z.PYWINTYPES27(?,?,00000000), ref: 1E8C9E57
FindResourceExA.KERNEL32(?,?,?,?), ref: 1E8C9E78
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(FindResourceEx,00000000), ref: 1E8C9E8A
?PyWinObject_FreeResourceId@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C9F06
?PyWinObject_FreeResourceId@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C9F0D

Strings

SizeofResource, xrefs: 1E8C9EA9
OOO|H:LoadResource, xrefs: 1E8C9DEE
LockResource, xrefs: 1E8C9EE0
FindResourceEx, xrefs: 1E8C9E85
LoadResource, xrefs: 1E8C9EC7

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_Resource$U_object@@$FreeId@@$Arg_Error@@FindParseTupleWin_
String ID: FindResourceEx$LoadResource$LockResource$OOO|H:LoadResource$SizeofResource
API String ID: 3720592045-4237740394
Opcode ID: ccdf75f54e6ebd645b8ea34059a997779c0bc2fe34197433e032d3ac8ab5ae6d
Instruction ID: 8909144d7fb4481530d47d56e535d535b342abd9dbd638d9673b933075a04785
Opcode Fuzzy Hash: ccdf75f54e6ebd645b8ea34059a997779c0bc2fe34197433e032d3ac8ab5ae6d
Instruction Fuzzy Hash: 81314DB1504251ABD300DFA9CDC8CEB77EDBA89245F088A5EF98DD3200E674D948CB72

Uniqueness

Uniqueness Score: -1.00%

Function 1ECB2D60 Relevance: 35.1, APIs: 7, Strings: 13, Instructions: 79COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON27(?,QueryServiceStatusEx does not exist on this platform), ref: 1ECB2D79
PyArg_ParseTuple.PYTHON27(?,O:QueryServiceStatusEx), ref: 1ECB2D96
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?), ref: 1ECB2DAC
QueryServiceStatusEx.ADVAPI32(?,00000000,?,00000024,?), ref: 1ECB2DCC
GetLastError.KERNEL32 ref: 1ECB2DD6
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(QueryServiceStatusEx,00000000), ref: 1ECB2DE2

Strings

ProcessId, xrefs: 1ECB2E0A
CheckPoint, xrefs: 1ECB2E1E
QueryServiceStatusEx, xrefs: 1ECB2DDD
Win32ExitCode, xrefs: 1ECB2E32
ServiceFlags, xrefs: 1ECB2E00
ServiceType, xrefs: 1ECB2E44
WaitHint, xrefs: 1ECB2E14
CurrentState, xrefs: 1ECB2E3E
QueryServiceStatusEx does not exist on this platform, xrefs: 1ECB2D73
ControlsAccepted, xrefs: 1ECB2E38
{s:l,s:l,s:l,s:l,s:l,s:l,s:l,s:l,s:l}, xrefs: 1ECB2E49
ServiceSpecificExitCode, xrefs: 1ECB2E28
O:QueryServiceStatusEx, xrefs: 1ECB2D90

Memory Dump Source

Source File: 0000000F.00000002.1435001879.000000001ECB1000.00000040.00000001.01000000.00000011.sdmp, Offset: 1ECB0000, based on PE: true

Associated: 0000000F.00000002.1434980425.000000001ECB0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBA000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBD000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435097428.000000001ECBF000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435120797.000000001ECC0000.00000004.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ecb0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: U_object@@$Arg_Err_ErrorError@@LastObject_ParseQueryServiceStatusStringTupleWin_
String ID: CheckPoint$ControlsAccepted$CurrentState$O:QueryServiceStatusEx$ProcessId$QueryServiceStatusEx$QueryServiceStatusEx does not exist on this platform$ServiceFlags$ServiceSpecificExitCode$ServiceType$WaitHint$Win32ExitCode${s:l,s:l,s:l,s:l,s:l,s:l,s:l,s:l,s:l}
API String ID: 2355156773-3860594903
Opcode ID: 76ce95d179aa8d0a5e587173d55e24bc740cf98c92af64f24b81408549260ae4
Instruction ID: 4cc53797019e6fccc0936ff5b4ea0096cdfe0cbbb2e6483989921205617912dd
Opcode Fuzzy Hash: 76ce95d179aa8d0a5e587173d55e24bc740cf98c92af64f24b81408549260ae4
Instruction Fuzzy Hash: 4F217F71214201BFD704DB64CE85EABB7F9EF88B85F404A4CFD8992355E630EA14CB66

Uniqueness

Uniqueness Score: -1.00%

Function 1ECB43D0 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 211COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,OOOOOOiOOOO:ChangeServiceConfig,?,?,?,?,?,?,?,?,?,?,?), ref: 1ECB4453
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?), ref: 1ECB4471
PyLong_AsUnsignedLongMask.PYTHON27(?), ref: 1ECB448A
PyErr_Occurred.PYTHON27 ref: 1ECB4498

Strings

OOOOOOiOOOO:ChangeServiceConfig, xrefs: 1ECB4411

Memory Dump Source

Source File: 0000000F.00000002.1435001879.000000001ECB1000.00000040.00000001.01000000.00000011.sdmp, Offset: 1ECB0000, based on PE: true

Associated: 0000000F.00000002.1434980425.000000001ECB0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBA000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBD000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435097428.000000001ECBF000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435120797.000000001ECC0000.00000004.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ecb0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Err_LongLong_MaskObject_OccurredParseTupleU_object@@Unsigned
String ID: OOOOOOiOOOO:ChangeServiceConfig
API String ID: 1011514818-1089899641
Opcode ID: 93ad06c4cac954990771ceb17ea047b9c429a1fd918720c4674486c726274f46
Instruction ID: d369397cf1d25eac13f5f38c53e974d98b083cd9cc883de5d54f8bd953deaa40
Opcode Fuzzy Hash: 93ad06c4cac954990771ceb17ea047b9c429a1fd918720c4674486c726274f46
Instruction Fuzzy Hash: B3612BB2608344AFD300DBA9CC90DABF7F9BFC4650F444A1EFA95C3254E671E9058B92

Uniqueness

Uniqueness Score: -1.00%

Function 1E7D21A0 Relevance: 33.4, APIs: 16, Strings: 3, Instructions: 171COMMON

Download Yara Rule

APIs

SetServiceStatus.ADVAPI32(?,1E7D6228), ref: 1E7D21D6
PyGILState_Ensure.PYTHON27 ref: 1E7D21F4
Py_BuildValue.PYTHON27((llN),?,?,6D07CB15), ref: 1E7D2243
Py_BuildValue.PYTHON27((i),?), ref: 1E7D225C
Py_BuildValue.PYTHON27((llN),?,?,00000000), ref: 1E7D2269
PyObject_CallObject.PYTHON27(?,00000000), ref: 1E7D22F3
PyInt_AsUnsignedLongMask.PYTHON27(00000000), ref: 1E7D2333
PyErr_Occurred.PYTHON27 ref: 1E7D2343
PyGILState_Release.PYTHON27(?), ref: 1E7D2375

Strings

(i), xrefs: 1E7D2257
(llN), xrefs: 1E7D223E, 1E7D2264, 1E7D22A8, 1E7D22C7
(l), xrefs: 1E7D22DA

Memory Dump Source

Source File: 0000000F.00000002.1434219289.000000001E7D1000.00000040.00000001.01000000.00000015.sdmp, Offset: 1E7D0000, based on PE: true

Associated: 0000000F.00000002.1434197225.000000001E7D0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000F.00000002.1434219289.000000001E7DA000.00000040.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000F.00000002.1434284534.000000001E7DB000.00000080.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000F.00000002.1434310614.000000001E7DD000.00000004.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e7d0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: BuildValue$State_$CallEnsureErr_Int_LongMaskObjectObject_OccurredReleaseServiceStatusUnsigned
String ID: (i)$(l)$(llN)
API String ID: 353108861-2099564678
Opcode ID: c22da60e3abb207b7781e4e564e769513ff537d039e32d990128fd4e91b29f88
Instruction ID: 472300e13a080c01584ac1e1882b629ff7e6bc43829210bdd771ab312945060e
Opcode Fuzzy Hash: c22da60e3abb207b7781e4e564e769513ff537d039e32d990128fd4e91b29f88
Instruction Fuzzy Hash: F451F971900351ABF2009B58DC849AB77ACFB89734F064719F89593760E736A81ACFA2

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C2EC0 Relevance: 33.3, APIs: 14, Strings: 5, Instructions: 99threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,:GetDomainName), ref: 1E8C2ED0
GetCurrentThread.KERNEL32 ref: 1E8C2EF4
OpenThreadToken.ADVAPI32(00000000), ref: 1E8C2EFB
GetLastError.KERNEL32 ref: 1E8C2F05
GetCurrentProcess.KERNEL32(00000008), ref: 1E8C2F18
OpenProcessToken.ADVAPI32(00000000), ref: 1E8C2F1F
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(OpenProcessToken,00000000), ref: 1E8C2F2F

Strings

:GetDomainName, xrefs: 1E8C2ECA
LookupAccountSid, xrefs: 1E8C2FDD
OpenThreadToken, xrefs: 1E8C2F41
GetTokenInformation, xrefs: 1E8C2F8A
OpenProcessToken, xrefs: 1E8C2F2A

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken$Arg_ErrorError@@LastParseTupleU_object@@Win_
String ID: :GetDomainName$GetTokenInformation$LookupAccountSid$OpenProcessToken$OpenThreadToken
API String ID: 523223422-430469702
Opcode ID: c786ee46c3823ce1ecae8b8924c1ad02153a4b773f7e1407ca050f1d828ea19b
Instruction ID: cec89cd6ca320d9d74611b11b2082b91bc7462ed5c4f7b20a2c515c98e8d94b3
Opcode Fuzzy Hash: c786ee46c3823ce1ecae8b8924c1ad02153a4b773f7e1407ca050f1d828ea19b
Instruction Fuzzy Hash: 5B31A4F15143116BF720CB54DC8DBDA76E8BB86B05F448928F65DC3280E734C5888B76

Uniqueness

Uniqueness Score: -1.00%

Function 03255390 Relevance: 31.7, APIs: 15, Strings: 3, Instructions: 234COMMON

Download Yara Rule

APIs

PyDict_New.PYTHON27 ref: 0325539D
PyErr_NoMemory.PYTHON27 ref: 032553E9
73BB3B4E.MSVCR90(?), ref: 03255620
73BB3B4E.MSVCR90(00000000), ref: 0325562E

Strings

GetIfTable() syscall failed, xrefs: 0325544C
(Oikk), xrefs: 03255530
%wS, xrefs: 03255484

Memory Dump Source

Source File: 0000000F.00000002.1423676562.0000000003251000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03250000, based on PE: true

Associated: 0000000F.00000002.1423656216.0000000003250000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423775563.0000000003263000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3250000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Dict_Err_Memory
String ID: %wS$(Oikk)$GetIfTable() syscall failed
API String ID: 197259469-3214263222
Opcode ID: 87b657e606950f092ab0db904801bfdf3a43e1703aec059fd92c654fb2291318
Instruction ID: b5bd1fb373a3a243e96713950e964ddf4e1e24e6f898b904ada0634d011c6ff3
Opcode Fuzzy Hash: 87b657e606950f092ab0db904801bfdf3a43e1703aec059fd92c654fb2291318
Instruction Fuzzy Hash: A281F2B15203029BC710DF54EC88A6B73E9FF85324F284628FD5A87245D774EB85CB92

Uniqueness

Uniqueness Score: -1.00%

Function 6CBC2420 Relevance: 31.7, APIs: 10, Strings: 8, Instructions: 207COMMON

Download Yara Rule

APIs

PyType_Ready.PYTHON27(6CCAFFF8), ref: 6CBC2439
Py_InitModule4.PYTHON27(_hashlib,6CCB0248,00000000,00000000,000003F5), ref: 6CBC245E

Part of subcall function 6CBC2120: PyFrozenSet_New.PYTHON27(00000000,?,6CBC2476), ref: 6CBC2128

PyModule_AddObject.PYTHON27(00000000,openssl_md_meth_names,00000000), ref: 6CBC2485
PyString_FromString.PYTHON27(md5), ref: 6CBC24A9
PyString_FromString.PYTHON27(sha1), ref: 6CBC2512
PyString_FromString.PYTHON27(sha224), ref: 6CBC257B
PyString_FromString.PYTHON27(sha256), ref: 6CBC25E4
PyString_FromString.PYTHON27(sha384), ref: 6CBC264D
PyString_FromString.PYTHON27(sha512), ref: 6CBC26B6

Strings

md5, xrefs: 6CBC24A4, 6CBC24B8, 6CBC24D5
sha384, xrefs: 6CBC2648, 6CBC265C, 6CBC2679
sha512, xrefs: 6CBC26B1, 6CBC26C5, 6CBC26E2
sha1, xrefs: 6CBC250D, 6CBC2521, 6CBC253E
sha256, xrefs: 6CBC25DF, 6CBC25F3, 6CBC2610
openssl_md_meth_names, xrefs: 6CBC247F
sha224, xrefs: 6CBC2576, 6CBC258A, 6CBC25A7
_hashlib, xrefs: 6CBC2459

Memory Dump Source

Source File: 0000000F.00000002.1435325332.000000006CBC1000.00000040.00000001.01000000.0000000E.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 0000000F.00000002.1435141262.000000006CBC0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCAB000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCBE000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436271764.000000006CCC4000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436295892.000000006CCC6000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6cbc0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: FromStringString_$FrozenInitModule4Module_ObjectReadySet_Type_
String ID: _hashlib$md5$openssl_md_meth_names$sha1$sha224$sha256$sha384$sha512
API String ID: 2349188679-4083105893
Opcode ID: 24ac3c9cf65998405f706a2a9bf18e86329bc23ab0212bff441b0fd18b212710
Instruction ID: d83b3727629b75efad8e6f796a2a0db0352b0ec6de7d424764618e4a70a81ecc
Opcode Fuzzy Hash: 24ac3c9cf65998405f706a2a9bf18e86329bc23ab0212bff441b0fd18b212710
Instruction Fuzzy Hash: 277140B0B002528FD71C9F68E81965AB6F4FF05308F04867EE419CAB41EB75D884CBA7

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C63F0 Relevance: 31.7, APIs: 14, Strings: 4, Instructions: 172COMMON

Download Yara Rule

APIs

PyArg_ParseTupleAndKeywords.PYTHON27(?,?,OOk|OkOO:RegCreateKeyEx,1E8D7024,?,?,?,?,?,?,?), ref: 1E8C644A
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?), ref: 1E8C6468
PyErr_Format.PYTHON27(00000000,%s is not available on this platform,RegCreateKeyTransacted), ref: 1E8C6496

Strings

RegCreateKeyTransacted, xrefs: 1E8C648B
%s is not available on this platform, xrefs: 1E8C6490
OOk|OkOO:RegCreateKeyEx, xrefs: 1E8C6435
RegCreateKeyEx, xrefs: 1E8C6586

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Err_FormatKeywordsObject_ParseTupleU_object@@
String ID: %s is not available on this platform$OOk|OkOO:RegCreateKeyEx$RegCreateKeyEx$RegCreateKeyTransacted
API String ID: 1905867990-921574732
Opcode ID: 5270a35b58e3dfdc766ef352397476d1cefe16119fd617b17e9e7bee3b439746
Instruction ID: 350c97792ece29acdeb826aa7db6dddbb9f173b162a6ed54a0a1d9faa4857387
Opcode Fuzzy Hash: 5270a35b58e3dfdc766ef352397476d1cefe16119fd617b17e9e7bee3b439746
Instruction Fuzzy Hash: 995107B2518341AFD304CB58CD94DABB7E9FFC9608F144A1DF589C3240E631E949CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 032524C0 Relevance: 29.9, APIs: 13, Strings: 4, Instructions: 197threadCOMMON

Download Yara Rule

APIs

PyList_New.PYTHON27(00000000), ref: 032524F4
PyArg_ParseTuple.PYTHON27(?,0325B458,?), ref: 03252515
CloseHandle.KERNEL32(?), ref: 0325258E
CloseHandle.KERNEL32(?), ref: 0325259D
Thread32First.KERNEL32 ref: 032525BA

Part of subcall function 032510D0: PyObject_CallFunction.PYTHON27(?,(is),0000000D,00000000,0325D7E0), ref: 0325110A
Part of subcall function 032510D0: PyErr_SetObject.PYTHON27(00000000,00000000,?,(is),0000000D,00000000,0325D7E0), ref: 0325111C

Strings

Thread32First, xrefs: 032525C3
kdd, xrefs: 03252689
GetThreadTimes, xrefs: 032526EF
CreateToolhelp32Snapshot, xrefs: 03252567

Memory Dump Source

Source File: 0000000F.00000002.1423676562.0000000003251000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03250000, based on PE: true

Associated: 0000000F.00000002.1423656216.0000000003250000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423775563.0000000003263000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3250000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: CloseHandle$Arg_CallErr_FirstFunctionList_ObjectObject_ParseThread32Tuple
String ID: CreateToolhelp32Snapshot$GetThreadTimes$Thread32First$kdd
API String ID: 3534724291-1357220548
Opcode ID: d223b1c1a254df08b7fd1e83542b7ac3e00555925a4908028779a7ef57c189cc
Instruction ID: 6efd698e7a02065bd2f33d8b4ccff52c47636629d60c0886fbe08d327bd8867d
Opcode Fuzzy Hash: d223b1c1a254df08b7fd1e83542b7ac3e00555925a4908028779a7ef57c189cc
Instruction Fuzzy Hash: 5A61C472A14301DBC724EF64E858A6BB7E8EB85750F148E18FD55C2284E771DB81CB92

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C51B0 Relevance: 29.9, APIs: 13, Strings: 4, Instructions: 170COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,(iOOiOOi):SetTimeZoneInformation,?,?,?,?,?,?,?), ref: 1E8C51E9
?PyWinObject_AsWCHAR@@YAHPAU_object@@PAPA_WHPAK@Z.PYWINTYPES27(?,00000000,00000000,00000000), ref: 1E8C5212

Strings

Time zone names must be < 32 chars long, xrefs: 1E8C5253
SetTimeZoneInformation, xrefs: 1E8C5361
Time zone names must be < 32 chars long, xrefs: 1E8C52CF
(iOOiOOi):SetTimeZoneInformation, xrefs: 1E8C51E3

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Object_ParseTupleU_object@@
String ID: (iOOiOOi):SetTimeZoneInformation$SetTimeZoneInformation$Time zone names must be < 32 chars long$Time zone names must be < 32 chars long
API String ID: 71531768-1674137198
Opcode ID: b6a2a68e8cb20b9b3e9ff0aa10af51562eb87591f3cc8888342cad2f150d5dfd
Instruction ID: 3d1c8bb9f6ab3507ad6e95e30ea568b8388f9c47f1938b10207c314bdb640152
Opcode Fuzzy Hash: b6a2a68e8cb20b9b3e9ff0aa10af51562eb87591f3cc8888342cad2f150d5dfd
Instruction Fuzzy Hash: 3A51B376500212AFE7009B68DC85FDB73E9EFC9350F444A19FD49C7250E638E64ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C73C0 Relevance: 29.9, APIs: 13, Strings: 4, Instructions: 146registrythreadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,Oi:PyRegEnumValue,?,?), ref: 1E8C73DA
?PyWinObject_AsHKEY@@YAHPAU_object@@PAPAUHKEY__@@@Z.PYWINTYPES27(?,?), ref: 1E8C73F3
RegQueryInfoKeyA.ADVAPI32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 1E8C7422
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(RegQueryInfoKey,00000000), ref: 1E8C7432
__alloca_probe_16.LIBCMT ref: 1E8C7453
__alloca_probe_16.LIBCMT ref: 1E8C745C
PyEval_SaveThread.PYTHON27 ref: 1E8C7473
RegEnumValueA.ADVAPI32(?,?,?,?,00000000,?,?,?), ref: 1E8C7494
PyEval_RestoreThread.PYTHON27(?,?,?,00000000,?,?,?), ref: 1E8C74A0
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(PyRegEnumValue,00000000,?), ref: 1E8C74B3

Strings

PyRegEnumValue, xrefs: 1E8C74AE
Oi:PyRegEnumValue, xrefs: 1E8C73D4
RegQueryInfoKey, xrefs: 1E8C742D
NOi, xrefs: 1E8C74EB

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: U_object@@$Error@@Eval_ThreadWin___alloca_probe_16$Arg_EnumInfoObject_ParseQueryRestoreSaveTupleValueY__@@@
String ID: NOi$Oi:PyRegEnumValue$PyRegEnumValue$RegQueryInfoKey
API String ID: 1596361088-4198447784
Opcode ID: 003ba76e537e111e5478a75f3bc3de86e6704c1d2df93d58009ce453d705e44e
Instruction ID: 58a4952741fde5f485a66da1bcfa748129611d6944648a5e2366bd2a31f829d1
Opcode Fuzzy Hash: 003ba76e537e111e5478a75f3bc3de86e6704c1d2df93d58009ce453d705e44e
Instruction Fuzzy Hash: 5E41D876E00118AFDB10DBE8DD859EEB7B9EF49221F004255E909E3240DB31DA55C7E1

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C8C30 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 141threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,OOOOOi:ShellExecute,?,?,?,?,?,?), ref: 1E8C8C76
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?), ref: 1E8C8C94
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,?,00000001,00000000), ref: 1E8C8CB8
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,?,00000000,00000000), ref: 1E8C8CD1
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,?,00000001,00000000), ref: 1E8C8CEB
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,?,00000001,00000000), ref: 1E8C8D05
PyEval_SaveThread.PYTHON27 ref: 1E8C8D1F
ShellExecuteA.SHELL32(?,?,?,?,?,?), ref: 1E8C8D45
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C8D4E
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(ShellExecute,00000000), ref: 1E8C8D63
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C8D86
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C8D8D
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C8D94
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C8DA2

Strings

ShellExecute, xrefs: 1E8C8D5E
OOOOOi:ShellExecute, xrefs: 1E8C8C59

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_$String@@$U_object@@$Free$Eval_Thread$Arg_Error@@ExecuteParseRestoreSaveShellTupleWin_
String ID: OOOOOi:ShellExecute$ShellExecute
API String ID: 86544676-3224373903
Opcode ID: 5b5daf74092e52be2527da0e2e33d70288ec19bd96e034f1b12261fe1ba315cd
Instruction ID: c58441b899affe96471c5f85c3054cfa6bb5bf819111beb0179f2eb3a17248c1
Opcode Fuzzy Hash: 5b5daf74092e52be2527da0e2e33d70288ec19bd96e034f1b12261fe1ba315cd
Instruction Fuzzy Hash: 2F416CB2514341AFD300DB69CC84DABB7E9FFC9214F448A1DFA99C3244E631E549CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C6690 Relevance: 29.9, APIs: 11, Strings: 6, Instructions: 125COMMON

Download Yara Rule

APIs

PyArg_ParseTupleAndKeywords.PYTHON27(?,?,OO|kO:RegDeleteKeyEx,1E8D7044,?,?,?,?), ref: 1E8C66CF
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?), ref: 1E8C66ED
PyErr_Format.PYTHON27(?,%s is not available on this platform,RegDeleteKeyTransacted), ref: 1E8C671A

Strings

RegDeleteKeyEx, xrefs: 1E8C6738
%s is not available on this platform, xrefs: 1E8C673D
%s is not available on this platform, xrefs: 1E8C6714
RegDeleteKeyEx, xrefs: 1E8C67B5
OO|kO:RegDeleteKeyEx, xrefs: 1E8C66BE
RegDeleteKeyTransacted, xrefs: 1E8C670F

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Err_FormatKeywordsObject_ParseTupleU_object@@
String ID: %s is not available on this platform$%s is not available on this platform$OO|kO:RegDeleteKeyEx$RegDeleteKeyEx$RegDeleteKeyEx$RegDeleteKeyTransacted
API String ID: 1905867990-810132254
Opcode ID: 5f4f6a968b40c5003cac1cbd05ac4c847c841ee097f59cd0a6561d95e283f1e6
Instruction ID: 5b23a5a42907900050b26b9de9b4be83742e10d6a063a3e6f0ea04af8024e34c
Opcode Fuzzy Hash: 5f4f6a968b40c5003cac1cbd05ac4c847c841ee097f59cd0a6561d95e283f1e6
Instruction Fuzzy Hash: 354121B5514211AFD210DF68CC88DAB77E9FF85649F408A19F94DC3210E631E959CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1ECB2B30 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 123threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,O:QueryServiceConfig,?), ref: 1ECB2B42
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?), ref: 1ECB2B5F
PyEval_SaveThread.PYTHON27 ref: 1ECB2B76
QueryServiceConfigW.ADVAPI32(?,?,00000004,?), ref: 1ECB2B95
GetLastError.KERNEL32 ref: 1ECB2B99
QueryServiceConfigW.ADVAPI32(?,00000000,?,?), ref: 1ECB2BC6
PyEval_RestoreThread.PYTHON27(?), ref: 1ECB2BCF
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(QueryServiceConfig,00000000,00000000), ref: 1ECB2BE8

Strings

O:QueryServiceConfig, xrefs: 1ECB2B3C
QueryServiceConfig, xrefs: 1ECB2BE3
lllNNlNNN, xrefs: 1ECB2C44

Memory Dump Source

Source File: 0000000F.00000002.1435001879.000000001ECB1000.00000040.00000001.01000000.00000011.sdmp, Offset: 1ECB0000, based on PE: true

Associated: 0000000F.00000002.1434980425.000000001ECB0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBA000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBD000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435097428.000000001ECBF000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435120797.000000001ECC0000.00000004.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ecb0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: ConfigEval_QueryServiceThreadU_object@@$Arg_ErrorError@@LastObject_ParseRestoreSaveTupleWin_
String ID: O:QueryServiceConfig$QueryServiceConfig$lllNNlNNN
API String ID: 3520613867-2615480070
Opcode ID: 612422cf9f9e35291dde3cd5cc55cd5d415dc5e592e4cd349207cade2a09aa2b
Instruction ID: e613243d49a8fc7bae60eb2cab412e6ceb5c89ecb7ae63c8040b9efd71b4c35d
Opcode Fuzzy Hash: 612422cf9f9e35291dde3cd5cc55cd5d415dc5e592e4cd349207cade2a09aa2b
Instruction Fuzzy Hash: 3731A5B1600301AFD614DB68DCC4C3BB7EDEFC8A54B444A6CF94AC3201EA35F9198766

Uniqueness

Uniqueness Score: -1.00%

Function 1ECB3220 Relevance: 29.9, APIs: 12, Strings: 5, Instructions: 115COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,O:QueryServiceLockStatus,?), ref: 1ECB3232
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?), ref: 1ECB324F
QueryServiceLockStatusW.ADVAPI32(?,00000000,00000000,?), ref: 1ECB3271
GetLastError.KERNEL32 ref: 1ECB3273
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(QueryServiceLockStatus,00000000), ref: 1ECB3285

Strings

O:QueryServiceLockStatus, xrefs: 1ECB322C
QueryServiceLockStatus, xrefs: 1ECB3280
QueryServiceLockStatus, xrefs: 1ECB332C
lOl, xrefs: 1ECB32F2
No memory for status buffer, xrefs: 1ECB32B0

Memory Dump Source

Source File: 0000000F.00000002.1435001879.000000001ECB1000.00000040.00000001.01000000.00000011.sdmp, Offset: 1ECB0000, based on PE: true

Associated: 0000000F.00000002.1434980425.000000001ECB0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBA000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBD000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435097428.000000001ECBF000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435120797.000000001ECC0000.00000004.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ecb0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: U_object@@$Arg_ErrorError@@LastLockObject_ParseQueryServiceStatusTupleWin_
String ID: No memory for status buffer$O:QueryServiceLockStatus$QueryServiceLockStatus$QueryServiceLockStatus$lOl
API String ID: 2194802886-3244492634
Opcode ID: 8f50ee58494684cf2cbd7e874a0b923fef2c0f04116412716a6ffb3cc7d7f9cb
Instruction ID: 4a87452917051e8b0b1f806f2019aafff9d1c4f2a6f78451bf09c26a2f2e1e1c
Opcode Fuzzy Hash: 8f50ee58494684cf2cbd7e874a0b923fef2c0f04116412716a6ffb3cc7d7f9cb
Instruction Fuzzy Hash: 9A31F676600211AFD3009B68ED85E6B77A9EFC4B94F448668FC49C3340E735E919C7A7

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C8680 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 110threadregistryCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,Ol:RegGetKeySecurity,?,?), ref: 1E8C8697
?PyWinObject_AsHKEY@@YAHPAU_object@@PAPAUHKEY__@@@Z.PYWINTYPES27(?,?), ref: 1E8C86B4
PyEval_SaveThread.PYTHON27 ref: 1E8C86D3
RegGetKeySecurity.ADVAPI32(?,?,00000000,00000000), ref: 1E8C86EE
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C86F3
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(RegGetKeySecurity,00000000), ref: 1E8C8707

Strings

RegGetKeySecurity, xrefs: 1E8C8702
RegGetKeySecurity, xrefs: 1E8C8768
Ol:RegGetKeySecurity, xrefs: 1E8C8691

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_ThreadU_object@@$Arg_Error@@Object_ParseRestoreSaveSecurityTupleWin_Y__@@@
String ID: Ol:RegGetKeySecurity$RegGetKeySecurity$RegGetKeySecurity
API String ID: 2929093490-397777079
Opcode ID: 634486cad53a4ed39618046cf6e52d7fd3a9805e2214d1dc1cfd6f4a22d8a303
Instruction ID: 93198accc984056b6e02dea87ec784334bf7f08e1d990d9dbda758d68c62ddaa
Opcode Fuzzy Hash: 634486cad53a4ed39618046cf6e52d7fd3a9805e2214d1dc1cfd6f4a22d8a303
Instruction Fuzzy Hash: 3531D7766002216FD300DBA9DC8D9EBB7E8FFC6265F440929FD09C3211E739E55986B2

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C1E00 Relevance: 29.9, APIs: 13, Strings: 4, Instructions: 109threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1E8C1E44
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,?,00000000,00000000,?,O|O:FindExecutable,?,?), ref: 1E8C1E6E
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,?,00000001,00000000), ref: 1E8C1E89
PyEval_SaveThread.PYTHON27 ref: 1E8C1EA8
FindExecutableA.SHELL32(?,?,?), ref: 1E8C1EBF
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C1EC8
PyErr_SetString.PYTHON27(00000000,FindExecutable: There is no association for the file), ref: 1E8C1EEA
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C1F3F
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C1F4D

Strings

(NN), xrefs: 1E8C1F22
O|O:FindExecutable, xrefs: 1E8C1E21
FindExecutable, xrefs: 1E8C1EF6
FindExecutable: There is no association for the file, xrefs: 1E8C1EE4

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_String@@$Eval_FreeThreadU_object@@$Arg_Err_ExecutableFindParseRestoreSaveStringTuple
String ID: (NN)$FindExecutable$FindExecutable: There is no association for the file$O|O:FindExecutable
API String ID: 3782625144-2336032024
Opcode ID: 7e57adeedc3c4d787cec3261d8fe7b5010847584e04a6b2b0c2a6c656835cdf7
Instruction ID: 00dead42f69c419d153b98a266a1f6c5c4d20c5b169ad28c58b669a4f56ed8f6
Opcode Fuzzy Hash: 7e57adeedc3c4d787cec3261d8fe7b5010847584e04a6b2b0c2a6c656835cdf7
Instruction Fuzzy Hash: 4D315171514311AFE310DF64DCC9BDB77E8EF8A214F404519FA9993280E735D589CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C2B20 Relevance: 29.8, APIs: 12, Strings: 5, Instructions: 99COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(?,%s is not available on this platform,GetComputerNameEx), ref: 1E8C2B40
PyArg_ParseTuple.PYTHON27(?,i:GetComputerNameEx,?), ref: 1E8C2B61

Strings

GetComputerNameExW, xrefs: 1E8C2B8D
i:GetComputerNameEx, xrefs: 1E8C2B57
%s is not available on this platform, xrefs: 1E8C2B3A
GetComputerNameEx, xrefs: 1E8C2B35
GetComputerNameEx, xrefs: 1E8C2BED

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Err_FormatParseTuple
String ID: %s is not available on this platform$GetComputerNameEx$GetComputerNameEx$GetComputerNameExW$i:GetComputerNameEx
API String ID: 361908667-1141911926
Opcode ID: e1192246da95919d947fb106ae5e610f31ae641fdfeb7b905632769c24848e49
Instruction ID: ad189e1f1af9a46008e41d87ec65636e06700883792d5e3c3dcdb4365da9761c
Opcode Fuzzy Hash: e1192246da95919d947fb106ae5e610f31ae641fdfeb7b905632769c24848e49
Instruction Fuzzy Hash: 4421A575500115AFD600AF64EC8DCEA77E8EB82616F444529FD0EC3300E736E69DC6A6

Uniqueness

Uniqueness Score: -1.00%

Function 1E8CCA70 Relevance: 29.8, APIs: 7, Strings: 10, Instructions: 76COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(?,%s is not available on this platform,GetMonitorInfo), ref: 1E8CCA8E
PyArg_ParseTupleAndKeywords.PYTHON27(?,?,O:GetMonitorInfo,1E8D7F9C), ref: 1E8CCAB3
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(00000000,?), ref: 1E8CCAC9
GetMonitorInfoA.USER32 ref: 1E8CCAF9
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(GetMonitorInfo,00000000), ref: 1E8CCB09

Strings

%s is not available on this platform, xrefs: 1E8CCA88
GetMonitorInfo, xrefs: 1E8CCB04
Work, xrefs: 1E8CCB40
H, xrefs: 1E8CCAF1
Device, xrefs: 1E8CCB2A
Flags, xrefs: 1E8CCB30
O:GetMonitorInfo, xrefs: 1E8CCAAC
GetMonitorInfo, xrefs: 1E8CCA83
{s:O&,s:O&,s:k,s:N}, xrefs: 1E8CCB50
Monitor, xrefs: 1E8CCB4B

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: U_object@@$Arg_Err_Error@@FormatInfoKeywordsMonitorObject_ParseTupleWin_
String ID: %s is not available on this platform$Device$Flags$GetMonitorInfo$GetMonitorInfo$H$Monitor$O:GetMonitorInfo$Work${s:O&,s:O&,s:k,s:N}
API String ID: 971695816-1907508076
Opcode ID: ada97584b9a4851728e03fbebe617f7d3ebc0dd1425393cc3e42e59f6f4775e9
Instruction ID: 5446124e3c06822213fce2dc56840008d908c8d2a0ee33fde4ac4ca0c6f31229
Opcode Fuzzy Hash: ada97584b9a4851728e03fbebe617f7d3ebc0dd1425393cc3e42e59f6f4775e9
Instruction Fuzzy Hash: C22179B0114345BFE700EBA8CD89EAA73F9BB84605F404A08F949C3380E735E918CB66

Uniqueness

Uniqueness Score: -1.00%

Function 03254F90 Relevance: 28.3, APIs: 12, Strings: 4, Instructions: 330COMMON

Download Yara Rule

APIs

PyList_New.PYTHON27(00000000), ref: 03254F9C

Part of subcall function 03251200: GetAdaptersAddresses.IPHLPAPI(00000000,00000000,00000000,00000000,?), ref: 0325123C
Part of subcall function 03251200: 73BB3B4E.MSVCR90(00000000), ref: 03251247
Part of subcall function 03251200: PyErr_SetString.PYTHON27(00000000,GetAdaptersAddresses() syscall failed.), ref: 03251274

PyUnicodeUCS2_FromWideChar.PYTHON27(?,?), ref: 03255011
Py_BuildValue.PYTHON27(0325B840,00000000), ref: 0325509B
Py_BuildValue.PYTHON27((OiOOOO),00000000,000000FF,00000000,6D07CB14,6D07CB14,6D07CB14), ref: 032550D0
PyList_Append.PYTHON27(?,00000000), ref: 032550E5

Strings

(OiOOOO), xrefs: 03255229
%.2X-, xrefs: 03255064
%.2X, xrefs: 03255057
(OiOOOO), xrefs: 032550CB

Memory Dump Source

Source File: 0000000F.00000002.1423676562.0000000003251000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03250000, based on PE: true

Associated: 0000000F.00000002.1423656216.0000000003250000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423775563.0000000003263000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3250000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: BuildList_Value$AdaptersAddressesAppendCharErr_FromStringUnicodeWide
String ID: %.2X$%.2X-$(OiOOOO)$(OiOOOO)
API String ID: 3530921289-1333837927
Opcode ID: 6b9099da8e714ec4165a6b49289fa1efacc82bcb99dfebd102da89328ee6e431
Instruction ID: 100d06e7e6e435e29341a4e0c939dc8b6346e9f480f9f5ac725a71642e05d5cf
Opcode Fuzzy Hash: 6b9099da8e714ec4165a6b49289fa1efacc82bcb99dfebd102da89328ee6e431
Instruction Fuzzy Hash: 82C1C3715143029FD710DF64EC4496BB3E8EF85324F188658FD568B291D774EE82CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1ECB2960 Relevance: 28.2, APIs: 13, Strings: 3, Instructions: 168threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1ECB297F
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?,?,?,?,?), ref: 1ECB299C
PyEval_SaveThread.PYTHON27 ref: 1ECB29B9
EnumDependentServicesW.ADVAPI32(?,?,?,00000004,?,?), ref: 1ECB29E0
GetLastError.KERNEL32 ref: 1ECB29E8
EnumDependentServicesW.ADVAPI32(?,?,00000000,?,?,?,?,?,?,?,?,?,?), ref: 1ECB2A24
PyEval_RestoreThread.PYTHON27(00000000), ref: 1ECB2A29
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(EnumDependentServices,00000000,?,?,?,?,?,?,?,?), ref: 1ECB2A46

Strings

EnumDependentServices, xrefs: 1ECB2A41
O|l:EnumDependentServices, xrefs: 1ECB2971
OO(lllllll), xrefs: 1ECB2AB2

Memory Dump Source

Source File: 0000000F.00000002.1435001879.000000001ECB1000.00000040.00000001.01000000.00000011.sdmp, Offset: 1ECB0000, based on PE: true

Associated: 0000000F.00000002.1434980425.000000001ECB0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBA000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBD000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435097428.000000001ECBF000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435120797.000000001ECC0000.00000004.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ecb0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: DependentEnumEval_ServicesThreadU_object@@$Arg_ErrorError@@LastObject_ParseRestoreSaveTupleWin_
String ID: EnumDependentServices$OO(lllllll)$O|l:EnumDependentServices
API String ID: 530557278-4029098243
Opcode ID: 982ae47404e25ebadcf9d8053d202c09f4ba1f787e1012c7a33a89e2c3aa221a
Instruction ID: 74615a42f1353213654d918ef06e9944456c1a2904dd4dc462e848242fbf0f43
Opcode Fuzzy Hash: 982ae47404e25ebadcf9d8053d202c09f4ba1f787e1012c7a33a89e2c3aa221a
Instruction Fuzzy Hash: 56515CB25042019FD314DF64CC84D6BB7EAFF88794F044A1CF99983245E734E95ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 03257930 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 130serviceCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 0325794A
QueryServiceConfig2W.ADVAPI32 ref: 03257993
GetLastError.KERNEL32 ref: 0325799B
CloseServiceHandle.ADVAPI32(00000000), ref: 032579A5
Py_BuildValue.PYTHON27(0325D478,0325D825), ref: 032579B5

Strings

QueryServiceConfig2W, xrefs: 03257A0D
QueryServiceConfig2W, xrefs: 032579CC

Memory Dump Source

Source File: 0000000F.00000002.1423676562.0000000003251000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03250000, based on PE: true

Associated: 0000000F.00000002.1423656216.0000000003250000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423775563.0000000003263000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3250000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Service$Arg_BuildCloseConfig2ErrorHandleLastParseQueryTupleValue
String ID: QueryServiceConfig2W$QueryServiceConfig2W
API String ID: 40459686-1180059196
Opcode ID: 5565d9d0cbd4fda8271910da6dd2d2a40a088a76eb05d019371f6e869378323e
Instruction ID: 4e0e3aa1e09b02c970b09005111eea2df3457ea9cf343682ffd02dc35146aa05
Opcode Fuzzy Hash: 5565d9d0cbd4fda8271910da6dd2d2a40a088a76eb05d019371f6e869378323e
Instruction Fuzzy Hash: 60311A76660301AFDB10F768BC49BAF73B8EBC0A25F088424FD05C2105E379978986B2

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C4790 Relevance: 28.1, APIs: 13, Strings: 3, Instructions: 123COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,OO|O:WriteProfileSection,?,?,?), ref: 1E8C47C4
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,?,00000001,00000000), ref: 1E8C47EA
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,?,00000001,?), ref: 1E8C4808
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,?,00000001,00000000), ref: 1E8C4822
PyErr_SetString.PYTHON27(?,Section data must be terminated by double null), ref: 1E8C4859
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C48D2
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C48D9
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C48E0

Strings

WriteProfileSection, xrefs: 1E8C48AA
OO|O:WriteProfileSection, xrefs: 1E8C47B2
Section data must be terminated by double null, xrefs: 1E8C4853

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_String@@$FreeU_object@@$Arg_Err_ParseStringTuple
String ID: OO|O:WriteProfileSection$Section data must be terminated by double null$WriteProfileSection
API String ID: 1819261588-3105349092
Opcode ID: 12216613bd653e384157a2120117019dc6cedcdbb7ca3cc00ba139fd1e1373fb
Instruction ID: d6c2441bad9cad4afe000966e9f645c6b79d027a81f9809c112e0d6a2f66d322
Opcode Fuzzy Hash: 12216613bd653e384157a2120117019dc6cedcdbb7ca3cc00ba139fd1e1373fb
Instruction Fuzzy Hash: AB416E71904352AFE700DF68CCD4DAB77E9EBC9204F408A1DF98993251E731D989CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C8840 Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 116threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,OO|O:SearchPath,?,?,?), ref: 1E8C887A
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,?,00000001,00000000), ref: 1E8C88A3
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,?,00000000,00000000), ref: 1E8C88BC
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,?,00000001,00000000), ref: 1E8C88D6
PyEval_SaveThread.PYTHON27 ref: 1E8C88E4
SearchPathA.KERNEL32(?,?,?,00000200,?,?), ref: 1E8C890A
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C8913
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(SearchPath,00000000), ref: 1E8C8927
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C8973
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C897A
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C8981

Strings

SearchPath, xrefs: 1E8C8922
OO|O:SearchPath, xrefs: 1E8C8868

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_String@@$U_object@@$Free$Eval_Thread$Arg_Error@@ParsePathRestoreSaveSearchTupleWin_
String ID: OO|O:SearchPath$SearchPath
API String ID: 1904503595-3479636443
Opcode ID: c7ea4f920c2bda0c0d33bae72982bf1cbf6df60f72143dbb9814e067db52642d
Instruction ID: 43e4729b964bcb02ead033175c4076db584848b4d7b91a76b44f62a52127da42
Opcode Fuzzy Hash: c7ea4f920c2bda0c0d33bae72982bf1cbf6df60f72143dbb9814e067db52642d
Instruction Fuzzy Hash: 40315EB15543116FE300DFA8CCC8DABB7ECEF89214F044A1DF54993241E634E9498BA3

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C59C0 Relevance: 28.1, APIs: 10, Strings: 6, Instructions: 98COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1E8C59DF
GetVersionExA.KERNEL32 ref: 1E8C5A07
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(GetVersionEx,00000000), ref: 1E8C5A17

Strings

iiiiNiiiii, xrefs: 1E8C5AE6
format must be 0 or 1 (got %d), xrefs: 1E8C5B04
GetVersionEx, xrefs: 1E8C5A12
GetVersionEx, xrefs: 1E8C5A7F
iiiiN, xrefs: 1E8C5A49
|i:GetVersionEx, xrefs: 1E8C59D1

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Error@@ParseTupleU_object@@VersionWin_
String ID: GetVersionEx$GetVersionEx$format must be 0 or 1 (got %d)$iiiiN$iiiiNiiiii$|i:GetVersionEx
API String ID: 2077112091-775768606
Opcode ID: d2729c43f573c087483a218408676203822ea4e806b495b59e05b83cc1997b7b
Instruction ID: 80792d530958f64933975d9b84be49680978ed2399fce0fc183d744f78130808
Opcode Fuzzy Hash: d2729c43f573c087483a218408676203822ea4e806b495b59e05b83cc1997b7b
Instruction Fuzzy Hash: 0B313CB5508251AFE310CB65CC88FAB77E9BBC9315F84861CF89DC2291E23496598B63

Uniqueness

Uniqueness Score: -1.00%

Function 1E8CB060 Relevance: 28.1, APIs: 3, Strings: 13, Instructions: 72COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(?,%s is not available on this platform,GlobalMemoryStatusEx), ref: 1E8CB07E
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(GlobalMemoryStatusEx,00000000), ref: 1E8CB0A3

Strings

TotalPhys, xrefs: 1E8CB122
GlobalMemoryStatusEx, xrefs: 1E8CB09E
AvailPageFile, xrefs: 1E8CB0F3
@, xrefs: 1E8CB08F
%s is not available on this platform, xrefs: 1E8CB078
AvailExtendedVirtual, xrefs: 1E8CB0C6
TotalVirtual, xrefs: 1E8CB0E4
GlobalMemoryStatusEx, xrefs: 1E8CB073
TotalPageFile, xrefs: 1E8CB102
AvailPhys, xrefs: 1E8CB111
Length, xrefs: 1E8CB12E
AvailVirtual, xrefs: 1E8CB0D5
MemoryLoad, xrefs: 1E8CB128

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Err_Error@@FormatU_object@@Win_
String ID: %s is not available on this platform$@$AvailExtendedVirtual$AvailPageFile$AvailPhys$AvailVirtual$GlobalMemoryStatusEx$GlobalMemoryStatusEx$Length$MemoryLoad$TotalPageFile$TotalPhys$TotalVirtual
API String ID: 1771588633-3205011328
Opcode ID: 9c960fb4037b89461c09805d8a8b189e8d2cab074f8ca2fb7799ae646d21142a
Instruction ID: 58493382babc2d529cf7e75ad7c818845a8fde163a9d764bf4e0cf200f7593f2
Opcode Fuzzy Hash: 9c960fb4037b89461c09805d8a8b189e8d2cab074f8ca2fb7799ae646d21142a
Instruction Fuzzy Hash: A621CCB2108350BFD244DB58DC84D9BB7F9BBC9A54F40960CF699D3310D631E908CB66

Uniqueness

Uniqueness Score: -1.00%

Function 03257590 Relevance: 26.5, APIs: 12, Strings: 3, Instructions: 220serviceCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,0325D400,?), ref: 032575B1
QueryServiceConfigW.ADVAPI32(00000000,00000000,00000000,?), ref: 032575F7
GetLastError.KERNEL32 ref: 032575F9
CloseServiceHandle.ADVAPI32(00000000), ref: 032577BB
73BB3B4E.MSVCR90(?), ref: 032577CA

Strings

QueryServiceConfigW, xrefs: 0325763C
QueryServiceConfigW, xrefs: 03257604
(OOOs), xrefs: 032576F0

Memory Dump Source

Source File: 0000000F.00000002.1423676562.0000000003251000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03250000, based on PE: true

Associated: 0000000F.00000002.1423656216.0000000003250000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423775563.0000000003263000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3250000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Service$Arg_CloseConfigErrorHandleLastParseQueryTuple
String ID: (OOOs)$QueryServiceConfigW$QueryServiceConfigW
API String ID: 2875933263-2285709846
Opcode ID: 8aa4ca6c525b31a84a5b841435d68204748addbd024e6ab789abdd7e8e16b046
Instruction ID: 171f327233eb38cb89af7d5e9ff0f2ec5ca1823a4066b2105dca83c01d989214
Opcode Fuzzy Hash: 8aa4ca6c525b31a84a5b841435d68204748addbd024e6ab789abdd7e8e16b046
Instruction Fuzzy Hash: 7B61E7B59503079BC710DF68EC8496BB3A9EF84220F084658FD1987341E734EF86CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1E7D1930 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 158threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,il|O:LogMsg,?,?,?), ref: 1E7D1956
?PyWinObject_FreeWCHAR@@YAXPA_W@Z.PYWINTYPES27(6D07CB14), ref: 1E7D19F4
PyEval_SaveThread.PYTHON27 ref: 1E7D1A80
PyEval_RestoreThread.PYTHON27(00000000,?,?), ref: 1E7D1A9A

Strings

il|O:LogMsg, xrefs: 1E7D1948
strings must be None or a sequence, xrefs: 1E7D1AD9
RegisterEventSource/ReportEvent, xrefs: 1E7D1ABF
Allocating string arrays, xrefs: 1E7D19C8

Memory Dump Source

Source File: 0000000F.00000002.1434219289.000000001E7D1000.00000040.00000001.01000000.00000015.sdmp, Offset: 1E7D0000, based on PE: true

Associated: 0000000F.00000002.1434197225.000000001E7D0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000F.00000002.1434219289.000000001E7DA000.00000040.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000F.00000002.1434284534.000000001E7DB000.00000080.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000F.00000002.1434310614.000000001E7DD000.00000004.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e7d0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_Thread$Arg_FreeObject_ParseRestoreSaveTuple
String ID: Allocating string arrays$RegisterEventSource/ReportEvent$il|O:LogMsg$strings must be None or a sequence
API String ID: 715270677-2263833891
Opcode ID: 40aa4e241577b29e4ce9751ad365563a5b70aac3a11ac9608c415343b62425e3
Instruction ID: 98a5e5bb5567575b6d775909243e88dfa7043eda63c36672b0407e2250aec0b1
Opcode Fuzzy Hash: 40aa4e241577b29e4ce9751ad365563a5b70aac3a11ac9608c415343b62425e3
Instruction Fuzzy Hash: BC5191755043519FE300DFA9EC88A9B77E9FFD8214F040A29FD8697211E736E90D8B92

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C2C30 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 99COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(?,%s is not available on this platform,GetComputerObjectName), ref: 1E8C2C50
PyArg_ParseTuple.PYTHON27(?,i:GetComputerObjectName,?), ref: 1E8C2C71

Strings

GetComputerObjectName, xrefs: 1E8C2CFE
i:GetComputerObjectName, xrefs: 1E8C2C67
%s is not available on this platform, xrefs: 1E8C2C4A
GetComputerObjectName, xrefs: 1E8C2C45
GetComputerObjectName, xrefs: 1E8C2C9D

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Err_FormatParseTuple
String ID: %s is not available on this platform$GetComputerObjectName$GetComputerObjectName$GetComputerObjectName$i:GetComputerObjectName
API String ID: 361908667-738876011
Opcode ID: 565ac351e6b566c003bf358833ebbd5d30c4f6ee2a39853b8196c1ac47c1aba1
Instruction ID: 1377436846e20d5c88a01d2b5412e8fc247d6411cf6e65db4beabb29361a6f41
Opcode Fuzzy Hash: 565ac351e6b566c003bf358833ebbd5d30c4f6ee2a39853b8196c1ac47c1aba1
Instruction Fuzzy Hash: 6821E671510129AFD600AB68EC8D8EB77E8EB82516F444129FC0EC3300E636E69DD6B6

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C2DB0 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 99COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(?,%s is not available on this platform,GetUserNameEx), ref: 1E8C2DD0
PyArg_ParseTuple.PYTHON27(?,i:GetUserNameEx,?), ref: 1E8C2DF1

Strings

i:GetUserNameEx, xrefs: 1E8C2DE7
GetUserNameEx, xrefs: 1E8C2DC5
%s is not available on this platform, xrefs: 1E8C2DCA
GetUserNameEx, xrefs: 1E8C2E7E
GetUserNameExW, xrefs: 1E8C2E1D

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Err_FormatParseTuple
String ID: %s is not available on this platform$GetUserNameEx$GetUserNameEx$GetUserNameExW$i:GetUserNameEx
API String ID: 361908667-2181525025
Opcode ID: e8e96063e89c3f4aff41cbe69608225173f791040a9830340ff7ef3838d7625d
Instruction ID: 24be49119b52eee284ce1f95427ff48e58ed1df9fb5cc11fbf9c17e64b90bd3f
Opcode Fuzzy Hash: e8e96063e89c3f4aff41cbe69608225173f791040a9830340ff7ef3838d7625d
Instruction Fuzzy Hash: 5F21D675510129AFD600AB68EC8D8EB77E8FF82516F444129FC0EC3301E636E69DD6A6

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C4C70 Relevance: 26.3, APIs: 10, Strings: 5, Instructions: 95COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(?,%s is not available on this platform,GetLongPathNameA), ref: 1E8C4C90
PyArg_ParseTuple.PYTHON27(?,s:GetLongPathName,?), ref: 1E8C4CB7

Strings

s:GetLongPathName, xrefs: 1E8C4CA8
GetLongPathName, xrefs: 1E8C4D3E
GetLongPathNameA, xrefs: 1E8C4C85
Unable to allocate %d bytes, xrefs: 1E8C4D25
%s is not available on this platform, xrefs: 1E8C4C8A

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Err_FormatParseTuple
String ID: %s is not available on this platform$GetLongPathName$GetLongPathNameA$Unable to allocate %d bytes$s:GetLongPathName
API String ID: 361908667-2741634594
Opcode ID: bcbf2c6fcb84620b4abb7079a0e799bbb152fb91de9b8c8d8d4ad9b315c76f8a
Instruction ID: 30b7ba01699f3ea5dc06cfba7b30505fbdf348210ea9ffaaac0e2ba624bd4ddd
Opcode Fuzzy Hash: bcbf2c6fcb84620b4abb7079a0e799bbb152fb91de9b8c8d8d4ad9b315c76f8a
Instruction Fuzzy Hash: 9321A376500221AFD311AB68AC889CB77AABF82755F044225FD0993310E736E599CAE6

Uniqueness

Uniqueness Score: -1.00%

Function 1E8CBE60 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 181COMMON

Download Yara Rule

APIs

PyString_AsString.PYTHON27(?), ref: 1E8CBE6B
?PyWinObject_FromTCHAR@@YAPAU_object@@PBDH@Z.PYWINTYPES27(?,000000FF), ref: 1E8CBEB7

Strings

DeviceString, xrefs: 1E8CBED7
DeviceName, xrefs: 1E8CBE7B
DeviceID, xrefs: 1E8CBF3A
DeviceKey, xrefs: 1E8CBFA1

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: FromObject_StringString_U_object@@
String ID: DeviceID$DeviceKey$DeviceName$DeviceString
API String ID: 1511502740-1635029413
Opcode ID: f5b51a0f38e787e99a7c68749799043d7dd8300e44dde7908592e4787ea2718e
Instruction ID: 2d52eaaaae14393f9ce1e5ccd28030320e608ee961fbaeed575294a800acd404
Opcode Fuzzy Hash: f5b51a0f38e787e99a7c68749799043d7dd8300e44dde7908592e4787ea2718e
Instruction Fuzzy Hash: 46416C33B6E9E216E70106383C607EE7B479F93039B4C4769ED9B8B2D6E203C58A5351

Uniqueness

Uniqueness Score: -1.00%

Function 1E7D27C0 Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 135registryCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1E7D27E4
PyCallable_Check.PYTHON27(?,?,?,?,?,?), ref: 1E7D27F5
PyErr_SetString.PYTHON27(00000000,Second argument must be a callable object,?,?,?,?,?,?), ref: 1E7D2810
?PyWinObject_AsWCHAR@@YAHPAU_object@@PAPA_WHPAK@Z.PYWINTYPES27(?,?,00000000,00000000,?,?,?,?,?,?), ref: 1E7D282D
PyErr_SetString.PYTHON27(?,The service name is not hosted by this process,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1E7D2858
?PyWinObject_FreeWCHAR@@YAXPA_W@Z.PYWINTYPES27(?,?,The service name is not hosted by this process,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1E7D2863
RegisterServiceCtrlHandlerW.ADVAPI32(?,Function_000023B0,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1E7D28E2
?PyWinObject_FreeWCHAR@@YAXPA_W@Z.PYWINTYPES27(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1E7D28F0
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27 ref: 1E7D2929
?PyWinLong_FromHANDLE@@YAPAU_object@@PAX@Z.PYWINTYPES27(?,?,?,?,?,?,?,?,?,?,?,?), ref: 1E7D2939

Strings

RegisterServiceCtrlHandlerEx, xrefs: 1E7D291C
Second argument must be a callable object, xrefs: 1E7D280A
The service name is not hosted by this process, xrefs: 1E7D2852
OO|i, xrefs: 1E7D27D6

Memory Dump Source

Source File: 0000000F.00000002.1434219289.000000001E7D1000.00000040.00000001.01000000.00000015.sdmp, Offset: 1E7D0000, based on PE: true

Associated: 0000000F.00000002.1434197225.000000001E7D0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000F.00000002.1434219289.000000001E7DA000.00000040.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000F.00000002.1434284534.000000001E7DB000.00000080.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000F.00000002.1434310614.000000001E7DD000.00000004.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e7d0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_U_object@@$Err_FreeString$Arg_Callable_CheckCtrlError@@FromHandlerLong_ParseRegisterServiceTupleWin_
String ID: OO|i$RegisterServiceCtrlHandlerEx$Second argument must be a callable object$The service name is not hosted by this process
API String ID: 2228332292-2207870682
Opcode ID: c2e17d6a6a44dd70480fb3b280b68feff1f86b69b2f2e4337e17cf976b2b899b
Instruction ID: 1f9dc4e5dc9dd537e8a2d6ec313060b4f63501be62f7fbcf9e17bc041402a3e6
Opcode Fuzzy Hash: c2e17d6a6a44dd70480fb3b280b68feff1f86b69b2f2e4337e17cf976b2b899b
Instruction Fuzzy Hash: 09418C75604351AFE300DF98C884A9B77E8FB88720F408958FD5997321E735E85ACFA2

Uniqueness

Uniqueness Score: -1.00%

Function 1E7D1D60 Relevance: 24.6, APIs: 8, Strings: 6, Instructions: 117registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000105), ref: 1E7D1D98
GetLastError.KERNEL32 ref: 1E7D1DA2
PyGILState_Ensure.PYTHON27(?,00000000), ref: 1E7D1DCD
PySys_GetObject.PYTHON27 ref: 1E7D1DF1
PyString_AsString.PYTHON27(00000000), ref: 1E7D1E15
wsprintfW.USER32 ref: 1E7D1E3F
RegSetValueW.ADVAPI32(80000002,?,00000001,?,?), ref: 1E7D1E74

Strings

Software\Python\PythonService\%hs, xrefs: 1E7D1E39
Registration failed due to GetModuleFileName() failing (error %d), xrefs: 1E7D1DA9
Registration failed due to RegSetValue() of service EXE - error %d, xrefs: 1E7D1E7F
Registering the Python Service Manager..., xrefs: 1E7D1D82
Registration failed as sys.winver is not available or not a string, xrefs: 1E7D1EC8
winver, xrefs: 1E7D1DE1

Memory Dump Source

Source File: 0000000F.00000002.1434219289.000000001E7D1000.00000040.00000001.01000000.00000015.sdmp, Offset: 1E7D0000, based on PE: true

Associated: 0000000F.00000002.1434197225.000000001E7D0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000F.00000002.1434219289.000000001E7DA000.00000040.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000F.00000002.1434284534.000000001E7DB000.00000080.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000F.00000002.1434310614.000000001E7DD000.00000004.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e7d0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: EnsureErrorFileLastModuleNameObjectState_StringString_Sys_Valuewsprintf
String ID: Registering the Python Service Manager...$Registration failed as sys.winver is not available or not a string$Registration failed due to GetModuleFileName() failing (error %d)$Registration failed due to RegSetValue() of service EXE - error %d$Software\Python\PythonService\%hs$winver
API String ID: 2187450830-2799430497
Opcode ID: 5f89df80ed307d3c79789a95e7f64700c8b69935aeaf3aae4ebf9122850c3aa1
Instruction ID: 9d5be4f4b1b50138bf3a97763f075546987ae75cfc6311b596dabd65a8da1f60
Opcode Fuzzy Hash: 5f89df80ed307d3c79789a95e7f64700c8b69935aeaf3aae4ebf9122850c3aa1
Instruction Fuzzy Hash: CB410571500351ABF320DF64EC45BEA73E9FB84721F444728F95982290E738A50DCBA6

Uniqueness

Uniqueness Score: -1.00%

Function 1E8CA590 Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 117threadCOMMON

Download Yara Rule

APIs

PyThreadState_Swap.PYTHON27(00000000), ref: 1E8CA59C
PyThreadState_Swap.PYTHON27(00000000), ref: 1E8CA5A1
?PyWinThreadState_Ensure@@YAHXZ.PYWINTYPES27 ref: 1E8CA5AE
?PyWinInterpreterLock_Acquire@@YAXXZ.PYWINTYPES27 ref: 1E8CA5B9
Py_BuildValue.PYTHON27(i(OO),?,00000000,6D07CB14), ref: 1E8CA5DF
PyObject_CallObject.PYTHON27(?,00000000), ref: 1E8CA605
PyInt_AsLong.PYTHON27(00000000), ref: 1E8CA638
PyObject_IsSubclass.PYTHON27(00000000), ref: 1E8CA64F
PySequence_Check.PYTHON27(00000000), ref: 1E8CA66D
PySequence_GetItem.PYTHON27(00000000,00000000), ref: 1E8CA683
PySequence_GetItem.PYTHON27(00000000,00000001), ref: 1E8CA68E
?PyWinInterpreterLock_Release@@YAXXZ.PYWINTYPES27 ref: 1E8CA6B3
?PyWinThreadState_Free@@YAXXZ.PYWINTYPES27 ref: 1E8CA6BD

Strings

i(OO), xrefs: 1E8CA5DA

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: State_Thread$Sequence_$InterpreterItemLock_Object_Swap$Acquire@@BuildCallCheckEnsure@@Free@@Int_LongObjectRelease@@SubclassValue
String ID: i(OO)
API String ID: 3009821372-2031314091
Opcode ID: 1a6c49850dc0de776762b4286ae1f6dab4ca442a85580e2fa685412d38254857
Instruction ID: ece8b00d006cce45e548db9df1cac9afc86007f4ff7a7fbd246210c5ddb811fe
Opcode Fuzzy Hash: 1a6c49850dc0de776762b4286ae1f6dab4ca442a85580e2fa685412d38254857
Instruction Fuzzy Hash: 1B41A0716006119FD3109FA4DC88DDBB3E6AF86724F114368F95A87390EB31E946CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C7910 Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 107COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(?,%s is not available on this platform,RegOpenKeyTransacted), ref: 1E8C7930
PyArg_ParseTupleAndKeywords.PYTHON27(?,?,OOkO|k:RegOpenKeyTransacted,1E8D7064,?,?,?,?,?), ref: 1E8C7973

Strings

OOkO|k:RegOpenKeyTransacted, xrefs: 1E8C7964
RegOpenKeyTransacted, xrefs: 1E8C7925
RegOpenKeyTransacted, xrefs: 1E8C79FB
%s is not available on this platform, xrefs: 1E8C792A

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Err_FormatKeywordsParseTuple
String ID: %s is not available on this platform$OOkO|k:RegOpenKeyTransacted$RegOpenKeyTransacted$RegOpenKeyTransacted
API String ID: 223827023-3216062451
Opcode ID: 96458b4445a962a848d21e9d857b18f7d91fe55e95370a3f79c657aaa78c516b
Instruction ID: ce2fc416dff5f990ff51d9772673f82cf8b1031ea0e3426ebd306b0197a267d2
Opcode Fuzzy Hash: 96458b4445a962a848d21e9d857b18f7d91fe55e95370a3f79c657aaa78c516b
Instruction Fuzzy Hash: 1E318DB1508211AFD714DB68CC88D9BB7E9BF89609F044A1CF54DC3200E631EA99CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C7E00 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 98registryCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,OO:RegQueryValue,?,?), ref: 1E8C7E22
?PyWinObject_AsHKEY@@YAHPAU_object@@PAPAUHKEY__@@@Z.PYWINTYPES27(?,?), ref: 1E8C7E41
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,?,00000001,00000000), ref: 1E8C7E5D
RegQueryValueA.ADVAPI32(?,?,00000000,?), ref: 1E8C7E7D
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(RegQueryValue,00000000), ref: 1E8C7E89
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C7EDA

Strings

RegQueryValue, xrefs: 1E8C7EBB
OO:RegQueryValue, xrefs: 1E8C7E16
RegQueryValue, xrefs: 1E8C7E84

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_U_object@@$String@@$Arg_Error@@FreeParseQueryTupleValueWin_Y__@@@
String ID: OO:RegQueryValue$RegQueryValue$RegQueryValue
API String ID: 1119018263-3043149522
Opcode ID: 5466167c444d972d2f66830f46f97243278f92543d0f4d9d3efde8fe82d3edc5
Instruction ID: f7005b942fc446a8a372d7cbd68b8cb1d97c1daf8d6bd93c672faa54a740e5ab
Opcode Fuzzy Hash: 5466167c444d972d2f66830f46f97243278f92543d0f4d9d3efde8fe82d3edc5
Instruction Fuzzy Hash: D0317F76A00119EBDB14EBA8CD88CEEB7B9EB45215B104268E909A3240E7319E548BA1

Uniqueness

Uniqueness Score: -1.00%

Function 1ECB19E0 Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 97COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1ECB1A03
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?), ref: 1ECB1A1A
PyErr_SetString.PYTHON27(?,Only UOI_FLAGS currently supported), ref: 1ECB1A3A
PyErr_SetString.PYTHON27(?,1ECB6720), ref: 1ECB1A69
PyTuple_New.PYTHON27(00000000), ref: 1ECB1A7A
PyArg_ParseTupleAndKeywords.PYTHON27(00000000,?,lll,1ECBA4E8,20000000,20000000,20000000), ref: 1ECB1A9F
PyErr_SetString.PYTHON27(?,1ECB6720), ref: 1ECB1ABB
SetUserObjectInformationW.USER32(?,?,?,0000000C), ref: 1ECB1ADA
GetLastError.KERNEL32(?,?,0000000C), ref: 1ECB1AE4
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(SetUserObjectInformation,00000000,?,?,0000000C), ref: 1ECB1AF0

Strings

OO|l:SetUserObjectInformation, xrefs: 1ECB19F5
SetUserObjectInformation, xrefs: 1ECB1AEB
Only UOI_FLAGS currently supported, xrefs: 1ECB1A34
lll, xrefs: 1ECB1A98

Memory Dump Source

Source File: 0000000F.00000002.1435001879.000000001ECB1000.00000040.00000001.01000000.00000011.sdmp, Offset: 1ECB0000, based on PE: true

Associated: 0000000F.00000002.1434980425.000000001ECB0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBA000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBD000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435097428.000000001ECBF000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435120797.000000001ECC0000.00000004.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ecb0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Err_String$Arg_ParseTupleU_object@@$ErrorError@@InformationKeywordsLastObjectObject_Tuple_UserWin_
String ID: OO|l:SetUserObjectInformation$Only UOI_FLAGS currently supported$SetUserObjectInformation$lll
API String ID: 1725894471-1453886628
Opcode ID: a9a0a92c5f1772a612277377e859ad41ee12f0d13fbaaaa587883aae3b41733d
Instruction ID: 7297ad1dc565577a754d6b1cfb0a94e2b14d0adff6ea34bd23f9762e8c27ee01
Opcode Fuzzy Hash: a9a0a92c5f1772a612277377e859ad41ee12f0d13fbaaaa587883aae3b41733d
Instruction Fuzzy Hash: 70318171100212AFD704DF68CDC9E6673E9FF84B82F448698F84AC3252E735E659CB62

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C4FB0 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 92threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,OO|i:GetTempFileName,?,?,?), ref: 1E8C4FE1
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,?,00000000,00000000), ref: 1E8C5009
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,?,00000000,00000000), ref: 1E8C501E
PyEval_SaveThread.PYTHON27 ref: 1E8C5028
GetTempFileNameA.KERNEL32(?,?,?,?), ref: 1E8C5044
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C504D
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(GetTempFileName,00000000), ref: 1E8C5061
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C5099
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C50A0

Strings

OO|i:GetTempFileName, xrefs: 1E8C4FCF
(Ni), xrefs: 1E8C507E
GetTempFileName, xrefs: 1E8C505C

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_String@@$U_object@@$Eval_FreeThread$Arg_Error@@FileNameParseRestoreSaveTempTupleWin_
String ID: (Ni)$GetTempFileName$OO|i:GetTempFileName
API String ID: 3415277092-3597938607
Opcode ID: 594d8e3bfbd98ff37d45c84c7555e12c7d8bc5021fe8b9d9e810e8436eece282
Instruction ID: fd9089542891bb9b423ed1937ae24c168eb2ff2f12b6f580d2a7689ea6adb7dd
Opcode Fuzzy Hash: 594d8e3bfbd98ff37d45c84c7555e12c7d8bc5021fe8b9d9e810e8436eece282
Instruction Fuzzy Hash: 0F213AB2504315AFE310DF68DCC4CEB77EDBB89214F044A2DF999D3241E635D9498BA2

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C3820 Relevance: 24.6, APIs: 10, Strings: 4, Instructions: 89COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,OO:VkKeyScanEx,?,?), ref: 1E8C3837
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?), ref: 1E8C3854
PyErr_SetString.PYTHON27(?,must be a byte string of length 1), ref: 1E8C3886

Strings

OO:VkKeyScanEx, xrefs: 1E8C3831
must be a byte string of length 1, xrefs: 1E8C3880
must be a unicode string of length 1, xrefs: 1E8C38C2
must be a unicode or byte string of length 1, xrefs: 1E8C3904

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Err_Object_ParseStringTupleU_object@@
String ID: OO:VkKeyScanEx$must be a byte string of length 1$must be a unicode or byte string of length 1$must be a unicode string of length 1
API String ID: 2332810667-3442240018
Opcode ID: 23de94490bda52380355a156d0ac491852025d51af6bdd6d5dc6b335e823fdf8
Instruction ID: 590ee1446a018ab948a50419a2ca79e7017aafe3bffb213e9b36f8e5d724c7d9
Opcode Fuzzy Hash: 23de94490bda52380355a156d0ac491852025d51af6bdd6d5dc6b335e823fdf8
Instruction Fuzzy Hash: 7521AE75500210AFE300CB68D8989EB77E5FF86615F048668FC4983360E635DA8ACB92

Uniqueness

Uniqueness Score: -1.00%

Function 03254FD8 Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 231COMMON

Download Yara Rule

APIs

PyUnicodeUCS2_FromWideChar.PYTHON27(?,?), ref: 03255011
Py_BuildValue.PYTHON27(0325B840,00000000), ref: 0325509B
Py_BuildValue.PYTHON27((OiOOOO),00000000,000000FF,00000000,6D07CB14,6D07CB14,6D07CB14), ref: 032550D0
PyList_Append.PYTHON27(?,00000000), ref: 032550E5

Strings

(OiOOOO), xrefs: 03255229
%.2X, xrefs: 03255057
(OiOOOO), xrefs: 032550CB

Memory Dump Source

Source File: 0000000F.00000002.1423676562.0000000003251000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03250000, based on PE: true

Associated: 0000000F.00000002.1423656216.0000000003250000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423775563.0000000003263000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3250000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: BuildValue$AppendCharFromList_UnicodeWide
String ID: %.2X$(OiOOOO)$(OiOOOO)
API String ID: 3269264928-2842833335
Opcode ID: 4895c9716d51e2c2c9e38e3e471b96a415aa133d123684739af6938eb8250829
Instruction ID: 18d69e8639f641cb119cef254e3b50dee4fe97d0ed3d122dc929fc3b07459e23
Opcode Fuzzy Hash: 4895c9716d51e2c2c9e38e3e471b96a415aa133d123684739af6938eb8250829
Instruction Fuzzy Hash: B381AFB15143029FD710DF68EC44A6BB3E8EF89324F188658FD56CB251D774EA81CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 03253D00 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 185COMMON

Download Yara Rule

APIs

PyDict_New.PYTHON27 ref: 03253D07
GetIfEntry2.IPHLPAPI(00000000), ref: 03253D71
Py_BuildValue.PYTHON27((KKKKKKKK),?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 03253E0B
PyUnicodeUCS2_FromWideChar.PYTHON27(?,?), ref: 03253E37
PyDict_SetItem.PYTHON27(?,00000000,00000000), ref: 03253E51

Strings

(KKKKKKKK), xrefs: 03253E06
GetIfEntry() or GetIfEntry2() syscalls failed., xrefs: 03253EBF

Memory Dump Source

Source File: 0000000F.00000002.1423676562.0000000003251000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03250000, based on PE: true

Associated: 0000000F.00000002.1423656216.0000000003250000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423775563.0000000003263000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3250000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Dict_$BuildCharEntry2FromItemUnicodeValueWide
String ID: (KKKKKKKK)$GetIfEntry() or GetIfEntry2() syscalls failed.
API String ID: 3218330116-1738093298
Opcode ID: 653641d4b9a2c6909244eb0c5099155e9e5d09598cafcafb0c72409ca45ab504
Instruction ID: 859519e80edc0dad2883f3f31d1cf2b8b03724476ec1115e1aafc9f819065029
Opcode Fuzzy Hash: 653641d4b9a2c6909244eb0c5099155e9e5d09598cafcafb0c72409ca45ab504
Instruction Fuzzy Hash: 2E5195B55007029FC710DB68EC84EA7B3E9AF84365F084618FE5AC7345D734EA95CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C4650 Relevance: 22.9, APIs: 11, Strings: 2, Instructions: 115threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,O|O:GetProfileSection,?,?), ref: 1E8C467F
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,?,00000000,00000000), ref: 1E8C46A4
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,?,00000001,00000000), ref: 1E8C46BE
PyEval_SaveThread.PYTHON27 ref: 1E8C46F2
GetPrivateProfileSectionA.KERNEL32(?,00000000,00000100,?), ref: 1E8C470A
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C4722
?PyWinObject_FromMultipleString@@YAPAU_object@@PAD@Z.PYWINTYPES27(00000000), ref: 1E8C4733
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C474D
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C4754

Strings

O|O:GetProfileSection, xrefs: 1E8C466D
Error allocating space for return buffer, xrefs: 1E8C4778

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_String@@$U_object@@$Eval_FreeThread$Arg_FromMultipleParsePrivateProfileRestoreSaveSectionTuple
String ID: Error allocating space for return buffer$O|O:GetProfileSection
API String ID: 751482902-2414598846
Opcode ID: 4f50df2ad9ead24bd95235cca58548cf9ff99a5234bdbbc9afc430dbe6fb1e28
Instruction ID: 96d833fdebf80fc2e5e84dd39127f04babc3a828e241d4988ce002cea2fd8c0e
Opcode Fuzzy Hash: 4f50df2ad9ead24bd95235cca58548cf9ff99a5234bdbbc9afc430dbe6fb1e28
Instruction Fuzzy Hash: 1B318FB25043116BD300EF6DDC88DEB77E9AF86650F450A18F98993200E735E999CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1E7D1750 Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 114registrywindowCOMMON

Download Yara Rule

APIs

FormatMessageW.KERNEL32(00002900,1E7D0000,?,00000000,?,00000000,?,?,00000000,00000000,?,1E7D1FE9), ref: 1E7D17BE
LocalFree.KERNEL32(?,?,?,?,00000001), ref: 1E7D181A

Part of subcall function 1E7D1620: GetModuleFileNameW.KERNEL32(1E7D0000,1E7D6448,00000104), ref: 1E7D164D
Part of subcall function 1E7D1620: RegCreateKeyExW.ADVAPI32(80000002,?,00000000,00000000,00000000,00020006,00000000,00000000,00000000,00000000,00000000), ref: 1E7D16D0
Part of subcall function 1E7D1620: RegSetValueExW.ADVAPI32(?,EventMessageFile,00000000,00000001,1E7D6448,00000000), ref: 1E7D170F
Part of subcall function 1E7D1620: RegSetValueExW.ADVAPI32(?,?,?,TypesSupported,00000000,00000004,?,00000004), ref: 1E7D172E
Part of subcall function 1E7D1620: RegCloseKey.ADVAPI32(?), ref: 1E7D1735

RegisterEventSourceW.ADVAPI32(00000000,Python Service), ref: 1E7D1836
ReportEventW.ADVAPI32(00000000,?,00000000,?,00000000,00000000,00000000,?,00000000), ref: 1E7D1858
DeregisterEventSource.ADVAPI32(00000000), ref: 1E7D1861

Strings

Warning, xrefs: 1E7D179B, 1E7D17CF
Info, xrefs: 1E7D1794
%s 0x%X - %s, xrefs: 1E7D1807
Error, xrefs: 1E7D17A2, 1E7D1806
'%s',, xrefs: 1E7D17E7
Python Service, xrefs: 1E7D182F
%s 0x%X - No message availableMessage inserts were, xrefs: 1E7D17D0
Message, xrefs: 1E7D178D

Memory Dump Source

Source File: 0000000F.00000002.1434219289.000000001E7D1000.00000040.00000001.01000000.00000015.sdmp, Offset: 1E7D0000, based on PE: true

Associated: 0000000F.00000002.1434197225.000000001E7D0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000F.00000002.1434219289.000000001E7DA000.00000040.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000F.00000002.1434284534.000000001E7DB000.00000080.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000F.00000002.1434310614.000000001E7DD000.00000004.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e7d0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Event$SourceValue$CloseCreateDeregisterFileFormatFreeLocalMessageModuleNameRegisterReport
String ID: %s 0x%X - %s$%s 0x%X - No message availableMessage inserts were$'%s',$Error$Info$Message$Python Service$Warning
API String ID: 1291031356-1119858224
Opcode ID: 681144f03a66e9611f18a05e8588019f9d75f3c869e0668e6a6fa29dbf1cc80b
Instruction ID: c79a2acd9aa300f4ca30d2f385512c3588b0003da70e9513d8842060bbd87cba
Opcode Fuzzy Hash: 681144f03a66e9611f18a05e8588019f9d75f3c869e0668e6a6fa29dbf1cc80b
Instruction Fuzzy Hash: E73129766003246BF2104A9AFC48FE737DDFBC5672F1103A5F945962A0EA61AC0987B5

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C8220 Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 101COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(?,%s is not available on this platform,RegSaveKeyEx), ref: 1E8C8240
PyArg_ParseTupleAndKeywords.PYTHON27 ref: 1E8C828C

Strings

RegSaveKeyEx, xrefs: 1E8C8235
RegSaveKeyEx, xrefs: 1E8C830A
OO|Ok:RegSaveKeyEx, xrefs: 1E8C8279
%s is not available on this platform, xrefs: 1E8C823A

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Err_FormatKeywordsParseTuple
String ID: %s is not available on this platform$OO|Ok:RegSaveKeyEx$RegSaveKeyEx$RegSaveKeyEx
API String ID: 223827023-1259186164
Opcode ID: c2645fa61a656834efdff443b0c05885f0ec4c0e6755791e725a26701c316b1d
Instruction ID: 6c4ef5ac84a8bb8a691da766c14d6203bbcbd749a5487d12e2334a6e887fb3cb
Opcode Fuzzy Hash: c2645fa61a656834efdff443b0c05885f0ec4c0e6755791e725a26701c316b1d
Instruction Fuzzy Hash: 47317AB1514211AFD300DB68CD88DABB3EAFF89215F408918F94DC3251E630E95ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C1840 Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 87threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1E8C185A
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,00000000,00000000,00000000,?,?,?), ref: 1E8C187B
PyEval_SaveThread.PYTHON27 ref: 1E8C1892
GetEnvironmentVariableA.KERNEL32(?,00000000,00000000), ref: 1E8C18A5
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C18AA
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C190D
73BB3B4E.MSVCR90(00000000), ref: 1E8C191B

Strings

O:GetEnvironmentVariable, xrefs: 1E8C184C

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_Object_String@@Thread$Arg_EnvironmentFreeParseRestoreSaveTupleU_object@@Variable
String ID: O:GetEnvironmentVariable
API String ID: 2175569948-3344723964
Opcode ID: 91800f26b6cc0bb89b82e3fc8629ff86154290a0cae5c8a237f81655dde15e72
Instruction ID: 4e6b5d66eff904c701821f54e5425f416212c7459308f03729f1a644831683c2
Opcode Fuzzy Hash: 91800f26b6cc0bb89b82e3fc8629ff86154290a0cae5c8a237f81655dde15e72
Instruction Fuzzy Hash: FB219F75504222AFE300DB65DDC8B9B77E8EF86655F000628F90DD3250D734D959C7A7

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C5B20 Relevance: 22.8, APIs: 10, Strings: 3, Instructions: 85threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,O:GetVolumeInformation,?), ref: 1E8C5B35
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,00000000,00000000,00000000), ref: 1E8C5B59
PyEval_SaveThread.PYTHON27 ref: 1E8C5B68
GetVolumeInformationA.KERNEL32(?,?,00000105,?,?,?,?,00000105), ref: 1E8C5B9B
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C5BA4
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C5BAF
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(GetVolumeInformation,00000000), ref: 1E8C5BC2

Strings

NlllN, xrefs: 1E8C5C06
GetVolumeInformation, xrefs: 1E8C5BBD
O:GetVolumeInformation, xrefs: 1E8C5B2F

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_Object_String@@ThreadU_object@@$Arg_Error@@FreeInformationParseRestoreSaveTupleVolumeWin_
String ID: GetVolumeInformation$NlllN$O:GetVolumeInformation
API String ID: 1421789331-666831025
Opcode ID: e7906ca7c3c987ac10274442d5f4883f6be1f20c91e4a47fb294281eb45e9218
Instruction ID: 4d58ad8699403ca73ebb80b53c6f01b67f0b4c1e96997fad01a7ec056afa05a5
Opcode Fuzzy Hash: e7906ca7c3c987ac10274442d5f4883f6be1f20c91e4a47fb294281eb45e9218
Instruction Fuzzy Hash: 52217C715042126FE710DBA8DC88EEB77E9ABC5315F444A19FA58C3280E634E649CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C7EF0 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 112registryCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1E8C7F21
?PyWinObject_AsHKEY@@YAHPAU_object@@PAPAUHKEY__@@@Z.PYWINTYPES27(?,?,?,?), ref: 1E8C7F40
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,?,00000001,00000000), ref: 1E8C7F5B
RegQueryValueExA.ADVAPI32(?,?,00000000,?,00000000,?), ref: 1E8C7F87
Py_BuildValue.PYTHON27(1E8D13D0,00000000,?), ref: 1E8C7FA7
73BB3B4E.MSVCR90(00000000), ref: 1E8C800D
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C801B

Strings

OO:RegQueryValueEx, xrefs: 1E8C7F03
RegQueryValueEx, xrefs: 1E8C7FF9

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_$String@@U_object@@Value$Arg_BuildFreeParseQueryTupleY__@@@
String ID: OO:RegQueryValueEx$RegQueryValueEx
API String ID: 2099248246-1921053433
Opcode ID: 4a7a1aa8182ae7015301109fcecf135db65ce4d09849cb5578d5795d36535af4
Instruction ID: 306eee98499ccb731e353381e3fbc38d9541e788477bbed4304465d9ea89da96
Opcode Fuzzy Hash: 4a7a1aa8182ae7015301109fcecf135db65ce4d09849cb5578d5795d36535af4
Instruction Fuzzy Hash: B131D672514311AFE310DF29DC88ADBB7E9EF89714F004A18F84993240E735EA45CBA7

Uniqueness

Uniqueness Score: -1.00%

Function 1E8CA420 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 99COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,OOO:EnumResourceLanguages,?,?,?), ref: 1E8CA456
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?), ref: 1E8CA474
?PyWinObject_AsResourceIdW@@YAHPAU_object@@PAPA_WH@Z.PYWINTYPES27(?,?,00000000), ref: 1E8CA496
?PyWinObject_AsResourceIdW@@YAHPAU_object@@PAPA_WH@Z.PYWINTYPES27(?,?,00000000), ref: 1E8CA4AA
PyList_New.PYTHON27(00000000), ref: 1E8CA4B4
EnumResourceLanguagesW.KERNEL32(?,?,?,Function_0000A3C0,00000000), ref: 1E8CA4D8
GetLastError.KERNEL32 ref: 1E8CA4F5
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(EnumResourceLanguages,00000000), ref: 1E8CA501
?PyWinObject_FreeResourceId@@YAXPA_W@Z.PYWINTYPES27(?), ref: 1E8CA515
?PyWinObject_FreeResourceId@@YAXPA_W@Z.PYWINTYPES27(?), ref: 1E8CA51C

Strings

EnumResourceLanguages, xrefs: 1E8CA4FC
OOO:EnumResourceLanguages, xrefs: 1E8CA43A

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_Resource$U_object@@$FreeId@@$Arg_EnumErrorError@@LanguagesLastList_ParseTupleWin_
String ID: EnumResourceLanguages$OOO:EnumResourceLanguages
API String ID: 734881567-861562290
Opcode ID: bad675ad59e1b4f3cdcd7aa72b3459a27dbeb2fa18f97708cf32a1754811467a
Instruction ID: c0774c2638d42c6cd68c8e8b35c75f2045a8551a174f4e929a104f744a97a602
Opcode Fuzzy Hash: bad675ad59e1b4f3cdcd7aa72b3459a27dbeb2fa18f97708cf32a1754811467a
Instruction Fuzzy Hash: B73150B65043119FD300DFA8DC94CDBB7EDFE89214F058A1DF98A93241E634E949CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C8EC0 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 94threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,OOi|O:WinHelp,?,?,?,?), ref: 1E8C8EEA
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?), ref: 1E8C8F07
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,?,00000000,00000000), ref: 1E8C8F64
PyEval_SaveThread.PYTHON27 ref: 1E8C8F73
WinHelpA.USER32(?,?,?,?), ref: 1E8C8F8F
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C8F98
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C8FA3
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(WinHelp,00000000), ref: 1E8C8FB9

Strings

OOi|O:WinHelp, xrefs: 1E8C8EE4
WinHelp, xrefs: 1E8C8FB4

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_U_object@@$Eval_String@@Thread$Arg_Error@@FreeHelpParseRestoreSaveTupleWin_
String ID: OOi|O:WinHelp$WinHelp
API String ID: 2453526005-3128034683
Opcode ID: 1d9c47eac0c275099b39d94e1ce04d0603552ebc67847f8fc685256d39673581
Instruction ID: 9d519815855b33ee89cc602196df56b2860816fcdacfcc6ce97c58ae3aaf2e3d
Opcode Fuzzy Hash: 1d9c47eac0c275099b39d94e1ce04d0603552ebc67847f8fc685256d39673581
Instruction Fuzzy Hash: 69318F70124242AFD300DF68CD88EABB7E9BF89255F44891CF94DC3251E734E559CB66

Uniqueness

Uniqueness Score: -1.00%

Function 1ECB3FB0 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 92COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1ECB3FD7
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?,?,?,?,?), ref: 1ECB3FF3
PyLong_AsUnsignedLongMask.PYTHON27(?,?,?,?,?,?,?,?), ref: 1ECB4006
PyErr_Occurred.PYTHON27(?,?,?,?,?,?,?), ref: 1ECB4016

Strings

lllllll, xrefs: 1ECB40A2
OO:ControlService, xrefs: 1ECB3FC1
ControlService, xrefs: 1ECB4054

Memory Dump Source

Source File: 0000000F.00000002.1435001879.000000001ECB1000.00000040.00000001.01000000.00000011.sdmp, Offset: 1ECB0000, based on PE: true

Associated: 0000000F.00000002.1434980425.000000001ECB0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBA000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBD000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435097428.000000001ECBF000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435120797.000000001ECC0000.00000004.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ecb0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Err_LongLong_MaskObject_OccurredParseTupleU_object@@Unsigned
String ID: ControlService$OO:ControlService$lllllll
API String ID: 1011514818-2272326731
Opcode ID: 9080c3d98b6f7ed1ad85338367a041548703e0efbe6c824be1291430f27f6d1d
Instruction ID: 870cc3011301549b75b3447a31a9d3b1f6ad35ffb8ec4ae74a0ace4e08ac7d9a
Opcode Fuzzy Hash: 9080c3d98b6f7ed1ad85338367a041548703e0efbe6c824be1291430f27f6d1d
Instruction Fuzzy Hash: 75319C72504201AFD304DBA8DD84D6B77E9FFC8695F08465CF89983284E734E904CBA3

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C3E10 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 91COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,OOlll:InitiateSystemShutdown,?,?,?,?,?), ref: 1E8C3E36
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,00000001,00000001,00000000), ref: 1E8C3E5C
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,?,00000001,00000000), ref: 1E8C3E73
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C3E81

Strings

OOlll:InitiateSystemShutdown, xrefs: 1E8C3E30
InitiateSystemShutdown, xrefs: 1E8C3EE0

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_String@@$U_object@@$Arg_FreeParseTuple
String ID: InitiateSystemShutdown$OOlll:InitiateSystemShutdown
API String ID: 3103853464-804409923
Opcode ID: 96ad772f2f3f91269950edf204f5dc55568f3a471627ced70e2375cca16bfaf6
Instruction ID: 312bb687a3e4b6c24a55875ec7546afeaadea95344f896822874532197890f3a
Opcode Fuzzy Hash: 96ad772f2f3f91269950edf204f5dc55568f3a471627ced70e2375cca16bfaf6
Instruction Fuzzy Hash: 5A214A76514311AFD300DB68CC89EEB73E9FFC9204F84494DFA8993251E734E6498BA2

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C6230 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 89COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(?,%s is not available on this platform,RegCopyTree), ref: 1E8C6250
PyArg_ParseTupleAndKeywords.PYTHON27(?,?,OOO:RegCopyTree,1E8D7014,?,?,?), ref: 1E8C6285

Strings

RegCopyTree, xrefs: 1E8C62F8
RegCopyTree, xrefs: 1E8C6245
OOO:RegCopyTree, xrefs: 1E8C627A
%s is not available on this platform, xrefs: 1E8C624A

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Err_FormatKeywordsParseTuple
String ID: %s is not available on this platform$OOO:RegCopyTree$RegCopyTree$RegCopyTree
API String ID: 223827023-3951061800
Opcode ID: f6da3e202515ed75e992b77df770d76144eb07fc6488c06f22be3db4ef3cb937
Instruction ID: 0982ed2fd7570e109c5b7dfbab82c95aa3b7c237e9d778a7a5a00602a13ee555
Opcode Fuzzy Hash: f6da3e202515ed75e992b77df770d76144eb07fc6488c06f22be3db4ef3cb937
Instruction Fuzzy Hash: 35215EB1504312AFD200DF68CC94DABB7E9BFC5649F044A18F889C3251E730E94ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C75C0 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 89threadregistryCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,OOO:RegLoadKey,?,?,?), ref: 1E8C75E7
?PyWinObject_AsHKEY@@YAHPAU_object@@PAPAUHKEY__@@@Z.PYWINTYPES27(?,?), ref: 1E8C7604
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,?,00000000,00000000), ref: 1E8C7623
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,?,00000000,00000000), ref: 1E8C7638
PyEval_SaveThread.PYTHON27 ref: 1E8C7642
RegLoadKeyA.ADVAPI32(?,?,?), ref: 1E8C7659
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C7662
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(RegLoadKey,00000000), ref: 1E8C7676
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C7699
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C76A0

Strings

RegLoadKey, xrefs: 1E8C7671
OOO:RegLoadKey, xrefs: 1E8C75D9

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_$String@@U_object@@$Eval_FreeThread$Arg_Error@@LoadParseRestoreSaveTupleWin_Y__@@@
String ID: OOO:RegLoadKey$RegLoadKey
API String ID: 3033533871-1174909360
Opcode ID: 8652c88fa7ee4dcd08550c00fa0d9839e84c6e7ab9836332b9de4efceaa55a91
Instruction ID: db769196a775b7d40aa12ac4039b55a1420bc7a0fae478c4ca9803d7bbc214b5
Opcode Fuzzy Hash: 8652c88fa7ee4dcd08550c00fa0d9839e84c6e7ab9836332b9de4efceaa55a91
Instruction Fuzzy Hash: 4E215EB2504311AFE700EF68DDC4CAB77EDAE89254F444A1DF949D3201E631E949CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 03255860 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 88memoryCOMMON

Download Yara Rule

APIs

PyErr_SetFromWindowsErr.PYTHON27(00000000), ref: 0325587F
PyErr_SetString.PYTHON27(?,GetSystemInfo() failed to retrieve CPU count), ref: 032558B1
LocalAlloc.KERNEL32(00000040), ref: 032558CC
PyErr_SetFromWindowsErr.PYTHON27(00000000), ref: 032558D9

Strings

CallNtPowerInformation syscall failed, xrefs: 032558FF
GetSystemInfo() failed to retrieve CPU count, xrefs: 032558AB
GetActiveProcessorCount() not available; using GetSystemInfo(), xrefs: 0325588D

Memory Dump Source

Source File: 0000000F.00000002.1423676562.0000000003251000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03250000, based on PE: true

Associated: 0000000F.00000002.1423656216.0000000003250000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423775563.0000000003263000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3250000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Err_$FromWindows$AllocLocalString
String ID: CallNtPowerInformation syscall failed$GetActiveProcessorCount() not available; using GetSystemInfo()$GetSystemInfo() failed to retrieve CPU count
API String ID: 1553409448-865213082
Opcode ID: 73e0a3a077b091f94696340c1732f27f4769ae423a018146015c86e0673a38dc
Instruction ID: fa2ae6333ee6998af76cfacd9c2807080191255eaf94825f348a0ad1a32172f8
Opcode Fuzzy Hash: 73e0a3a077b091f94696340c1732f27f4769ae423a018146015c86e0673a38dc
Instruction Fuzzy Hash: D921DE33A51311ABD720ABA8BC4CF8B3368EF85B22F184020FD06D7244D734EAD4C6A5

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C8030 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 86COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(?,%s is not available on this platform,RegRestoreKey), ref: 1E8C8050
PyArg_ParseTupleAndKeywords.PYTHON27(?,?,OO|k:RegRestoreKey,1E8D7088,?,?,?), ref: 1E8C8089

Strings

RegRestoreKey, xrefs: 1E8C8045
RegRestoreKey, xrefs: 1E8C80E5
%s is not available on this platform, xrefs: 1E8C804A
OO|k:RegRestoreKey, xrefs: 1E8C807A

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Err_FormatKeywordsParseTuple
String ID: %s is not available on this platform$OO|k:RegRestoreKey$RegRestoreKey$RegRestoreKey
API String ID: 223827023-2315993601
Opcode ID: 34767345ae3486f3f1005ad0ceb3aedce25f7ebefa6af06e1068dbd61f4711da
Instruction ID: 1d57f0b7dc2aa30f1588a0fa50cc106ba422c4a5bdb0fce39d4f22198050bbf6
Opcode Fuzzy Hash: 34767345ae3486f3f1005ad0ceb3aedce25f7ebefa6af06e1068dbd61f4711da
Instruction Fuzzy Hash: 01216DB1514221AFD204DF18CD889DBB3E9FF89A15F448618F84DD3311E631E959CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 03255E90 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 84COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,0325253C,00000000,?,0325253C,?), ref: 03255EA7
GetLastError.KERNEL32(?,0325253C,?), ref: 03255EB3

Strings

OpenProcess(PROCESS_VM_READ), xrefs: 03255EE2
pir: OpenProcess() -> INVALID_PARAMETER, xrefs: 03255EBE
GetExitCodeProcess, xrefs: 03255F58
pir: GetExitCodeProcess() -> ERROR_ACCESS_DENIED, xrefs: 03255F3F
pir: OpenProcess() ACCESS_DENIED, xrefs: 03255EDB
pir: GetExitCodeProcess() -> STILL_ACTIVE, xrefs: 03255F16

Memory Dump Source

Source File: 0000000F.00000002.1423676562.0000000003251000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03250000, based on PE: true

Associated: 0000000F.00000002.1423656216.0000000003250000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423775563.0000000003263000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3250000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: ErrorLastOpenProcess
String ID: GetExitCodeProcess$OpenProcess(PROCESS_VM_READ)$pir: GetExitCodeProcess() -> ERROR_ACCESS_DENIED$pir: GetExitCodeProcess() -> STILL_ACTIVE$pir: OpenProcess() -> INVALID_PARAMETER$pir: OpenProcess() ACCESS_DENIED
API String ID: 919517065-509861091
Opcode ID: 6fa7123c7fc4d2ae12ef43d962d214d343162316e367dc53556cf2f31f059667
Instruction ID: 0f7bc24717c18f12f7812ef6e1dd90562c2e380a155ccd83db687fc9e052358e
Opcode Fuzzy Hash: 6fa7123c7fc4d2ae12ef43d962d214d343162316e367dc53556cf2f31f059667
Instruction Fuzzy Hash: 26113B766B8322AACA10E57CBC4D9AF336C9F83A31B648261FC26D5588F774D7C085D1

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C1510 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 84COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1E8C1534
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,00000000,00000000,00000000,?,?,?,?,?,?), ref: 1E8C155A
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,?,00000000,00000000,?,?,?,?,?,?,?,?,?), ref: 1E8C1571
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1E8C157F

Strings

CopyFile, xrefs: 1E8C15D4
OO|i:CopyFile, xrefs: 1E8C1526

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_String@@$U_object@@$Arg_FreeParseTuple
String ID: CopyFile$OO|i:CopyFile
API String ID: 3103853464-317066227
Opcode ID: 746ddc09d9fa6dc34148626cf1ff41e6febbb03f3fe9b5fd226b44c5bbb2fbbb
Instruction ID: b84d3b3e2b9da1d41e1f228d1f595a2875256bb4020c8dbf0bd581cffc15d9cf
Opcode Fuzzy Hash: 746ddc09d9fa6dc34148626cf1ff41e6febbb03f3fe9b5fd226b44c5bbb2fbbb
Instruction Fuzzy Hash: C5218175514211AFE304DB68CCC9FEB73E8EF89604F848959F94DD3241E630E9488BA2

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C3A90 Relevance: 21.1, APIs: 10, Strings: 2, Instructions: 83threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,O:GetModuleFileName,?), ref: 1E8C3AAF
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?), ref: 1E8C3ACE
73BB3B4E.MSVCR90(00000000), ref: 1E8C3AE5
PyEval_SaveThread.PYTHON27 ref: 1E8C3B00
GetModuleFileNameA.KERNEL32(?,00000000,00000104), ref: 1E8C3B0F
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C3B18
PyErr_NoMemory.PYTHON27 ref: 1E8C3B2C
73BB3B4E.MSVCR90(00000000), ref: 1E8C3B5B

Strings

GetModuleFileName, xrefs: 1E8C3B36
O:GetModuleFileName, xrefs: 1E8C3A9E

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_Thread$Arg_Err_FileMemoryModuleNameObject_ParseRestoreSaveTupleU_object@@
String ID: GetModuleFileName$O:GetModuleFileName
API String ID: 1490344696-2842272935
Opcode ID: 03d403be442bc3eed99ebb5c07f02df8a46e78307f5bda0b06023e0ec0911065
Instruction ID: 53940a33e794e5847157e4a735daf2c544b7d082e00d4bc445c4151c0c8c9cb8
Opcode Fuzzy Hash: 03d403be442bc3eed99ebb5c07f02df8a46e78307f5bda0b06023e0ec0911065
Instruction Fuzzy Hash: E321C575404211AFE300DB69AC8C9DBB7E9BFC2615F040668FD4EC3201E731D65AC6A7

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C6800 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 81COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(?,%s is not available on this platform,RegDeleteTree), ref: 1E8C6820
PyArg_ParseTupleAndKeywords.PYTHON27(?,?,OO:RegDeleteTree,1E8D7058,?,?), ref: 1E8C6850

Strings

RegDeleteTree, xrefs: 1E8C68A8
RegDeleteTree, xrefs: 1E8C6815
OO:RegDeleteTree, xrefs: 1E8C6845
%s is not available on this platform, xrefs: 1E8C681A

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Err_FormatKeywordsParseTuple
String ID: %s is not available on this platform$OO:RegDeleteTree$RegDeleteTree$RegDeleteTree
API String ID: 223827023-1985079115
Opcode ID: e086dc3ab64c79f64efc9e6e5591929dc87e1a73162660bd0920310d61f102e5
Instruction ID: 040caf5378a44e35a8b4502c4df40e7e10b3274990dc3c32fb4c763f1d9a927c
Opcode Fuzzy Hash: e086dc3ab64c79f64efc9e6e5591929dc87e1a73162660bd0920310d61f102e5
Instruction Fuzzy Hash: 762160B5500221AFE700DB58CC889EB73E9FF85749F848918F85DD3351E231E959CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C29E0 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 79COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,:GetConsoleTitle), ref: 1E8C29F8
SetLastError.KERNEL32(00000000), ref: 1E8C2A0B
73BB3B4E.MSVCR90(00000000), ref: 1E8C2A1D
GetConsoleTitleA.KERNEL32(00000000,00000400), ref: 1E8C2A3D
GetLastError.KERNEL32 ref: 1E8C2A45
?PyWinObject_FromTCHAR@@YAPAU_object@@PBDH@Z.PYWINTYPES27(00000000,000000FF), ref: 1E8C2A57
73BB3B4E.MSVCR90(00000000), ref: 1E8C2A63

Strings

:GetConsoleTitle, xrefs: 1E8C29E7
GetConsoleTitle: unable to allocate %d bytes, xrefs: 1E8C2A7C
GetConsoleTitle, xrefs: 1E8C2A93

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: ErrorLast$Arg_ConsoleFromObject_ParseTitleTupleU_object@@
String ID: :GetConsoleTitle$GetConsoleTitle$GetConsoleTitle: unable to allocate %d bytes
API String ID: 221919973-4097672822
Opcode ID: ae87bfdaff589fe9f2782dacb00f6526f95543153cea977352e9ab3ed3f39dac
Instruction ID: 56e757ac0e8889e62d4ddda27037944d67db03f8b04a98897218bd30d371e9b0
Opcode Fuzzy Hash: ae87bfdaff589fe9f2782dacb00f6526f95543153cea977352e9ab3ed3f39dac
Instruction Fuzzy Hash: A3112C766416315FE2119769AC8CACB77D5EFC7B76F140225F90EC3380D730D44186A6

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C35C0 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 66threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,O:GetFileAttributes), ref: 1E8C35CF
PyEval_SaveThread.PYTHON27 ref: 1E8C35F0
GetFileAttributesA.KERNEL32(?), ref: 1E8C3600
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C3628
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(GetFileAttributes,00000000), ref: 1E8C363D

Strings

pathName arg must be string or unicode, xrefs: 1E8C3665
GetFileAttributes, xrefs: 1E8C3638
O:GetFileAttributes, xrefs: 1E8C35C9

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_Thread$Arg_AttributesError@@FileParseRestoreSaveTupleU_object@@Win_
String ID: GetFileAttributes$O:GetFileAttributes$pathName arg must be string or unicode
API String ID: 1146278787-533566742
Opcode ID: b07d0bd861b3969a7672670ed8560af901903c2490bdf57cd8034a3fb870de05
Instruction ID: d80e112462cd3708e11500b21013632e73c2a4cbc39ff36c3ddb443d9e22c4fb
Opcode Fuzzy Hash: b07d0bd861b3969a7672670ed8560af901903c2490bdf57cd8034a3fb870de05
Instruction Fuzzy Hash: A811C471600110AFE30097B9EC8CECA77E9EF86266F108269F94EC3391CB30D592DA61

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C7050 Relevance: 19.7, APIs: 13, Instructions: 159COMMON

Download Yara Rule

APIs

PyErr_NoMemory.PYTHON27 ref: 1E8C708A
?PyWinObject_FromTCHAR@@YAPAU_object@@PBDH@Z.PYWINTYPES27(1E8CF587,000000FF), ref: 1E8C718C
?PyWinObject_AsMultipleString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,?,00000001), ref: 1E8C71D3
?PyWinObject_AsReadBuffer@@YAHPAU_object@@PAPAXPAKH@Z.PYWINTYPES27(?,?,?,00000001), ref: 1E8C71EB

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_U_object@@$Buffer@@Err_FromMemoryMultipleReadString@@
String ID:
API String ID: 3829625989-0
Opcode ID: 077a660928327377741a5378f25fb64cf86d25a3f417acdde52cc903b11eed7b
Instruction ID: 8275b145f2a1b815e64553742487605387e77bf2e640b7dc9a2f97e5a6ab76f9
Opcode Fuzzy Hash: 077a660928327377741a5378f25fb64cf86d25a3f417acdde52cc903b11eed7b
Instruction Fuzzy Hash: 49414FB52001129FE710AFBCE8C87D977E5EF86331F20426AE559CB290D772D492DB61

Uniqueness

Uniqueness Score: -1.00%

Function 03254BC7 Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 234COMMON

Download Yara Rule

APIs

PyList_New.PYTHON27(00000000), ref: 03254C5B
PyArg_ParseTuple.PYTHON27(?,0325B81C,?), ref: 03254C8B
VirtualQueryEx.KERNEL32(00000000,00000000,?,0000001C), ref: 03254CCC
GetMappedFileNameW.PSAPI(00000000,?,?,00000208), ref: 03254CF6
PyUnicodeUCS2_FromWideChar.PYTHON27(?,?,00000000,?,?,00000208), ref: 03254D25
Py_BuildValue.PYTHON27((ksOI),?,00000000,?), ref: 03254D52
PyList_Append.PYTHON27(?,00000000), ref: 03254D67

Strings

(ksOI), xrefs: 03254D4D

Memory Dump Source

Source File: 0000000F.00000002.1423676562.0000000003251000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03250000, based on PE: true

Associated: 0000000F.00000002.1423656216.0000000003250000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423775563.0000000003263000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3250000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: List_$AppendArg_BuildCharFileFromMappedNameParseQueryTupleUnicodeValueVirtualWide
String ID: (ksOI)
API String ID: 1590903978-3583691019
Opcode ID: 9e31b6fe239f3a8b653f3db9871e3c0e71d0713ef5723e7b04e3d39b027403a8
Instruction ID: 391969c78a3d1e6e0859b486d7cf0ec16323ef157df8c07056a13970c17658ff
Opcode Fuzzy Hash: 9e31b6fe239f3a8b653f3db9871e3c0e71d0713ef5723e7b04e3d39b027403a8
Instruction Fuzzy Hash: 355109715013469FD710EF60EC88AA7B7A8EF81720F094668FD558B245E334EAC5CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 03251970 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 106COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 032519B0
73BB3B4E.MSVCR90(00000000), ref: 032519C0
GetLogicalProcessorInformationEx.KERNELBASE(0000FFFF,00000000,?), ref: 032519E8
73BB3B4E.MSVCR90(00000000), ref: 03251A14
Py_BuildValue.PYTHON27(0325B284,00000000), ref: 03251A27

Strings

GetLogicalProcessorInformationEx() returned , xrefs: 03251A4B
GetLogicalProcessorInformationEx() count was 0, xrefs: 03251A65
Win < 7; cpu_count_phys() forced to None, xrefs: 0325198C

Memory Dump Source

Source File: 0000000F.00000002.1423676562.0000000003251000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03250000, based on PE: true

Associated: 0000000F.00000002.1423656216.0000000003250000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423775563.0000000003263000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3250000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: BuildErrorInformationLastLogicalProcessorValue
String ID: GetLogicalProcessorInformationEx() count was 0$GetLogicalProcessorInformationEx() returned $Win < 7; cpu_count_phys() forced to None
API String ID: 2362883678-2290087675
Opcode ID: a7fd109b3b37e205933f235ba8be7d04e23eae1dbc1ca5af49553f5382ba07f7
Instruction ID: 88bb1fd5caa2507243cb541ad86fe558ecc4c16521a802acfd21d2d324329c49
Opcode Fuzzy Hash: a7fd109b3b37e205933f235ba8be7d04e23eae1dbc1ca5af49553f5382ba07f7
Instruction Fuzzy Hash: C531F732A103169FCB11EB64FC48A7FB758EF81652B188174FC15C6204EB75A7A9C7E2

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C9FB0 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 101COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,OOOO|H:UpdateResource,?,?,?,?,?), ref: 1E8C9FE5
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?), ref: 1E8CA002
?PyWinObject_AsResourceIdW@@YAHPAU_object@@PAPA_WH@Z.PYWINTYPES27(?,?,00000000), ref: 1E8CA024
?PyWinObject_AsResourceIdW@@YAHPAU_object@@PAPA_WH@Z.PYWINTYPES27(?,?,00000000), ref: 1E8CA038
?PyWinObject_AsReadBuffer@@YAHPAU_object@@PAPAXPAKH@Z.PYWINTYPES27(?,?,?,00000001), ref: 1E8CA052
UpdateResourceW.KERNEL32(?,?,?,?,?,?), ref: 1E8CA07D
?PyWinObject_FreeResourceId@@YAXPA_W@Z.PYWINTYPES27(?), ref: 1E8CA0B0
?PyWinObject_FreeResourceId@@YAXPA_W@Z.PYWINTYPES27(?), ref: 1E8CA0B7

Strings

OOOO|H:UpdateResource, xrefs: 1E8C9FD3
UpdateResource, xrefs: 1E8CA097

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_$Resource$U_object@@$FreeId@@$Arg_Buffer@@ParseReadTupleUpdate
String ID: OOOO|H:UpdateResource$UpdateResource
API String ID: 132849400-879542628
Opcode ID: 0cd9e45aa350622be9a3e14041c4ede15daaaeb799517808782204baf7c2d153
Instruction ID: fd8078a47d40d457e9ba2da89bd67ec3d6951b53395f9d389f6f4cdec9179e88
Opcode Fuzzy Hash: 0cd9e45aa350622be9a3e14041c4ede15daaaeb799517808782204baf7c2d153
Instruction Fuzzy Hash: BF3119B6514341AFD304DF59CC94DABB7E9BFC9244F048A0DF989D3240EA31EA44CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1E8CBA00 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 97COMMON

Download Yara Rule

APIs

PyGILState_Ensure.PYTHON27 ref: 1E8CBA1B
Py_BuildValue.PYTHON27((i),?), ref: 1E8CBA3B
PyGILState_Release.PYTHON27(00000000), ref: 1E8CBA4B
PyObject_Call.PYTHON27(?,00000000,00000000), ref: 1E8CBA9F
PySys_WriteStderr.PYTHON27(ConsoleCtrlHandler function failed), ref: 1E8CBAAF
PyErr_Print.PYTHON27 ref: 1E8CBAB8
PyErr_Clear.PYTHON27 ref: 1E8CBABE
PyGILState_Release.PYTHON27(?), ref: 1E8CBB01

Strings

(i), xrefs: 1E8CBA32
ConsoleCtrlHandler function failed, xrefs: 1E8CBAAA

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: State_$Err_Release$BuildCallClearEnsureObject_PrintStderrSys_ValueWrite
String ID: (i)$ConsoleCtrlHandler function failed
API String ID: 4176950722-3292405424
Opcode ID: e604332fc568f453b9d3cd10b08c4b301b17788021c8d800f8076ecd8a80aeaa
Instruction ID: 97a5726d800a9ee6c9b267abc8ac720d6e1804a5f7b231dfc411550cc3870f6d
Opcode Fuzzy Hash: e604332fc568f453b9d3cd10b08c4b301b17788021c8d800f8076ecd8a80aeaa
Instruction Fuzzy Hash: 933106B2540B519FD300DF58D888A8BB7E4FB46724F044B29F84A87750D739ED81CB92

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C9220 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 94threadwindowCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1E8C926A
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?,?,?,?,?,?,?,?), ref: 1E8C9287
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,?,00000000,00000000,?,?,?,?,?,?,?,?), ref: 1E8C92A6
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,?,00000001,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1E8C92BC
PyEval_SaveThread.PYTHON27(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1E8C92C5
MessageBoxExA.USER32(?,?,?,?,?), ref: 1E8C92E6
PyEval_RestoreThread.PYTHON27(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1E8C92EF
Py_BuildValue.PYTHON27(1E8D1780,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1E8C92FB
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?,?,?,?,?,?,?,?,?), ref: 1E8C9311
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?,?,?,?,?,?,?,?,?), ref: 1E8C9318

Strings

OO|Oli:MessageBox(Ex), xrefs: 1E8C924C

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_$String@@$U_object@@$Eval_FreeThread$Arg_BuildMessageParseRestoreSaveTupleValue
String ID: OO|Oli:MessageBox(Ex)
API String ID: 619529236-3619530671
Opcode ID: 1bbc5ed398ed5761120f78669298df9200f0a1989dbffead5a3db7215f20e15e
Instruction ID: a04408fa2644c845f173f4c730ed22b115f0f5b651eb1b3156f58a6fdb298661
Opcode Fuzzy Hash: 1bbc5ed398ed5761120f78669298df9200f0a1989dbffead5a3db7215f20e15e
Instruction Fuzzy Hash: 9B314EB2504311AFD304DFA9DD84C9BB7E9AFC9614F044A0DF989D3250E730D949CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C69C0 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 93registryCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,Oi:RegEnumKey,?,?), ref: 1E8C69D9
?PyWinObject_AsHKEY@@YAHPAU_object@@PAPAUHKEY__@@@Z.PYWINTYPES27(?,?), ref: 1E8C69F9
RegQueryInfoKeyA.ADVAPI32(?,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000), ref: 1E8C6A22
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(RegQueryInfoKey,00000000), ref: 1E8C6A32

Strings

Oi:RegEnumKey, xrefs: 1E8C69D3
RegQueryInfoKey, xrefs: 1E8C6A2D
RegEnumKey, xrefs: 1E8C6A69

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: U_object@@$Arg_Error@@InfoObject_ParseQueryTupleWin_Y__@@@
String ID: Oi:RegEnumKey$RegEnumKey$RegQueryInfoKey
API String ID: 1520217418-336487990
Opcode ID: f5aacfa418798ca1b384e398378a0eda06950a28b611639fb3efa39e33725bef
Instruction ID: 37cf65dfacb88f3f2d66db031d035c8689c27e9f145bb02fa306ddb16131ae5a
Opcode Fuzzy Hash: f5aacfa418798ca1b384e398378a0eda06950a28b611639fb3efa39e33725bef
Instruction Fuzzy Hash: FB21B835A00118ABDB10DB99DC4ABFF777DEB85625F004265FE18D3240EB30A565D7E1

Uniqueness

Uniqueness Score: -1.00%

Function 1E8CC7D0 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 87COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(?,%s is not available on this platform,EnumDisplaySettingsEx), ref: 1E8CC7F3
PyArg_ParseTupleAndKeywords.PYTHON27(?,?,|Okk:EnumDisplaySettingsEx,1E8D7F80,?,?,?), ref: 1E8CC843

Strings

%s is not available on this platform, xrefs: 1E8CC7ED
EnumDisplaySettingsEx, xrefs: 1E8CC8B0
|Okk:EnumDisplaySettingsEx, xrefs: 1E8CC830
EnumDisplaySettingsEx, xrefs: 1E8CC7E8

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Err_FormatKeywordsParseTuple
String ID: %s is not available on this platform$EnumDisplaySettingsEx$EnumDisplaySettingsEx$|Okk:EnumDisplaySettingsEx
API String ID: 223827023-1665988883
Opcode ID: 59bf1633497b1cd8ca634a5840f14c559329578e8ea7eba20c916d213a056d8e
Instruction ID: 7eb45e5e3b26c37f8ff8979245972a44c19be8e58934fc529b4c2dbc2d2ac67b
Opcode Fuzzy Hash: 59bf1633497b1cd8ca634a5840f14c559329578e8ea7eba20c916d213a056d8e
Instruction Fuzzy Hash: B63147B1514311ABE214DB28DC88FAB7BE8FF89644F404A28F48993241E334D958CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 1E8CA1C0 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 84COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1E8CA1DF
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?), ref: 1E8CA1FC
?PyWinObject_AsResourceIdA@@YAHPAU_object@@PAPADH@Z.PYWINTYPES27(?,00000000,00000000), ref: 1E8CA215
PyList_New.PYTHON27(00000000), ref: 1E8CA225
EnumResourceNamesA.KERNEL32(?,?,Function_0000A150,00000000), ref: 1E8CA244
PyErr_Occurred.PYTHON27 ref: 1E8CA24E
?PyWinObject_FreeResourceId@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8CA2A0

Strings

OO:EnumResourceNames, xrefs: 1E8CA1D1
EnumResourceNames, xrefs: 1E8CA27A

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_Resource$U_object@@$Arg_EnumErr_FreeId@@List_NamesOccurredParseTuple
String ID: EnumResourceNames$OO:EnumResourceNames
API String ID: 1632480692-2028383064
Opcode ID: d962eb60ba70a29a62c4f3619c56ab9a1a567397f324369c3388793ed8431768
Instruction ID: 1a21ba4367a68eda478ebbd9f826bae8ad56db6ae5c82ea57088a47b18ab3c35
Opcode Fuzzy Hash: d962eb60ba70a29a62c4f3619c56ab9a1a567397f324369c3388793ed8431768
Instruction Fuzzy Hash: E4219474500222AFE310DBB4CD88ADBB7E9BF82615F004B59F95EC3290E735D945CB92

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C5E10 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 83threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,OOi:MoveFileEx,?,?,?), ref: 1E8C5E40
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,?,00000000,00000000), ref: 1E8C5E65
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,?,00000001,00000000), ref: 1E8C5E7B
PyEval_SaveThread.PYTHON27 ref: 1E8C5E85
MoveFileExA.KERNEL32(?,?,?), ref: 1E8C5E9C
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C5EA5
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(MoveFileEx,00000000), ref: 1E8C5EB9
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C5EDC
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C5EE3

Strings

OOi:MoveFileEx, xrefs: 1E8C5E32
MoveFileEx, xrefs: 1E8C5EB4

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_String@@$U_object@@$Eval_FreeThread$Arg_Error@@FileMoveParseRestoreSaveTupleWin_
String ID: MoveFileEx$OOi:MoveFileEx
API String ID: 89984253-2883942482
Opcode ID: b984fb99cb5dbb6b12cce05005d1ffec4fdb9675b059858311653e19e7322bde
Instruction ID: f0a65ab3573a85b271c616647f5610e6dad7bd9527d889b3995a486c4b6877fa
Opcode Fuzzy Hash: b984fb99cb5dbb6b12cce05005d1ffec4fdb9675b059858311653e19e7322bde
Instruction Fuzzy Hash: 84213CB2514316AFE704DF68CCC8CAB77E9FB89644F44491EF949C3211E634E9498BB2

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C50B0 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 80timeCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1E8C50CF
GetTimeZoneInformation.KERNEL32(?), ref: 1E8C50E9
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(GetTimeZoneInformation,00000000), ref: 1E8C50FD

Strings

i,(lNNlNNl), xrefs: 1E8C518B
|i:GetTimeZoneInformation, xrefs: 1E8C50C1
GetTimeZoneInformation, xrefs: 1E8C50F8

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Error@@InformationParseTimeTupleU_object@@Win_Zone
String ID: GetTimeZoneInformation$i,(lNNlNNl)$|i:GetTimeZoneInformation
API String ID: 964415491-3450524445
Opcode ID: a1f87bed195bc0ea6df67117905399b7c4b1cb089babefed9294ee77dd3cfb15
Instruction ID: 10fb71efeaef5aa3d3aaa8682fefefe93d61082b38ceafc91edbb58e4ccda36d
Opcode Fuzzy Hash: a1f87bed195bc0ea6df67117905399b7c4b1cb089babefed9294ee77dd3cfb15
Instruction Fuzzy Hash: 4B217171504304ABE6209765DC88FEB73EDAFC5364F448A2AF54D83240E779E5588BA3

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C7820 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 80threadregistryCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1E8C7859
?PyWinObject_AsHKEY@@YAHPAU_object@@PAPAUHKEY__@@@Z.PYWINTYPES27(?,?,?,?,?,?,?,?), ref: 1E8C7876
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,00000001,00000001,00000000,?,?,?,?,?,?,?,?), ref: 1E8C7891
PyEval_SaveThread.PYTHON27(?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1E8C78A0
RegOpenKeyExA.ADVAPI32(?,?,?,?,?), ref: 1E8C78C1
PyEval_RestoreThread.PYTHON27(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1E8C78CA
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1E8C78D5
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(RegOpenKeyEx,00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1E8C78E8

Strings

OO|ii:RegOpenKey, xrefs: 1E8C783B
RegOpenKeyEx, xrefs: 1E8C78E3

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_U_object@@$Eval_String@@Thread$Arg_Error@@FreeOpenParseRestoreSaveTupleWin_Y__@@@
String ID: OO|ii:RegOpenKey$RegOpenKeyEx
API String ID: 3232511256-2694016402
Opcode ID: 70e2d97c4afcf28e4b94b41bf58667ee37d8104f41d881504cb8ac338e23deb0
Instruction ID: 32dce3f2eaf2d03c8efc364cc67ad8f30cbc112fb9b9832833d0b9210998b13c
Opcode Fuzzy Hash: 70e2d97c4afcf28e4b94b41bf58667ee37d8104f41d881504cb8ac338e23deb0
Instruction Fuzzy Hash: 43214B75504311AFD300DB68CC88AAB77E8EFC9605F448A1CF94993241E735E659CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 1ECB3C10 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 78threadserviceCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1ECB3C44
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?,?,?,?,?,?), ref: 1ECB3C61
?PyWinObject_AsWCHAR@@YAHPAU_object@@PAPA_WHPAK@Z.PYWINTYPES27(?,00000000,00000000,00000000,?,?,?,?,?,?,?), ref: 1ECB3C7C
PyEval_SaveThread.PYTHON27(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1ECB3C8B
OpenServiceW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1ECB3CA2
PyEval_RestoreThread.PYTHON27(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1ECB3CAB
?PyWinObject_FreeWCHAR@@YAXPA_W@Z.PYWINTYPES27(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1ECB3CBD
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(OpenService,00000000,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1ECB3CC9

Strings

OpenService, xrefs: 1ECB3CC4
OOl:OpenService, xrefs: 1ECB3C26

Memory Dump Source

Source File: 0000000F.00000002.1435001879.000000001ECB1000.00000040.00000001.01000000.00000011.sdmp, Offset: 1ECB0000, based on PE: true

Associated: 0000000F.00000002.1434980425.000000001ECB0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBA000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBD000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435097428.000000001ECBF000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435120797.000000001ECC0000.00000004.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ecb0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_U_object@@$Eval_Thread$Arg_Error@@FreeOpenParseRestoreSaveServiceTupleWin_
String ID: OOl:OpenService$OpenService
API String ID: 387567726-720578341
Opcode ID: db47457a082ec8a134afff72ea83d67076f8c009d365c7a0eaf7ecda76d009b0
Instruction ID: 4be84bdd9f9ccf9d7dff6088a125e1482b83c7d2bbf4197eaf6f86df1db3739e
Opcode Fuzzy Hash: db47457a082ec8a134afff72ea83d67076f8c009d365c7a0eaf7ecda76d009b0
Instruction Fuzzy Hash: E72186B5504211AFD300DF68CD89B5B7BE8AFC4B95F444A68F949C2211E734D918CBB3

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C3490 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 73threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1E8C34B3
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,00000001,00000001,00000000), ref: 1E8C34D4
PyEval_SaveThread.PYTHON27 ref: 1E8C34E3
GetDiskFreeSpaceExA.KERNEL32(?,?,?,?), ref: 1E8C34FF
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C3508
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C3513
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(GetDiskSpaceFreeEx,00000000), ref: 1E8C3529

Strings

LLL, xrefs: 1E8C3554
GetDiskSpaceFreeEx, xrefs: 1E8C3524
|O:GetDiskFreeSpaceEx, xrefs: 1E8C34A1

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_FreeObject_String@@ThreadU_object@@$Arg_DiskError@@ParseRestoreSaveSpaceTupleWin_
String ID: GetDiskSpaceFreeEx$LLL$|O:GetDiskFreeSpaceEx
API String ID: 2423468851-1562949391
Opcode ID: 5a173eee4af35ab75be0b959351217a3d524f8ba8fd3c20215730fe30630348c
Instruction ID: bb88ae2d1c52611ff98d0636c29635e54f5d75a69918f2fccea0bd7e8743a893
Opcode Fuzzy Hash: 5a173eee4af35ab75be0b959351217a3d524f8ba8fd3c20215730fe30630348c
Instruction Fuzzy Hash: F6216D75504211BFE300CBA5CD88E9BB7E8AFC9615F448A0CF94DC3240E730EA85CB62

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C16E0 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 71fileCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1E8C1704
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?), ref: 1E8C1724
DragQueryFile.SHELL32(?,000000FF,00000000,00000000), ref: 1E8C1742
Py_BuildValue.PYTHON27(1E8CF754,00000000), ref: 1E8C174E

Strings

DragQueryFile, xrefs: 1E8C1796
O|i:DragQueryFile, xrefs: 1E8C16F6

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_BuildDragFileObject_ParseQueryTupleU_object@@Value
String ID: DragQueryFile$O|i:DragQueryFile
API String ID: 1170003328-4176030986
Opcode ID: cf84baf4f7cb553f2315c8198ce27056a18c430d6a122e40438565ca5875514a
Instruction ID: a0672eba7f82cc965d7f98df8014b784467443d94df7ebe7f4d4e57ffecd2ede
Opcode Fuzzy Hash: cf84baf4f7cb553f2315c8198ce27056a18c430d6a122e40438565ca5875514a
Instruction Fuzzy Hash: 1021A1B55042016FE7108B64CC89FDB77E8AF86321F004A28FA6D832D0E775D1D58AA2

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C33B0 Relevance: 19.3, APIs: 8, Strings: 3, Instructions: 71threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1E8C33D3
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,00000001,00000001,00000000), ref: 1E8C33F4
PyEval_SaveThread.PYTHON27 ref: 1E8C3403
GetDiskFreeSpaceA.KERNEL32(?,?,?,?,?), ref: 1E8C3424
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C342D
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C3438
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(GetDiskSpaceFree,00000000), ref: 1E8C344E

Strings

(iiii), xrefs: 1E8C346F
|O:GetDiskFreeSpace, xrefs: 1E8C33C1
GetDiskSpaceFree, xrefs: 1E8C3449

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_FreeObject_String@@ThreadU_object@@$Arg_DiskError@@ParseRestoreSaveSpaceTupleWin_
String ID: (iiii)$GetDiskSpaceFree$|O:GetDiskFreeSpace
API String ID: 2423468851-3240110619
Opcode ID: cf74ea3fb0b384af92f51f12907a686cd0bb0cad235224c32ed5ab4dcbe0252d
Instruction ID: 00c4c8651a69bba7fc2e630e5ae722c79234188095a7c49ec141697e07d4cef4
Opcode Fuzzy Hash: cf74ea3fb0b384af92f51f12907a686cd0bb0cad235224c32ed5ab4dcbe0252d
Instruction Fuzzy Hash: 2C2149B5504301AFE300DB68CC89EDB77E8BFC9605F448A1CFA4983251E735E649CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C40C0 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 70threadlibraryCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,OOl:LoadLibraryEx,?,?,?), ref: 1E8C40DC
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?), ref: 1E8C40F9
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,00000000,00000000,00000000), ref: 1E8C4114
PyEval_SaveThread.PYTHON27 ref: 1E8C4123
LoadLibraryExA.KERNEL32(?,?,?), ref: 1E8C413A
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C4143
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C414E
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(LoadLibraryEx,00000000), ref: 1E8C4161

Strings

LoadLibraryEx, xrefs: 1E8C415C
OOl:LoadLibraryEx, xrefs: 1E8C40D6

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_U_object@@$Eval_String@@Thread$Arg_Error@@FreeLibraryLoadParseRestoreSaveTupleWin_
String ID: LoadLibraryEx$OOl:LoadLibraryEx
API String ID: 3157523754-510471668
Opcode ID: 1b8ddbec2f13538f9f78068a7b5ea0f14f877a6e0c0f46db488acf4b1ca062cd
Instruction ID: d6bb3c43ea84c97e318eba1ac07e3508fec979947abf7383d2110c8f94039bf4
Opcode Fuzzy Hash: 1b8ddbec2f13538f9f78068a7b5ea0f14f877a6e0c0f46db488acf4b1ca062cd
Instruction Fuzzy Hash: 3611AFB9500211AFD300EB68CC88AEB37E8BFC5655F848928F94EC3201E734D599C7B2

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C32C0 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 62threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1E8C32DF
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?), ref: 1E8C32FC
?PyWinObject_AsResourceIdA@@YAHPAU_object@@PAPADH@Z.PYWINTYPES27(?,00000000,00000000), ref: 1E8C3315
PyEval_SaveThread.PYTHON27 ref: 1E8C3324
LoadCursorA.USER32(?,?), ref: 1E8C3337
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C3340
?PyWinObject_FreeResourceId@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C334B
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(LoadCursor,00000000), ref: 1E8C335E
?PyWinLong_FromHANDLE@@YAPAU_object@@PAX@Z.PYWINTYPES27(00000000), ref: 1E8C3368

Strings

OO:LoadCursor, xrefs: 1E8C32D1
LoadCursor, xrefs: 1E8C3359

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: U_object@@$Object_$Eval_ResourceThread$Arg_CursorError@@FreeFromId@@LoadLong_ParseRestoreSaveTupleWin_
String ID: LoadCursor$OO:LoadCursor
API String ID: 3847829699-2215962681
Opcode ID: 68fa3e804fbb55c0ba6ce98fd9439a542221466be20e0c0d371649aeb8893884
Instruction ID: 65708e05925c36e8386b3b81513c449a0015e823e93752e127d9018f53439a98
Opcode Fuzzy Hash: 68fa3e804fbb55c0ba6ce98fd9439a542221466be20e0c0d371649aeb8893884
Instruction Fuzzy Hash: 601194755002216FE700ABA8CD8DDDB7BECEF86646F404918F94DC3251E734D699C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C4980 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 62COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(?,%s is not available on this platform,GetNativeSystemInfo), ref: 1E8C499E
PyArg_ParseTuple.PYTHON27(?,:GetNativeSystemInfo), ref: 1E8C49B5

Strings

%s is not available on this platform, xrefs: 1E8C4998
:GetNativeSystemInfo, xrefs: 1E8C49AF
GetNativeSystemInfo, xrefs: 1E8C4993
iiNNNiii(HH), xrefs: 1E8C4A25

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Err_FormatParseTuple
String ID: %s is not available on this platform$:GetNativeSystemInfo$GetNativeSystemInfo$iiNNNiii(HH)
API String ID: 361908667-387961642
Opcode ID: e980adeecaca180ad0829cc39d25928e351ca304743d84886ef2d8b5cacd1ebb
Instruction ID: 7a66f0c4dfadbcac7cd5148ed897dbb2aa1bcfb58ee23ec4d7e034b94e684868
Opcode Fuzzy Hash: e980adeecaca180ad0829cc39d25928e351ca304743d84886ef2d8b5cacd1ebb
Instruction Fuzzy Hash: DD1160B1414210AFD2049B69CD89D6B73EABBCC70DF04461CF98D93310E234EA958BA7

Uniqueness

Uniqueness Score: -1.00%

Function 1E7D2950 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 181registryCOMMON

Download Yara Rule

APIs

SetConsoleCtrlHandler.KERNEL32(1E7D23D0,00000001,?,00000002,00000000,?), ref: 1E7D2990
PyGILState_Ensure.PYTHON27(?,00000002,00000000,?), ref: 1E7D2996
RegisterServiceCtrlHandlerW.ADVAPI32(?,1E7D23B0), ref: 1E7D2AAB
SetServiceStatus.ADVAPI32(?,1E7D620C), ref: 1E7D2ACF
SetServiceStatus.ADVAPI32(?,1E7D6244), ref: 1E7D2AEA
PyObject_GetAttrString.PYTHON27(00000000,SvcRun), ref: 1E7D2B03
PyObject_CallObject.PYTHON27(00000000,00000000), ref: 1E7D2B21

Part of subcall function 1E7D1F00: GetLastError.KERNEL32(00000000,?), ref: 1E7D1F0E
Part of subcall function 1E7D1F00: FormatMessageW.KERNEL32(00001000,00000000,00000000,00000000,?,00000200,00000000,00000000,?), ref: 1E7D1F2C
Part of subcall function 1E7D1F00: wsprintfW.USER32 ref: 1E7D1FB8

SetServiceStatus.ADVAPI32(?,1E7D6260), ref: 1E7D2B80
PyGILState_Release.PYTHON27(?), ref: 1E7D2B98

Strings

SvcRun, xrefs: 1E7D2AFD

Memory Dump Source

Source File: 0000000F.00000002.1434219289.000000001E7D1000.00000040.00000001.01000000.00000015.sdmp, Offset: 1E7D0000, based on PE: true

Associated: 0000000F.00000002.1434197225.000000001E7D0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000F.00000002.1434219289.000000001E7DA000.00000040.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000F.00000002.1434284534.000000001E7DB000.00000080.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000F.00000002.1434310614.000000001E7DD000.00000004.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e7d0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Service$Status$CtrlHandlerObject_State_$AttrCallConsoleEnsureErrorFormatLastMessageObjectRegisterReleaseStringwsprintf
String ID: SvcRun
API String ID: 2607542345-4087590218
Opcode ID: a9ff2d058d0f3b545622c7cf91ecafadd5e28e79d72e5ffc4d6d818ba245cd66
Instruction ID: bd58b4309c9d3fc151f05a69bc044f97fa358b27aec673f544e188db4cac6625
Opcode Fuzzy Hash: a9ff2d058d0f3b545622c7cf91ecafadd5e28e79d72e5ffc4d6d818ba245cd66
Instruction Fuzzy Hash: 7551D1749003D29BF321DF54DD84A9A73AAFB88B30F004729E84497264E775E94ACBD2

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C8490 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 101threadregistryCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1E8C84C6
?PyWinObject_AsHKEY@@YAHPAU_object@@PAPAUHKEY__@@@Z.PYWINTYPES27(?,?,?,?,?,?,?,?,?), ref: 1E8C84DD
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,?,00000001,00000000,?,?,?,?,?,?,?,?,?,?), ref: 1E8C8515
PyEval_SaveThread.PYTHON27(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1E8C853B
RegSetValueExA.ADVAPI32(?,?,00000000,?,?,?), ref: 1E8C855E
PyEval_RestoreThread.PYTHON27(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1E8C8567
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?,?,?), ref: 1E8C8581
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(RegSetValueEx,00000000), ref: 1E8C8594

Strings

RegSetValueEx, xrefs: 1E8C858F
OOOiO:RegSetValueEx, xrefs: 1E8C84B0

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_U_object@@$Eval_String@@Thread$Arg_Error@@FreeParseRestoreSaveTupleValueWin_Y__@@@
String ID: OOOiO:RegSetValueEx$RegSetValueEx
API String ID: 968808361-1011897307
Opcode ID: 498f16a28b0dc91fc3b834a5f9238bfd8b31534c7a2ae3a005b5e5829f14c458
Instruction ID: 97441c23c34c42aa387d0e4e335bf02e0dd5db0e8a81773bd95343cd9ec0b272
Opcode Fuzzy Hash: 498f16a28b0dc91fc3b834a5f9238bfd8b31534c7a2ae3a005b5e5829f14c458
Instruction Fuzzy Hash: C03130B5514301AFD304DB59DC84EABB3E9EFC9744F448A1CF94983250E774E949CB62

Uniqueness

Uniqueness Score: -1.00%

Function 6CBC6F30 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 100registryfilewindowCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F4,00000000), ref: 6CBC6F46
GetFileType.KERNEL32(00000000), ref: 6CBC6F53
WriteFile.KERNEL32(00000000,?,00000000,?,00000000), ref: 6CBC6F95
GetVersion.KERNEL32 ref: 6CBC6FCB
RegisterEventSourceA.ADVAPI32(00000000,OpenSSL), ref: 6CBC6FE8
ReportEventA.ADVAPI32(00000000,00000001,00000000,00000000,00000000,00000001,00000000,?,00000000), ref: 6CBC7016
DeregisterEventSource.ADVAPI32(00000000), ref: 6CBC701D
MessageBoxA.USER32(00000000,?,OpenSSL: FATAL,00000010), ref: 6CBC7042

Strings

OpenSSL: FATAL, xrefs: 6CBC7034
OpenSSL, xrefs: 6CBC6FE1

Memory Dump Source

Source File: 0000000F.00000002.1435325332.000000006CBC1000.00000040.00000001.01000000.0000000E.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 0000000F.00000002.1435141262.000000006CBC0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCAB000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCBE000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436271764.000000006CCC4000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436295892.000000006CCC6000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6cbc0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Event$FileSource$DeregisterHandleMessageRegisterReportTypeVersionWrite
String ID: OpenSSL$OpenSSL: FATAL
API String ID: 689975944-4224901669
Opcode ID: e5db6321d226b6529b17512223b5ddd29e977b2c227918519a3a5afb0ae95809
Instruction ID: 39cfd94dc591fbeae2ac820a90402ea9bba4d38ec7a20dc647b73a2e45299858
Opcode Fuzzy Hash: e5db6321d226b6529b17512223b5ddd29e977b2c227918519a3a5afb0ae95809
Instruction Fuzzy Hash: B531DB71750128ABDF11DB64CC49FED37B8EF49704F104194FA05EA5C0EBB19A44CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C5EF0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 86COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1E8C5F2D
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?,?,?,?,?,?,?), ref: 1E8C5F4A
?PyWinObject_AsPARAM@@YAHPAU_object@@PAI@Z.PYWINTYPES27(?,?,?,?,?,?,?,?,?,?,?), ref: 1E8C5F67
?PyWinObject_AsPARAM@@YAHPAU_object@@PAI@Z.PYWINTYPES27(?,?,?,?,?,?,?,?,?,?,?,?), ref: 1E8C5F7A

Strings

PostMessage, xrefs: 1E8C5FC0
OI|OO:PostMessage, xrefs: 1E8C5F17

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_U_object@@$Arg_ParseTuple
String ID: OI|OO:PostMessage$PostMessage
API String ID: 1248562531-2393048322
Opcode ID: 38c00d130359cdbb39636801a46feb9cf7ccdb142de9ace731748fd0aa679d90
Instruction ID: 26bf24229c85a2fa613f2c6c9d0a0e967e1aca7e03669ac9d4dd4ea73f283b75
Opcode Fuzzy Hash: 38c00d130359cdbb39636801a46feb9cf7ccdb142de9ace731748fd0aa679d90
Instruction Fuzzy Hash: 47214175514212AFD700DF68CC84ADB73E9EFC9209F44495DF889C3250E730E6498BA2

Uniqueness

Uniqueness Score: -1.00%

Function 1E8CC5D0 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 86COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(?,%s is not available on this platform,EnumDisplayDevices), ref: 1E8CC5F3
PyArg_ParseTupleAndKeywords.PYTHON27(?,?,|Okk:EnumDisplayDevices,1E8D7F64,?,?,?), ref: 1E8CC643

Strings

EnumDisplayDevices, xrefs: 1E8CC5E8
%s is not available on this platform, xrefs: 1E8CC5ED
|Okk:EnumDisplayDevices, xrefs: 1E8CC630
EnumDisplayDevices, xrefs: 1E8CC6AE

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Err_FormatKeywordsParseTuple
String ID: %s is not available on this platform$EnumDisplayDevices$EnumDisplayDevices$|Okk:EnumDisplayDevices
API String ID: 223827023-1002584741
Opcode ID: 5c55174ee9b1255d10824cf7e5bcce9062b9702ec90c525ec58c7d46bb5053f9
Instruction ID: 316a10fb34c0979385bf05bacb5445eb8342d90b13edda04d331a52d403746b9
Opcode Fuzzy Hash: 5c55174ee9b1255d10824cf7e5bcce9062b9702ec90c525ec58c7d46bb5053f9
Instruction Fuzzy Hash: 5A2189B1504352ABE214DF18DC84EDBBBE8AF85744F004A1CF88D93241E731D949CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 03251C70 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 79processCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,0325B300), ref: 03251C84
CreateToolhelp32Snapshot.KERNEL32(00000002), ref: 03251C9F

Strings

CreateToolhelp32Snapshot, xrefs: 03251CAB
Process32FirstW, xrefs: 03251CD7

Memory Dump Source

Source File: 0000000F.00000002.1423676562.0000000003251000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03250000, based on PE: true

Associated: 0000000F.00000002.1423656216.0000000003250000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423775563.0000000003263000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3250000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_CreateParseSnapshotToolhelp32Tuple
String ID: CreateToolhelp32Snapshot$Process32FirstW
API String ID: 1338670803-1839410257
Opcode ID: d14bbb2bf8636e60597ed2497747b56347ed7d8485c1ac1215246e358df122cc
Instruction ID: ab40e2f74bdbec761cd0ef29803719fbaee3e72d94cac2cf05131d8e4fbe2038
Opcode Fuzzy Hash: d14bbb2bf8636e60597ed2497747b56347ed7d8485c1ac1215246e358df122cc
Instruction Fuzzy Hash: AC21F8755203166BDB10FB64EC9EBEF33ACAF40744F488424FC5986144F7B4A79486A3

Uniqueness

Uniqueness Score: -1.00%

Function 1E8CC4F0 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 78COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(?,%s is not available on this platform,ChangeDisplaySettingsEx), ref: 1E8CC510
PyArg_ParseTupleAndKeywords.PYTHON27(?,?,|OOk:ChangeDisplaySettingsEx,1E8D7F54,?,?,?), ref: 1E8CC556

Strings

ChangeDisplaySettingsEx, xrefs: 1E8CC505
|OOk:ChangeDisplaySettingsEx, xrefs: 1E8CC547
%s is not available on this platform, xrefs: 1E8CC50A

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Err_FormatKeywordsParseTuple
String ID: %s is not available on this platform$ChangeDisplaySettingsEx$|OOk:ChangeDisplaySettingsEx
API String ID: 223827023-2087358017
Opcode ID: 8df334ca78facc268b7e6df591aeb36029b80a9083ac18d501200d55fdd35a24
Instruction ID: b27f1001493b57bd9de01df9de0b36f62e79fa1959cb84eb32a57b83e76aefe2
Opcode Fuzzy Hash: 8df334ca78facc268b7e6df591aeb36029b80a9083ac18d501200d55fdd35a24
Instruction Fuzzy Hash: 9D2148B5514321AFD214DF68CD88DDBBBE8BF89A54F408A19F94DC3211E234D949CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1ECB3ED0 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 76threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1ECB3EFE
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?,?,?,?), ref: 1ECB3F18
PyArg_ParseTuple.PYTHON27(?,lllllll,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1ECB3F52
PyEval_SaveThread.PYTHON27 ref: 1ECB3F5C
SetServiceStatus.ADVAPI32(?,?), ref: 1ECB3F6E
PyEval_RestoreThread.PYTHON27(00000000), ref: 1ECB3F77
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(SetServiceStatus,00000000), ref: 1ECB3F8C

Strings

OO:SetServiceStatus, xrefs: 1ECB3EE8
SetServiceStatus, xrefs: 1ECB3F87
lllllll, xrefs: 1ECB3F4C

Memory Dump Source

Source File: 0000000F.00000002.1435001879.000000001ECB1000.00000040.00000001.01000000.00000011.sdmp, Offset: 1ECB0000, based on PE: true

Associated: 0000000F.00000002.1434980425.000000001ECB0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBA000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBD000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435097428.000000001ECBF000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435120797.000000001ECC0000.00000004.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ecb0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Eval_ParseThreadTupleU_object@@$Error@@Object_RestoreSaveServiceStatusWin_
String ID: OO:SetServiceStatus$SetServiceStatus$lllllll
API String ID: 1330235194-117683800
Opcode ID: 079b6eb15afff3658c588117f7d53a48787b15128eef4d27b62c762f36804b85
Instruction ID: 7fb685c636534348ef9514a364cee03c534d983d0a3a2f7160b53dd9e8199fcc
Opcode Fuzzy Hash: 079b6eb15afff3658c588117f7d53a48787b15128eef4d27b62c762f36804b85
Instruction Fuzzy Hash: 7B218372504211ABC704DB68CDC4EDB7BFCAFC8695F084A5DF98993210F670D6488BA2

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C9D00 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 74COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1E8C9D23
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?), ref: 1E8C9D40
PyErr_Format.PYTHON27(?,Allocating buffer of %d bytes for LoadString,?), ref: 1E8C9D73

Strings

Oi|i:LoadString, xrefs: 1E8C9D15
LoadString, xrefs: 1E8C9D9D
Allocating buffer of %d bytes for LoadString, xrefs: 1E8C9D6D

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Err_FormatObject_ParseTupleU_object@@
String ID: Allocating buffer of %d bytes for LoadString$LoadString$Oi|i:LoadString
API String ID: 3520361810-709151105
Opcode ID: 8a32e6313b5a7bcbb0aeb500659e0127973efd3239abbf7a618b35ed14fd9b69
Instruction ID: 5f3974d1b42e7b2407e2290833bdf3e33621a2848b7664c9f06d01da9c60b0ec
Opcode Fuzzy Hash: 8a32e6313b5a7bcbb0aeb500659e0127973efd3239abbf7a618b35ed14fd9b69
Instruction Fuzzy Hash: 2E11C075200221BFE301DB69CC88DEB37E8FFC2259F484958F94ED3200E630D959C6A2

Uniqueness

Uniqueness Score: -1.00%

Function 1ECB3E00 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 73threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1ECB3E19
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(00000000,?), ref: 1ECB3E35
PyEval_SaveThread.PYTHON27 ref: 1ECB3E44
QueryServiceStatus.ADVAPI32(?,?), ref: 1ECB3E56
PyEval_RestoreThread.PYTHON27(00000000), ref: 1ECB3E5F
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(QueryServiceStatus,00000000), ref: 1ECB3E75

Strings

lllllll, xrefs: 1ECB3EBD
O:QueryServiceStatus, xrefs: 1ECB3E0B
QueryServiceStatus, xrefs: 1ECB3E70

Memory Dump Source

Source File: 0000000F.00000002.1435001879.000000001ECB1000.00000040.00000001.01000000.00000011.sdmp, Offset: 1ECB0000, based on PE: true

Associated: 0000000F.00000002.1434980425.000000001ECB0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBA000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBD000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435097428.000000001ECBF000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435120797.000000001ECC0000.00000004.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ecb0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_ThreadU_object@@$Arg_Error@@Object_ParseQueryRestoreSaveServiceStatusTupleWin_
String ID: O:QueryServiceStatus$QueryServiceStatus$lllllll
API String ID: 2799662476-1423136912
Opcode ID: 4411294f514e55f49019ee6640884ecb19e83a6b42d66584ca5100e069638f93
Instruction ID: 6f62716c3fbc53f53e92667760cfbdeb58964990a4fc9d16d2eadbbee7b77d91
Opcode Fuzzy Hash: 4411294f514e55f49019ee6640884ecb19e83a6b42d66584ca5100e069638f93
Instruction Fuzzy Hash: 80217CB2504201AFD704DBA8CD8895B77E9EFC8395F048658F859C3205E670D95ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 032514B0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,0325B104), ref: 032514BF

Strings

OpenProcess -> ERROR_INVALID_PARAMETER turned into NoSuchProcess, xrefs: 03251501
TerminateProcess, xrefs: 03251545

Memory Dump Source

Source File: 0000000F.00000002.1423676562.0000000003251000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03250000, based on PE: true

Associated: 0000000F.00000002.1423656216.0000000003250000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423775563.0000000003263000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3250000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_ParseTuple
String ID: OpenProcess -> ERROR_INVALID_PARAMETER turned into NoSuchProcess$TerminateProcess
API String ID: 3371842430-2687439338
Opcode ID: 95ac5cb00929320bcd2f7a9ef9d925a8bf40ad987472e725dd3dcacda9e5bc2c
Instruction ID: acd873295d5579499a079cd2f2c043d39a0da5da6885013ef0ca22d4f8593569
Opcode Fuzzy Hash: 95ac5cb00929320bcd2f7a9ef9d925a8bf40ad987472e725dd3dcacda9e5bc2c
Instruction Fuzzy Hash: A811C1B2620311ABDA10FB68BC0DBDE33989F00A66F14C065FD07D5A45EB70A7E09652

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C7A50 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 70COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(?,%s is not available on this platform,RegOverridePredefKey), ref: 1E8C7A6E
PyArg_ParseTupleAndKeywords.PYTHON27(?,?,OO:RegOverridePredefKey,1E8D707C,?,?), ref: 1E8C7A99

Strings

%s is not available on this platform, xrefs: 1E8C7A68
RegOverridePredefKey, xrefs: 1E8C7A63
RegOverridePredefKey, xrefs: 1E8C7AF2
OO:RegOverridePredefKey, xrefs: 1E8C7A92

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Err_FormatKeywordsParseTuple
String ID: %s is not available on this platform$OO:RegOverridePredefKey$RegOverridePredefKey$RegOverridePredefKey
API String ID: 223827023-9875006
Opcode ID: fc65ce8f20fe0f4c4c67d99dd7a98e86b283ea27fc8631791300f1f5ff2b4076
Instruction ID: 556c4b43c863ef4003f0d7ae91f6d195aa362526275ec928491b34fb1823ef74
Opcode Fuzzy Hash: fc65ce8f20fe0f4c4c67d99dd7a98e86b283ea27fc8631791300f1f5ff2b4076
Instruction Fuzzy Hash: FF117275510216AFE700EB68CC85DEB73E9FF85205F848959F85CC3351F235E9198BA2

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C68F0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 69threadregistryCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1E8C6918
?PyWinObject_AsHKEY@@YAHPAU_object@@PAPAUHKEY__@@@Z.PYWINTYPES27(?,?), ref: 1E8C6935
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,00000001,00000001,00000000), ref: 1E8C6950
PyEval_SaveThread.PYTHON27 ref: 1E8C695F
RegDeleteValueA.ADVAPI32(?,?), ref: 1E8C6971
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C697A
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C6985
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(RegDeleteValue,00000000), ref: 1E8C6998

Strings

RegDeleteValue, xrefs: 1E8C6993
OO:RegDeleteValue, xrefs: 1E8C690A

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_U_object@@$Eval_String@@Thread$Arg_DeleteError@@FreeParseRestoreSaveTupleValueWin_Y__@@@
String ID: OO:RegDeleteValue$RegDeleteValue
API String ID: 193626020-1782645334
Opcode ID: 5c7234767f9338ad1533f928e5dcc9c01fd6c6d0502e729fbec34b049e87ac25
Instruction ID: e1bfe98b07e83c614c24771e7c80368a6593409dbb3c73483f48c18e5bfd793d
Opcode Fuzzy Hash: 5c7234767f9338ad1533f928e5dcc9c01fd6c6d0502e729fbec34b049e87ac25
Instruction Fuzzy Hash: 58219075500211AFE300DB68CD88AAB77E8FFCA655F408918F94DC3251E734E549CB63

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C76B0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 67threadregistryCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1E8C76CF
?PyWinObject_AsHKEY@@YAHPAU_object@@PAPAUHKEY__@@@Z.PYWINTYPES27(?,?), ref: 1E8C76EC
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,00000000,00000000,00000000), ref: 1E8C7707
PyEval_SaveThread.PYTHON27 ref: 1E8C7716
RegUnLoadKeyA.ADVAPI32(?,?), ref: 1E8C7728
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C7731
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C773C
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(RegUnLoadKey,00000000), ref: 1E8C774F

Strings

OO:RegUnLoadKey, xrefs: 1E8C76C1
RegUnLoadKey, xrefs: 1E8C774A

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_U_object@@$Eval_String@@Thread$Arg_Error@@FreeLoadParseRestoreSaveTupleWin_Y__@@@
String ID: OO:RegUnLoadKey$RegUnLoadKey
API String ID: 1849577564-1964549283
Opcode ID: bd7a78c44746c8dd3e164888707f3439dcdbb1fa62584d016c6d8aaef67600c2
Instruction ID: 1b4573b64d191d5ccb3b0ab82ae08e8b468e7245339e54f77c665a9c3291c2b4
Opcode Fuzzy Hash: bd7a78c44746c8dd3e164888707f3439dcdbb1fa62584d016c6d8aaef67600c2
Instruction Fuzzy Hash: 11119D75604211AFE300EB68CC8CEEB77E8EF85255F408918F94DC3211E730D589CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C42C0 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 66COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(?,%s is not available on this platform,GetDllDirectory), ref: 1E8C42DE
73BB3B4E.MSVCR90(00000000), ref: 1E8C4305
GetDllDirectoryW.KERNEL32(00000100,00000000), ref: 1E8C4321
?PyWinObject_FromOLECHAR@@YAPAU_object@@PB_WH@Z.PYWINTYPES27(00000000,00000000), ref: 1E8C4333
73BB3B4E.MSVCR90(00000000), ref: 1E8C4348

Strings

GetDllDirectory, xrefs: 1E8C4362
%s is not available on this platform, xrefs: 1E8C42D8
GetDllDirectory, xrefs: 1E8C42D3

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: DirectoryErr_FormatFromObject_U_object@@
String ID: %s is not available on this platform$GetDllDirectory$GetDllDirectory
API String ID: 4005545441-244808744
Opcode ID: 19a80307655a444f6c6939128087d7eb2aef259e563fd1fa95f24b576b4d0858
Instruction ID: 73add1e402b718b39919f1e5875fd0992ff4bc3db0d7d3048ba172c578819d3c
Opcode Fuzzy Hash: 19a80307655a444f6c6939128087d7eb2aef259e563fd1fa95f24b576b4d0858
Instruction Fuzzy Hash: 9511C476500325AFD3018B699C88EDB77B5FBC2751F100229F85A83210D734D8D686A5

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C20D0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 64threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,Oil:FindFirstChangeNotification,?,?,?), ref: 1E8C20EC
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,00000000,00000000,00000000), ref: 1E8C210D
PyEval_SaveThread.PYTHON27 ref: 1E8C211C
FindFirstChangeNotificationA.KERNEL32(?,?,?), ref: 1E8C2133
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C213C
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C2147
?PyWinLong_FromHANDLE@@YAPAU_object@@PAX@Z.PYWINTYPES27(00000000), ref: 1E8C215A

Strings

Oil:FindFirstChangeNotification, xrefs: 1E8C20E6
FindFirstChangeNotification, xrefs: 1E8C216B

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_Object_String@@ThreadU_object@@$Arg_ChangeFindFirstFreeFromLong_NotificationParseRestoreSaveTuple
String ID: FindFirstChangeNotification$Oil:FindFirstChangeNotification
API String ID: 3035025450-3656035498
Opcode ID: e32afe06f6f049b2e311a97c25c2ead155b5e185607daae1cf76adec442f014e
Instruction ID: 1645cda2b55b607ce60c162096edf9511bf8b64eaedaeafb65774d97ecb9f306
Opcode Fuzzy Hash: e32afe06f6f049b2e311a97c25c2ead155b5e185607daae1cf76adec442f014e
Instruction Fuzzy Hash: 7D1182755002216FE300DB68CC8DAEB77E8EF85615F848A28F95DC3291E734D559C6A2

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C3A00 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 62COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,:GetLogicalDriveStrings), ref: 1E8C3A0F
GetLogicalDriveStringsA.KERNEL32(00000000,00000000), ref: 1E8C3A2E
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(GetLogicalDriveStrings,00000000), ref: 1E8C3A3C

Strings

:GetLogicalDriveStrings, xrefs: 1E8C3A09
GetLogicalDriveStrings, xrefs: 1E8C3A37
GetLogicalDriveStrings, xrefs: 1E8C3A5D

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_DriveError@@LogicalParseStringsTupleU_object@@Win_
String ID: :GetLogicalDriveStrings$GetLogicalDriveStrings$GetLogicalDriveStrings
API String ID: 3159777487-1660296831
Opcode ID: 23fe7b9b30ccd2c4f5bec634b705a096fa415f603f715fb02e5943b751a728bc
Instruction ID: 0de6204f0511d253a4a7aa7f3c23de3ce8858000d48c025be3eba2638a1c3957
Opcode Fuzzy Hash: 23fe7b9b30ccd2c4f5bec634b705a096fa415f603f715fb02e5943b751a728bc
Instruction Fuzzy Hash: F9012836A00115BFEA105799BC89DDEB76CEB8227AF000172FB0CD3201D731963682F5

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C5C20 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 59threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,O:GetFullPathName,?), ref: 1E8C5C35
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,00000000,00000000,00000000), ref: 1E8C5C59
PyEval_SaveThread.PYTHON27 ref: 1E8C5C68
GetFullPathNameA.KERNEL32(?,00000104,?,?), ref: 1E8C5C84
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C5C8D
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C5C98
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(GetFullPathName,00000000), ref: 1E8C5CAE

Strings

GetFullPathName, xrefs: 1E8C5CA9
O:GetFullPathName, xrefs: 1E8C5C2F

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_Object_String@@ThreadU_object@@$Arg_Error@@FreeFullNameParsePathRestoreSaveTupleWin_
String ID: GetFullPathName$O:GetFullPathName
API String ID: 1895604217-1004454013
Opcode ID: b1ca3cdb206b3fdfd55914c8570acefb9ca115afa9de5226629a9f8bccd599da
Instruction ID: 52f28faae06c7efd4a13237f92817e9f4db7047c9379704ee39e2635c781e64d
Opcode Fuzzy Hash: b1ca3cdb206b3fdfd55914c8570acefb9ca115afa9de5226629a9f8bccd599da
Instruction Fuzzy Hash: 1F1191B55003116BE714CB64CD8DFEA37E9AFC5315F448918FA1DC32D0E675D1988B62

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C87A0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 55threadregistryclipboardCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,O:RegisterWindowMessage,?), ref: 1E8C87B2
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,00000000,00000000,00000000), ref: 1E8C87D3
PyEval_SaveThread.PYTHON27 ref: 1E8C87E2
RegisterClipboardFormatA.USER32(?), ref: 1E8C87EF
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C87F8
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C8803
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(RegisterWindowMessage,00000000), ref: 1E8C8816

Strings

RegisterWindowMessage, xrefs: 1E8C8811
O:RegisterWindowMessage, xrefs: 1E8C87AC

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_Object_String@@ThreadU_object@@$Arg_ClipboardError@@FormatFreeParseRegisterRestoreSaveTupleWin_
String ID: O:RegisterWindowMessage$RegisterWindowMessage
API String ID: 4176757481-3515438174
Opcode ID: 79b61061e756ccbe671b3de8b14d4ee1dcac148547cab7cb88757cf085f486f1
Instruction ID: e9742d92bda9fde6cbd8875f3140e7f062253279fa11c7ffe28248d9b275e3b6
Opcode Fuzzy Hash: 79b61061e756ccbe671b3de8b14d4ee1dcac148547cab7cb88757cf085f486f1
Instruction Fuzzy Hash: 8F01D6395102107FD60057B8ED8DADB7BE8AFC1656F448528FD0DC3240E634D599C6B2

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C4020 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 54threadlibraryCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,O:LoadLibrary,?), ref: 1E8C4032
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,00000000,00000000,00000000), ref: 1E8C4053
PyEval_SaveThread.PYTHON27 ref: 1E8C4062
LoadLibraryA.KERNEL32(?), ref: 1E8C406F
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C4078
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C4083
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(LoadLibrary,00000000), ref: 1E8C4096

Strings

O:LoadLibrary, xrefs: 1E8C402C
LoadLibrary, xrefs: 1E8C4091

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_Object_String@@ThreadU_object@@$Arg_Error@@FreeLibraryLoadParseRestoreSaveTupleWin_
String ID: LoadLibrary$O:LoadLibrary
API String ID: 1508038121-2271714166
Opcode ID: 040756d8fbe13fbfa50eb7bcaf2d07c556e7e1bc92d3eb8f0d4b1d0bf88604ac
Instruction ID: 34abc1f4e1494cb67574e1fccd4a35e612180d2b4f06c1a97db0df1d86aba10b
Opcode Fuzzy Hash: 040756d8fbe13fbfa50eb7bcaf2d07c556e7e1bc92d3eb8f0d4b1d0bf88604ac
Instruction Fuzzy Hash: 5601B5359002107FE6109778DD8DADB3BE9AFC6766F848528FA4DC3200E734D599C6A6

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C5840 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 53COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(?,%s is not available on this platform,GetSystemFileCacheSize), ref: 1E8C585E
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(GetSystemFileCacheSize,00000000), ref: 1E8C5885

Strings

%s is not available on this platform, xrefs: 1E8C5858
GetSystemFileCacheSize, xrefs: 1E8C5880
NNN, xrefs: 1E8C58C1
GetSystemFileCacheSize, xrefs: 1E8C5853

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Err_Error@@FormatU_object@@Win_
String ID: %s is not available on this platform$GetSystemFileCacheSize$GetSystemFileCacheSize$NNN
API String ID: 1771588633-94199171
Opcode ID: fd3b36131d9282b35e82db1b5c110b01ac8bd27e455d43245f4bfd3601474aed
Instruction ID: 0f15e2e025335361572222ae5b7acb01f9a88880eeed20a8a48ce732dcf852e6
Opcode Fuzzy Hash: fd3b36131d9282b35e82db1b5c110b01ac8bd27e455d43245f4bfd3601474aed
Instruction Fuzzy Hash: 4F019EB58003107FE200DB68DC89FEB37A9FF85605F448518FC4993301E631E66DCAA2

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C13C0 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 51COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(?,%s is not available on this platform,GetHandleInformation), ref: 1E8C13DE
PyArg_ParseTuple.PYTHON27(?,O:GetHandleInformation), ref: 1E8C13F9

Strings

%s is not available on this platform, xrefs: 1E8C13D8
GetHandleInformation, xrefs: 1E8C1437
O:GetHandleInformation, xrefs: 1E8C13F3
GetHandleInformation, xrefs: 1E8C13D3

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Err_FormatParseTuple
String ID: %s is not available on this platform$GetHandleInformation$GetHandleInformation$O:GetHandleInformation
API String ID: 361908667-3788333353
Opcode ID: 6f7c0ff3cca502408d35d3e7f65da728e159d36b139045739267e567cb3eab4a
Instruction ID: 8623642ceada62434d08cc5f8fa8b826c3cc8aa3ae7958f3a8cc8e249336f8a7
Opcode Fuzzy Hash: 6f7c0ff3cca502408d35d3e7f65da728e159d36b139045739267e567cb3eab4a
Instruction Fuzzy Hash: D40140B4500202AFE610DB70EDC9EAA33E9BB85609F444528FC4D83354E635D69DCB67

Uniqueness

Uniqueness Score: -1.00%

Function 1E8CAFF0 Relevance: 17.5, APIs: 2, Strings: 8, Instructions: 33COMMON

Download Yara Rule

APIs

GlobalMemoryStatus.KERNEL32 ref: 1E8CAFF7
Py_BuildValue.PYTHON27(1E8D20EC,Length,?,MemoryLoad,?,TotalPhys,?,AvailPhys,?,TotalPageFile,?,AvailPageFile,?,TotalVirtual,?,AvailVirtual), ref: 1E8CB053

Strings

AvailVirtual, xrefs: 1E8CB00E
TotalVirtual, xrefs: 1E8CB018
TotalPageFile, xrefs: 1E8CB02C
MemoryLoad, xrefs: 1E8CB047
AvailPageFile, xrefs: 1E8CB022
TotalPhys, xrefs: 1E8CB041
Length, xrefs: 1E8CB04D
AvailPhys, xrefs: 1E8CB036

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: BuildGlobalMemoryStatusValue
String ID: AvailPageFile$AvailPhys$AvailVirtual$Length$MemoryLoad$TotalPageFile$TotalPhys$TotalVirtual
API String ID: 866325862-3466484070
Opcode ID: 170894b851bd81d58d458be23e74ec6b5add3d71c88a29d91d58a86cfb426db8
Instruction ID: b5a587bb71ccd411de42389e3ca28b7c92c37b7eabc73ef75f9d0c326a21ef6b
Opcode Fuzzy Hash: 170894b851bd81d58d458be23e74ec6b5add3d71c88a29d91d58a86cfb426db8
Instruction Fuzzy Hash: 40F0A9B1504301BBDA05DA99CC84D9BB7F9BBDCA10F008A0CB649A3310D230F8498B66

Uniqueness

Uniqueness Score: -1.00%

Function 1E7D2000 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 138COMMON

Download Yara Rule

APIs

PyErr_Occurred.PYTHON27(776004E0,?,?,?,?,?,?,1E7D2B38,C0000003), ref: 1E7D2004
PyErr_Fetch.PYTHON27(?,?,?,00000000,00000000,?,?,?,?,?,?,1E7D2B38,C0000003), ref: 1E7D2035
?GetPythonTraceback@@YAPADPAU_object@@00@Z.PYWINTYPES27 ref: 1E7D2054
MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000002,00000000,00000002,?,?,?,?,?,?,?), ref: 1E7D2090
73BB3B4E.MSVCR90(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,1E7D2B38,C0000003), ref: 1E7D20A3
73BB3B4E.MSVCR90(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,1E7D2B38), ref: 1E7D20CD
PyErr_Restore.PYTHON27(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,1E7D2B38), ref: 1E7D20F0

Strings

<No Python Error!>, xrefs: 1E7D2164
<No memory!>, xrefs: 1E7D204A

Memory Dump Source

Source File: 0000000F.00000002.1434219289.000000001E7D1000.00000040.00000001.01000000.00000015.sdmp, Offset: 1E7D0000, based on PE: true

Associated: 0000000F.00000002.1434197225.000000001E7D0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000F.00000002.1434219289.000000001E7DA000.00000040.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000F.00000002.1434284534.000000001E7DB000.00000080.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000F.00000002.1434310614.000000001E7DD000.00000004.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e7d0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Err_$ByteCharFetchMultiOccurredPythonRestoreTraceback@@U_object@@00@Wide
String ID: <No Python Error!>$<No memory!>
API String ID: 1333398504-21959789
Opcode ID: 043dd64ddae35b3f7e966d7a3ae95548ca388ecf1d006655b467b9af9660b30c
Instruction ID: c73423ecc75e0b1d340371beeb1729f8e9e8ce8440a217c044e76d15084c0d51
Opcode Fuzzy Hash: 043dd64ddae35b3f7e966d7a3ae95548ca388ecf1d006655b467b9af9660b30c
Instruction Fuzzy Hash: C941A171504345AFE300CF55D884A9BB7E9FF88710F41861DF94997220E736E94ACFA2

Uniqueness

Uniqueness Score: -1.00%

Function 6CBC6DF0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 107libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(00000000,0000014D,00000000,C:\build27\cpython\externals\openssl-1.0.2j\crypto\evp\pmeth_lib.c,?,6CBC6FDD), ref: 6CBC6E11
GetProcAddress.KERNEL32(00000000,_OPENSSL_isservice), ref: 6CBC6E21
GetProcessWindowStation.USER32(0000014D,00000000,C:\build27\cpython\externals\openssl-1.0.2j\crypto\evp\pmeth_lib.c,?,6CBC6FDD), ref: 6CBC6E45
GetUserObjectInformationW.USER32(00000000,00000002,00000000,00000000,?,?,6CBC6FDD), ref: 6CBC6E60
GetLastError.KERNEL32(?,6CBC6FDD), ref: 6CBC6E6E
GetUserObjectInformationW.USER32(00000000,00000002,?,?,?,?,6CBC6FDD), ref: 6CBC6EA7

Strings

_OPENSSL_isservice, xrefs: 6CBC6E1B
Service-0x, xrefs: 6CBC6EBF
C:\build27\cpython\externals\openssl-1.0.2j\crypto\evp\pmeth_lib.c, xrefs: 6CBC6E05

Memory Dump Source

Source File: 0000000F.00000002.1435325332.000000006CBC1000.00000040.00000001.01000000.0000000E.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 0000000F.00000002.1435141262.000000006CBC0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCAB000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCBE000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436271764.000000006CCC4000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436295892.000000006CCC6000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6cbc0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: InformationObjectUser$AddressErrorHandleLastModuleProcProcessStationWindow
String ID: C:\build27\cpython\externals\openssl-1.0.2j\crypto\evp\pmeth_lib.c$Service-0x$_OPENSSL_isservice
API String ID: 1944374717-387006027
Opcode ID: 7881867c2238ad3898f2c54c2485042d82886c0742a34284e9bd1f38ace1e300
Instruction ID: b75c6525c797ef294ebc14adfdca9c44e2bd8ee78d5ff4cfe92a3caa7fdc1844
Opcode Fuzzy Hash: 7881867c2238ad3898f2c54c2485042d82886c0742a34284e9bd1f38ace1e300
Instruction Fuzzy Hash: 5131A731B101099BCF11DFB9DC89EAE77B8EF4A314F500265E926D75C0EB319515C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 1ECB1FF0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 96COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,OllO:CreateWindowStation,?,?,?,?), ref: 1ECB2026
?PyWinObject_AsSECURITY_ATTRIBUTES@@YAHPAU_object@@PAPAU_SECURITY_ATTRIBUTES@@H@Z.PYWINTYPES27(?,?,00000001), ref: 1ECB2050
?PyWinObject_AsWCHAR@@YAHPAU_object@@PAPA_WHPAK@Z.PYWINTYPES27(?,00000001,00000001,00000000), ref: 1ECB206B
CreateWindowStationW.USER32(?,?,?,?), ref: 1ECB208D
?PyWinObject_FreeWCHAR@@YAXPA_W@Z.PYWINTYPES27(?), ref: 1ECB209A
GetLastError.KERNEL32 ref: 1ECB20A7
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(CreateWindowStation,00000000), ref: 1ECB20B3

Strings

CreateWindowStation, xrefs: 1ECB20AE
OllO:CreateWindowStation, xrefs: 1ECB2020

Memory Dump Source

Source File: 0000000F.00000002.1435001879.000000001ECB1000.00000040.00000001.01000000.00000011.sdmp, Offset: 1ECB0000, based on PE: true

Associated: 0000000F.00000002.1434980425.000000001ECB0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBA000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBD000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435097428.000000001ECBF000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435120797.000000001ECC0000.00000004.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ecb0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_U_object@@$Arg_CreateErrorError@@FreeLastParseStationTupleWin_Window
String ID: CreateWindowStation$OllO:CreateWindowStation
API String ID: 1898723962-3820068026
Opcode ID: ba9ea0e63aa2a5847dfa2cb13fe6ac56551f99e21040f7cead6596089fdfd08c
Instruction ID: 9fbecd6aeee4273c7d628c827f71b990b5b8e4498788ad2ace326ccf4147900b
Opcode Fuzzy Hash: ba9ea0e63aa2a5847dfa2cb13fe6ac56551f99e21040f7cead6596089fdfd08c
Instruction Fuzzy Hash: FF315EB6904241AFD308DF64DD95B9BB7E9FF88B80F444A1DF95582240E739D504CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 032516E0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 94timeCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,0325B210), ref: 032516F1
GetProcessTimes.KERNEL32(00000000,?,?,?,?), ref: 0325172F
GetLastError.KERNEL32 ref: 03251739
CloseHandle.KERNEL32(00000000), ref: 03251752

Strings

(dd), xrefs: 032517EB

Memory Dump Source

Source File: 0000000F.00000002.1423676562.0000000003251000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03250000, based on PE: true

Associated: 0000000F.00000002.1423656216.0000000003250000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423775563.0000000003263000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3250000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_CloseErrorHandleLastParseProcessTimesTuple
String ID: (dd)
API String ID: 459457561-1212091902
Opcode ID: 1538cc9e34b78e53475f306671ea3d20f0dee04721a4dad4a1cfe6ac67d56fcb
Instruction ID: a8852957c4c884b974e18b1d56b35578a1a0dee48e5d065d3cb12e1803f492de
Opcode Fuzzy Hash: 1538cc9e34b78e53475f306671ea3d20f0dee04721a4dad4a1cfe6ac67d56fcb
Instruction Fuzzy Hash: 0031B075A05301EBC700FB15F84DAAB77A8FF48745F458948F84A91148FB319BA48A92

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C6F00 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 91threadregistryCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,OiiOi,?,?,?,?,?), ref: 1E8C6F40
?PyWinObject_AsHKEY@@YAHPAU_object@@PAPAUHKEY__@@@Z.PYWINTYPES27(?,?), ref: 1E8C6F5F
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?), ref: 1E8C6F76
PyEval_SaveThread.PYTHON27 ref: 1E8C6F85
RegNotifyChangeKeyValue.ADVAPI32(?,?,?,?,?), ref: 1E8C6FA6
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C6FAF

Strings

RegNotifyChangeKeyValue, xrefs: 1E8C6FD3
OiiOi, xrefs: 1E8C6F24

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_Object_ThreadU_object@@$Arg_ChangeNotifyParseRestoreSaveTupleValueY__@@@
String ID: OiiOi$RegNotifyChangeKeyValue
API String ID: 3139844297-3658889070
Opcode ID: 01c136a3df25d09ed3e4b5861f6c2dadeb513a047621ef91571892eb4a0135d0
Instruction ID: f56565d22df40ec24c7b347191942098c9965372b66d78a256c1c6bdc90a8268
Opcode Fuzzy Hash: 01c136a3df25d09ed3e4b5861f6c2dadeb513a047621ef91571892eb4a0135d0
Instruction Fuzzy Hash: E72161B2518305AFD300DF5ACC88CABB7E9FFC9649F444A1DF949C3211D631EA498B62

Uniqueness

Uniqueness Score: -1.00%

Function 1ECB2C70 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 85serviceCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,O:CloseServiceHandle), ref: 1ECB2C81
PyErr_SetString.PYTHON27(?,PyHANDLE passed to CloseServiceHandle must be a PySC_HANDLE), ref: 1ECB2CE7
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(00000000,?), ref: 1ECB2D19
CloseServiceHandle.ADVAPI32(?), ref: 1ECB2D2B
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(CloseServiceHandle,00000000), ref: 1ECB2D3B

Strings

PySC_HANDLE, xrefs: 1ECB2CA5
PyHANDLE passed to CloseServiceHandle must be a PySC_HANDLE, xrefs: 1ECB2CE1
CloseServiceHandle, xrefs: 1ECB2D36
O:CloseServiceHandle, xrefs: 1ECB2C7B

Memory Dump Source

Source File: 0000000F.00000002.1435001879.000000001ECB1000.00000040.00000001.01000000.00000011.sdmp, Offset: 1ECB0000, based on PE: true

Associated: 0000000F.00000002.1434980425.000000001ECB0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBA000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBD000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435097428.000000001ECBF000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435120797.000000001ECC0000.00000004.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ecb0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: U_object@@$Arg_CloseErr_Error@@HandleObject_ParseServiceStringTupleWin_
String ID: CloseServiceHandle$O:CloseServiceHandle$PyHANDLE passed to CloseServiceHandle must be a PySC_HANDLE$PySC_HANDLE
API String ID: 2015084006-769269872
Opcode ID: dc688b6c9173ffeadb7d2efc32d76292bacd919e6aed916f83e8efb393021f07
Instruction ID: 1e92c47394e3d513045f3174a41a3e460c8e90decaf089b367aa3f3c70d9e0a3
Opcode Fuzzy Hash: dc688b6c9173ffeadb7d2efc32d76292bacd919e6aed916f83e8efb393021f07
Instruction Fuzzy Hash: 4E2102726101518FD708DB38DEA899777E7AF40BC1B448698FC45C3229E731D918C6A1

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C12E0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 83COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,OOOiii:DuplicateHandle,?,?,?,?,?,?), ref: 1E8C130B
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?), ref: 1E8C132C
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?), ref: 1E8C133F
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?), ref: 1E8C1352

Strings

DuplicateHandle, xrefs: 1E8C1390
OOOiii:DuplicateHandle, xrefs: 1E8C1305

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_U_object@@$Arg_ParseTuple
String ID: DuplicateHandle$OOOiii:DuplicateHandle
API String ID: 1248562531-540718549
Opcode ID: a57080ec3c3728e07c99d3f998911132e306799c38cdd439b11c4bef7a5f6406
Instruction ID: 8d8c034a2c598071e4b69cb89a372e7fb2ac853a402b44f5587e301baf1dfe2a
Opcode Fuzzy Hash: a57080ec3c3728e07c99d3f998911132e306799c38cdd439b11c4bef7a5f6406
Instruction Fuzzy Hash: E2213EB1504202AFD604DB69DDD4CEB73FDAEC9608F444A1DF98993200F634EA598BA2

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C5490 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 82COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1E8C54C8
?PyWinObject_AsSYSTEMTIME@@YAHPAU_object@@PAU_SYSTEMTIME@@@Z.PYWINTYPES27(?,?), ref: 1E8C54F1
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,00000001,00000001,00000000), ref: 1E8C5510

Strings

GetTimeFormat, xrefs: 1E8C555C
iiO|O:GetTimeFormat, xrefs: 1E8C54BA

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_U_object@@$Arg_E@@@ParseString@@Tuple
String ID: GetTimeFormat$iiO|O:GetTimeFormat
API String ID: 2448270514-1815775382
Opcode ID: 1e7706ead334d1208c31677c11155ba746f441963d574c9494cdedcfb83db56c
Instruction ID: 43c9b9df9f4404c621f99cf8c57207f56cc31a63ba92bfe2faee2b7646d4e947
Opcode Fuzzy Hash: 1e7706ead334d1208c31677c11155ba746f441963d574c9494cdedcfb83db56c
Instruction Fuzzy Hash: 6F21AE71514312AFE710DBA4DD89EDB77E8AF85354F408918F94DC3240E634E648CBE2

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C5390 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 82COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1E8C53C8
?PyWinObject_AsSYSTEMTIME@@YAHPAU_object@@PAU_SYSTEMTIME@@@Z.PYWINTYPES27(?,?), ref: 1E8C53F1
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,00000001,00000001,00000000), ref: 1E8C5410

Strings

iiO|O:GetDateFormat, xrefs: 1E8C53BA
GetDateFormat, xrefs: 1E8C545C

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_U_object@@$Arg_E@@@ParseString@@Tuple
String ID: GetDateFormat$iiO|O:GetDateFormat
API String ID: 2448270514-1523432675
Opcode ID: 805856440e01bce6b9f1a592770dec48595dab8c6330e3a9cf6160e127c4a3ed
Instruction ID: 8fbccf6edc6030a595d36f21ee5390794f16633623c6f37bfc6c20ade26d7ea0
Opcode Fuzzy Hash: 805856440e01bce6b9f1a592770dec48595dab8c6330e3a9cf6160e127c4a3ed
Instruction Fuzzy Hash: 9F219CB2414311AFE710DBA4DD89ADB77E8AF85355F408918F94DC3251E234E649CBE2

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C89A0 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 77COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,OI|OO:SendMessage,?,?,?,?), ref: 1E8C89D7
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?), ref: 1E8C89F4
?PyWinObject_AsPARAM@@YAHPAU_object@@PAI@Z.PYWINTYPES27(?,?), ref: 1E8C8A11
?PyWinObject_AsPARAM@@YAHPAU_object@@PAI@Z.PYWINTYPES27(?,?), ref: 1E8C8A24

Strings

OI|OO:SendMessage, xrefs: 1E8C89D1

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_U_object@@$Arg_ParseTuple
String ID: OI|OO:SendMessage
API String ID: 1248562531-1672979447
Opcode ID: 4316ac0989473d0a19e9a678a626ebc64ee85e673e1c30ba908e3537ce7e89cb
Instruction ID: 5f381af56ab5f93a6d7fca6181419d5c36775a2a5e4ab63516b1321efb855708
Opcode Fuzzy Hash: 4316ac0989473d0a19e9a678a626ebc64ee85e673e1c30ba908e3537ce7e89cb
Instruction Fuzzy Hash: 30211D75514212AFD700DF68CC849ABB7E9AFC9205F44891DF989C3211E634E559CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C5FF0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 77COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1E8C602D
?PyWinObject_AsPARAM@@YAHPAU_object@@PAI@Z.PYWINTYPES27(00000000,?,?,?,?,?,?,?,?), ref: 1E8C604E
?PyWinObject_AsPARAM@@YAHPAU_object@@PAI@Z.PYWINTYPES27(?,?,?,?,?,?,?,?,?,?), ref: 1E8C6061

Strings

PostThreadMessage, xrefs: 1E8C60A7
iI|OO:PostThreadMessage, xrefs: 1E8C6017

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_U_object@@$Arg_ParseTuple
String ID: PostThreadMessage$iI|OO:PostThreadMessage
API String ID: 1248562531-2629939695
Opcode ID: 3e73b6577046baeaa16ae45936f458097c79a212e52c54bdb8e8474024e218aa
Instruction ID: 7b49a9f00394045e8badcaafc670d7769d98234d8dd218b301be51515478d8a8
Opcode Fuzzy Hash: 3e73b6577046baeaa16ae45936f458097c79a212e52c54bdb8e8474024e218aa
Instruction Fuzzy Hash: 4F216075504211AFE300EB68CC88EEB77E9BFC9649F44495DF88DD3211E730E9498BA2

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C1AA0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,OO:SetEnvironmentVariable,?,?), ref: 1E8C1AC2
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,?,00000000,00000000), ref: 1E8C1AE7
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,?,00000001,00000000), ref: 1E8C1AFD
SetEnvironmentVariableA.KERNEL32(?,?), ref: 1E8C1B10
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C1B43
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C1B4A

Strings

SetEnvironmentVariable, xrefs: 1E8C1B2A
OO:SetEnvironmentVariable, xrefs: 1E8C1AB4

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_String@@$FreeU_object@@$Arg_EnvironmentParseTupleVariable
String ID: OO:SetEnvironmentVariable$SetEnvironmentVariable
API String ID: 3715059473-1236800792
Opcode ID: ff964f64653956fabb7ed36c1522f48f432f8a0566922608358a01bff9807fa4
Instruction ID: 1fb2cdec8ff39287f0ad5e88da3b47df7763529c0fdaa4bb2adeda2070a04232
Opcode Fuzzy Hash: ff964f64653956fabb7ed36c1522f48f432f8a0566922608358a01bff9807fa4
Instruction Fuzzy Hash: 82112C76614212ABE304DB59CC94CEB77F9EBC6600F844A0EFA5893250E630D559CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1ECB3080 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 67COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1ECB30A8
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?), ref: 1ECB30C9
?PyWinObject_AsWCHAR@@YAHPAU_object@@PAPA_WHPAK@Z.PYWINTYPES27(?,?,00000000,00000000), ref: 1ECB30E4
GetServiceKeyNameW.ADVAPI32(?,?,?,?), ref: 1ECB3105
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(GetServiceKeyName,00000000), ref: 1ECB3115
?PyWinObject_FreeWCHAR@@YAXPA_W@Z.PYWINTYPES27(?), ref: 1ECB3137

Strings

OO:GetServiceKeyName, xrefs: 1ECB3098
GetServiceKeyName, xrefs: 1ECB3110

Memory Dump Source

Source File: 0000000F.00000002.1435001879.000000001ECB1000.00000040.00000001.01000000.00000011.sdmp, Offset: 1ECB0000, based on PE: true

Associated: 0000000F.00000002.1434980425.000000001ECB0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBA000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBD000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435097428.000000001ECBF000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435120797.000000001ECC0000.00000004.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ecb0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_U_object@@$Arg_Error@@FreeNameParseServiceTupleWin_
String ID: GetServiceKeyName$OO:GetServiceKeyName
API String ID: 1389320550-3361264681
Opcode ID: c62e68a7371218ac031869fddc187c2aca8b92fa69283dd21761517917ce5a7a
Instruction ID: 7dddb3c0762aa29a696f1d177398934ea532e4f3ece504cadd5eafac4d17f006
Opcode Fuzzy Hash: c62e68a7371218ac031869fddc187c2aca8b92fa69283dd21761517917ce5a7a
Instruction Fuzzy Hash: 58117FB2604212AFE704DF68DD88EAB77ACAF84B84F04495CF955C2240E735D908CBA3

Uniqueness

Uniqueness Score: -1.00%

Function 1ECB3150 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 66COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1ECB3178
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?,?,?,?), ref: 1ECB3199
?PyWinObject_AsWCHAR@@YAHPAU_object@@PAPA_WHPAK@Z.PYWINTYPES27(?,?,00000000,00000000,?,?,?,?,?), ref: 1ECB31B4
GetServiceDisplayNameW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 1ECB31D5
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(GetServiceDisplayName,00000000,?,?,?,?,?,?,?,?,?), ref: 1ECB31E5
?PyWinObject_FreeWCHAR@@YAXPA_W@Z.PYWINTYPES27(?,?,?,?,?,?,?,?,?,?,?), ref: 1ECB3205

Strings

OO:GetServiceDisplayName, xrefs: 1ECB3168
GetServiceDisplayName, xrefs: 1ECB31E0

Memory Dump Source

Source File: 0000000F.00000002.1435001879.000000001ECB1000.00000040.00000001.01000000.00000011.sdmp, Offset: 1ECB0000, based on PE: true

Associated: 0000000F.00000002.1434980425.000000001ECB0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBA000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBD000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435097428.000000001ECBF000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435120797.000000001ECC0000.00000004.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ecb0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_U_object@@$Arg_DisplayError@@FreeNameParseServiceTupleWin_
String ID: GetServiceDisplayName$OO:GetServiceDisplayName
API String ID: 3610659741-3922382307
Opcode ID: 89f7d023c2fc97f36b56cc008612b3f4f2c607e5954f5d82f27dff52b160a5c5
Instruction ID: dd56a8fa5cf409d0fca0fbacce9e0c7c6747dc6a8cb4ec33e5958043d89c29cd
Opcode Fuzzy Hash: 89f7d023c2fc97f36b56cc008612b3f4f2c607e5954f5d82f27dff52b160a5c5
Instruction Fuzzy Hash: 97117FB2504212AFE704DB68DD89EAB77ACEF84B85F00895CF959C2140F634D518CBA7

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C85C0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 66threadregistryCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,OlO:RegSetKeySecurity,?,?,?), ref: 1E8C85DC
?PyWinObject_AsHKEY@@YAHPAU_object@@PAPAUHKEY__@@@Z.PYWINTYPES27(?,?), ref: 1E8C85F8
?PyWinObject_AsSECURITY_DESCRIPTOR@@YAHPAU_object@@PAPAXH@Z.PYWINTYPES27(?,?,00000000), ref: 1E8C8611
PyEval_SaveThread.PYTHON27 ref: 1E8C8620
RegSetKeySecurity.ADVAPI32(?,?,?), ref: 1E8C8637
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C8640
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(RegSetKeySecurity,00000000), ref: 1E8C8653

Strings

OlO:RegSetKeySecurity, xrefs: 1E8C85D6
RegSetKeySecurity, xrefs: 1E8C864E

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: U_object@@$Eval_Object_Thread$Arg_Error@@ParseRestoreSaveSecurityTupleWin_Y__@@@
String ID: OlO:RegSetKeySecurity$RegSetKeySecurity
API String ID: 2150150574-3249879953
Opcode ID: 53c21e8c8ffeec5e3793e349735ff9428433be570529571b5414a80f33bb7d72
Instruction ID: 0f9da83946dd72e9c95b21acb852344fcd71e4dee6ab97ecb2ad99e7bfbfaa8e
Opcode Fuzzy Hash: 53c21e8c8ffeec5e3793e349735ff9428433be570529571b5414a80f33bb7d72
Instruction Fuzzy Hash: DD115EB5510211AFD300DBA8CC89DEB77E8FFC5655F844928F94AC3211E734EA59CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C4210 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 59libraryloaderCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1E8C422F
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?), ref: 1E8C424C
?PyWinObject_AsResourceIdA@@YAHPAU_object@@PAPADH@Z.PYWINTYPES27(?,00000000,00000000), ref: 1E8C4265
GetProcAddress.KERNEL32(?), ref: 1E8C427C
?PyWinObject_FreeResourceId@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C4289
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(GetProcAddress,00000000), ref: 1E8C429C

Strings

GetProcAddress, xrefs: 1E8C4297
OO:GetProcAddress, xrefs: 1E8C4221

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_U_object@@$Resource$AddressArg_Error@@FreeId@@ParseProcTupleWin_
String ID: GetProcAddress$OO:GetProcAddress
API String ID: 2070942437-1932483860
Opcode ID: ad6da6f3cac10a4c9f868802923917457701d011b009e35efdad0055511e5de2
Instruction ID: 4ca27b447c9b2fc01e5d42690da257960eb92f777495014b62f6d7d964871e53
Opcode Fuzzy Hash: ad6da6f3cac10a4c9f868802923917457701d011b009e35efdad0055511e5de2
Instruction Fuzzy Hash: 2511A0755042116FE300EB68CD8AADB3BE8EF85245F804918F94DC3251E730D598C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C1460 Relevance: 15.8, APIs: 5, Strings: 4, Instructions: 56COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(?,%s is not available on this platform,SetHandleInformation), ref: 1E8C147E
PyArg_ParseTuple.PYTHON27(?,Okk:SetHandleInformation,?,?,?), ref: 1E8C14A4

Strings

SetHandleInformation, xrefs: 1E8C14E7
Okk:SetHandleInformation, xrefs: 1E8C149E
SetHandleInformation, xrefs: 1E8C1473
%s is not available on this platform, xrefs: 1E8C1478

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Err_FormatParseTuple
String ID: %s is not available on this platform$Okk:SetHandleInformation$SetHandleInformation$SetHandleInformation
API String ID: 361908667-1298775441
Opcode ID: 2efaea8d4860490fc697b61386f2ff988010e963a4b6843afa684460c68c73b0
Instruction ID: fe1766e325c506101042777a94bea95d1d80880727e6ce4800cbbb54a38ef7cd
Opcode Fuzzy Hash: 2efaea8d4860490fc697b61386f2ff988010e963a4b6843afa684460c68c73b0
Instruction Fuzzy Hash: 041170B8510212AFE700DB28CCC8DA673F9FB86205F848A58F85DC3361E635D599CB52

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C1640 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 52threadfileCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,O:DeleteFile,?), ref: 1E8C1652
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,00000000,00000000,00000000), ref: 1E8C1673
PyEval_SaveThread.PYTHON27 ref: 1E8C1682
DeleteFileA.KERNEL32(?), ref: 1E8C168F
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C1698
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C16A3
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(DeleteFile,00000000), ref: 1E8C16B9

Strings

O:DeleteFile, xrefs: 1E8C164C
DeleteFile, xrefs: 1E8C16B4

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_Object_String@@ThreadU_object@@$Arg_DeleteError@@FileFreeParseRestoreSaveTupleWin_
String ID: DeleteFile$O:DeleteFile
API String ID: 3580031932-1169856613
Opcode ID: efff25156973c8738df8a8e2cbfa9780a7759b3de42862ade3bfd13503303295
Instruction ID: 0c020ab8722f410430d835d4b06f61bbb3775530ca325cbfaa1ab5741c2c1cba
Opcode Fuzzy Hash: efff25156973c8738df8a8e2cbfa9780a7759b3de42862ade3bfd13503303295
Instruction Fuzzy Hash: 60019279500211BFE7009B74DC8DEDA37F8AFC6746F448528FA0DC3251E634D599CAA6

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C8A70 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 52threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,O:SetConsoleTitle,?), ref: 1E8C8A82
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,00000000,00000000,00000000), ref: 1E8C8AA3
PyEval_SaveThread.PYTHON27 ref: 1E8C8AB2
SetConsoleTitleA.KERNEL32(?), ref: 1E8C8ABF
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C8AC8
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C8AD3
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(SetConsoleTitle,00000000), ref: 1E8C8AE9

Strings

SetConsoleTitle, xrefs: 1E8C8AE4
O:SetConsoleTitle, xrefs: 1E8C8A7C

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_Object_String@@ThreadU_object@@$Arg_ConsoleError@@FreeParseRestoreSaveTitleTupleWin_
String ID: O:SetConsoleTitle$SetConsoleTitle
API String ID: 1171155573-358701353
Opcode ID: 31e4524fb1d42c22c9182ee6acb77623473d95a6ab49ce5076c69c05980cffec
Instruction ID: b2999665c28ac694a174f86dc0f3312bd8a3613d2403d23b208708aee577fba6
Opcode Fuzzy Hash: 31e4524fb1d42c22c9182ee6acb77623473d95a6ab49ce5076c69c05980cffec
Instruction Fuzzy Hash: 300122395102117FE7009B74EC8DADA37E8AFC5242F448428FA0CC3200E730D559CB62

Uniqueness

Uniqueness Score: -1.00%

Function 6CC2ED28 Relevance: 15.2, APIs: 10, Instructions: 173COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 6CC2ED65
GetTickCount.KERNEL32 ref: 6CC2ED94
GetTickCount.KERNEL32 ref: 6CC2EDF9
GetTickCount.KERNEL32 ref: 6CC2EE21
GetTickCount.KERNEL32 ref: 6CC2EE90
GetTickCount.KERNEL32 ref: 6CC2EEB4
GetTickCount.KERNEL32 ref: 6CC2EF1F
CloseHandle.KERNEL32(?,?,00000000,00000001), ref: 6CC2EF4A
FreeLibrary.KERNEL32(00000000,?,00000000,00000001), ref: 6CC2EF51
GlobalMemoryStatus.KERNEL32(?), ref: 6CC2EF63
GetCurrentProcessId.KERNEL32 ref: 6CC2EF82

Memory Dump Source

Source File: 0000000F.00000002.1435325332.000000006CBC1000.00000040.00000001.01000000.0000000E.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 0000000F.00000002.1435141262.000000006CBC0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCAB000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCBE000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436271764.000000006CCC4000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436295892.000000006CCC6000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6cbc0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: CountTick$CloseCurrentFreeGlobalHandleLibraryMemoryProcessStatus
String ID:
API String ID: 2654232908-0
Opcode ID: 7d080f021697e76196a859b539e9eaa6c625de079184f2221b4d47c08f8c201e
Instruction ID: 4c5b65eb8b678a47e29fbac275923685f9f3e414f1f38e7b7c56a48197cb752a
Opcode Fuzzy Hash: 7d080f021697e76196a859b539e9eaa6c625de079184f2221b4d47c08f8c201e
Instruction Fuzzy Hash: 98610D71D112299BDF269B64CC84BADB778FB08309F0045DDE609A2584EB359B88CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 1E7D2430 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 159COMMON

Download Yara Rule

APIs

Part of subcall function 1E7D1400: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?), ref: 1E7D1469
Part of subcall function 1E7D1400: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000), ref: 1E7D148E
Part of subcall function 1E7D1400: Py_SetProgramName.PYTHON27(?,?), ref: 1E7D14AE
Part of subcall function 1E7D1400: Py_Initialize.PYTHON27(?), ref: 1E7D14B7
Part of subcall function 1E7D1400: PyEval_InitThreads.PYTHON27(?,?), ref: 1E7D14BD
Part of subcall function 1E7D1400: PySys_SetArgv.PYTHON27(00000000,00000000), ref: 1E7D14C9
Part of subcall function 1E7D1400: initservicemanager.SERVICEMANAGER ref: 1E7D14D2
Part of subcall function 1E7D1400: 73BB3B4E.MSVCR90 ref: 1E7D14E7
Part of subcall function 1E7D1400: 73BB3B4E.MSVCR90(00000000), ref: 1E7D14F2

PySys_GetObject.PYTHON27(path), ref: 1E7D2482
?PyWinObject_FromOLECHAR@@YAPAU_object@@PB_W@Z.PYWINTYPES27(?), ref: 1E7D24B0

Part of subcall function 1E7D2000: PyErr_Occurred.PYTHON27(776004E0,?,?,?,?,?,?,1E7D2B38,C0000003), ref: 1E7D2004
Part of subcall function 1E7D2000: PyErr_Fetch.PYTHON27(?,?,?,00000000,00000000,?,?,?,?,?,?,1E7D2B38,C0000003), ref: 1E7D2035
Part of subcall function 1E7D2000: ?GetPythonTraceback@@YAPADPAU_object@@00@Z.PYWINTYPES27 ref: 1E7D2054
Part of subcall function 1E7D2000: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000002,00000000,00000002,?,?,?,?,?,?,?), ref: 1E7D2090
Part of subcall function 1E7D2000: 73BB3B4E.MSVCR90(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,1E7D2B38,C0000003), ref: 1E7D20A3
Part of subcall function 1E7D2000: 73BB3B4E.MSVCR90(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,1E7D2B38), ref: 1E7D20CD
Part of subcall function 1E7D2000: PyErr_Restore.PYTHON27(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,1E7D2B38), ref: 1E7D20F0

Strings

path, xrefs: 1E7D2477

Memory Dump Source

Source File: 0000000F.00000002.1434219289.000000001E7D1000.00000040.00000001.01000000.00000015.sdmp, Offset: 1E7D0000, based on PE: true

Associated: 0000000F.00000002.1434197225.000000001E7D0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000F.00000002.1434219289.000000001E7DA000.00000040.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000F.00000002.1434284534.000000001E7DB000.00000080.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000F.00000002.1434310614.000000001E7DD000.00000004.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e7d0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: ByteCharErr_MultiWide$Sys_$ArgvEval_FetchFromInitInitializeNameObjectObject_OccurredProgramPythonRestoreThreadsTraceback@@U_object@@U_object@@00@initservicemanager
String ID: path
API String ID: 2776858932-190089999
Opcode ID: 26239ddff2df7d7167a8f024cadb0282f09da6fa94adb9e84379d58ed97f0b08
Instruction ID: a0dad073360c693050753c08007b20f091d996a6e6000b6fc62071cc923a0f61
Opcode Fuzzy Hash: 26239ddff2df7d7167a8f024cadb0282f09da6fa94adb9e84379d58ed97f0b08
Instruction Fuzzy Hash: B74127B6A403419BF3109B74FC81BD77395FB80635F054635EE5982250FB39E90F96A2

Uniqueness

Uniqueness Score: -1.00%

Function 1ECB3510 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON27(?,1ECB6F60), ref: 1ECB3549
PyTuple_New.PYTHON27(00000000), ref: 1ECB355D
PyArg_ParseTupleAndKeywords.PYTHON27(00000000,?,lOOO:SERVICE_FAILURE_ACTIONS,1ECBA500,?,?,?,?), ref: 1ECB358C
PyErr_Clear.PYTHON27 ref: 1ECB35AC
PyErr_SetString.PYTHON27(?,1ECB6F60), ref: 1ECB35C1

Strings

lOOO:SERVICE_FAILURE_ACTIONS, xrefs: 1ECB3585

Memory Dump Source

Source File: 0000000F.00000002.1435001879.000000001ECB1000.00000040.00000001.01000000.00000011.sdmp, Offset: 1ECB0000, based on PE: true

Associated: 0000000F.00000002.1434980425.000000001ECB0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBA000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBD000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435097428.000000001ECBF000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435120797.000000001ECC0000.00000004.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ecb0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Err_$String$Arg_ClearKeywordsParseTupleTuple_
String ID: lOOO:SERVICE_FAILURE_ACTIONS
API String ID: 2880908027-486590644
Opcode ID: a8ff3696b3c0fa137c7a4ad9379a035501729b3cea05ed3d8d54fbb09a3647a9
Instruction ID: 0e13d77a9c00328038942445d26f38d5627f2493d77bcc87b9d59d7ba0d0ee19
Opcode Fuzzy Hash: a8ff3696b3c0fa137c7a4ad9379a035501729b3cea05ed3d8d54fbb09a3647a9
Instruction Fuzzy Hash: B2317EB6600301AFE300DF68DD80AA773A9FF84651F448A69FD59C7241E775E509CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0325740C Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 94serviceCOMMON

Download Yara Rule

APIs

PyUnicodeUCS2_FromWideChar.PYTHON27 ref: 03257437
PyUnicodeUCS2_FromWideChar.PYTHON27(?,?), ref: 03257461
Py_BuildValue.PYTHON27((OO),00000000,00000000), ref: 03257477
PyList_Append.PYTHON27(?,00000000), ref: 03257494
CloseServiceHandle.ADVAPI32(?), ref: 032574F6
73BB3B4E.MSVCR90(00000000), ref: 032574FD

Strings

,, xrefs: 032574D9
(OO), xrefs: 03257472

Memory Dump Source

Source File: 0000000F.00000002.1423676562.0000000003251000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03250000, based on PE: true

Associated: 0000000F.00000002.1423656216.0000000003250000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423775563.0000000003263000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3250000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: CharFromUnicodeWide$AppendBuildCloseHandleList_ServiceValue
String ID: (OO)$,
API String ID: 556702654-3074773281
Opcode ID: 37ed0a876b9d4dd997596f0d10f16e3c5059ace189dd75f1f91a4fd2e54b8b58
Instruction ID: 7ccbf94a798888193b70e946441998f5220f45ed69330e3356b9bfe7d0115f8a
Opcode Fuzzy Hash: 37ed0a876b9d4dd997596f0d10f16e3c5059ace189dd75f1f91a4fd2e54b8b58
Instruction Fuzzy Hash: 36319E765403029BC710DF28E84485BB7E5FF88325F088A58FD9A87340D734EB92CB92

Uniqueness

Uniqueness Score: -1.00%

Function 1E7D1620 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 90registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(1E7D0000,1E7D6448,00000104), ref: 1E7D164D
RegCreateKeyExW.ADVAPI32(80000002,?,00000000,00000000,00000000,00020006,00000000,00000000,00000000,00000000,00000000), ref: 1E7D16D0
RegSetValueExW.ADVAPI32(?,EventMessageFile,00000000,00000001,1E7D6448,00000000), ref: 1E7D170F
RegSetValueExW.ADVAPI32(?,?,?,TypesSupported,00000000,00000004,?,00000004), ref: 1E7D172E
RegCloseKey.ADVAPI32(?), ref: 1E7D1735

Strings

EventMessageFile, xrefs: 1E7D1709
TypesSupported, xrefs: 1E7D1720
Python Service, xrefs: 1E7D1674

Memory Dump Source

Source File: 0000000F.00000002.1434219289.000000001E7D1000.00000040.00000001.01000000.00000015.sdmp, Offset: 1E7D0000, based on PE: true

Associated: 0000000F.00000002.1434197225.000000001E7D0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000F.00000002.1434219289.000000001E7DA000.00000040.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000F.00000002.1434284534.000000001E7DB000.00000080.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000F.00000002.1434310614.000000001E7DD000.00000004.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e7d0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Value$CloseCreateFileModuleName
String ID: EventMessageFile$Python Service$TypesSupported
API String ID: 3045805707-2879936719
Opcode ID: 5e4c88f888cf83aa022e1fc8f0c0d2040b376688563c4dd23e26047f5ea31456
Instruction ID: b5c2bf9ad9d169c6600898d0995fa9170baeab6da0eb9e85a9eb099a34f91c07
Opcode Fuzzy Hash: 5e4c88f888cf83aa022e1fc8f0c0d2040b376688563c4dd23e26047f5ea31456
Instruction Fuzzy Hash: 1731D571610315ABF3209B94DC96F9772E9FB88750F048A08FA46DB2E4E7B4A548C751

Uniqueness

Uniqueness Score: -1.00%

Function 1ECB1C10 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 86COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,Olll:OpenWindowStation,?,?,?,?), ref: 1ECB1C4D
?PyWinObject_AsWCHAR@@YAHPAU_object@@PAPA_WHPAK@Z.PYWINTYPES27(?,?,00000000,00000000), ref: 1ECB1C78
OpenDesktopW.USER32(?,?,?,?), ref: 1ECB1C9A
GetLastError.KERNEL32 ref: 1ECB1CA6
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(OpenDesktop,00000000), ref: 1ECB1CB2
?PyWinObject_FreeWCHAR@@YAXPA_W@Z.PYWINTYPES27(?), ref: 1ECB1CF3

Strings

OpenDesktop, xrefs: 1ECB1CAD
Olll:OpenWindowStation, xrefs: 1ECB1C41

Memory Dump Source

Source File: 0000000F.00000002.1435001879.000000001ECB1000.00000040.00000001.01000000.00000011.sdmp, Offset: 1ECB0000, based on PE: true

Associated: 0000000F.00000002.1434980425.000000001ECB0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBA000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBD000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435097428.000000001ECBF000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435120797.000000001ECC0000.00000004.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ecb0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_U_object@@$Arg_DesktopErrorError@@FreeLastOpenParseTupleWin_
String ID: Olll:OpenWindowStation$OpenDesktop
API String ID: 1430290024-1656445327
Opcode ID: f4adb8ac8064fb87b93fbc7b4247ada2e0a7ee641fc02afb353b73bb2aaf4c1d
Instruction ID: 0576490160f7af2bbbf4fcf972113562add8d677559ee0bbf05d38fbb0e7927c
Opcode Fuzzy Hash: f4adb8ac8064fb87b93fbc7b4247ada2e0a7ee641fc02afb353b73bb2aaf4c1d
Instruction Fuzzy Hash: D8218EB6608250AFD204CF69CD84A5BBBE9FBC8B90F048B2DF85AC3240D734D5458B62

Uniqueness

Uniqueness Score: -1.00%

Function 1ECB2210 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 82COMMON

Download Yara Rule

APIs

?PyWinObject_AsMultipleString@@YAHPAU_object@@PAPA_WHPAK@Z.PYWINTYPES27(?,00000001,00000001,00000000), ref: 1ECB2227
ChangeServiceConfigW.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?), ref: 1ECB227B
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(ChangeServiceConfig,00000000), ref: 1ECB228B
?PyWinObject_FreeMultipleString@@YAXPA_W@Z.PYWINTYPES27(?), ref: 1ECB229B
PyInt_FromLong.PYTHON27(?), ref: 1ECB22B4
?PyWinObject_FreeMultipleString@@YAXPA_W@Z.PYWINTYPES27(?), ref: 1ECB22C4
?PyWinObject_FreeMultipleString@@YAXPA_W@Z.PYWINTYPES27(?), ref: 1ECB22E1

Strings

ChangeServiceConfig, xrefs: 1ECB2286

Memory Dump Source

Source File: 0000000F.00000002.1435001879.000000001ECB1000.00000040.00000001.01000000.00000011.sdmp, Offset: 1ECB0000, based on PE: true

Associated: 0000000F.00000002.1434980425.000000001ECB0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBA000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBD000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435097428.000000001ECBF000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435120797.000000001ECC0000.00000004.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ecb0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: MultipleObject_String@@$Free$U_object@@$ChangeConfigError@@FromInt_LongServiceWin_
String ID: ChangeServiceConfig
API String ID: 3044672756-3026956072
Opcode ID: fdefe3f07d48441ba2fd652c846c65da0b0d5b63f2bcc2d296011cf0fdc57c4f
Instruction ID: 64f802548a6bea563f2b6d441d447d67152235f955b195f1d6bf05b79823da0b
Opcode Fuzzy Hash: fdefe3f07d48441ba2fd652c846c65da0b0d5b63f2bcc2d296011cf0fdc57c4f
Instruction Fuzzy Hash: 17215EB6604220AFC744DB58DD84D6BB7E8EF88A95F44496CF989D3305E230E954CBA3

Uniqueness

Uniqueness Score: -1.00%

Function 1ECB1B10 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 82COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,Oll:OpenWindowStation,?,?,?), ref: 1ECB1B48
?PyWinObject_AsWCHAR@@YAHPAU_object@@PAPA_WHPAK@Z.PYWINTYPES27(?,?,00000000,00000000), ref: 1ECB1B73
OpenWindowStationW.USER32(?,?,?), ref: 1ECB1B90
GetLastError.KERNEL32 ref: 1ECB1B9C
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(OpenWindowStation,00000000), ref: 1ECB1BA8
?PyWinObject_FreeWCHAR@@YAXPA_W@Z.PYWINTYPES27(?), ref: 1ECB1BE9

Strings

Oll:OpenWindowStation, xrefs: 1ECB1B3C
OpenWindowStation, xrefs: 1ECB1BA3

Memory Dump Source

Source File: 0000000F.00000002.1435001879.000000001ECB1000.00000040.00000001.01000000.00000011.sdmp, Offset: 1ECB0000, based on PE: true

Associated: 0000000F.00000002.1434980425.000000001ECB0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBA000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBD000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435097428.000000001ECBF000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435120797.000000001ECC0000.00000004.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ecb0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_U_object@@$Arg_ErrorError@@FreeLastOpenParseStationTupleWin_Window
String ID: Oll:OpenWindowStation$OpenWindowStation
API String ID: 3902380053-3929729995
Opcode ID: 9f05801c7cdb1abd009a249a1e12eb41c5fc56674f7cf617b82736e8a3518a3b
Instruction ID: 59a0bf3adbc6b0ba4210a9e783b8fd3584d2b71c46ff03177bf71f7ab22d262b
Opcode Fuzzy Hash: 9f05801c7cdb1abd009a249a1e12eb41c5fc56674f7cf617b82736e8a3518a3b
Instruction Fuzzy Hash: 002160B6504251AFD314CF69CD84E6BBBE9FBC8A90F044B69F85AD3244E634D9048B62

Uniqueness

Uniqueness Score: -1.00%

Function 03255F70 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 78COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00001000,?,03256070,00001000,00001000,00001000,032560F2,00000000,00001000,?,03251711,?,00001000), ref: 03255F82
PyErr_SetString.PYTHON27(?,iphr: exit fun), ref: 03255FBD
GetExitCodeProcess.KERNEL32(?,00000000), ref: 03255FD4
CloseHandle.KERNEL32(?), ref: 0325601D
CloseHandle.KERNEL32(?,?,03256070,00001000,00001000,00001000,032560F2,00000000,00001000,?,03251711,?,00001000), ref: 03256029

Part of subcall function 03255DC0: 73BB3B4E.MSVCR90(00000000,00000000,?), ref: 03255DEF

Strings

iphr: exit fun, xrefs: 0325604A
iphr: GetExitCodeProcess() -> STILL_ACTIVE, xrefs: 03255FEC
iphr: OpenProcess() -> ERROR_INVALID_PARAMETER, xrefs: 03255FAF

Memory Dump Source

Source File: 0000000F.00000002.1423676562.0000000003251000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03250000, based on PE: true

Associated: 0000000F.00000002.1423656216.0000000003250000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423775563.0000000003263000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3250000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: CloseHandle$CodeErr_ErrorExitLastProcessString
String ID: iphr: GetExitCodeProcess() -> STILL_ACTIVE$iphr: OpenProcess() -> ERROR_INVALID_PARAMETER$iphr: exit fun
API String ID: 1037456587-1526647775
Opcode ID: 924bbdb49103ff485d7bbf601b118b5bf69daa44f5597a0fe7c9ece06d4a9baa
Instruction ID: 3c29c710490d56b9824c5cd0bf0fce622ca7a4db812e55eda9d2605bba5f095e
Opcode Fuzzy Hash: 924bbdb49103ff485d7bbf601b118b5bf69daa44f5597a0fe7c9ece06d4a9baa
Instruction Fuzzy Hash: 7121EBB39213119BCA10EB68F84C5AE7398FF42625F688959FD13C6180D774DBC4C742

Uniqueness

Uniqueness Score: -1.00%

Function 1E8CA7A4 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 78threadCOMMON

Download Yara Rule

APIs

PyThreadState_Swap.PYTHON27(00000000), ref: 1E8CA7B0
PyThreadState_Swap.PYTHON27(00000000), ref: 1E8CA7BD
PyObject_IsSubclass.PYTHON27(?), ref: 1E8CA7CB
PyErr_SetObject.PYTHON27(?,?), ref: 1E8CA7F8
PyErr_SetString.PYTHON27(?,exception handler must return a valid object which can be raised as an exception (eg (exc_type, exc_value) or exc_class_instance)), ref: 1E8CA820

Strings

instance exception returned from exception handler may not have a separate value, xrefs: 1E8CA7DF
exception handler must return a valid object which can be raised as an exception (eg (exc_type, exc_value) or exc_class_instance), xrefs: 1E8CA812

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Err_State_SwapThread$ObjectObject_StringSubclass
String ID: exception handler must return a valid object which can be raised as an exception (eg (exc_type, exc_value) or exc_class_instance)$instance exception returned from exception handler may not have a separate value
API String ID: 591502950-790970431
Opcode ID: ca4452cd228b764df8c62bf98e757a8f4d7bb3d3d163f9a4b600ce3b3a0d2f5a
Instruction ID: 5857ef73c1b05dc43e0a3d71909422ab730530249a8b09304649a3d72bb56c85
Opcode Fuzzy Hash: ca4452cd228b764df8c62bf98e757a8f4d7bb3d3d163f9a4b600ce3b3a0d2f5a
Instruction Fuzzy Hash: E82160729001159BDB10DFA8D8D48DAB3F5FF4A220B1143B9E96AA3290D731EC82CB91

Uniqueness

Uniqueness Score: -1.00%

Function 1E8CA6D0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 75threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,OOO,?,?,?), ref: 1E8CA713
PyCallable_Check.PYTHON27(?), ref: 1E8CA724
PyErr_SetString.PYTHON27(00000000,First argument must be an exception handler which accepts 2 arguments.), ref: 1E8CA73F
PyThreadState_Swap.PYTHON27(00000000), ref: 1E8CA762
PyThreadState_Swap.PYTHON27(00000000), ref: 1E8CA768
PyObject_CallObject.PYTHON27(?,?), ref: 1E8CA778

Strings

First argument must be an exception handler which accepts 2 arguments., xrefs: 1E8CA731
OOO, xrefs: 1E8CA70A

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: State_SwapThread$Arg_CallCallable_CheckErr_ObjectObject_ParseStringTuple
String ID: First argument must be an exception handler which accepts 2 arguments.$OOO
API String ID: 2129682363-1352449461
Opcode ID: 5ad5063a2e17e72756d4b8b16bdd48641aef8846f2c2d5cba09f47427f7024da
Instruction ID: c53357eb086760f4ef39b2d2badc3e70e87fa9638f2343554b1ab4568ca9031e
Opcode Fuzzy Hash: 5ad5063a2e17e72756d4b8b16bdd48641aef8846f2c2d5cba09f47427f7024da
Instruction Fuzzy Hash: E52165B2D00218AFDB00DFE9DC84ADEF7B8FB49625F40466AF919E3340E73595458BA0

Uniqueness

Uniqueness Score: -1.00%

Function 1E8CC6F0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 70COMMON

Download Yara Rule

APIs

PyArg_ParseTupleAndKeywords.PYTHON27(?,?,|Ok:EnumDisplaySettings,1E8D7F74,?,?), ref: 1E8CC72E
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,?,00000001,00000000), ref: 1E8CC752
EnumDisplaySettingsA.USER32(?,?,?), ref: 1E8CC78B
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(EnumDisplaySettings,00000000), ref: 1E8CC79B
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8CC7BB

Strings

EnumDisplaySettings, xrefs: 1E8CC796
|Ok:EnumDisplaySettings, xrefs: 1E8CC71D

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_String@@U_object@@$Arg_DisplayEnumError@@FreeKeywordsParseSettingsTupleWin_
String ID: EnumDisplaySettings$|Ok:EnumDisplaySettings
API String ID: 262557981-2957657313
Opcode ID: 2161efe2338b2dff6147b6d7170a97a0b2985dd725a99f9ac41cff99ce3d7fc3
Instruction ID: 38dcdfd4769f531a5122e9445e71a23eabdd5d1adbf577628cd5e0f2432abae7
Opcode Fuzzy Hash: 2161efe2338b2dff6147b6d7170a97a0b2985dd725a99f9ac41cff99ce3d7fc3
Instruction Fuzzy Hash: 45213BB1504351ABE224DB68DC88E9B7BE8EF85644F408A2CF58DC3241E734D558CBA7

Uniqueness

Uniqueness Score: -1.00%

Function 1ECB3640 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 69COMMON

Download Yara Rule

APIs

PyTuple_New.PYTHON27(?), ref: 1ECB3649
Py_BuildValue.PYTHON27(1ECB701C,?,?), ref: 1ECB367C
Py_BuildValue.PYTHON27({s:l,s:u,s:u,s:N},ResetPeriod,?,RebootMsg,?,Command,?,Actions,00000000), ref: 1ECB36C1

Strings

Command, xrefs: 1ECB36AB
{s:l,s:u,s:u,s:N}, xrefs: 1ECB36BC
RebootMsg, xrefs: 1ECB36B1
Actions, xrefs: 1ECB36A5
ResetPeriod, xrefs: 1ECB36B7

Memory Dump Source

Source File: 0000000F.00000002.1435001879.000000001ECB1000.00000040.00000001.01000000.00000011.sdmp, Offset: 1ECB0000, based on PE: true

Associated: 0000000F.00000002.1434980425.000000001ECB0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBA000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBD000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435097428.000000001ECBF000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435120797.000000001ECC0000.00000004.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ecb0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: BuildValue$Tuple_
String ID: Actions$Command$RebootMsg$ResetPeriod${s:l,s:u,s:u,s:N}
API String ID: 1175426528-2179363625
Opcode ID: aec33f2b548ed58a938598ebff51b2b248e7d34b53e21b8cdd312865ccff1bb6
Instruction ID: bf403ef8c3c61c92ea2fb4c2b0a70c06f1b8e3cc1fa39971fad2fc29e97a2a80
Opcode Fuzzy Hash: aec33f2b548ed58a938598ebff51b2b248e7d34b53e21b8cdd312865ccff1bb6
Instruction Fuzzy Hash: A2117CB2A04206AFD600CF58EC84C5BB3A9FF842A0B05872AFC2997744D331FC55CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 032580A0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 68registryCOMMON

Download Yara Rule

APIs

73AA68D0.PDH(00000000,00000000,?), ref: 032580AD
CreateEventW.KERNEL32(00000000,00000000,00000000,LoadUpdateEvent,?,\System\Processor Queue Length,00000000,?,00000000,00000000,?), ref: 032580D7
GetLastError.KERNEL32 ref: 032580E3
PyErr_SetFromWindowsErr.PYTHON27(00000000), ref: 032580EA
PyErr_SetExcFromWindowsErr.PYTHON27(?,00000000,00000000,00000000,?), ref: 03258116
RegisterWaitForSingleObject.KERNEL32(?,00000000,Function_00008020,00000000,000000FF,00000000), ref: 0325813A

Strings

LoadUpdateEvent, xrefs: 032580CF
\System\Processor Queue Length, xrefs: 032580C0

Memory Dump Source

Source File: 0000000F.00000002.1423676562.0000000003251000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03250000, based on PE: true

Associated: 0000000F.00000002.1423656216.0000000003250000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423775563.0000000003263000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3250000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Err_FromWindows$CreateErrorEventLastObjectRegisterSingleWait
String ID: LoadUpdateEvent$\System\Processor Queue Length
API String ID: 3912169399-2418050192
Opcode ID: 50a8eb55097f14d094ccd2914c8b6b879b6269c323d4d11fb5339101866ae698
Instruction ID: 924cf5d05b754f3b2ddf09ea77be3778ee7d38066a714364a8c01a5b9ffcd1b5
Opcode Fuzzy Hash: 50a8eb55097f14d094ccd2914c8b6b879b6269c323d4d11fb5339101866ae698
Instruction Fuzzy Hash: 3B116D75714311ABE610E664FC49FAB37ACAB48A14F048514FD46D6184E6B4DB84CB62

Uniqueness

Uniqueness Score: -1.00%

Function 1E7D1C80 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 66COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,|OO,?,?), ref: 1E7D1CA4
?PyWinObject_AsWCHAR@@YAHPAU_object@@PAPA_WHPAK@Z.PYWINTYPES27(?,00000001,00000001,00000000), ref: 1E7D1CCA
?PyWinObject_AsWCHAR@@YAHPAU_object@@PAPA_WHPAK@Z.PYWINTYPES27(?,?,00000001,00000000), ref: 1E7D1CE1
?PyWinObject_FreeWCHAR@@YAXPA_W@Z.PYWINTYPES27(?), ref: 1E7D1CEF

Strings

|OO, xrefs: 1E7D1C9E

Memory Dump Source

Source File: 0000000F.00000002.1434219289.000000001E7D1000.00000040.00000001.01000000.00000015.sdmp, Offset: 1E7D0000, based on PE: true

Associated: 0000000F.00000002.1434197225.000000001E7D0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000F.00000002.1434219289.000000001E7DA000.00000040.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000F.00000002.1434284534.000000001E7DB000.00000080.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000F.00000002.1434310614.000000001E7DD000.00000004.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e7d0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_$U_object@@$Arg_FreeParseTuple
String ID: |OO
API String ID: 2955467632-858277869
Opcode ID: 2ab5521879703652a986c9e19c091e67a91ed52ededb46e3cc035d55ab295149
Instruction ID: d4c6b3d349695d5b39f1da46f1b206ee0d7602d8a9ee09f6d1441eb2cb494f48
Opcode Fuzzy Hash: 2ab5521879703652a986c9e19c091e67a91ed52ededb46e3cc035d55ab295149
Instruction Fuzzy Hash: 1F117275904321AFE300DB68CC85AEB77E8FF88200F408D49FA5983251F635E9088B92

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C65E0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 60registryCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1E8C65FF
?PyWinObject_AsHKEY@@YAHPAU_object@@PAPAUHKEY__@@@Z.PYWINTYPES27(?,?), ref: 1E8C661C
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,00000000,00000000,00000000), ref: 1E8C6637
RegDeleteKeyA.ADVAPI32(?), ref: 1E8C664E
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C665B
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(RegDeleteKey,00000000), ref: 1E8C666E

Strings

RegDeleteKey, xrefs: 1E8C6669
OO:RegDeleteKey, xrefs: 1E8C65F1

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_U_object@@$String@@$Arg_DeleteError@@FreeParseTupleWin_Y__@@@
String ID: OO:RegDeleteKey$RegDeleteKey
API String ID: 3487491845-662082429
Opcode ID: cf69b9c7668b60515a10c24e7241fb0c4b88b600747e696c5d6e3419488a5974
Instruction ID: 305fa623a94ae26b3216b272c4620c6f215a0a9d338a3e034bdf798d67866d93
Opcode Fuzzy Hash: cf69b9c7668b60515a10c24e7241fb0c4b88b600747e696c5d6e3419488a5974
Instruction Fuzzy Hash: B41194B4504211AFE300DB68CC89ED777E9EF85649F404918F94DC3251E731E555CB92

Uniqueness

Uniqueness Score: -1.00%

Function 03257000 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 57COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,00000000,?,032570D6), ref: 0325700B
OpenProcessToken.ADVAPI32(00000000,00000028,00000000,?,00000000,?,032570D6), ref: 03257021
GetLastError.KERNEL32(?,00000000,?,032570D6), ref: 03257027
ImpersonateSelf.ADVAPI32(00000002,?,00000000,?,032570D6), ref: 03257036
OpenProcessToken.ADVAPI32(00000000,00000028,00000000,?,00000000,?,032570D6), ref: 0325705B

Part of subcall function 03251090: GetLastError.KERNEL32 ref: 032510B2
Part of subcall function 03251090: PyErr_SetFromWindowsErrWithFilename.PYTHON27(00000000), ref: 032510B9

Strings

OpenProcessToken, xrefs: 03257061
ImpersonateSelf, xrefs: 03257040
OpenProcessToken, xrefs: 03257074

Memory Dump Source

Source File: 0000000F.00000002.1423676562.0000000003251000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03250000, based on PE: true

Associated: 0000000F.00000002.1423656216.0000000003250000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423775563.0000000003263000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3250000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Process$ErrorLastOpenToken$CurrentErr_FilenameFromImpersonateSelfWindowsWith
String ID: ImpersonateSelf$OpenProcessToken$OpenProcessToken
API String ID: 2863890154-2646372828
Opcode ID: 40c55030ab87a02167be1438d80f9f4808ed3ee3fd84fda10001029b46979826
Instruction ID: 33001952fce46a9c8c5cbc341c9650447adaa6adcaf1b310a87db76adbf1f61f
Opcode Fuzzy Hash: 40c55030ab87a02167be1438d80f9f4808ed3ee3fd84fda10001029b46979826
Instruction Fuzzy Hash: 1201B1B72602116EE710A6A9FC09AAF6398DB805B2F18447AFD06C5445FB70D6C04262

Uniqueness

Uniqueness Score: -1.00%

Function 1E8CA320 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 56COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1E8CA339
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(00000000,?), ref: 1E8CA355
PyList_New.PYTHON27(00000000), ref: 1E8CA365

Strings

O:EnumResourceTypes, xrefs: 1E8CA32B
EnumResourceTypes, xrefs: 1E8CA3A8

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_List_Object_ParseTupleU_object@@
String ID: EnumResourceTypes$O:EnumResourceTypes
API String ID: 2673777529-4281011403
Opcode ID: c5d678750caadd43ac5bbd6d890d14bd7dbb60326b5afa3b282b38cd1967d983
Instruction ID: 4d6846d25a09bb338a415a7abd01405960e63a55a7fdb4bcef1f60b7580893c6
Opcode Fuzzy Hash: c5d678750caadd43ac5bbd6d890d14bd7dbb60326b5afa3b282b38cd1967d983
Instruction Fuzzy Hash: E401C8716002115BD210ABB4EC58ACB77E9BF42656F440614FC4DC3340E334D559C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 1ECB2E60 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 55COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,OlO:SetServiceObjectSecurity,?,?,?), ref: 1ECB2E7C
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?), ref: 1ECB2E98
?PyWinObject_AsSECURITY_DESCRIPTOR@@YAHPAU_object@@PAPAXH@Z.PYWINTYPES27(?,?,00000000), ref: 1ECB2EB1
SetServiceObjectSecurity.ADVAPI32(?,?,?), ref: 1ECB2ECD
GetLastError.KERNEL32 ref: 1ECB2ED7
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(SetServiceObjectSecurity,00000000), ref: 1ECB2EE3

Strings

OlO:SetServiceObjectSecurity, xrefs: 1ECB2E76
SetServiceObjectSecurity, xrefs: 1ECB2EDE

Memory Dump Source

Source File: 0000000F.00000002.1435001879.000000001ECB1000.00000040.00000001.01000000.00000011.sdmp, Offset: 1ECB0000, based on PE: true

Associated: 0000000F.00000002.1434980425.000000001ECB0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBA000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBD000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435097428.000000001ECBF000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435120797.000000001ECC0000.00000004.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ecb0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: U_object@@$Object_$Arg_ErrorError@@LastObjectParseSecurityServiceTupleWin_
String ID: OlO:SetServiceObjectSecurity$SetServiceObjectSecurity
API String ID: 3614701857-3525016331
Opcode ID: 7b1b44db8871715073f0bf1c39cf39ef40d42c2c851943ef6d31e9f6fc36bed9
Instruction ID: 1777a4a7cb58e5a90677f15abfa28c7a95fb6697b95fafca316b8fa6e1582309
Opcode Fuzzy Hash: 7b1b44db8871715073f0bf1c39cf39ef40d42c2c851943ef6d31e9f6fc36bed9
Instruction Fuzzy Hash: B51182B1514242AFD704DB65CD84D6B77B9FF84A86F448998F84AC2205E734D518CB62

Uniqueness

Uniqueness Score: -1.00%

Function 1E8CCCD0 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 55COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(?,%s is not available on this platform,MonitorFromWindow), ref: 1E8CCCEE
PyArg_ParseTupleAndKeywords.PYTHON27 ref: 1E8CCD20

Strings

%s is not available on this platform, xrefs: 1E8CCCE8
O|k:MonitorFromWindow, xrefs: 1E8CCD11
MonitorFromWindow, xrefs: 1E8CCCE3

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Err_FormatKeywordsParseTuple
String ID: %s is not available on this platform$MonitorFromWindow$O|k:MonitorFromWindow
API String ID: 223827023-3164843671
Opcode ID: 25324d5f7a8ffb9dab251f0e6472fc7fc057bd6ab9ff661e5b7b333824aaed43
Instruction ID: 97962056412182635b6da1506115ca3bb0cd8e33f242d9c389ab40465cddeaaf
Opcode Fuzzy Hash: 25324d5f7a8ffb9dab251f0e6472fc7fc057bd6ab9ff661e5b7b333824aaed43
Instruction Fuzzy Hash: 001182B4510206AFD710DB28DC88E9677E9FB85649F448618F94DC3321E335DA5DCB92

Uniqueness

Uniqueness Score: -1.00%

Function 1E8CCC20 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 55COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(?,%s is not available on this platform,MonitorFromRect), ref: 1E8CCC3E
PyArg_ParseTupleAndKeywords.PYTHON27 ref: 1E8CCC70

Strings

%s is not available on this platform, xrefs: 1E8CCC38
O|k:MonitorFromRect, xrefs: 1E8CCC61
MonitorFromRect, xrefs: 1E8CCC33

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Err_FormatKeywordsParseTuple
String ID: %s is not available on this platform$MonitorFromRect$O|k:MonitorFromRect
API String ID: 223827023-1141344094
Opcode ID: c1ba122fcf73b6d4cec234cf5cdf7efc09bf810ee3b0819a59a0a641860fb890
Instruction ID: fb1dfa74742429da72e84d301b0f39155f64cbfa30947fc61c199224611fefd3
Opcode Fuzzy Hash: c1ba122fcf73b6d4cec234cf5cdf7efc09bf810ee3b0819a59a0a641860fb890
Instruction Fuzzy Hash: BD1182B4514606AFE704EB68CC89A8777E9BB85205F848558F80DC3311E334DA59CB92

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C9A60 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 55threadtimeCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,hhhhhhhh:SetSystemTime,?,?,?,?,?,?,?,?), ref: 1E8C9A95
PyEval_SaveThread.PYTHON27 ref: 1E8C9AA8
SetSystemTime.KERNEL32(?), ref: 1E8C9AB5
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C9ABE
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(SetSystemTime,00000000), ref: 1E8C9AD1

Strings

SetSystemTime, xrefs: 1E8C9ACC
hhhhhhhh:SetSystemTime, xrefs: 1E8C9A8F

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_Thread$Arg_Error@@ParseRestoreSaveSystemTimeTupleU_object@@Win_
String ID: SetSystemTime$hhhhhhhh:SetSystemTime
API String ID: 3654231324-3782942145
Opcode ID: ce5b30e74a65f7a89dd888dae692b275c4533abe6778426cf6c60565d09fdc53
Instruction ID: 5d946574f1b1154512aaab02837e468e82a330523052d790e160cc26799fb718
Opcode Fuzzy Hash: ce5b30e74a65f7a89dd888dae692b275c4533abe6778426cf6c60565d09fdc53
Instruction Fuzzy Hash: 5C0184774042217BD301DB59CC88CDB77ECEEC5255F844A5AF94A83211FA30D25DCBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C9450 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 54threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,OiO:SetWindowLong,?,?,?), ref: 1E8C946C
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?), ref: 1E8C9488
?PyWinLong_AsVoidPtr@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?), ref: 1E8C949F
PyEval_SaveThread.PYTHON27 ref: 1E8C94AE
SetWindowLongA.USER32(?,?,?), ref: 1E8C94C5
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C94CE
?PyWinLong_FromVoidPtr@@YAPAU_object@@PBX@Z.PYWINTYPES27(00000000), ref: 1E8C94D5

Strings

OiO:SetWindowLong, xrefs: 1E8C9466

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: U_object@@$Eval_Long_Ptr@@ThreadVoid$Arg_FromLongObject_ParseRestoreSaveTupleWindow
String ID: OiO:SetWindowLong
API String ID: 3773251432-48778103
Opcode ID: 866c9d79fec775ba0bd2ac97d75be929aa62a36f2f670f292608685b5a0715b9
Instruction ID: 8fb4125ead357f9b32eb986a03b01d147d0fae1f48b7a79c8a8b851d1b49f03f
Opcode Fuzzy Hash: 866c9d79fec775ba0bd2ac97d75be929aa62a36f2f670f292608685b5a0715b9
Instruction Fuzzy Hash: 2A015BB5514212AFD700EB68CD888AB77E8BEC5605F44496CF98AC3211E734D959CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C9580 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 54threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,OiO:SetClassLong,?,?,?), ref: 1E8C959C
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?), ref: 1E8C95B8
?PyWinLong_AsVoidPtr@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?), ref: 1E8C95CF
PyEval_SaveThread.PYTHON27 ref: 1E8C95DE
SetClassLongA.USER32(?,?,?), ref: 1E8C95F5
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C95FE
?PyWinLong_FromVoidPtr@@YAPAU_object@@PBX@Z.PYWINTYPES27(00000000), ref: 1E8C9605

Strings

OiO:SetClassLong, xrefs: 1E8C9596

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: U_object@@$Eval_Long_Ptr@@ThreadVoid$Arg_ClassFromLongObject_ParseRestoreSaveTuple
String ID: OiO:SetClassLong
API String ID: 789884394-51586606
Opcode ID: c88b99324ab71fb4544443bfbd7dc46bf0e1eb255344ac8eec8197cc9fb5c7e7
Instruction ID: 02410e2f948a0705c0780211a2642ef19cdec132b7311aa235b064dd4f324e02
Opcode Fuzzy Hash: c88b99324ab71fb4544443bfbd7dc46bf0e1eb255344ac8eec8197cc9fb5c7e7
Instruction Fuzzy Hash: 85018BB5110212AFD700EBA8CC888AB37E8BEC5605F44492CF949C3200EB35D959CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C48F0 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 51COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,:GetSystemInfo), ref: 1E8C48FD
GetSystemInfo.KERNEL32(?), ref: 1E8C4914
PyLong_FromUnsignedLongLong.PYTHON27(?,00000000,?,?,?,?,?), ref: 1E8C493C
?PyWinLong_FromVoidPtr@@YAPAU_object@@PBX@Z.PYWINTYPES27(?,00000000), ref: 1E8C4951
?PyWinLong_FromVoidPtr@@YAPAU_object@@PBX@Z.PYWINTYPES27(?,00000000), ref: 1E8C495C
Py_BuildValue.PYTHON27(iiNNNiii(HH),?,?,00000000), ref: 1E8C4972

Strings

:GetSystemInfo, xrefs: 1E8C48F7
iiNNNiii(HH), xrefs: 1E8C496D

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: FromLong_$LongPtr@@U_object@@Void$Arg_BuildInfoParseSystemTupleUnsignedValue
String ID: :GetSystemInfo$iiNNNiii(HH)
API String ID: 1993707043-3631835655
Opcode ID: aa6295b7887f643f2ed2158fe94bfb534e43364dd5bceb777d9a5e74cd4abd33
Instruction ID: c6012ef18fc0839e24b16b5b9d2ede3c8c9897f9409de8ec886d3a859f63f472
Opcode Fuzzy Hash: aa6295b7887f643f2ed2158fe94bfb534e43364dd5bceb777d9a5e74cd4abd33
Instruction Fuzzy Hash: 800121B55082106BD2049B69CC89DBB77E9FFCC609F04461CF98DA3240E635EA94CB62

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C9C70 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 51threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,Oi:TerminateProcess,?,?), ref: 1E8C9C87
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?), ref: 1E8C9CA3
PyEval_SaveThread.PYTHON27 ref: 1E8C9CB2
TerminateProcess.KERNEL32(?,?), ref: 1E8C9CC4
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C9CCD
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(TerminateProcess,00000000), ref: 1E8C9CE3

Strings

Oi:TerminateProcess, xrefs: 1E8C9C81
TerminateProcess, xrefs: 1E8C9CDE

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_ThreadU_object@@$Arg_Error@@Object_ParseProcessRestoreSaveTerminateTupleWin_
String ID: Oi:TerminateProcess$TerminateProcess
API String ID: 458641537-979489166
Opcode ID: 349fa0efb5c1701ed6f1887a4b23fecb1336853a262b535deca19666c83626b0
Instruction ID: 2a57874a2c82853ab7e7197ea9c7398848d6892afcf63e3c383df7279f775f5d
Opcode Fuzzy Hash: 349fa0efb5c1701ed6f1887a4b23fecb1336853a262b535deca19666c83626b0
Instruction Fuzzy Hash: 33014C79510211AFE300DB78DD8DAAA37E8AF86655F844529FD0DC3210E634D659CAA2

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C3C50 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1E8C3C73
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,00000001,00000001,00000000), ref: 1E8C3C94
GetModuleHandleA.KERNEL32 ref: 1E8C3CA6
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C3CB3
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(GetModuleHandle,00000000), ref: 1E8C3CC6

Strings

GetModuleHandle, xrefs: 1E8C3CC1
|O:GetModuleHandle, xrefs: 1E8C3C61

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_String@@U_object@@$Arg_Error@@FreeHandleModuleParseTupleWin_
String ID: GetModuleHandle$|O:GetModuleHandle
API String ID: 3638201006-1447205508
Opcode ID: fc7bea19f4521c8b3012d317108db8c0872ee261aa9c414bccd4088dc24832f7
Instruction ID: 2cd3e7766a20d6e4620a5da226db86af2a4a3b2952faf5c10377487ab8b2627c
Opcode Fuzzy Hash: fc7bea19f4521c8b3012d317108db8c0872ee261aa9c414bccd4088dc24832f7
Instruction Fuzzy Hash: A0019E74500321ABE6109B28DD8DACB37E8AF85655F848928F94DC3240E335D659CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1ECB15C0 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 49COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,:EnumDesktopWindows), ref: 1ECB15CA
PyList_New.PYTHON27(00000000), ref: 1ECB15DB

Strings

EnumDesktopWindows, xrefs: 1ECB1633
:EnumDesktopWindows, xrefs: 1ECB15C4

Memory Dump Source

Source File: 0000000F.00000002.1435001879.000000001ECB1000.00000040.00000001.01000000.00000011.sdmp, Offset: 1ECB0000, based on PE: true

Associated: 0000000F.00000002.1434980425.000000001ECB0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBA000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBD000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435097428.000000001ECBF000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435120797.000000001ECC0000.00000004.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ecb0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_List_ParseTuple
String ID: :EnumDesktopWindows$EnumDesktopWindows
API String ID: 1475923592-1909442800
Opcode ID: 848b42a2b7192eebd4c8db6ba1286d3980119a05f0a06d6766726492a2bdd77e
Instruction ID: 8025ff7ceba5467d185c2f9943e2916178b694f0c2e0a84956ff18ae8a8c9cee
Opcode Fuzzy Hash: 848b42a2b7192eebd4c8db6ba1286d3980119a05f0a06d6766726492a2bdd77e
Instruction Fuzzy Hash: E101FE33A101229BC3405FB5ED48A8B3BD9AF806F1B044354FC1AC3359E720D955C7D1

Uniqueness

Uniqueness Score: -1.00%

Function 1ECB1350 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 49COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,:EnumDesktops), ref: 1ECB135A
PyList_New.PYTHON27(00000000), ref: 1ECB136B

Strings

:EnumDesktops, xrefs: 1ECB1354
EnumDesktops, xrefs: 1ECB13C3

Memory Dump Source

Source File: 0000000F.00000002.1435001879.000000001ECB1000.00000040.00000001.01000000.00000011.sdmp, Offset: 1ECB0000, based on PE: true

Associated: 0000000F.00000002.1434980425.000000001ECB0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBA000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBD000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435097428.000000001ECBF000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435120797.000000001ECC0000.00000004.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ecb0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_List_ParseTuple
String ID: :EnumDesktops$EnumDesktops
API String ID: 1475923592-2568362730
Opcode ID: db63eed111da55a9b78ebe79198ee8831212368aba75b9da578b6660737933b1
Instruction ID: 00c3db5806b7b4c2fc4a237ee6bbe1076b23a1b131a95581fbe626ba6d9420bc
Opcode Fuzzy Hash: db63eed111da55a9b78ebe79198ee8831212368aba75b9da578b6660737933b1
Instruction Fuzzy Hash: E901D6326102329BD3405BB9ED48A8B3BE5AF84AF2B044354FC19C2759F724D941C7D2

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C9BF0 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 48threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,iil:OpenProcess,?,?), ref: 1E8C9C0B
PyEval_SaveThread.PYTHON27 ref: 1E8C9C1E
OpenProcess.KERNEL32(?,?,?), ref: 1E8C9C35
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C9C3E
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(OpenProcess,00000000), ref: 1E8C9C51

Strings

iil:OpenProcess, xrefs: 1E8C9C05
OpenProcess, xrefs: 1E8C9C4C

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_Thread$Arg_Error@@OpenParseProcessRestoreSaveTupleU_object@@Win_
String ID: OpenProcess$iil:OpenProcess
API String ID: 90074578-2189161723
Opcode ID: 3ad0fd452d9d6d72b050a79ba5a326567632004b0b7969a847ea26c87cf9be64
Instruction ID: 4ba70e1dccb70cd8fd8fcc4dc3e81a66243a79e0be3dac0460834a4afeeb15c0
Opcode Fuzzy Hash: 3ad0fd452d9d6d72b050a79ba5a326567632004b0b7969a847ea26c87cf9be64
Instruction Fuzzy Hash: 5B018FB59002116BD200DB68EC8C9DB3BE8AEC6615F844528F94DD3211E230969DC6A3

Uniqueness

Uniqueness Score: -1.00%

Function 1ECB4650 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 47threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1ECB4669
?PyWinLong_AsVoidPtr@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(00000000,?), ref: 1ECB4685
PyEval_SaveThread.PYTHON27 ref: 1ECB4694
UnlockServiceDatabase.ADVAPI32(?), ref: 1ECB46A1
PyEval_RestoreThread.PYTHON27(00000000), ref: 1ECB46AA
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(UnlockServiceDatabase,00000000), ref: 1ECB46C0

Strings

O:UnlockServiceDatabase, xrefs: 1ECB465B
UnlockServiceDatabase, xrefs: 1ECB46BB

Memory Dump Source

Source File: 0000000F.00000002.1435001879.000000001ECB1000.00000040.00000001.01000000.00000011.sdmp, Offset: 1ECB0000, based on PE: true

Associated: 0000000F.00000002.1434980425.000000001ECB0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBA000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBD000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435097428.000000001ECBF000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435120797.000000001ECC0000.00000004.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ecb0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_ThreadU_object@@$Arg_DatabaseError@@Long_ParsePtr@@RestoreSaveServiceTupleUnlockVoidWin_
String ID: O:UnlockServiceDatabase$UnlockServiceDatabase
API String ID: 3026235313-2652563801
Opcode ID: 833b711fd267e1c0f03136bed192ce46366f3a3c64a37c7e6bfe34955bee6f86
Instruction ID: 64f7be7dcf836d2a79863afef8d4201742ad5aa29df1954004742881bf2a4423
Opcode Fuzzy Hash: 833b711fd267e1c0f03136bed192ce46366f3a3c64a37c7e6bfe34955bee6f86
Instruction Fuzzy Hash: D001A2B1904210ABCB009BA8ED89A5E77F8BF84796F484568FC09C3305F7349528CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C2210 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 47threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,O:FindCloseChangeNotification), ref: 1E8C2221
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(00000000,?), ref: 1E8C223D
PyEval_SaveThread.PYTHON27 ref: 1E8C224C
FindCloseChangeNotification.KERNEL32(?), ref: 1E8C2259
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C2262
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(FindCloseChangeNotification,00000000), ref: 1E8C2278

Strings

FindCloseChangeNotification, xrefs: 1E8C2273
O:FindCloseChangeNotification, xrefs: 1E8C221B

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_ThreadU_object@@$Arg_ChangeCloseError@@FindNotificationObject_ParseRestoreSaveTupleWin_
String ID: FindCloseChangeNotification$O:FindCloseChangeNotification
API String ID: 2570197897-4193707565
Opcode ID: 1d0d89c131936cd51cd971f8463684be1000c53e92039bf7edd5cd371cc44bc9
Instruction ID: 6e82c7b2ab214671bb1d8334c29f7fb728f7e2fef596e16dd3e55384dc3137b4
Opcode Fuzzy Hash: 1d0d89c131936cd51cd971f8463684be1000c53e92039bf7edd5cd371cc44bc9
Instruction Fuzzy Hash: EF01A2795002116FEB009B78EC8CADA37E9BFC6606F444528F80DC3250E735D6A9CA62

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C4180 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 47threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,O:FreeLibrary), ref: 1E8C4191
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(00000000,?), ref: 1E8C41AD
PyEval_SaveThread.PYTHON27 ref: 1E8C41BC
FreeLibrary.KERNEL32(?), ref: 1E8C41C9
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C41D2
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(FreeLibrary,00000000), ref: 1E8C41E8

Strings

FreeLibrary, xrefs: 1E8C41E3
O:FreeLibrary, xrefs: 1E8C418B

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_ThreadU_object@@$Arg_Error@@FreeLibraryObject_ParseRestoreSaveTupleWin_
String ID: FreeLibrary$O:FreeLibrary
API String ID: 1794003482-3363983482
Opcode ID: b38620576044066e78b3bd98cede809cd702ab9c8bfe47b811e37416d9910afc
Instruction ID: 0d1e0c0a7fef23a10bc91aaaa913e5d98f6b086b36226ed70b3c5f3562f8ace0
Opcode Fuzzy Hash: b38620576044066e78b3bd98cede809cd702ab9c8bfe47b811e37416d9910afc
Instruction Fuzzy Hash: EC01D6755002116FE700AB79ED8C99A37E9FFC6346F444528F84DC3311EA34D59ACA62

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C2180 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 47threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,O:FindNextChangeNotification), ref: 1E8C2191
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(00000000,?), ref: 1E8C21AD
PyEval_SaveThread.PYTHON27 ref: 1E8C21BC
FindNextChangeNotification.KERNEL32(?), ref: 1E8C21C9
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C21D2
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(FindNextChangeNotification,00000000), ref: 1E8C21E8

Strings

FindNextChangeNotification, xrefs: 1E8C21E3
O:FindNextChangeNotification, xrefs: 1E8C218B

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_ThreadU_object@@$Arg_ChangeError@@FindNextNotificationObject_ParseRestoreSaveTupleWin_
String ID: FindNextChangeNotification$O:FindNextChangeNotification
API String ID: 3286478268-580746906
Opcode ID: f3738be183ec305cdb917eac349472293375d39cbac3a635671df5178872fee6
Instruction ID: 40c4164ad846c6473cca01bd3b6e46b7898887aa0f4486bba1c168b778b630e3
Opcode Fuzzy Hash: f3738be183ec305cdb917eac349472293375d39cbac3a635671df5178872fee6
Instruction Fuzzy Hash: 7301A275500211BFEB00AB78DD8C9DA37E9BFC6606F444528F90DC3250E634D559CA62

Uniqueness

Uniqueness Score: -1.00%

Function 1ECB1730 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 41COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,:EnumWindowStations), ref: 1ECB173A
PyList_New.PYTHON27(00000000), ref: 1ECB174B

Strings

:EnumWindowStations, xrefs: 1ECB1734
EnumWindowStations, xrefs: 1ECB1790

Memory Dump Source

Source File: 0000000F.00000002.1435001879.000000001ECB1000.00000040.00000001.01000000.00000011.sdmp, Offset: 1ECB0000, based on PE: true

Associated: 0000000F.00000002.1434980425.000000001ECB0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBA000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBD000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435097428.000000001ECBF000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435120797.000000001ECC0000.00000004.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ecb0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_List_ParseTuple
String ID: :EnumWindowStations$EnumWindowStations
API String ID: 1475923592-4098542401
Opcode ID: 6bdcd47e879d799ece883a43cd02ea4440ca5f1864484cae07f772e3c4d0c10c
Instruction ID: 300ef4885f795d21d793500fc5bbd347d9d7f0139b141896e959deb34d4e3705
Opcode Fuzzy Hash: 6bdcd47e879d799ece883a43cd02ea4440ca5f1864484cae07f772e3c4d0c10c
Instruction Fuzzy Hash: 04F0BB32A0013167D3502BB5ED4CACB3BD5AF80AE2F0443A4FC0AD3259EB24D855C7D2

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C31D0 Relevance: 14.0, APIs: 6, Strings: 2, Instructions: 40threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,:GetCursorPos), ref: 1E8C31DD
PyEval_SaveThread.PYTHON27 ref: 1E8C31F0
GetCursorPos.USER32(?), ref: 1E8C31FD
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C3206
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(GetCursorPos,00000000), ref: 1E8C321C

Strings

:GetCursorPos, xrefs: 1E8C31D7
GetCursorPos, xrefs: 1E8C3217

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_Thread$Arg_CursorError@@ParseRestoreSaveTupleU_object@@Win_
String ID: :GetCursorPos$GetCursorPos
API String ID: 647088857-1774093815
Opcode ID: 00c938739524955ca3c231708cf2e0d335633b594cc60f2a8acad4ec40d4e874
Instruction ID: 70a2905b7f1b115a9371997d843d0bc99cc983abbcace6b6b86f1973b7bb9384
Opcode Fuzzy Hash: 00c938739524955ca3c231708cf2e0d335633b594cc60f2a8acad4ec40d4e874
Instruction Fuzzy Hash: ACF090B99001107FEB0067B9FD4D9CA3BE4AF86657F444128F80DD3311E635D6AACAB2

Uniqueness

Uniqueness Score: -1.00%

Function 1E7D1400 Relevance: 13.6, APIs: 9, Instructions: 94threadCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?), ref: 1E7D1469
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000), ref: 1E7D148E
Py_SetProgramName.PYTHON27(?,?), ref: 1E7D14AE
Py_Initialize.PYTHON27(?), ref: 1E7D14B7
PyEval_InitThreads.PYTHON27(?,?), ref: 1E7D14BD
PySys_SetArgv.PYTHON27(00000000,00000000), ref: 1E7D14C9
initservicemanager.SERVICEMANAGER ref: 1E7D14D2
73BB3B4E.MSVCR90 ref: 1E7D14E7
73BB3B4E.MSVCR90(00000000), ref: 1E7D14F2

Memory Dump Source

Source File: 0000000F.00000002.1434219289.000000001E7D1000.00000040.00000001.01000000.00000015.sdmp, Offset: 1E7D0000, based on PE: true

Associated: 0000000F.00000002.1434197225.000000001E7D0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000F.00000002.1434219289.000000001E7DA000.00000040.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000F.00000002.1434284534.000000001E7DB000.00000080.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000F.00000002.1434310614.000000001E7DD000.00000004.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e7d0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: ByteCharMultiWide$ArgvEval_InitInitializeNameProgramSys_Threadsinitservicemanager
String ID:
API String ID: 2042743612-0
Opcode ID: 7a39ccf0efd7e3df8d5da2f0d499ea75c594747fbb452e623b0ded86c42f309b
Instruction ID: a0392e3e3e2a76a9845a165dc6b7268a72a51679ae9da2b5d78a42f6fab579ec
Opcode Fuzzy Hash: 7a39ccf0efd7e3df8d5da2f0d499ea75c594747fbb452e623b0ded86c42f309b
Instruction Fuzzy Hash: 4431D071200329AFF3118F94ECC5FA637ADFB49714F114368FE465B294E771AC0A8AA1

Uniqueness

Uniqueness Score: -1.00%

Function 03251800 Relevance: 13.6, APIs: 9, Instructions: 94timeCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,0325B21C), ref: 03251811
GetProcessTimes.KERNEL32(00000000,?,?,?,?), ref: 03251860
GetLastError.KERNEL32 ref: 0325186A
CloseHandle.KERNEL32(00000000), ref: 03251883

Memory Dump Source

Source File: 0000000F.00000002.1423676562.0000000003251000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03250000, based on PE: true

Associated: 0000000F.00000002.1423656216.0000000003250000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423775563.0000000003263000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3250000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_CloseErrorHandleLastParseProcessTimesTuple
String ID:
API String ID: 459457561-0
Opcode ID: b2decd1c22385437f6cfab5f23b283e3d4e07be0ead46e3bfd9b77b9f23e6c6e
Instruction ID: b4263ce1de4e8d8b0380f15694212224b60469aeb6a76408d721b7c14096b466
Opcode Fuzzy Hash: b2decd1c22385437f6cfab5f23b283e3d4e07be0ead46e3bfd9b77b9f23e6c6e
Instruction Fuzzy Hash: 4D21E471914310ABDA14FB74AC4DBAF7698AF84A05F488818FC45D5144E7B4A7D887E3

Uniqueness

Uniqueness Score: -1.00%

Function 1E7D1449 Relevance: 13.6, APIs: 9, Instructions: 71threadCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000,?), ref: 1E7D1469
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,00000000,00000000,00000000,00000000), ref: 1E7D148E
Py_SetProgramName.PYTHON27(?,?), ref: 1E7D14AE
Py_Initialize.PYTHON27(?), ref: 1E7D14B7
PyEval_InitThreads.PYTHON27(?,?), ref: 1E7D14BD
PySys_SetArgv.PYTHON27(00000000,00000000), ref: 1E7D14C9
initservicemanager.SERVICEMANAGER ref: 1E7D14D2
73BB3B4E.MSVCR90 ref: 1E7D14E7
73BB3B4E.MSVCR90(00000000), ref: 1E7D14F2

Memory Dump Source

Source File: 0000000F.00000002.1434219289.000000001E7D1000.00000040.00000001.01000000.00000015.sdmp, Offset: 1E7D0000, based on PE: true

Associated: 0000000F.00000002.1434197225.000000001E7D0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000F.00000002.1434219289.000000001E7DA000.00000040.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000F.00000002.1434284534.000000001E7DB000.00000080.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000F.00000002.1434310614.000000001E7DD000.00000004.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e7d0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: ByteCharMultiWide$ArgvEval_InitInitializeNameProgramSys_Threadsinitservicemanager
String ID:
API String ID: 2042743612-0
Opcode ID: e425585aeffd8f1277e7e1446690ffc79acafd4b4fe3c46fc2f7537bd46c7ded
Instruction ID: 99f6ec0bafa58afc0e72521e30d67f33e2ea0aa508dae55fd677d2d357cd758b
Opcode Fuzzy Hash: e425585aeffd8f1277e7e1446690ffc79acafd4b4fe3c46fc2f7537bd46c7ded
Instruction Fuzzy Hash: 6911E6716003246FF2205F94FCC5F563768FF48B15F104364FE166B2D1E721AC058AA6

Uniqueness

Uniqueness Score: -1.00%

Function 03255127 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 129COMMON

Download Yara Rule

APIs

ConvertLengthToIpv4Mask.IPHLPAPI(?,?), ref: 03255168
PyString_FromString.PYTHON27(?,?,?,?,00000400), ref: 032551CD
PyString_FromString.PYTHON27(?), ref: 032551ED
Py_BuildValue.PYTHON27((OiOOOO),00000000,?,?,?,6D07CB14,6D07CB14), ref: 0325522E
PyList_Append.PYTHON27(?,00000000), ref: 03255247
73BB3B4E.MSVCR90(?), ref: 032552DC

Part of subcall function 03257140: WSAAddressToStringA.WS2_32(?,?,00000000,?,?), ref: 032571BF
Part of subcall function 03257140: WSAGetLastError.WS2_32 ref: 032571C9
Part of subcall function 03257140: PyErr_SetExcFromWindowsErr.PYTHON27(?,00000000), ref: 032571D9

73BB3B4E.MSVCR90(?), ref: 032552F9

Strings

(OiOOOO), xrefs: 03255229

Memory Dump Source

Source File: 0000000F.00000002.1423676562.0000000003251000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03250000, based on PE: true

Associated: 0000000F.00000002.1423656216.0000000003250000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423775563.0000000003263000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3250000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: FromString$String_$AddressAppendBuildConvertErr_ErrorIpv4LastLengthList_MaskValueWindows
String ID: (OiOOOO)
API String ID: 2950778551-2236119840
Opcode ID: df81f5e0433a6daff48f765633947a74de09eafb6652257d129ff072e847fe5b
Instruction ID: 030a688435e621b3f250f04ba8c8b5117df9cc08d1f742fc5b9d735590fb3c71
Opcode Fuzzy Hash: df81f5e0433a6daff48f765633947a74de09eafb6652257d129ff072e847fe5b
Instruction Fuzzy Hash: 9141B3B1514302DFDB10DF64D84496BB3E8EF85324F188658FD56CB280D774EA86CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 03255129 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 129COMMON

Download Yara Rule

APIs

ConvertLengthToIpv4Mask.IPHLPAPI(?,?), ref: 03255168
PyString_FromString.PYTHON27(?,?,?,?,00000400), ref: 032551CD
PyString_FromString.PYTHON27(?), ref: 032551ED
Py_BuildValue.PYTHON27((OiOOOO),00000000,?,?,?,6D07CB14,6D07CB14), ref: 0325522E
PyList_Append.PYTHON27(?,00000000), ref: 03255247
73BB3B4E.MSVCR90(?), ref: 032552DC

Part of subcall function 03257140: WSAAddressToStringA.WS2_32(?,?,00000000,?,?), ref: 032571BF
Part of subcall function 03257140: WSAGetLastError.WS2_32 ref: 032571C9
Part of subcall function 03257140: PyErr_SetExcFromWindowsErr.PYTHON27(?,00000000), ref: 032571D9

73BB3B4E.MSVCR90(?), ref: 032552F9

Strings

(OiOOOO), xrefs: 03255229

Memory Dump Source

Source File: 0000000F.00000002.1423676562.0000000003251000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03250000, based on PE: true

Associated: 0000000F.00000002.1423656216.0000000003250000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423775563.0000000003263000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3250000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: FromString$String_$AddressAppendBuildConvertErr_ErrorIpv4LastLengthList_MaskValueWindows
String ID: (OiOOOO)
API String ID: 2950778551-2236119840
Opcode ID: 31775e77188f1885e09614c4cfd52d1f599ff1d1bb66db922de23d1bf94f47b8
Instruction ID: 69f7010b85463a4d088206ec1c4c11b0c92abcba28773e716a0beca434b2c844
Opcode Fuzzy Hash: 31775e77188f1885e09614c4cfd52d1f599ff1d1bb66db922de23d1bf94f47b8
Instruction Fuzzy Hash: 9E4182B1514302DFDB10DF64D84496BB3E8EF85324F148658FD56CB250D774EA86CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 03253D36 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

GetIfEntry2.IPHLPAPI(00000000), ref: 03253D71
Py_BuildValue.PYTHON27((KKKKKKKK),?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 03253E0B
PyUnicodeUCS2_FromWideChar.PYTHON27(?,?), ref: 03253E37
PyDict_SetItem.PYTHON27(?,00000000,00000000), ref: 03253E51
73BB3B4E.MSVCR90(00000000), ref: 03253E81
73BB3B4E.MSVCR90(?), ref: 03253E9A
PyErr_NoMemory.PYTHON27 ref: 03253EAF
73BB3B4E.MSVCR90(?), ref: 03253F10
73BB3B4E.MSVCR90(00000000), ref: 03253F1E

Strings

(KKKKKKKK), xrefs: 03253E06

Memory Dump Source

Source File: 0000000F.00000002.1423676562.0000000003251000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03250000, based on PE: true

Associated: 0000000F.00000002.1423656216.0000000003250000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423775563.0000000003263000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3250000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: BuildCharDict_Entry2Err_FromItemMemoryUnicodeValueWide
String ID: (KKKKKKKK)
API String ID: 1551035170-4200950264
Opcode ID: 51f071aea71351057e789657f6da46b44d4860066e7d2aba05bf0625d1af364b
Instruction ID: 54637e6859eb7747ad7a1882f473d6e00a6445b6e07d7912dadd34def4fd9815
Opcode Fuzzy Hash: 51f071aea71351057e789657f6da46b44d4860066e7d2aba05bf0625d1af364b
Instruction Fuzzy Hash: DD414FB5500B019BC764DB68DD84FA7B3E9AF88315F08851CFA5A87241D730FA41CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 03253D34 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

GetIfEntry2.IPHLPAPI(00000000), ref: 03253D71
Py_BuildValue.PYTHON27((KKKKKKKK),?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 03253E0B
PyUnicodeUCS2_FromWideChar.PYTHON27(?,?), ref: 03253E37
PyDict_SetItem.PYTHON27(?,00000000,00000000), ref: 03253E51
73BB3B4E.MSVCR90(00000000), ref: 03253E81
73BB3B4E.MSVCR90(?), ref: 03253E9A
PyErr_NoMemory.PYTHON27 ref: 03253EAF
73BB3B4E.MSVCR90(?), ref: 03253F10
73BB3B4E.MSVCR90(00000000), ref: 03253F1E

Strings

(KKKKKKKK), xrefs: 03253E06

Memory Dump Source

Source File: 0000000F.00000002.1423676562.0000000003251000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03250000, based on PE: true

Associated: 0000000F.00000002.1423656216.0000000003250000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423775563.0000000003263000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3250000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: BuildCharDict_Entry2Err_FromItemMemoryUnicodeValueWide
String ID: (KKKKKKKK)
API String ID: 1551035170-4200950264
Opcode ID: 975ab5818ed984b4acfa50c7f93e301d2d9f003f48d015463e7c72799b1fbf62
Instruction ID: f59c4433700d9fd266988857129f6b60d6560290fce78c4f6bbb47218291e3ff
Opcode Fuzzy Hash: 975ab5818ed984b4acfa50c7f93e301d2d9f003f48d015463e7c72799b1fbf62
Instruction Fuzzy Hash: 87415EB5600B019BC754DB68DD84FA7B3E9AF88315F08851CFA5AC7241D730FA81CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 032527A0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 86COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 032527BD
QueryDosDeviceA.KERNEL32(?,?,000001FF), ref: 03252817
Py_BuildValue.PYTHON27(0325B4AC,0325D7E2,?,?,?,?,?), ref: 03252866

Strings

A, xrefs: 032527B8
%c:, xrefs: 0325287E
:, xrefs: 032527F3

Memory Dump Source

Source File: 0000000F.00000002.1423676562.0000000003251000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03250000, based on PE: true

Associated: 0000000F.00000002.1423656216.0000000003250000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423775563.0000000003263000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3250000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_BuildDeviceParseQueryTupleValue
String ID: %c:$:$A
API String ID: 1455332766-2475154457
Opcode ID: 529222bc53723fb9a18a66fd7c0605db319df5137376ce8dd58237db5144aba5
Instruction ID: b3ee6ae1b4c1e91960d65b1cbcbcf5814b1afddccef381f6521909754b246d1c
Opcode Fuzzy Hash: 529222bc53723fb9a18a66fd7c0605db319df5137376ce8dd58237db5144aba5
Instruction Fuzzy Hash: DD212731158386DFC310DB74AC999BA7B9A9F55208F48885CFCD886182E275C38DC372

Uniqueness

Uniqueness Score: -1.00%

Function 1E7D1657 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 80registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.ADVAPI32(80000002,?,00000000,00000000,00000000,00020006,00000000,00000000,00000000,00000000,00000000), ref: 1E7D16D0
RegSetValueExW.ADVAPI32(?,EventMessageFile,00000000,00000001,1E7D6448,00000000), ref: 1E7D170F
RegSetValueExW.ADVAPI32(?,?,?,TypesSupported,00000000,00000004,?,00000004), ref: 1E7D172E
RegCloseKey.ADVAPI32(?), ref: 1E7D1735

Strings

EventMessageFile, xrefs: 1E7D1709
TypesSupported, xrefs: 1E7D1720
Python Service, xrefs: 1E7D1674

Memory Dump Source

Source File: 0000000F.00000002.1434219289.000000001E7D1000.00000040.00000001.01000000.00000015.sdmp, Offset: 1E7D0000, based on PE: true

Associated: 0000000F.00000002.1434197225.000000001E7D0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000F.00000002.1434219289.000000001E7DA000.00000040.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000F.00000002.1434284534.000000001E7DB000.00000080.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000F.00000002.1434310614.000000001E7DD000.00000004.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e7d0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Value$CloseCreate
String ID: EventMessageFile$Python Service$TypesSupported
API String ID: 390822645-2879936719
Opcode ID: fe5685efc27950c2a276f6cf6786660ac442da45ae8e0b7223b40184b48f251e
Instruction ID: d56bdcff274a61134d157c363338a037fdce2dc2d8520dbb6766495f3734e1c9
Opcode Fuzzy Hash: fe5685efc27950c2a276f6cf6786660ac442da45ae8e0b7223b40184b48f251e
Instruction Fuzzy Hash: 6C21B631214315ABE3249B98DC56FEB73E5FBC8750F048A08FA46DB2E4E7B4A504C741

Uniqueness

Uniqueness Score: -1.00%

Function 1ECB1E30 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,lll:OpenInputDesktop,?,?), ref: 1ECB1E60
OpenInputDesktop.USER32(?,?), ref: 1ECB1E8B
GetLastError.KERNEL32 ref: 1ECB1E97
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(OpenInputDesktop,00000000), ref: 1ECB1EA3

Strings

OpenInputDesktop, xrefs: 1ECB1E9E
lll:OpenInputDesktop, xrefs: 1ECB1E5A

Memory Dump Source

Source File: 0000000F.00000002.1435001879.000000001ECB1000.00000040.00000001.01000000.00000011.sdmp, Offset: 1ECB0000, based on PE: true

Associated: 0000000F.00000002.1434980425.000000001ECB0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBA000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBD000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435097428.000000001ECBF000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435120797.000000001ECC0000.00000004.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ecb0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_DesktopErrorError@@InputLastOpenParseTupleU_object@@Win_
String ID: OpenInputDesktop$lll:OpenInputDesktop
API String ID: 2395410537-3412331953
Opcode ID: 29745574bddb2cdaae60afed451db728ab3c7b48b2e5b193e66aed986088de28
Instruction ID: e37fc1f6efc7fefcc782dcd1ed6b54d73b1b028e2d2c885f743ea7f2ec6113de
Opcode Fuzzy Hash: 29745574bddb2cdaae60afed451db728ab3c7b48b2e5b193e66aed986088de28
Instruction Fuzzy Hash: EE218EB65047919BD300DF58CD44B9ABBE9FBC8B90F404A6DF89A83750D7389505CB62

Uniqueness

Uniqueness Score: -1.00%

Function 032539B0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 68COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,0325B5C4), ref: 032539C1
GetProcessIoCounters.KERNEL32(00000000,?), ref: 032539F0
PyErr_SetFromWindowsErr.PYTHON27(00000000), ref: 032539FB
CloseHandle.KERNEL32(00000000), ref: 03253A05

Strings

(KKKKKK), xrefs: 03253A55

Memory Dump Source

Source File: 0000000F.00000002.1423676562.0000000003251000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03250000, based on PE: true

Associated: 0000000F.00000002.1423656216.0000000003250000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423775563.0000000003263000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3250000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_CloseCountersErr_FromHandleParseProcessTupleWindows
String ID: (KKKKKK)
API String ID: 1109189336-585410369
Opcode ID: 3a232d146be1bf79f84d37897f02cf43f86c84396360d8917fcd5051d6e0e30e
Instruction ID: 14cac7d88d3d54afcbdea4f7e921289f3da4643f59db9fa0fd6f418acc30c0f9
Opcode Fuzzy Hash: 3a232d146be1bf79f84d37897f02cf43f86c84396360d8917fcd5051d6e0e30e
Instruction Fuzzy Hash: 341130B1515200AFD204EB68DC49D5BB7E9AF88704F448918FD59C2204E734DA458BA6

Uniqueness

Uniqueness Score: -1.00%

Function 03251D70 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,0325B330), ref: 03251D81
GetProcessMemoryInfo.PSAPI(00000000,?,0000002C), ref: 03251DB2
PyErr_SetFromWindowsErr.PYTHON27(00000000,00000000,?,0000002C), ref: 03251DBC
CloseHandle.KERNEL32(00000000), ref: 03251DC6

Strings

(kIIIIIIIII), xrefs: 03251E0D

Memory Dump Source

Source File: 0000000F.00000002.1423676562.0000000003251000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03250000, based on PE: true

Associated: 0000000F.00000002.1423656216.0000000003250000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423775563.0000000003263000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3250000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_CloseErr_FromHandleInfoMemoryParseProcessTupleWindows
String ID: (kIIIIIIIII)
API String ID: 708189517-1713939979
Opcode ID: f1ac6720557ce2bf5a3148bf9f2236d65ad63fa5c3b53952349d414c2696b5e9
Instruction ID: a748113c76398f89d992e5f21f832301e2e3c3ae5e7e58d3b4907bbd95c8eb81
Opcode Fuzzy Hash: f1ac6720557ce2bf5a3148bf9f2236d65ad63fa5c3b53952349d414c2696b5e9
Instruction Fuzzy Hash: 2B118175515210AFD200EB64DC48E6BB7EDAFC8614F448908FD58D2204E374EB518BA2

Uniqueness

Uniqueness Score: -1.00%

Function 1ECB1650 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 64threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,l:GetThreadDesktop), ref: 1ECB1676
GetThreadDesktop.USER32 ref: 1ECB1697
GetLastError.KERNEL32 ref: 1ECB16A3
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(GetThreadDesktop,00000000), ref: 1ECB16AF

Strings

l:GetThreadDesktop, xrefs: 1ECB1670
GetThreadDesktop, xrefs: 1ECB16AA

Memory Dump Source

Source File: 0000000F.00000002.1435001879.000000001ECB1000.00000040.00000001.01000000.00000011.sdmp, Offset: 1ECB0000, based on PE: true

Associated: 0000000F.00000002.1434980425.000000001ECB0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBA000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBD000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435097428.000000001ECBF000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435120797.000000001ECC0000.00000004.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ecb0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_DesktopErrorError@@LastParseThreadTupleU_object@@Win_
String ID: GetThreadDesktop$l:GetThreadDesktop
API String ID: 1922581371-642169515
Opcode ID: 73129d082b217c79acfedf545b039714c20eb69fdecd89b22c47967fba489c79
Instruction ID: 215ba6a63b130fc1afc68a906abb60ac429673be804b33d7b18574d512add020
Opcode Fuzzy Hash: 73129d082b217c79acfedf545b039714c20eb69fdecd89b22c47967fba489c79
Instruction Fuzzy Hash: 2311D0B6540A51EBC314DF18CD44B8BBBE9FFC4BA0F844A6DF88A83754D7389005CA92

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C24F9 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 62threadCOMMON

Download Yara Rule

APIs

PyEval_RestoreThread.PYTHON27(?), ref: 1E8C2510
PyErr_SetString.PYTHON27(?,Access violation (probably due to missing string inserts)), ref: 1E8C252C
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(FormatMessageA,00000000), ref: 1E8C2542
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27 ref: 1E8C2574
73BB3B4E.MSVCR90(?), ref: 1E8C2584
?PyWinObject_FreeString@@YAXPAD@Z.PYWINTYPES27(?), ref: 1E8C2591
LocalFree.KERNEL32(?), ref: 1E8C25A2

Strings

Access violation (probably due to missing string inserts), xrefs: 1E8C251E

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Free$Object_String@@$Err_Error@@Eval_LocalRestoreStringThreadU_object@@Win_
String ID: Access violation (probably due to missing string inserts)
API String ID: 1800408334-128206310
Opcode ID: fc50f3304528f3ec3b313973029f8afe6eb78674cf561145a0c0c8fa9dad79d2
Instruction ID: 12733c964b43730b4ea4540a08a2a93448caa703ae141151f4c283cd149d8228
Opcode Fuzzy Hash: fc50f3304528f3ec3b313973029f8afe6eb78674cf561145a0c0c8fa9dad79d2
Instruction Fuzzy Hash: C2116DB5D00515DFDB00CFE8D8D88EEB7B2BB46715F108228E91AA3380E735E956CB91

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C2839 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 62threadCOMMON

Download Yara Rule

APIs

PyEval_RestoreThread.PYTHON27(?), ref: 1E8C2850
PyErr_SetString.PYTHON27(?,Access violation (probably due to missing string inserts)), ref: 1E8C286C
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(FormatMessageW,00000000), ref: 1E8C2882
?PyWinObject_FreeWCHAR@@YAXPA_W@Z.PYWINTYPES27 ref: 1E8C28B4
73BB3B4E.MSVCR90(?), ref: 1E8C28C4
?PyWinObject_FreeWCHAR@@YAXPA_W@Z.PYWINTYPES27(?), ref: 1E8C28D1
LocalFree.KERNEL32(?), ref: 1E8C28E2

Strings

Access violation (probably due to missing string inserts), xrefs: 1E8C285E

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Free$Object_$Err_Error@@Eval_LocalRestoreStringThreadU_object@@Win_
String ID: Access violation (probably due to missing string inserts)
API String ID: 994519068-128206310
Opcode ID: bfed4550160334b2ed93617aecd1105052835a2012531f5148b5a9d792fa24f1
Instruction ID: 6b44f014c853838e1f6fb425279690adb7f5054058f44e2681a430f98a0b634a
Opcode Fuzzy Hash: bfed4550160334b2ed93617aecd1105052835a2012531f5148b5a9d792fa24f1
Instruction Fuzzy Hash: C7113AB5D00519DBDB00DFE8D8C88DEB7B2FB46725F114229E92AA3280C735E856CB91

Uniqueness

Uniqueness Score: -1.00%

Function 1ECB1F20 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,:GetProcessWindowStation,?,?,1ECB5CA9,000000FF), ref: 1ECB1F40
GetProcessWindowStation.USER32 ref: 1ECB1F5D
GetLastError.KERNEL32 ref: 1ECB1F69
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(GetProcessWindowStation,00000000), ref: 1ECB1F75

Strings

:GetProcessWindowStation, xrefs: 1ECB1F3A
GetProcessWindowStation, xrefs: 1ECB1F70

Memory Dump Source

Source File: 0000000F.00000002.1435001879.000000001ECB1000.00000040.00000001.01000000.00000011.sdmp, Offset: 1ECB0000, based on PE: true

Associated: 0000000F.00000002.1434980425.000000001ECB0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBA000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBD000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435097428.000000001ECBF000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435120797.000000001ECC0000.00000004.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ecb0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_ErrorError@@LastParseProcessStationTupleU_object@@Win_Window
String ID: :GetProcessWindowStation$GetProcessWindowStation
API String ID: 596320009-526594011
Opcode ID: 43e35f29e793e1469c4b399525b0cf0869ee23831f4001f8bc2c1da2920dc449
Instruction ID: 0cafc5db227684f60ef9a4c0750158153893940b63f27f59fcd257070ccaf4fe
Opcode Fuzzy Hash: 43e35f29e793e1469c4b399525b0cf0869ee23831f4001f8bc2c1da2920dc449
Instruction Fuzzy Hash: 2111C176544A51EBD310CF18DE4579ABBE9FF84BA0F804A6DF85A83750D73D9800CB92

Uniqueness

Uniqueness Score: -1.00%

Function 03257B10 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 56servicethreadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,0325D4C4), ref: 03257B21
PyEval_SaveThread.PYTHON27 ref: 03257B4E
ControlService.ADVAPI32(00000000,00000001,?), ref: 03257B5E
PyEval_RestoreThread.PYTHON27(00000000), ref: 03257B67
CloseServiceHandle.ADVAPI32(00000000), ref: 03257B84

Strings

ControlService, xrefs: 03257B76

Memory Dump Source

Source File: 0000000F.00000002.1423676562.0000000003251000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03250000, based on PE: true

Associated: 0000000F.00000002.1423656216.0000000003250000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423775563.0000000003263000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3250000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_ServiceThread$Arg_CloseControlHandleParseRestoreSaveTuple
String ID: ControlService
API String ID: 1908151670-253159669
Opcode ID: 80d80190074f39793d2d8288d175338e5007ea2690aa74859b04ebad3ebe5960
Instruction ID: 15d5d86b469f210fe340c8246a80f52092b94ae1ee5fb64b06bed21454c8f257
Opcode Fuzzy Hash: 80d80190074f39793d2d8288d175338e5007ea2690aa74859b04ebad3ebe5960
Instruction Fuzzy Hash: 7A01D272521310BFD720FB68BC8DEAF73A8AF48615F088514FC09C2209E77997C486A2

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C58E0 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 52COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(?,%s is not available on this platform,SetSystemFileCacheSize), ref: 1E8C58FE
PyArg_ParseTupleAndKeywords.PYTHON27 ref: 1E8C5937

Strings

%s is not available on this platform, xrefs: 1E8C58F8
SetSystemFileCacheSize, xrefs: 1E8C58F3
SetSystemFileCacheSize, xrefs: 1E8C5961

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Err_FormatKeywordsParseTuple
String ID: %s is not available on this platform$SetSystemFileCacheSize$SetSystemFileCacheSize
API String ID: 223827023-2598241473
Opcode ID: bc6d2715eaa3e589252fb0dacca9e7eecf476bd4067585dc77295466f82830f6
Instruction ID: 080d5c9a79d2c53f7e7599484dfd1590d1ee20e5f8fb7f27ef648be3c58d6010
Opcode Fuzzy Hash: bc6d2715eaa3e589252fb0dacca9e7eecf476bd4067585dc77295466f82830f6
Instruction Fuzzy Hash: 051139B5514205AFE700DB18EC84EAA73E9FBC9749F448A18F84DC3350E2359A5ECB66

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C94F0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,OiH:SetWindowWord,?,?,?), ref: 1E8C950C
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?), ref: 1E8C9528
PyEval_SaveThread.PYTHON27 ref: 1E8C9537
SetWindowWord.USER32(?,?,?), ref: 1E8C954E
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C9558
Py_BuildValue.PYTHON27(1E8D17EC), ref: 1E8C9564

Strings

OiH:SetWindowWord, xrefs: 1E8C9506

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_Thread$Arg_BuildObject_ParseRestoreSaveTupleU_object@@ValueWindowWord
String ID: OiH:SetWindowWord
API String ID: 3386090183-1636800532
Opcode ID: 693b13e680d05a84d006e96f0a2156bb9a3167adbaf6073728440dfb751567b7
Instruction ID: 9757fcb5d6840237fca44759b2fb2800b93672f0fdcc2e8b89194e9a623a20bd
Opcode Fuzzy Hash: 693b13e680d05a84d006e96f0a2156bb9a3167adbaf6073728440dfb751567b7
Instruction Fuzzy Hash: 3B017CB9104211BFE700EBA9CC88CEB37ECEEC5215F44891CF94983211E630D55ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C9620 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 47threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,OiH:SetClassWord,?,?,?), ref: 1E8C963C
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?), ref: 1E8C9658
PyEval_SaveThread.PYTHON27 ref: 1E8C9667
SetClassWord.USER32(?,?,?), ref: 1E8C967E
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C9688
Py_BuildValue.PYTHON27(1E8D1818), ref: 1E8C9694

Strings

OiH:SetClassWord, xrefs: 1E8C9636

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_Thread$Arg_BuildClassObject_ParseRestoreSaveTupleU_object@@ValueWord
String ID: OiH:SetClassWord
API String ID: 4137373742-2662879383
Opcode ID: 60916635556915d4755e0385fe637fd5652a27065125a1c28e87bc86ce65a818
Instruction ID: 6e4b15cd90c58defe7778c42c5c8bed0fa7f48acf13b0415796ddc49a107f7c1
Opcode Fuzzy Hash: 60916635556915d4755e0385fe637fd5652a27065125a1c28e87bc86ce65a818
Instruction Fuzzy Hash: 9C0178B9104221BFE700EBA8CC88CEB77E8EEC5605F44895CF849C3211E630D55ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C8E30 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 45threadprocessCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1E8C8E4E
PyEval_SaveThread.PYTHON27 ref: 1E8C8E61
WinExec.KERNEL32(?,?), ref: 1E8C8E73
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C8E7C
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(WinExec,00000000), ref: 1E8C8E90

Strings

s|i:WinExec, xrefs: 1E8C8E40
WinExec, xrefs: 1E8C8E8B

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_Thread$Arg_Error@@ExecParseRestoreSaveTupleU_object@@Win_
String ID: WinExec$s|i:WinExec
API String ID: 2056427439-1679636345
Opcode ID: 7c82fa5205b9f8d0cf3c31fca5a3a44589ebd4e45f68d0512a48efd5fac95032
Instruction ID: 159855b81b8e51874cb0150887629e4abb79e4fb6d01676d991d131ce2afe9b1
Opcode Fuzzy Hash: 7c82fa5205b9f8d0cf3c31fca5a3a44589ebd4e45f68d0512a48efd5fac95032
Instruction Fuzzy Hash: 1401A275500211AFE300EB69EC8C8CBBBE8FFC6215F444529F94DC3211E7309599CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1E8CAE60 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 44COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1E8CAE7E
?PyWinObject_AsString@@YAHPAU_object@@PAPADHPAK@Z.PYWINTYPES27(?,?,00000000,00000000), ref: 1E8CAE9F
LoadKeyboardLayoutA.USER32(?), ref: 1E8CAEB5
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(LoadKeyboardLayout,00000000), ref: 1E8CAEC5

Strings

O|k:LoadKeyboardLayout, xrefs: 1E8CAE70
LoadKeyboardLayout, xrefs: 1E8CAEC0

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: U_object@@$Arg_Error@@KeyboardLayoutLoadObject_ParseString@@TupleWin_
String ID: LoadKeyboardLayout$O|k:LoadKeyboardLayout
API String ID: 3027879772-2653305174
Opcode ID: 1a71ddff9180a3fa61f994ffea2360d2e9551e9f2fc33960db58859f990cb953
Instruction ID: aab2a2f48a223e0b75216b41e25fcc03c12d86bbd9ef672072850926747cb1f5
Opcode Fuzzy Hash: 1a71ddff9180a3fa61f994ffea2360d2e9551e9f2fc33960db58859f990cb953
Instruction Fuzzy Hash: B10162B45043026BE310DB64DC49FAB77E8BB84605F844A18F94AC3240F735D65CC7A3

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C93D0 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 42threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,Oi:GetWindowLong,?,?), ref: 1E8C93E7
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?), ref: 1E8C9403
PyEval_SaveThread.PYTHON27 ref: 1E8C9412
GetWindowLongA.USER32(?,?), ref: 1E8C9424
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C942D
?PyWinLong_FromVoidPtr@@YAPAU_object@@PBX@Z.PYWINTYPES27(00000000), ref: 1E8C9434

Strings

Oi:GetWindowLong, xrefs: 1E8C93E1

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_ThreadU_object@@$Arg_FromLongLong_Object_ParsePtr@@RestoreSaveTupleVoidWindow
String ID: Oi:GetWindowLong
API String ID: 1337450506-643273479
Opcode ID: fe0f14b34b76ef1aa2a3c6c40cdeacec275f490749824ac1fcbd184791dfac54
Instruction ID: 9dbc677ce5d791d03a312997c9a79426bb36f6e7e5fad179a5d83d7aa77490a2
Opcode Fuzzy Hash: fe0f14b34b76ef1aa2a3c6c40cdeacec275f490749824ac1fcbd184791dfac54
Instruction Fuzzy Hash: 7CF06975500211AFD300DBB8DD8C9AB37E8EE86615F444929FD4DC3210EB35D59ACAA2

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C8B10 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 42threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,(ii):SetCursorPos,?), ref: 1E8C8B26
PyEval_SaveThread.PYTHON27 ref: 1E8C8B39
SetCursorPos.USER32(?,?), ref: 1E8C8B4B
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C8B54
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(SetCursorPos,00000000), ref: 1E8C8B6A

Strings

(ii):SetCursorPos, xrefs: 1E8C8B20
SetCursorPos, xrefs: 1E8C8B65

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_Thread$Arg_CursorError@@ParseRestoreSaveTupleU_object@@Win_
String ID: (ii):SetCursorPos$SetCursorPos
API String ID: 647088857-2583399437
Opcode ID: 46b12024f42166a58400776cf2848e42b4b56acf0635cf6b9676b25b696b6c79
Instruction ID: d0bf164e9695ec1ed29dd8ff2556ef71d848b48139457e3b4605a368a05c5645
Opcode Fuzzy Hash: 46b12024f42166a58400776cf2848e42b4b56acf0635cf6b9676b25b696b6c79
Instruction Fuzzy Hash: B1F081B95102117FE700AB78EC8D9DA37E4EF86252F844528F90EC3211E630E559CAA6

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C2920 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 42threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,ll:GenerateConsoleCtrlEvent,?), ref: 1E8C2936
PyEval_SaveThread.PYTHON27 ref: 1E8C2949
GenerateConsoleCtrlEvent.KERNEL32(?,?), ref: 1E8C295B
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C2964
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(GenerateConsoleCtrlEvent,00000000), ref: 1E8C297A

Strings

GenerateConsoleCtrlEvent, xrefs: 1E8C2975
ll:GenerateConsoleCtrlEvent, xrefs: 1E8C2930

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_Thread$Arg_ConsoleCtrlError@@EventGenerateParseRestoreSaveTupleU_object@@Win_
String ID: GenerateConsoleCtrlEvent$ll:GenerateConsoleCtrlEvent
API String ID: 2295157843-3675785453
Opcode ID: e63e4e8a3dd996caf342ebad4f51df8f02cc3a3785e10096a6d3410208ed8a27
Instruction ID: fe574b0c7b7cfe122e6096f740d61bf58c9d6fd84ce55bb5a138f21cde9d477b
Opcode Fuzzy Hash: e63e4e8a3dd996caf342ebad4f51df8f02cc3a3785e10096a6d3410208ed8a27
Instruction Fuzzy Hash: 34F0AFBA510111BFE700AB68DC8DDDA77E8EFC6646F844528F90DC3361E730D599CAA2

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C9900 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 40threadtimeCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,:GetSystemTime), ref: 1E8C990D
PyEval_SaveThread.PYTHON27 ref: 1E8C991F
GetSystemTime.KERNEL32(?), ref: 1E8C992C
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C9933
Py_BuildValue.PYTHON27((hhhhhhhh),?,?,?,?,?,?,?,?), ref: 1E8C996E

Strings

:GetSystemTime, xrefs: 1E8C9907
(hhhhhhhh), xrefs: 1E8C9969

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_Thread$Arg_BuildParseRestoreSaveSystemTimeTupleValue
String ID: (hhhhhhhh)$:GetSystemTime
API String ID: 2142700038-484796045
Opcode ID: 87137d63702dbb6af0df5b8a9a5e6bee568a8e8c6cd4f39bc92b013ba4d42653
Instruction ID: a44096939f3c937b81a47f373943e3559f2622194acb0566e44efa176687763a
Opcode Fuzzy Hash: 87137d63702dbb6af0df5b8a9a5e6bee568a8e8c6cd4f39bc92b013ba4d42653
Instruction Fuzzy Hash: 8DF036A1408231BBD344DFAADC488BB76E9FE89A02F40494DF98991151F73C8599D377

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C91B0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 39threadwindowCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,|i:MessageBeep), ref: 1E8C91C7
PyEval_SaveThread.PYTHON27 ref: 1E8C91D8
MessageBeep.USER32(?), ref: 1E8C91E5
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C91EE
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(MessageBeep,00000000), ref: 1E8C9204

Strings

MessageBeep, xrefs: 1E8C91FF
|i:MessageBeep, xrefs: 1E8C91B9

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_Thread$Arg_BeepError@@MessageParseRestoreSaveTupleU_object@@Win_
String ID: MessageBeep$|i:MessageBeep
API String ID: 3242808027-984191393
Opcode ID: dd1e6941ebad322ef9b9d53e5ed57da65e2730346cf2d1c792ac8bf816f57f33
Instruction ID: c8f8a986a808dcf6b7472ef62cee4ecbfbf3c348f8bc72a49a2330aaab80a333
Opcode Fuzzy Hash: dd1e6941ebad322ef9b9d53e5ed57da65e2730346cf2d1c792ac8bf816f57f33
Instruction Fuzzy Hash: 1BF090B5110211BFE3109B69EC8CACA37F8EFCA366F148159F90EC3361DB349496DA61

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C3250 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 38threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,O:SetCursor), ref: 1E8C3261
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(00000000,?), ref: 1E8C327D
PyEval_SaveThread.PYTHON27 ref: 1E8C328C
SetCursor.USER32(?), ref: 1E8C3299
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C32A2
?PyWinLong_FromHANDLE@@YAPAU_object@@PAX@Z.PYWINTYPES27(00000000), ref: 1E8C32A9

Strings

O:SetCursor, xrefs: 1E8C325B

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_ThreadU_object@@$Arg_CursorFromLong_Object_ParseRestoreSaveTuple
String ID: O:SetCursor
API String ID: 3428432267-3909396347
Opcode ID: 4d2e2fcc5fb17deadd4f2858d9e161bd464ee683d7b575d28ef08367569555f5
Instruction ID: 5f31362884e0252305bdac1811b4adf885422f02c771a9a2e498e6ec6ba7da09
Opcode Fuzzy Hash: 4d2e2fcc5fb17deadd4f2858d9e161bd464ee683d7b575d28ef08367569555f5
Instruction Fuzzy Hash: C5F090755001106FDB00ABB8ED8C8EB37E9BF86606F444928F94DC3200E638D65AC6A2

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C30D0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 30threadwindowCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,:GetFocus), ref: 1E8C30DA
PyEval_SaveThread.PYTHON27 ref: 1E8C30EA
GetFocus.USER32 ref: 1E8C30F2
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C30FB

Strings

:GetFocus, xrefs: 1E8C30D4
No window has the focus, xrefs: 1E8C3112

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_Thread$Arg_FocusParseRestoreSaveTuple
String ID: :GetFocus$No window has the focus
API String ID: 1746004230-4284376810
Opcode ID: 25a051c9d68cfc617a08563b5d3fbcd5f70c09b6d65c2b16a97492498e0f2857
Instruction ID: 8e7685c53ce8a165b35c7e30d536c9ba2e62afbace7b2f2048a7686770725b0b
Opcode Fuzzy Hash: 25a051c9d68cfc617a08563b5d3fbcd5f70c09b6d65c2b16a97492498e0f2857
Instruction Fuzzy Hash: DFF0A072500220ABE3011B79EC4C6CB3BE4AF832A6F408125FA0DC3210D335C58A8792

Uniqueness

Uniqueness Score: -1.00%

Function 03256630 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 104COMMON

Download Yara Rule

APIs

CommandLineToArgvW.SHELL32(?,?,?,?,?,03251B15,?,00000000), ref: 0325668A
PyList_New.PYTHON27(?,?,?,?,03251B15,?,00000000), ref: 032566AE
PyUnicodeUCS2_FromWideChar.PYTHON27(?,?,?,?,?,?,03251B15,?,00000000), ref: 032566F1
LocalFree.KERNEL32(00000000,?,?,?,03251B15,?,00000000), ref: 03256719
73BB3B4E.MSVCR90(?,?,?,03251B15,?,00000000), ref: 03256729

Part of subcall function 03256100: GetCurrentProcess.KERNEL32(?,?,00000000), ref: 0325614F
Part of subcall function 03256100: IsWow64Process.KERNEL32(00000000,?,00000000), ref: 0325615C
Part of subcall function 03256100: IsWow64Process.KERNEL32(00000000,?,?,00000000), ref: 0325616C
Part of subcall function 03256100: PyErr_Clear.PYTHON27(?,?,?,00000000), ref: 032561AE
Part of subcall function 03256100: CloseHandle.KERNEL32(00000000,?,?,00000000), ref: 03256488
Part of subcall function 03256100: 73BB3B4E.MSVCR90(00000000,?,?,00000000), ref: 03256493

Strings

CommandLineToArgvW, xrefs: 0325669A

Memory Dump Source

Source File: 0000000F.00000002.1423676562.0000000003251000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03250000, based on PE: true

Associated: 0000000F.00000002.1423656216.0000000003250000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423775563.0000000003263000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3250000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Process$Wow64$ArgvCharClearCloseCommandCurrentErr_FreeFromHandleLineList_LocalUnicodeWide
String ID: CommandLineToArgvW
API String ID: 3998261610-1958408031
Opcode ID: aaaf31e856969d361c03fac27769c30569a4fa9bb78f625d9f6d1c323f3851ed
Instruction ID: 5e6cfa5b9b2905b456ea2d38080e2317e67cb9952e30fb8800fcce0bde13484c
Opcode Fuzzy Hash: aaaf31e856969d361c03fac27769c30569a4fa9bb78f625d9f6d1c323f3851ed
Instruction Fuzzy Hash: 3031B07A5143129FC710DF58D88486FB7E8FB84614F489529FC858B204E775EB85CB92

Uniqueness

Uniqueness Score: -1.00%

Function 1E7D26E0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 67registryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,000003F8,?,00000100,?), ref: 1E7D26F0
LoadStringW.USER32(00000000), ref: 1E7D26F7
RegOpenKeyW.ADVAPI32(80000002,?,?), ref: 1E7D2741
RegQueryValueExW.ADVAPI32(?,00000000,00000000,?,?,?,?,?,?,?), ref: 1E7D277F
RegCloseKey.ADVAPI32(?,?,?,?,?,?), ref: 1E7D27A9

Part of subcall function 1E7D1F00: GetLastError.KERNEL32(00000000,?), ref: 1E7D1F0E
Part of subcall function 1E7D1F00: FormatMessageW.KERNEL32(00001000,00000000,00000000,00000000,?,00000200,00000000,00000000,?), ref: 1E7D1F2C
Part of subcall function 1E7D1F00: wsprintfW.USER32 ref: 1E7D1FB8

Strings

System\CurrentControlSet\Services\%s\PythonClass, xrefs: 1E7D2712

Memory Dump Source

Source File: 0000000F.00000002.1434219289.000000001E7D1000.00000040.00000001.01000000.00000015.sdmp, Offset: 1E7D0000, based on PE: true

Associated: 0000000F.00000002.1434197225.000000001E7D0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000F.00000002.1434219289.000000001E7DA000.00000040.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000F.00000002.1434284534.000000001E7DB000.00000080.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000F.00000002.1434310614.000000001E7DD000.00000004.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e7d0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: CloseErrorFormatHandleLastLoadMessageModuleOpenQueryStringValuewsprintf
String ID: System\CurrentControlSet\Services\%s\PythonClass
API String ID: 27574671-1026807537
Opcode ID: 40515b2818b6dc3e270ed72e885fa7a2b777dfc16a4924f6962957220fcecc06
Instruction ID: b8fd87fb04ddff267a4369b85114c0a4cdcc8413256b62ce42043f5239a09799
Opcode Fuzzy Hash: 40515b2818b6dc3e270ed72e885fa7a2b777dfc16a4924f6962957220fcecc06
Instruction Fuzzy Hash: 94114275604301ABF3609FA4ED89BA777ECFB88B61F40492CFA49D2144EA35D50CCA63

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C73AE Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 67registrythreadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,Oi:PyRegEnumValue,?,?), ref: 1E8C73DA
?PyWinObject_AsHKEY@@YAHPAU_object@@PAPAUHKEY__@@@Z.PYWINTYPES27(?,?), ref: 1E8C73F3
RegQueryInfoKeyA.ADVAPI32(?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000,00000000), ref: 1E8C7422
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(RegQueryInfoKey,00000000), ref: 1E8C7432
__alloca_probe_16.LIBCMT ref: 1E8C7453
__alloca_probe_16.LIBCMT ref: 1E8C745C
PyEval_SaveThread.PYTHON27 ref: 1E8C7473
RegEnumValueA.ADVAPI32(?,?,?,?,00000000,?,?,?), ref: 1E8C7494
PyEval_RestoreThread.PYTHON27(?,?,?,00000000,?,?,?), ref: 1E8C74A0
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(PyRegEnumValue,00000000,?), ref: 1E8C74B3

Strings

Oi:PyRegEnumValue, xrefs: 1E8C73D4
RegQueryInfoKey, xrefs: 1E8C742D

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: U_object@@$Error@@Eval_ThreadWin___alloca_probe_16$Arg_EnumInfoObject_ParseQueryRestoreSaveTupleValueY__@@@
String ID: Oi:PyRegEnumValue$RegQueryInfoKey
API String ID: 1596361088-2323119663
Opcode ID: e21ab7a682a271032234e114d654a7c0c3e36d51f578021c83ed091e73415115
Instruction ID: 4af1df99f5c254d1d898ccb9de021f5908bd2d7b8270b7a9d3d9faaaa6498ef8
Opcode Fuzzy Hash: e21ab7a682a271032234e114d654a7c0c3e36d51f578021c83ed091e73415115
Instruction Fuzzy Hash: C601B575A00208BBEB10EBA89D89FEFB7BCEF45506F104514FA09D3140E631E655C7B1

Uniqueness

Uniqueness Score: -1.00%

Function 03251BA0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 03251BC0
QueryFullProcessImageNameW.KERNEL32(00000000,00000000,?,?), ref: 03251C0E
CloseHandle.KERNEL32(00000000), ref: 03251C26

Strings

QueryFullProcessImageNameW, xrefs: 03251C18

Memory Dump Source

Source File: 0000000F.00000002.1423676562.0000000003251000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03250000, based on PE: true

Associated: 0000000F.00000002.1423656216.0000000003250000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423775563.0000000003263000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3250000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_CloseFullHandleImageNameParseProcessQueryTuple
String ID: QueryFullProcessImageNameW
API String ID: 1411945861-4231907612
Opcode ID: 5a4317657737630865d77aff70bf9cd4ada1006588b1e6d7b948a2096b7c39da
Instruction ID: 7577f51dae5e20ac6b47a3363e742d4e01a6a5f5dde42cc8e178b5950a08c11f
Opcode Fuzzy Hash: 5a4317657737630865d77aff70bf9cd4ada1006588b1e6d7b948a2096b7c39da
Instruction Fuzzy Hash: BF11E675510305ABD710EB50EC4EBEF7398AF84705F488814FD58C6144F7B4A79886D2

Uniqueness

Uniqueness Score: -1.00%

Function 1E8CAEE0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 60COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1E8CAF18
PyErr_Format.PYTHON27(?,keyboard state string must be exactly 256 characters), ref: 1E8CAF40

Strings

keyboard state string must be exactly 256 characters, xrefs: 1E8CAF3A
iis#|iO, xrefs: 1E8CAF02

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Err_FormatParseTuple
String ID: iis#|iO$keyboard state string must be exactly 256 characters
API String ID: 361908667-3385178162
Opcode ID: d940f14d424c1dee7a6e6b7e86e6a4b4b238b9f617b53157f3decbc1d883f2b9
Instruction ID: aba608c82e1aaf34ce578c390401470956eaed16462a6466cb76b7691235ee25
Opcode Fuzzy Hash: d940f14d424c1dee7a6e6b7e86e6a4b4b238b9f617b53157f3decbc1d883f2b9
Instruction Fuzzy Hash: C9110AB5514201AFD304DF69C884E9BB7E8BBC9644F808A8CF54E83261E630DA59CB62

Uniqueness

Uniqueness Score: -1.00%

Function 1E7D1890 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 56threadCOMMON

Download Yara Rule

APIs

?PyWinObject_AsWCHAR@@YAHPAU_object@@PAPA_WHPAK@Z.PYWINTYPES27(?,00000000,00000000,00000000), ref: 1E7D18A0
PyEval_SaveThread.PYTHON27 ref: 1E7D18C4
?PyWinObject_FreeWCHAR@@YAXPA_W@Z.PYWINTYPES27(00000000,-C00000FF), ref: 1E7D18F1
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E7D18F8
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(RegisterEventSource/ReportEvent,00000000), ref: 1E7D190E

Strings

RegisterEventSource/ReportEvent, xrefs: 1E7D1909

Memory Dump Source

Source File: 0000000F.00000002.1434219289.000000001E7D1000.00000040.00000001.01000000.00000015.sdmp, Offset: 1E7D0000, based on PE: true

Associated: 0000000F.00000002.1434197225.000000001E7D0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000F.00000002.1434219289.000000001E7DA000.00000040.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000F.00000002.1434284534.000000001E7DB000.00000080.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000F.00000002.1434310614.000000001E7DD000.00000004.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e7d0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_Object_ThreadU_object@@$Error@@FreeRestoreSaveWin_
String ID: RegisterEventSource/ReportEvent
API String ID: 4048910748-2303438860
Opcode ID: 48b1f20c97d904b64e62a35c35a0593539e51a329892c9e58eec7bd66798f6a8
Instruction ID: 224d882d99823ae8c3a7710d5ca33429d1bcd0e10a79e121167ea7d1a6192e6d
Opcode Fuzzy Hash: 48b1f20c97d904b64e62a35c35a0593539e51a329892c9e58eec7bd66798f6a8
Instruction Fuzzy Hash: EC01C0364402229BF300DB68FD85BEB37E8BF98614F440625FD44D2251F735991C8AA2

Uniqueness

Uniqueness Score: -1.00%

Function 032568D1 Relevance: 10.5, APIs: 7, Instructions: 45threadsynchronizationinjectionCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,Function_00006880,00000000,00000000,00000000), ref: 032568E8
SetEvent.KERNEL32(00000000), ref: 03256905
WaitForSingleObject.KERNEL32(00000000,00000064), ref: 0325691A
SuspendThread.KERNEL32(00000000), ref: 0325692D
TerminateThread.KERNEL32(00000000,00000001), ref: 0325693B
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0325694A
CloseHandle.KERNEL32(00000000), ref: 03256953

Memory Dump Source

Source File: 0000000F.00000002.1423676562.0000000003251000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03250000, based on PE: true

Associated: 0000000F.00000002.1423656216.0000000003250000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423775563.0000000003263000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3250000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Thread$ObjectSingleWait$CloseCreateEventHandleSuspendTerminate
String ID:
API String ID: 4123217685-0
Opcode ID: 6a3558876a6bee3e27e33e7ca0860a596ed23293ffde99a9e3a623e8cf6cb5e0
Instruction ID: 6db1fe7f0c65667e586ff2dbc7936aeaa865f486c98d5bbd69b0b423b2d23a59
Opcode Fuzzy Hash: 6a3558876a6bee3e27e33e7ca0860a596ed23293ffde99a9e3a623e8cf6cb5e0
Instruction Fuzzy Hash: B3012C76610310EBD610BBA8FC4DF4A37A9A788B11F14C525FA01D73D8C7B4968ACB61

Uniqueness

Uniqueness Score: -1.00%

Function 032568D0 Relevance: 10.5, APIs: 7, Instructions: 45threadsynchronizationinjectionCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,Function_00006880,00000000,00000000,00000000), ref: 032568E8
SetEvent.KERNEL32(00000000), ref: 03256905
WaitForSingleObject.KERNEL32(00000000,00000064), ref: 0325691A
SuspendThread.KERNEL32(00000000), ref: 0325692D
TerminateThread.KERNEL32(00000000,00000001), ref: 0325693B
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 0325694A
CloseHandle.KERNEL32(00000000), ref: 03256953

Memory Dump Source

Source File: 0000000F.00000002.1423676562.0000000003251000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03250000, based on PE: true

Associated: 0000000F.00000002.1423656216.0000000003250000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423775563.0000000003263000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3250000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Thread$ObjectSingleWait$CloseCreateEventHandleSuspendTerminate
String ID:
API String ID: 4123217685-0
Opcode ID: 584df7b507ec5c9b715d8cf4797d93dc6a64643df89c74cf45075c1d60ab314e
Instruction ID: 0e830de7e81ac53bc1e4030e80b1c60eda99f59ab2296759366b43e70f90599c
Opcode Fuzzy Hash: 584df7b507ec5c9b715d8cf4797d93dc6a64643df89c74cf45075c1d60ab314e
Instruction Fuzzy Hash: 33012876610311EBD610BBA8FC4DF0637A9A788B21F14C525FA01D73D8CBB4978ACB61

Uniqueness

Uniqueness Score: -1.00%

Function 1E8CA0D0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 41COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,Oi:EndUpdateResource,?,?), ref: 1E8CA0E7
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?), ref: 1E8CA103
EndUpdateResourceA.KERNEL32(?,?), ref: 1E8CA11A
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(EndUpdateResource,00000000), ref: 1E8CA12A

Strings

EndUpdateResource, xrefs: 1E8CA125
Oi:EndUpdateResource, xrefs: 1E8CA0E1

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: U_object@@$Arg_Error@@Object_ParseResourceTupleUpdateWin_
String ID: EndUpdateResource$Oi:EndUpdateResource
API String ID: 4121047371-1734625141
Opcode ID: c75c927be0fba14724fb0a0c494349b171f8eb2223558daf36e9fcdac5c91e02
Instruction ID: 105fb289bed03b331dd796e16fa62cab99200bf520088ebde34c660d0d9d8d3b
Opcode Fuzzy Hash: c75c927be0fba14724fb0a0c494349b171f8eb2223558daf36e9fcdac5c91e02
Instruction Fuzzy Hash: D0F0A478500202AFE700CB78DD899EB77E8FF85645F804528FD4EC3200E735DA98CA52

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C1220 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 41COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,iO:SetStdHandle,?), ref: 1E8C1236
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?), ref: 1E8C1252
SetStdHandle.KERNEL32(?,?), ref: 1E8C1269
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(SetStdHandle,00000000), ref: 1E8C1279

Strings

SetStdHandle, xrefs: 1E8C1274
iO:SetStdHandle, xrefs: 1E8C1230

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: U_object@@$Arg_Error@@HandleObject_ParseTupleWin_
String ID: SetStdHandle$iO:SetStdHandle
API String ID: 1363360364-96720624
Opcode ID: bcc7c0d22d117de4c8cb3bee34273880fa43975de0644e5ee1b5d1d81e712dc7
Instruction ID: 443a8c45348a6dd5a8db6d8d0ee51aada99b43da59f2574c7ea3b886bc8aa48c
Opcode Fuzzy Hash: bcc7c0d22d117de4c8cb3bee34273880fa43975de0644e5ee1b5d1d81e712dc7
Instruction Fuzzy Hash: E5F03CB8504201AFE700DB74DDC9DAA33F8BB85645F448918FD4DC3200F635DA99DAA2

Uniqueness

Uniqueness Score: -1.00%

Function 03257220 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 40serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,?), ref: 0325722A
OpenServiceA.ADVAPI32(00000000,?,?), ref: 03257253
CloseServiceHandle.ADVAPI32(00000000), ref: 0325726D

Part of subcall function 03251090: GetLastError.KERNEL32 ref: 032510B2
Part of subcall function 03251090: PyErr_SetFromWindowsErrWithFilename.PYTHON27(00000000), ref: 032510B9

Strings

OpenSCManager, xrefs: 03257236
OpenService, xrefs: 0325725F

Memory Dump Source

Source File: 0000000F.00000002.1423676562.0000000003251000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03250000, based on PE: true

Associated: 0000000F.00000002.1423656216.0000000003250000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423775563.0000000003263000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3250000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: OpenService$CloseErr_ErrorFilenameFromHandleLastManagerWindowsWith
String ID: OpenSCManager$OpenService
API String ID: 4042265537-1214084076
Opcode ID: b23c46d6324466eb68d29791c7927235acbdcadfb0a7e21a6c8f23a66dfa91ad
Instruction ID: d6954eeee7069a3bdcc86398575f32eb7078b74e9e054a7c5f042d65ebfccffb
Opcode Fuzzy Hash: b23c46d6324466eb68d29791c7927235acbdcadfb0a7e21a6c8f23a66dfa91ad
Instruction Fuzzy Hash: CBF0B47B665311BBDA11F638FC0DFAF2668EBC4261F044464FC04C2208EB30EAC185A2

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C99F0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 37timeCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,O:SetLocalTime), ref: 1E8C9A01
?PyWinObject_AsSYSTEMTIME@@YAHPAU_object@@PAU_SYSTEMTIME@@@Z.PYWINTYPES27(00000000,?), ref: 1E8C9A1D
SetLocalTime.KERNEL32(?), ref: 1E8C9A2F
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(SetLocalTime,00000000), ref: 1E8C9A3F

Strings

SetLocalTime, xrefs: 1E8C9A3A
O:SetLocalTime, xrefs: 1E8C99FB

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: U_object@@$Arg_E@@@Error@@LocalObject_ParseTimeTupleWin_
String ID: O:SetLocalTime$SetLocalTime
API String ID: 1291033024-2636629638
Opcode ID: 0180f5b66fde7ff7e5c118e077179e95732af4910b424f852f13321b630858b8
Instruction ID: 78caf500052a1c90a272530612c34794933576fa06f95cc288bb2ec09b89f863
Opcode Fuzzy Hash: 0180f5b66fde7ff7e5c118e077179e95732af4910b424f852f13321b630858b8
Instruction Fuzzy Hash: 78F090B4510201AFE704EB78CD888DB37E8BF81605F8445A8F80EC3212F635D668CB66

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C17D0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 36threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,O:DragFinish), ref: 1E8C17E1
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(00000000,?), ref: 1E8C17FD
PyEval_SaveThread.PYTHON27 ref: 1E8C180B
DragFinish.SHELL32(?), ref: 1E8C1818
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C181F

Strings

O:DragFinish, xrefs: 1E8C17DB

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_Thread$Arg_DragFinishObject_ParseRestoreSaveTupleU_object@@
String ID: O:DragFinish
API String ID: 667219122-2115251260
Opcode ID: 0e11a7cf812275f29d55ad1cb8714dc204b154e14af910ddceacc48ef915f7e3
Instruction ID: 1f616337184f3ce4f81639ad99c817622e22938b799c1965db2bbfffb8e7dcae
Opcode Fuzzy Hash: 0e11a7cf812275f29d55ad1cb8714dc204b154e14af910ddceacc48ef915f7e3
Instruction Fuzzy Hash: EEF03074510211AFE700EBB8DDCC8DA77F8BF86246F444928F84DC3215E735D699CAA6

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C8DC0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 35threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1E8C8DDE
PyEval_SaveThread.PYTHON27 ref: 1E8C8DF1
SleepEx.KERNEL32(?,?), ref: 1E8C8E03
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C8E0C
Py_BuildValue.PYTHON27(1E8D16C8,00000000), ref: 1E8C8E18

Strings

i|i:Sleep, xrefs: 1E8C8DD0

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_Thread$Arg_BuildParseRestoreSaveSleepTupleValue
String ID: i|i:Sleep
API String ID: 158943565-1579782342
Opcode ID: e45b8054deaec5112eab14cf63731a11efcd6a200fad6705fafbfa5a9dbeb54a
Instruction ID: d806c01f9865846d43ef39b987b8fbf1501cc82d24ae86c9a836417681d55fb3
Opcode Fuzzy Hash: e45b8054deaec5112eab14cf63731a11efcd6a200fad6705fafbfa5a9dbeb54a
Instruction Fuzzy Hash: 37F06775500211AFE300AB68EC8C9DB7BE8EFC6206F448A19F94DC3210E7308549CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C2AB0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 32COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,:GetComputerName), ref: 1E8C2ABD
GetComputerNameA.KERNEL32 ref: 1E8C2ADF
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(GetComputerName,00000000), ref: 1E8C2AEF

Strings

:GetComputerName, xrefs: 1E8C2AB7
GetComputerName, xrefs: 1E8C2AEA

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_ComputerError@@NameParseTupleU_object@@Win_
String ID: :GetComputerName$GetComputerName
API String ID: 4196016030-2709991892
Opcode ID: 0512f74f21b52b107b490ffa1c8e8b1009e0f943d950b31e8499fc6513ce866d
Instruction ID: b12b74aac5da509e22ea5d8a420b9a0cbf235df85fc4c94a6cb621774333b325
Opcode Fuzzy Hash: 0512f74f21b52b107b490ffa1c8e8b1009e0f943d950b31e8499fc6513ce866d
Instruction Fuzzy Hash: 7CF0E2F1800202ABD700AB68CC889CB7BE8BF81645F84451CF84EC3221F731C2988A77

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C3990 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 31COMMON

Download Yara Rule

APIs

PyErr_Format.PYTHON27(?,%s is not available on this platform,GetLastInputInfo), ref: 1E8C39AE
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(GetLastInputInfo,00000000), ref: 1E8C39D3

Strings

%s is not available on this platform, xrefs: 1E8C39A8
GetLastInputInfo, xrefs: 1E8C39CE
GetLastInputInfo, xrefs: 1E8C39A3

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Err_Error@@FormatU_object@@Win_
String ID: %s is not available on this platform$GetLastInputInfo$GetLastInputInfo
API String ID: 1771588633-2589227319
Opcode ID: 30dc0b3051989705708709633c8e8a7417d6f92dda299da89081135bda25bf6f
Instruction ID: 11e889900d90880b94c597949818924ac2dc31b5944f260e088313a4b06ab924
Opcode Fuzzy Hash: 30dc0b3051989705708709633c8e8a7417d6f92dda299da89081135bda25bf6f
Instruction Fuzzy Hash: 11F0A7F18002007FD700A769DC89A8933E5BB82645F444524F84DC3300F635DA6DC667

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C3680 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 30threadkeyboardCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,i:GetKeyState), ref: 1E8C368F
PyEval_SaveThread.PYTHON27 ref: 1E8C36A0
GetKeyState.USER32(?), ref: 1E8C36AD
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C36B7
Py_BuildValue.PYTHON27(1E8CFF44), ref: 1E8C36C3

Strings

i:GetKeyState, xrefs: 1E8C3689

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_Thread$Arg_BuildParseRestoreSaveStateTupleValue
String ID: i:GetKeyState
API String ID: 3560425627-953873090
Opcode ID: 874e11f6e6752b7958fa547267b63b222e8cbb90394d792a0352820dd353ef5f
Instruction ID: c7eed590ed3c1a63b1348e3e07fda079a8f11cc75afad1236c05f9476bc24966
Opcode Fuzzy Hash: 874e11f6e6752b7958fa547267b63b222e8cbb90394d792a0352820dd353ef5f
Instruction Fuzzy Hash: 1FE039765142217FE61457A5DC8CCDB3BE8EFCA216B10811DF94AC3220DA3081968765

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C8BE0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 30threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,i:ShowCursor), ref: 1E8C8BEF
PyEval_SaveThread.PYTHON27 ref: 1E8C8C00
ShowCursor.USER32(?), ref: 1E8C8C0D
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C8C16
Py_BuildValue.PYTHON27(1E8D1694,00000000), ref: 1E8C8C22

Strings

i:ShowCursor, xrefs: 1E8C8BE9

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_Thread$Arg_BuildCursorParseRestoreSaveShowTupleValue
String ID: i:ShowCursor
API String ID: 4093611133-3798339376
Opcode ID: 7171d54dc319324140084b959139bf1e9a4544ddf6d43ad1b62c5c3874224bdd
Instruction ID: d1b4b877a176d9f56fada2f030214ed3f2f62531e52fbd83decd2445a943bbd5
Opcode Fuzzy Hash: 7171d54dc319324140084b959139bf1e9a4544ddf6d43ad1b62c5c3874224bdd
Instruction Fuzzy Hash: F2E039761002217FD71057B9EC8CCDB7BE8EECA266B148529F90AC3221EB3084968B65

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C8B90 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 29threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,i:SetErrorMode), ref: 1E8C8B9F
PyEval_SaveThread.PYTHON27 ref: 1E8C8BB0
SetErrorMode.KERNEL32(?), ref: 1E8C8BBD
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C8BC6
PyInt_FromLong.PYTHON27(00000000), ref: 1E8C8BCD

Strings

i:SetErrorMode, xrefs: 1E8C8B99

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_Thread$Arg_ErrorFromInt_LongModeParseRestoreSaveTuple
String ID: i:SetErrorMode
API String ID: 3074247271-911818189
Opcode ID: e8150a1bf50b264aaa9479065a1ce7d985660c5c45fffff7373d61ca7f34cb14
Instruction ID: ee51321ec7a789ff2f4fde8a5302c4e441ec70b123c31863b561e08171481dba
Opcode Fuzzy Hash: e8150a1bf50b264aaa9479065a1ce7d985660c5c45fffff7373d61ca7f34cb14
Instruction Fuzzy Hash: E4E06DB21101207FD70057B5DC8C8EA77ECEFC6266F14852DF90EC3211DB3484968761

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C5CE0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 27threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,:GetWindowsDirectory), ref: 1E8C5CF0
PyEval_SaveThread.PYTHON27 ref: 1E8C5D05
GetWindowsDirectoryA.KERNEL32(00000104,00000104), ref: 1E8C5D17
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C5D1E
?PyWinObject_FromTCHAR@@YAPAU_object@@PBDH@Z.PYWINTYPES27(?,000000FF), ref: 1E8C5D2B

Strings

:GetWindowsDirectory, xrefs: 1E8C5CEA

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_Thread$Arg_DirectoryFromObject_ParseRestoreSaveTupleU_object@@Windows
String ID: :GetWindowsDirectory
API String ID: 3009372331-2340468556
Opcode ID: 962b626807ba67fc9742cbf347db58deebb524eff57d2dd19d7f6918ebe6386b
Instruction ID: 80df3d3ee1bcda18ef9ed22107583096ea1c938076e7ca8d19921f139c096ae0
Opcode Fuzzy Hash: 962b626807ba67fc9742cbf347db58deebb524eff57d2dd19d7f6918ebe6386b
Instruction Fuzzy Hash: 21E0E5B58002227FE7009778DCCC9CA3AA4AF81316F404614F65D871B0EA7882D9C796

Uniqueness

Uniqueness Score: -1.00%

Function 1E8CACF0 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,:GetKeyboardLayoutName), ref: 1E8CACFD
GetKeyboardLayoutNameW.USER32 ref: 1E8CAD12
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(GetKeyboardLayoutNameW,00000000), ref: 1E8CAD22

Strings

GetKeyboardLayoutNameW, xrefs: 1E8CAD1D
:GetKeyboardLayoutName, xrefs: 1E8CACF7

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Error@@KeyboardLayoutNameParseTupleU_object@@Win_
String ID: :GetKeyboardLayoutName$GetKeyboardLayoutNameW
API String ID: 364696899-3230485078
Opcode ID: fc9aecbdca34ad702312586820e69376db179222d8f3ceeedb0db3e0a29f3a1c
Instruction ID: 6551c84cbeb5ac7c60092215621d62be4356671e5b7074631baa72feb50c3108
Opcode Fuzzy Hash: fc9aecbdca34ad702312586820e69376db179222d8f3ceeedb0db3e0a29f3a1c
Instruction Fuzzy Hash: DAE092F58102026BD60477388C8D88B36A4BE8150AFC905A8F94BC2226FA29C26C85B7

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C57E0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 27threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,:GetSystemDirectory), ref: 1E8C57F0
PyEval_SaveThread.PYTHON27 ref: 1E8C5805
GetSystemDirectoryA.KERNEL32(00000105,00000105), ref: 1E8C5817
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C581E
?PyWinObject_FromTCHAR@@YAPAU_object@@PBDH@Z.PYWINTYPES27(?,000000FF), ref: 1E8C582B

Strings

:GetSystemDirectory, xrefs: 1E8C57EA

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_Thread$Arg_DirectoryFromObject_ParseRestoreSaveSystemTupleU_object@@
String ID: :GetSystemDirectory
API String ID: 3789406084-2580655871
Opcode ID: 5445fa0cc5344d84b2cd859abc1ced15b19ef7d755deb2825023aba21ded5b36
Instruction ID: 511e617184639e132d85474616b77c0220cadbf2a311004c9eeb9119a603c5c8
Opcode Fuzzy Hash: 5445fa0cc5344d84b2cd859abc1ced15b19ef7d755deb2825023aba21ded5b36
Instruction Fuzzy Hash: 12E02B718042227FEB006778DC8C9CF3BA4AF81315F804614F59D831E0EB3881D9C796

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C4EE0 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 23threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,:PyGetTickCount), ref: 1E8C4EEA
PyEval_SaveThread.PYTHON27 ref: 1E8C4EFA
GetTickCount.KERNEL32 ref: 1E8C4F02
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C4F0B
Py_BuildValue.PYTHON27(1E8D0690,00000000), ref: 1E8C4F17

Strings

:PyGetTickCount, xrefs: 1E8C4EE4

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_Thread$Arg_BuildCountParseRestoreSaveTickTupleValue
String ID: :PyGetTickCount
API String ID: 207086270-1183235398
Opcode ID: 16d0a5e4fd5531d6aa4d6a20d699ea7a28c6c1b47eda18dcf371e9492d44e105
Instruction ID: 7f1c4792ac6b9497bc45939c13e58b1da6aa85e37699b29b9bcee2c5673bb308
Opcode Fuzzy Hash: 16d0a5e4fd5531d6aa4d6a20d699ea7a28c6c1b47eda18dcf371e9492d44e105
Instruction Fuzzy Hash: F5E0BF3A5002217FE7101BB9AD4C8CA3AE9AFC6256B454514F50DC3210D62485969665

Uniqueness

Uniqueness Score: -1.00%

Function 1E8CB210 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 22COMMON

Download Yara Rule

APIs

PyLong_FromUnsignedLong.PYTHON27(?), ref: 1E8CB220
PyLong_FromUnsignedLong.PYTHON27(?,Capacity,00000000), ref: 1E8CB22E
Py_BuildValue.PYTHON27({s:N, s:N},Granularity,00000000,00000000), ref: 1E8CB23E

Strings

Granularity, xrefs: 1E8CB234
{s:N, s:N}, xrefs: 1E8CB239
Capacity, xrefs: 1E8CB228

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: FromLongLong_Unsigned$BuildValue
String ID: Capacity$Granularity${s:N, s:N}
API String ID: 760731585-1405704946
Opcode ID: 586267e8c9b8772deba39f19741fab5c17f1dc5479e567312a588fe7ac6d2544
Instruction ID: ecca7d0d8e1495485ea0b8364f649f29c85f9f25947dd19e7063274423bad656
Opcode Fuzzy Hash: 586267e8c9b8772deba39f19741fab5c17f1dc5479e567312a588fe7ac6d2544
Instruction Fuzzy Hash: 35E012B55002107FE5046B6DEC44CD7B39CAE85935B064529F989A3320D561E9558AB2

Uniqueness

Uniqueness Score: -1.00%

Function 1E7D25D0 Relevance: 9.1, APIs: 6, Instructions: 102COMMON

Download Yara Rule

APIs

PyTuple_New.PYTHON27(?,00000000,00000000,1E7D2A10,?,?), ref: 1E7D25EC

Part of subcall function 1E7D2000: PyErr_Occurred.PYTHON27(776004E0,?,?,?,?,?,?,1E7D2B38,C0000003), ref: 1E7D2004
Part of subcall function 1E7D2000: PyErr_Fetch.PYTHON27(?,?,?,00000000,00000000,?,?,?,?,?,?,1E7D2B38,C0000003), ref: 1E7D2035
Part of subcall function 1E7D2000: ?GetPythonTraceback@@YAPADPAU_object@@00@Z.PYWINTYPES27 ref: 1E7D2054
Part of subcall function 1E7D2000: MultiByteToWideChar.KERNEL32(00000000,00000000,00000000,00000002,00000000,00000002,?,?,?,?,?,?,?), ref: 1E7D2090
Part of subcall function 1E7D2000: 73BB3B4E.MSVCR90(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,1E7D2B38,C0000003), ref: 1E7D20A3
Part of subcall function 1E7D2000: 73BB3B4E.MSVCR90(00000000,?,?,?,?,?,?,?,?,?,?,?,?,?,?,1E7D2B38), ref: 1E7D20CD
Part of subcall function 1E7D2000: PyErr_Restore.PYTHON27(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,1E7D2B38), ref: 1E7D20F0

Memory Dump Source

Source File: 0000000F.00000002.1434219289.000000001E7D1000.00000040.00000001.01000000.00000015.sdmp, Offset: 1E7D0000, based on PE: true

Associated: 0000000F.00000002.1434197225.000000001E7D0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000F.00000002.1434219289.000000001E7DA000.00000040.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000F.00000002.1434284534.000000001E7DB000.00000080.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000F.00000002.1434310614.000000001E7DD000.00000004.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e7d0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Err_$ByteCharFetchMultiOccurredPythonRestoreTraceback@@Tuple_U_object@@00@Wide
String ID:
API String ID: 2813028372-0
Opcode ID: 7373bfe208acb559bd7bd61f0dfc6b3ccb59c34290f91cbda599b3b82ac85291
Instruction ID: eeaa5fe410aa8f6bb57b926c9732998bb83485d7342da4a4a61dd9611b0c1845
Opcode Fuzzy Hash: 7373bfe208acb559bd7bd61f0dfc6b3ccb59c34290f91cbda599b3b82ac85291
Instruction Fuzzy Hash: 3831E8B2A003515BF7009FA8FD44A8A7359BF84635F068734ED15D7665E732E80BCB92

Uniqueness

Uniqueness Score: -1.00%

Function 03253790 Relevance: 9.0, APIs: 6, Instructions: 50COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,0325B578), ref: 0325379F

Memory Dump Source

Source File: 0000000F.00000002.1423676562.0000000003251000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03250000, based on PE: true

Associated: 0000000F.00000002.1423656216.0000000003250000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423775563.0000000003263000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3250000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_ParseTuple
String ID:
API String ID: 3371842430-0
Opcode ID: 52b67fec685b9de8203e2663610018a83ef8f506e065900b825716fe3ef2a107
Instruction ID: 139bb7bd9a832f7f196d07c984afb70fd5f180ed931c5310f4bbd7c8c625077e
Opcode Fuzzy Hash: 52b67fec685b9de8203e2663610018a83ef8f506e065900b825716fe3ef2a107
Instruction Fuzzy Hash: 7AF0FFB2A11211EBC620AB74BC0CA9F37ADDF806A7B148429FD06C2604DB3583918AA1

Uniqueness

Uniqueness Score: -1.00%

Function 03253A70 Relevance: 9.0, APIs: 6, Instructions: 48COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,0325B5D4), ref: 03253A81
GetProcessAffinityMask.KERNEL32(00000000,?,?), ref: 03253AB5
PyErr_SetFromWindowsErr.PYTHON27(00000000), ref: 03253AC0
CloseHandle.KERNEL32(00000000), ref: 03253ACA

Memory Dump Source

Source File: 0000000F.00000002.1423676562.0000000003251000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03250000, based on PE: true

Associated: 0000000F.00000002.1423656216.0000000003250000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423775563.0000000003263000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3250000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: AffinityArg_CloseErr_FromHandleMaskParseProcessTupleWindows
String ID:
API String ID: 1573772585-0
Opcode ID: ec1252d2a3bb6efcf01511861a9aae2dc8a7ed579d7a2b821f42bba9a5b8e759
Instruction ID: 7c7a7ee1ac0317450a80eaaf8d4522f26c8f7e5f99cda6f7e17194c802df4584
Opcode Fuzzy Hash: ec1252d2a3bb6efcf01511861a9aae2dc8a7ed579d7a2b821f42bba9a5b8e759
Instruction Fuzzy Hash: B101A275510211AFC610EB74BC4DAAF77ACAF44655F84C528FD45C1204FB359798CAE3

Uniqueness

Uniqueness Score: -1.00%

Function 1E7D1160 Relevance: 9.0, APIs: 6, Instructions: 47windowthreadCOMMON

Download Yara Rule

APIs

PyEval_SaveThread.PYTHON27 ref: 1E7D1168
PeekMessageW.USER32(00000000,00000000,00000000,00000000,00000001), ref: 1E7D1180
DispatchMessageW.USER32(?), ref: 1E7D119C
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 1E7D11AB
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E7D11BA
PyInt_FromLong.PYTHON27(00000000), ref: 1E7D11C1

Memory Dump Source

Source File: 0000000F.00000002.1434219289.000000001E7D1000.00000040.00000001.01000000.00000015.sdmp, Offset: 1E7D0000, based on PE: true

Associated: 0000000F.00000002.1434197225.000000001E7D0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000F.00000002.1434219289.000000001E7DA000.00000040.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000F.00000002.1434284534.000000001E7DB000.00000080.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000F.00000002.1434310614.000000001E7DD000.00000004.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e7d0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Message$Eval_PeekThread$DispatchFromInt_LongRestoreSave
String ID:
API String ID: 657982229-0
Opcode ID: 4f6df83992706d05af043f1095cc6411094232bf5fd708fc8007b3c8b21bda32
Instruction ID: 79e05ceda1f12033598b73f50187700dec268c07c473ed28bbb07a70fed9b785
Opcode Fuzzy Hash: 4f6df83992706d05af043f1095cc6411094232bf5fd708fc8007b3c8b21bda32
Instruction Fuzzy Hash: 9BF0F43110031AABF300EAA4DDC5FA77B9CFB89740F800529FE0196081F667E9098BB1

Uniqueness

Uniqueness Score: -1.00%

Function 032548D0 Relevance: 9.0, APIs: 6, Instructions: 46COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,0325B7D8), ref: 032548E1
GetProcessHandleCount.KERNEL32(00000000,?), ref: 03254910
PyErr_SetFromWindowsErr.PYTHON27(00000000), ref: 0325491B
CloseHandle.KERNEL32(00000000), ref: 03254925

Memory Dump Source

Source File: 0000000F.00000002.1423676562.0000000003251000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03250000, based on PE: true

Associated: 0000000F.00000002.1423656216.0000000003250000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423775563.0000000003263000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3250000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Handle$Arg_CloseCountErr_FromParseProcessTupleWindows
String ID:
API String ID: 375582320-0
Opcode ID: cbaa286e4f7ebd5ed07e22ca63df3200460c882d333eb1ef3180eb46a29a77c8
Instruction ID: 6a679a154b838681fbc4ae323c0eac75726fb3d872be77c1f86ff306851a5a23
Opcode Fuzzy Hash: cbaa286e4f7ebd5ed07e22ca63df3200460c882d333eb1ef3180eb46a29a77c8
Instruction Fuzzy Hash: 19F08131915311AFD610FB74BC4E99FB79DAF44646F848424FC49C2204F73997D8CAA2

Uniqueness

Uniqueness Score: -1.00%

Function 03254960 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 174COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,0325B7E0,?), ref: 03254979
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 03254A70

Strings

kkdddiKKKKKKkIIIIIIIII, xrefs: 03254B23

Memory Dump Source

Source File: 0000000F.00000002.1423676562.0000000003251000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03250000, based on PE: true

Associated: 0000000F.00000002.1423656216.0000000003250000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423775563.0000000003263000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3250000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_ParseTupleUnothrow_t@std@@@__ehfuncinfo$??2@
String ID: kkdddiKKKKKKkIIIIIIIII
API String ID: 1811236384-3169003817
Opcode ID: 9b1299c5f809cff2b5152558879f75b5f69e3fdb4867a0707de788ec48276e1c
Instruction ID: 75930e5a55043702ee46192fd469e6f60d8c736b82163c8c74ed30b924391f73
Opcode Fuzzy Hash: 9b1299c5f809cff2b5152558879f75b5f69e3fdb4867a0707de788ec48276e1c
Instruction Fuzzy Hash: D05194B2614B01AFC324EF69D985E67B3E9FB88344F14890CF99AC3615E730B954CB61

Uniqueness

Uniqueness Score: -1.00%

Function 03257140 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 64networkCOMMON

Download Yara Rule

APIs

WSAAddressToStringA.WS2_32(?,?,00000000,?,?), ref: 032571BF
WSAGetLastError.WS2_32 ref: 032571C9
PyErr_SetExcFromWindowsErr.PYTHON27(?,00000000), ref: 032571D9

Strings

invalid family, xrefs: 03257201

Memory Dump Source

Source File: 0000000F.00000002.1423676562.0000000003251000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03250000, based on PE: true

Associated: 0000000F.00000002.1423656216.0000000003250000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423775563.0000000003263000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3250000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: AddressErr_ErrorFromLastStringWindows
String ID: invalid family
API String ID: 1619670159-3911939720
Opcode ID: 8636d67e9d7c3e342f918543ad55d423584b6785aff1adeec79635c944921e82
Instruction ID: 5a942729dfab6b15b6dafacd8808cd825c3ae48063720b9efa1babdbcf31622b
Opcode Fuzzy Hash: 8636d67e9d7c3e342f918543ad55d423584b6785aff1adeec79635c944921e82
Instruction Fuzzy Hash: B6211874614301AFD360DF58E888F9BB7E4FF88700F14C859E889C7251E770AA88CB92

Uniqueness

Uniqueness Score: -1.00%

Function 03251200 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

GetAdaptersAddresses.IPHLPAPI(00000000,00000000,00000000,00000000,?), ref: 0325123C
73BB3B4E.MSVCR90(00000000), ref: 03251247
PyErr_NoMemory.PYTHON27 ref: 03251254
PyErr_SetString.PYTHON27(00000000,GetAdaptersAddresses() syscall failed.), ref: 03251274

Strings

GetAdaptersAddresses() syscall failed., xrefs: 0325126E

Memory Dump Source

Source File: 0000000F.00000002.1423676562.0000000003251000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03250000, based on PE: true

Associated: 0000000F.00000002.1423656216.0000000003250000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423775563.0000000003263000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3250000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Err_$AdaptersAddressesMemoryString
String ID: GetAdaptersAddresses() syscall failed.
API String ID: 1780708024-4058666537
Opcode ID: 6747b29d22b4ac5017772dcd6817c9554a131154e557c9cb627edec27bfb7708
Instruction ID: 536ac4a8629b4d9b03940c2006c8f9b0accf844392cdc612cc7332b605e57388
Opcode Fuzzy Hash: 6747b29d22b4ac5017772dcd6817c9554a131154e557c9cb627edec27bfb7708
Instruction Fuzzy Hash: BD01407376532197DA10DA99BC48B5FF38CEB81631F144036F905C6180DB70FB9486A6

Uniqueness

Uniqueness Score: -1.00%

Function 1E7D1B90 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 44COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1E7D1BAF
?PyWinObject_AsWCHAR@@YAHPAU_object@@PAPA_WHPAK@Z.PYWINTYPES27(?,00000000,00000000,00000000,?,?,?,?), ref: 1E7D1BD0
?PyWinObject_FreeWCHAR@@YAXPA_W@Z.PYWINTYPES27(?,?,00000104), ref: 1E7D1BF6

Strings

O|i:SetEventSourceName, xrefs: 1E7D1BA1
Python Service, xrefs: 1E7D1BE6

Memory Dump Source

Source File: 0000000F.00000002.1434219289.000000001E7D1000.00000040.00000001.01000000.00000015.sdmp, Offset: 1E7D0000, based on PE: true

Associated: 0000000F.00000002.1434197225.000000001E7D0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000F.00000002.1434219289.000000001E7DA000.00000040.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000F.00000002.1434284534.000000001E7DB000.00000080.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000F.00000002.1434310614.000000001E7DD000.00000004.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e7d0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Object_$Arg_FreeParseTupleU_object@@
String ID: O|i:SetEventSourceName$Python Service
API String ID: 1565148867-529513643
Opcode ID: 0599bc790083b23f89953cd3b24e0be4fb3c60658e64526809c4facee4508021
Instruction ID: 495f03ea7a87981dc086c003640c53d9ad6f8914b936ddc2ee08646903b21914
Opcode Fuzzy Hash: 0599bc790083b23f89953cd3b24e0be4fb3c60658e64526809c4facee4508021
Instruction Fuzzy Hash: 93015A74104311AFF300DFA8E989BAA77E8FB88704F408958FA5992251F7759518CBA3

Uniqueness

Uniqueness Score: -1.00%

Function 1ECB2300 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43serviceCOMMON

Download Yara Rule

APIs

?PyWinObject_AsWCHARArray@@YAHPAU_object@@PAPAPA_WPAKH@Z.PYWINTYPES27 ref: 1ECB231C
StartServiceW.ADVAPI32(?,?,?), ref: 1ECB233C
?PyWinObject_FreeWCHARArray@@YAXPAPA_WK@Z.PYWINTYPES27(?,?), ref: 1ECB236B

Strings

StartService, xrefs: 1ECB2351

Memory Dump Source

Source File: 0000000F.00000002.1435001879.000000001ECB1000.00000040.00000001.01000000.00000011.sdmp, Offset: 1ECB0000, based on PE: true

Associated: 0000000F.00000002.1434980425.000000001ECB0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBA000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBD000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435097428.000000001ECBF000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435120797.000000001ECC0000.00000004.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ecb0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Array@@Object_$FreeServiceStartU_object@@
String ID: StartService
API String ID: 202537136-99420325
Opcode ID: a4dad46a1a8d175853de6fdbb5732ed2262c8a034127cdbcb69bcffb5858155e
Instruction ID: 82c345b72a7d3231467496633bd619550f7c24578c253615baa1be8e1ce8f000
Opcode Fuzzy Hash: a4dad46a1a8d175853de6fdbb5732ed2262c8a034127cdbcb69bcffb5858155e
Instruction Fuzzy Hash: 9D01AD75604200AFD304DB18DD85A2B7BEDFF84B82F448A58F98883304E731D818CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 1E7D2FF0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,1E7D4430,?,?), ref: 1E7D3007
?PyWinObject_AsWCHAR@@YAHPAU_object@@PAPA_WHPAK@Z.PYWINTYPES27(?,?,00000000,00000000), ref: 1E7D3021
PythonService_PrepareToHostMultiple.SERVICEMANAGER(?,?), ref: 1E7D3038
PyErr_SetString.PYTHON27(03AC6208,PrepareToHostMultiple failed!), ref: 1E7D3050

Strings

PrepareToHostMultiple failed!, xrefs: 1E7D304A

Memory Dump Source

Source File: 0000000F.00000002.1434219289.000000001E7D1000.00000040.00000001.01000000.00000015.sdmp, Offset: 1E7D0000, based on PE: true

Associated: 0000000F.00000002.1434197225.000000001E7D0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000F.00000002.1434219289.000000001E7DA000.00000040.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000F.00000002.1434284534.000000001E7DB000.00000080.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000F.00000002.1434310614.000000001E7DD000.00000004.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e7d0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Err_HostMultipleObject_ParsePreparePythonService_StringTupleU_object@@
String ID: PrepareToHostMultiple failed!
API String ID: 1222711015-3429171965
Opcode ID: b7e719f689ea6bbe7982a48dc7b0700921edfd19d239eb00ca995da368396ec1
Instruction ID: 6f3a04a2308bc642dd2cfa3c9dfd410a7730ce4d5d150b0fdfc8b6312f701fff
Opcode Fuzzy Hash: b7e719f689ea6bbe7982a48dc7b0700921edfd19d239eb00ca995da368396ec1
Instruction Fuzzy Hash: 8A01AD75100311ABF300DBA8EC89FAA33BEBB88604F404A18FD18D2251F636E918CB52

Uniqueness

Uniqueness Score: -1.00%

Function 03252030 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 41COMMON

Download Yara Rule

APIs

GlobalMemoryStatusEx.KERNEL32 ref: 0325203F
PyErr_SetFromWindowsErr.PYTHON27(00000000), ref: 0325204A
Py_BuildValue.PYTHON27((LLLLLL),?,?,?,?,?,?,?,?,?,?,?,?), ref: 03252098

Strings

@, xrefs: 03252037
(LLLLLL), xrefs: 03252093

Memory Dump Source

Source File: 0000000F.00000002.1423676562.0000000003251000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03250000, based on PE: true

Associated: 0000000F.00000002.1423656216.0000000003250000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423775563.0000000003263000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3250000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: BuildErr_FromGlobalMemoryStatusValueWindows
String ID: (LLLLLL)$@
API String ID: 1532042667-4274804333
Opcode ID: 350725eb3c748bdb38d7317291c1c0f4fcfb0c2f048e0a197f5285555eb00318
Instruction ID: 97dd0af48b0049f23541756959b65293d661f1cc36e56d90741e3afc6bc49b80
Opcode Fuzzy Hash: 350725eb3c748bdb38d7317291c1c0f4fcfb0c2f048e0a197f5285555eb00318
Instruction Fuzzy Hash: 0B01A1F1618300AFD344DB68D885D2BB3EDABCC614F448A0CF6ADD3254D634EA558B63

Uniqueness

Uniqueness Score: -1.00%

Function 1E8CC490 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,Ol:ChangeDisplaySettings,?,?), ref: 1E8CC4A7
?PyWinObject_AsDEVMODE@@YAHPAU_object@@PAPAU_devicemodeA@@H@Z.PYWINTYPES27(?,?,00000001), ref: 1E8CC4C5
ChangeDisplaySettingsA.USER32(?,?), ref: 1E8CC4DC
PyLong_FromLong.PYTHON27(00000000), ref: 1E8CC4E3

Strings

Ol:ChangeDisplaySettings, xrefs: 1E8CC4A1

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_ChangeDisplayFromLongLong_Object_ParseSettingsTupleU_devicemodeU_object@@
String ID: Ol:ChangeDisplaySettings
API String ID: 3818478573-3103544731
Opcode ID: fa3f3607112ed3cdb6b2581a02ffef90bcb212320e5154c00ad130450a5e7dbe
Instruction ID: a818a24045d3b82742ea6a6c60390124733a7f6b70b4184c9e8bac0533bb95b3
Opcode Fuzzy Hash: fa3f3607112ed3cdb6b2581a02ffef90bcb212320e5154c00ad130450a5e7dbe
Instruction Fuzzy Hash: 22F030B55042007BE304DBB4DD89AAB77E8BB84600F408928FE49C3240E635D698C792

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C9980 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 34timeCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,:GetLocalTime), ref: 1E8C998D
GetLocalTime.KERNEL32 ref: 1E8C99A2
Py_BuildValue.PYTHON27((hhhhhhhh),?,?,?,?,?,?,?,?), ref: 1E8C99DD

Strings

(hhhhhhhh), xrefs: 1E8C99D8
:GetLocalTime, xrefs: 1E8C9987

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_BuildLocalParseTimeTupleValue
String ID: (hhhhhhhh)$:GetLocalTime
API String ID: 3440996560-3174222679
Opcode ID: 962b2b3fad23355d32a191882aba7bd93fffec2874ccd47b13ab7b539e90085e
Instruction ID: fce27bc3f8d6523c934b3ae2fa700324a7e6f33faa9b206168d5b99a2a0e40f3
Opcode Fuzzy Hash: 962b2b3fad23355d32a191882aba7bd93fffec2874ccd47b13ab7b539e90085e
Instruction Fuzzy Hash: 07F036A5408220BAD3549B5ACC4887BB3E8FEC9A02F44894DF9DD81151F23CC5A4D333

Uniqueness

Uniqueness Score: -1.00%

Function 1ECB45F0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 30COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1ECB4609
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(00000000,?), ref: 1ECB4625
LockServiceDatabase.ADVAPI32(?), ref: 1ECB4637
?PyWinLong_FromVoidPtr@@YAPAU_object@@PBX@Z.PYWINTYPES27(00000000), ref: 1ECB463E

Strings

O:LockServiceDatabase, xrefs: 1ECB45FB

Memory Dump Source

Source File: 0000000F.00000002.1435001879.000000001ECB1000.00000040.00000001.01000000.00000011.sdmp, Offset: 1ECB0000, based on PE: true

Associated: 0000000F.00000002.1434980425.000000001ECB0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBA000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBD000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435097428.000000001ECBF000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435120797.000000001ECC0000.00000004.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ecb0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: U_object@@$Arg_DatabaseFromLockLong_Object_ParsePtr@@ServiceTupleVoid
String ID: O:LockServiceDatabase
API String ID: 1147127449-2142276707
Opcode ID: 4136af22113a7622291be0d94de2838f7b67ba2b9a4fd97268f9d919dd008205
Instruction ID: 1b08b44732fb650c4a9456cfe48cfe97c71542b0a3dc42ae8464154f49aa8d8b
Opcode Fuzzy Hash: 4136af22113a7622291be0d94de2838f7b67ba2b9a4fd97268f9d919dd008205
Instruction Fuzzy Hash: B6F030B1908211ABDB00EBA4EE49A5E77FCBF80646F444D68FC49C3205F639D528CB67

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C60D0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 28threadwindowCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,|i:PostQuitMessage), ref: 1E8C60E7
PyEval_SaveThread.PYTHON27 ref: 1E8C60F7
PostQuitMessage.USER32(?), ref: 1E8C6104
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C610B

Strings

|i:PostQuitMessage, xrefs: 1E8C60D9

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_Thread$Arg_MessageParsePostQuitRestoreSaveTuple
String ID: |i:PostQuitMessage
API String ID: 269209952-1144408335
Opcode ID: 82e29b0b71da585f572279535b2e7e01a812acf761bb326885863395b2838976
Instruction ID: 4f7c9f09a45ccba557c0e5c9e07c43df70fb202aa7e24ca0219a018d5ef01fd4
Opcode Fuzzy Hash: 82e29b0b71da585f572279535b2e7e01a812acf761bb326885863395b2838976
Instruction Fuzzy Hash: 20F06575114221BFE3009BA8D88C9CA73E8FF8A35AF108129F94EC3321DB349556DF56

Uniqueness

Uniqueness Score: -1.00%

Function 1ECB14A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,:SetThreadDesktop), ref: 1ECB14AA
SetThreadDesktop.USER32(?), ref: 1ECB14CB
GetLastError.KERNEL32 ref: 1ECB14D5

Strings

SetThreadDesktop, xrefs: 1ECB14DF
:SetThreadDesktop, xrefs: 1ECB14A4

Memory Dump Source

Source File: 0000000F.00000002.1435001879.000000001ECB1000.00000040.00000001.01000000.00000011.sdmp, Offset: 1ECB0000, based on PE: true

Associated: 0000000F.00000002.1434980425.000000001ECB0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBA000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBD000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435097428.000000001ECBF000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435120797.000000001ECC0000.00000004.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ecb0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_DesktopErrorLastParseThreadTuple
String ID: :SetThreadDesktop$SetThreadDesktop
API String ID: 2364561443-291575684
Opcode ID: 9de42567b025f0829f8c5e721df2c281bc5bb95471ab0e5ca3f07d9646c229af
Instruction ID: f78d84378e99b8b092273a8c78dfce19f7b1a34e234547bd60d566d1c38defdb
Opcode Fuzzy Hash: 9de42567b025f0829f8c5e721df2c281bc5bb95471ab0e5ca3f07d9646c229af
Instruction Fuzzy Hash: 87F01536604211DFC704CFB9DEC4A0A3BE8BF88AD6B048698F80AC7265E730D440CF12

Uniqueness

Uniqueness Score: -1.00%

Function 1ECB1440 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,:CloseWindowStation), ref: 1ECB144A
CloseWindowStation.USER32(?), ref: 1ECB146B
GetLastError.KERNEL32 ref: 1ECB1475

Strings

:CloseWindowStation, xrefs: 1ECB1444
CloseWindowStation, xrefs: 1ECB147F

Memory Dump Source

Source File: 0000000F.00000002.1435001879.000000001ECB1000.00000040.00000001.01000000.00000011.sdmp, Offset: 1ECB0000, based on PE: true

Associated: 0000000F.00000002.1434980425.000000001ECB0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBA000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBD000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435097428.000000001ECBF000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435120797.000000001ECC0000.00000004.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ecb0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_CloseErrorLastParseStationTupleWindow
String ID: :CloseWindowStation$CloseWindowStation
API String ID: 583746960-2417172394
Opcode ID: cc9de6e2b155ab3d8c7011bdd29c9910798148a406cbe7c6c60d4246ea36049d
Instruction ID: d40f8b44e69788782392836c924becfdc1cbba29eec015e7d05a4da208ab40e0
Opcode Fuzzy Hash: cc9de6e2b155ab3d8c7011bdd29c9910798148a406cbe7c6c60d4246ea36049d
Instruction Fuzzy Hash: 83F09875614251DFC700DFB5DE8450677E9BF89AD6B448698FC09C7255E731D4008E22

Uniqueness

Uniqueness Score: -1.00%

Function 1ECB13E0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,:SetProcessWindowStation), ref: 1ECB13EA
SetProcessWindowStation.USER32(?), ref: 1ECB140B
GetLastError.KERNEL32 ref: 1ECB1415

Strings

:SetProcessWindowStation, xrefs: 1ECB13E4
SetProcessWindowStation, xrefs: 1ECB141F

Memory Dump Source

Source File: 0000000F.00000002.1435001879.000000001ECB1000.00000040.00000001.01000000.00000011.sdmp, Offset: 1ECB0000, based on PE: true

Associated: 0000000F.00000002.1434980425.000000001ECB0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBA000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBD000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435097428.000000001ECBF000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435120797.000000001ECC0000.00000004.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ecb0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_ErrorLastParseProcessStationTupleWindow
String ID: :SetProcessWindowStation$SetProcessWindowStation
API String ID: 2737379679-1107135172
Opcode ID: c91f9608003bb3a30201bd24aef731b209816a74ad2befb842dbc52ca2d51754
Instruction ID: 6c95f287b584613e36674dd782e97aeec7567ccca6f5562f6bf7faa08d0f7a31
Opcode Fuzzy Hash: c91f9608003bb3a30201bd24aef731b209816a74ad2befb842dbc52ca2d51754
Instruction Fuzzy Hash: B4F01C76614211DFC714CFB5DE889063BE8BF88AD6B448699FC49C7255E730D400CF12

Uniqueness

Uniqueness Score: -1.00%

Function 1ECB1560 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,:CloseDesktop), ref: 1ECB156A
CloseDesktop.USER32(?), ref: 1ECB158B
GetLastError.KERNEL32 ref: 1ECB1595

Strings

:CloseDesktop, xrefs: 1ECB1564
CloseDesktop, xrefs: 1ECB159F

Memory Dump Source

Source File: 0000000F.00000002.1435001879.000000001ECB1000.00000040.00000001.01000000.00000011.sdmp, Offset: 1ECB0000, based on PE: true

Associated: 0000000F.00000002.1434980425.000000001ECB0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBA000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBD000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435097428.000000001ECBF000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435120797.000000001ECC0000.00000004.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ecb0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_CloseDesktopErrorLastParseTuple
String ID: :CloseDesktop$CloseDesktop
API String ID: 1666975722-304348735
Opcode ID: b3a727504f8b6ecbca4df9de942ca90cbc527331f22ee777b944d2042e224d29
Instruction ID: 00bd60fb3eadd6509c3f12c41aebaac8a4542d3464bc8271dd54b8873f3ae598
Opcode Fuzzy Hash: b3a727504f8b6ecbca4df9de942ca90cbc527331f22ee777b944d2042e224d29
Instruction Fuzzy Hash: A0F0A575A14251DFC700DF7ACE84A0B7BE9BF89AD6B548698F80AC3265E731D414CB12

Uniqueness

Uniqueness Score: -1.00%

Function 1ECB1500 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 27COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,:SwitchDesktop), ref: 1ECB150A
SwitchDesktop.USER32(?), ref: 1ECB152B
GetLastError.KERNEL32 ref: 1ECB1535

Strings

:SwitchDesktop, xrefs: 1ECB1504
SwitchDesktop, xrefs: 1ECB153F

Memory Dump Source

Source File: 0000000F.00000002.1435001879.000000001ECB1000.00000040.00000001.01000000.00000011.sdmp, Offset: 1ECB0000, based on PE: true

Associated: 0000000F.00000002.1434980425.000000001ECB0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBA000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBD000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435097428.000000001ECBF000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435120797.000000001ECC0000.00000004.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ecb0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_DesktopErrorLastParseSwitchTuple
String ID: :SwitchDesktop$SwitchDesktop
API String ID: 230140814-1331545489
Opcode ID: fb1dd8ff23dafe1da6656fcc92f655b58d315a0bb605da4bb77e99d7ce94804d
Instruction ID: 70f43fa05d20faf32633dcb69dca4ead68c9a3afcd9db6f22c4b22f5211a19a4
Opcode Fuzzy Hash: fb1dd8ff23dafe1da6656fcc92f655b58d315a0bb605da4bb77e99d7ce94804d
Instruction Fuzzy Hash: D4F0F876614211DFD700CF79CE84A073BE8BF89BD5B448698F80AC3269D731D414DB02

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C1600 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 20threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,:DebugBreak), ref: 1E8C160A
PyEval_SaveThread.PYTHON27 ref: 1E8C1619
DebugBreak.KERNEL32 ref: 1E8C1621
PyEval_RestoreThread.PYTHON27(00000000), ref: 1E8C1628

Strings

:DebugBreak, xrefs: 1E8C1604

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Eval_Thread$Arg_BreakDebugParseRestoreSaveTuple
String ID: :DebugBreak
API String ID: 3289820779-303509038
Opcode ID: 518779556bc3d7879ce74f03b7fbb960c24639bcc4f7645481982fd9471bbffd
Instruction ID: 34e1c241da1c6be935254b1badbcbbb2164396c5b4b5829c3c61708fd7579241
Opcode Fuzzy Hash: 518779556bc3d7879ce74f03b7fbb960c24639bcc4f7645481982fd9471bbffd
Instruction Fuzzy Hash: 4BE0B639500621AFE7015BB8ECCC8C937E4AF4B246B448050F90EC3221D72496D68A95

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C29A0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 18COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,:GetLogicalDrives), ref: 1E8C29AA
GetLogicalDrives.KERNEL32 ref: 1E8C29B8

Strings

:GetLogicalDrives, xrefs: 1E8C29A4
GetLogicalDrives, xrefs: 1E8C29C6

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_DrivesLogicalParseTuple
String ID: :GetLogicalDrives$GetLogicalDrives
API String ID: 264834140-2320110798
Opcode ID: 80d1d7a2175918ecc6cea6558e36c6e1fd0b3e22cfbd169ad0bc9c649af3e07d
Instruction ID: ef833bf3ea7ffd4b79836891a99121fb47201ce6f46cc944831f6b38c3e55405
Opcode Fuzzy Hash: 80d1d7a2175918ecc6cea6558e36c6e1fd0b3e22cfbd169ad0bc9c649af3e07d
Instruction Fuzzy Hash: C5E0ECB4504312ABEA009B64D94C5CA7AE8BE46A49F804969F94DC3150E734C1D4CB16

Uniqueness

Uniqueness Score: -1.00%

Function 6CBDA040 Relevance: 7.6, APIs: 6, Instructions: 144COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,00000000,00000000), ref: 6CBDA080
GetLastError.KERNEL32(?,?,00000000,00000000), ref: 6CBDA08C
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000,?,?,00000000,00000000), ref: 6CBDA0AD
GetLastError.KERNEL32(?,?,00000000,00000000), ref: 6CBDA0B9
MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,?,00000000,?,?,00000000,00000000), ref: 6CBDA10B
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,?,00000008,?,?,?,00000000,?,?,00000000,00000000), ref: 6CBDA139

Memory Dump Source

Source File: 0000000F.00000002.1435325332.000000006CBC1000.00000040.00000001.01000000.0000000E.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 0000000F.00000002.1435141262.000000006CBC0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCAB000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCBE000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436271764.000000006CCC4000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436295892.000000006CCC6000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6cbc0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: f010717621a6c83513add52cf7deb6ca28ff91dc2953918f4a1ccd5caf3bedcc
Instruction ID: d2eef671f027c58456acecfb516a199c41e0fe929bc96baf30991dc042e9de1b
Opcode Fuzzy Hash: f010717621a6c83513add52cf7deb6ca28ff91dc2953918f4a1ccd5caf3bedcc
Instruction Fuzzy Hash: 9741D731B00119ABDB119FB5DC49BEE7BB8EB4A715F054155ED06EB280DB30A909CBF1

Uniqueness

Uniqueness Score: -1.00%

Function 032513D0 Relevance: 7.6, APIs: 5, Instructions: 89COMMON

Download Yara Rule

APIs

PyList_New.PYTHON27(00000000), ref: 032513D6
Py_BuildValue.PYTHON27(0325B100), ref: 0325141B
PyList_Append.PYTHON27(?,00000000), ref: 0325142C
73BB3B4E.MSVCR90(00000000), ref: 03251456

Memory Dump Source

Source File: 0000000F.00000002.1423676562.0000000003251000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03250000, based on PE: true

Associated: 0000000F.00000002.1423656216.0000000003250000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423775563.0000000003263000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3250000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: List_$AppendBuildValue
String ID:
API String ID: 3827097313-0
Opcode ID: ecda3ccbc7b6abefbc7880885b7486e6818831a985bd704a5bd5ca7b24751f7e
Instruction ID: 1d051d620d5f4b74cd60a34b1ee0f7fc1d28d532a91d4966181b272b483c87c2
Opcode Fuzzy Hash: ecda3ccbc7b6abefbc7880885b7486e6818831a985bd704a5bd5ca7b24751f7e
Instruction Fuzzy Hash: 2821CC72A0031297CB10DF54BD4556B7398AF80632F185678FD5587240E735FAAAC7E3

Uniqueness

Uniqueness Score: -1.00%

Function 03255C00 Relevance: 7.6, APIs: 5, Instructions: 63COMMON

Download Yara Rule

APIs

73BB3B4E.MSVCR90(00000000,0325253C,00000000,?,?,?,03255DCA,?,?,03255E23,?,03255F4A,0325253C,pir: GetExitCodeProcess() -> ERROR_ACCESS_DENIED,0325253C,?), ref: 03255C2B
EnumProcesses.PSAPI(00000000,-00001000,?,?), ref: 03255C43
PyErr_NoMemory.PYTHON27(?), ref: 03255C65

Memory Dump Source

Source File: 0000000F.00000002.1423676562.0000000003251000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03250000, based on PE: true

Associated: 0000000F.00000002.1423656216.0000000003250000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423775563.0000000003263000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3250000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: EnumErr_MemoryProcesses
String ID:
API String ID: 1372074777-0
Opcode ID: c28d69e04705578f7897048e652187210b6ab6d9646789d11feea6d16c4413cc
Instruction ID: 1a41644681c8f1f86533be6c43b53e30c2b1af9829f1c75fea2526d536e8a636
Opcode Fuzzy Hash: c28d69e04705578f7897048e652187210b6ab6d9646789d11feea6d16c4413cc
Instruction Fuzzy Hash: 320128736162255BD320DB6DBC44AABF3D8EBC1662F24452AFD06C2100D731965483E6

Uniqueness

Uniqueness Score: -1.00%

Function 03251300 Relevance: 7.6, APIs: 5, Instructions: 50timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(?), ref: 0325130A
__aulldiv.LIBCMT ref: 0325133D
GetTickCount.KERNEL32 ref: 0325135B
__aulldiv.LIBCMT ref: 0325136B
Py_BuildValue.PYTHON27(0325B0F8,00000000,?,00000000,00000000,000003E8,00000000,?,00989680,00000000,?,00000000,00000000,00000001), ref: 0325137B

Memory Dump Source

Source File: 0000000F.00000002.1423676562.0000000003251000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03250000, based on PE: true

Associated: 0000000F.00000002.1423656216.0000000003250000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423775563.0000000003263000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3250000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Time__aulldiv$BuildCountFileSystemTickValue
String ID:
API String ID: 2881610869-0
Opcode ID: d14e310ea380d65fca498635e2785de958849814367c0dc87690267757bc22b1
Instruction ID: 6cc74f71fe48096a3777fb321e0cbf7529b480ffc85f50471a0c4776606f50f7
Opcode Fuzzy Hash: d14e310ea380d65fca498635e2785de958849814367c0dc87690267757bc22b1
Instruction Fuzzy Hash: A601F976B9031077E620F3B8EC8EF9B3A5D9FC0F51F148514F904EB1C4D9B0968482A2

Uniqueness

Uniqueness Score: -1.00%

Function 03253B00 Relevance: 7.5, APIs: 5, Instructions: 46COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,0325B5DC,?,?), ref: 03253B17
SetProcessAffinityMask.KERNEL32(00000000,?), ref: 03253B46
PyErr_SetFromWindowsErr.PYTHON27(00000000), ref: 03253B51
CloseHandle.KERNEL32(00000000), ref: 03253B5B

Memory Dump Source

Source File: 0000000F.00000002.1423676562.0000000003251000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03250000, based on PE: true

Associated: 0000000F.00000002.1423656216.0000000003250000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423775563.0000000003263000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3250000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: AffinityArg_CloseErr_FromHandleMaskParseProcessTupleWindows
String ID:
API String ID: 1573772585-0
Opcode ID: b4f2feaf59cd3f6704506c0f1bbccd1debc0dffb3c9028f1e111d3b9875d70cc
Instruction ID: 7d17e6acf0fbe9ded940670bbd6ca0a20c5d2a0b205a366567c68e6f905989da
Opcode Fuzzy Hash: b4f2feaf59cd3f6704506c0f1bbccd1debc0dffb3c9028f1e111d3b9875d70cc
Instruction Fuzzy Hash: AE016D75900310FFDA00FB68FC4DADB77A8AF44A46F448514FD05C2205E7399B98CAA6

Uniqueness

Uniqueness Score: -1.00%

Function 03253810 Relevance: 7.5, APIs: 5, Instructions: 46COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,0325B580,?,?), ref: 03253827
SetPriorityClass.KERNEL32(00000000,?), ref: 03253856
PyErr_SetFromWindowsErr.PYTHON27(00000000), ref: 03253861
CloseHandle.KERNEL32(00000000), ref: 0325386B

Memory Dump Source

Source File: 0000000F.00000002.1423676562.0000000003251000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03250000, based on PE: true

Associated: 0000000F.00000002.1423656216.0000000003250000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423775563.0000000003263000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3250000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_ClassCloseErr_FromHandleParsePriorityTupleWindows
String ID:
API String ID: 3897049644-0
Opcode ID: 51741985a4b0d33c76b69298ea9f2df139e617c45ddf952e69e90efced45b8db
Instruction ID: 3dc1612a3e02077129c3f92fae85b478553abe9a12168d1f63f82347be969dac
Opcode Fuzzy Hash: 51741985a4b0d33c76b69298ea9f2df139e617c45ddf952e69e90efced45b8db
Instruction Fuzzy Hash: 0A01A275900310EBDB04FB24FC4DADB77A8EF44646F448514FD05C2204F739A798CAA2

Uniqueness

Uniqueness Score: -1.00%

Function 6CC4E490 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 158libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(00000000), ref: 6CC4E4CF
FreeLibrary.KERNEL32(?), ref: 6CC4E62E

Strings

C:\build27\cpython\externals\openssl-1.0.2j\crypto\dso\dso_win32.c, xrefs: 6CC4E4B0, 6CC4E4E6, 6CC4E53A, 6CC4E54C, 6CC4E56E, 6CC4E5B1
filename(, xrefs: 6CC4E4FB

Memory Dump Source

Source File: 0000000F.00000002.1435325332.000000006CBC1000.00000040.00000001.01000000.0000000E.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 0000000F.00000002.1435141262.000000006CBC0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCAB000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCBE000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436271764.000000006CCC4000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436295892.000000006CCC6000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6cbc0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Library$FreeLoad
String ID: C:\build27\cpython\externals\openssl-1.0.2j\crypto\dso\dso_win32.c$filename(
API String ID: 534179979-1298034851
Opcode ID: 8766bc861c7cece93f1786acd0d7bb49715ec1b3f3254572d823001d4f74eed2
Instruction ID: fdf3f01ef7e2c05ee87c0bfe88e068751894d6eb7b10ed35e1401b260084dfea
Opcode Fuzzy Hash: 8766bc861c7cece93f1786acd0d7bb49715ec1b3f3254572d823001d4f74eed2
Instruction Fuzzy Hash: A141F670B803056BEB10DBE4EC8AF5973B89B45316F10846EFE08D7681F771E51587A6

Uniqueness

Uniqueness Score: -1.00%

Function 1ECB33C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 97COMMON

Download Yara Rule

APIs

?PyWinSequence_Tuple@@YAPAU_object@@PAU1@PAK@Z.PYWINTYPES27(?,?), ref: 1ECB33F7
PyErr_Format.PYTHON27(00000000,Unable to allocate %d SC_ACTION structures,?), ref: 1ECB3449

Strings

Unable to allocate %d SC_ACTION structures, xrefs: 1ECB3443

Memory Dump Source

Source File: 0000000F.00000002.1435001879.000000001ECB1000.00000040.00000001.01000000.00000011.sdmp, Offset: 1ECB0000, based on PE: true

Associated: 0000000F.00000002.1434980425.000000001ECB0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBA000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBD000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435097428.000000001ECBF000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435120797.000000001ECC0000.00000004.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ecb0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Err_FormatSequence_Tuple@@U_object@@
String ID: Unable to allocate %d SC_ACTION structures
API String ID: 1543589335-1457178731
Opcode ID: 1f1d1683aba39347225f811f49c435f081f87a9575292f0b49147f003d2a556f
Instruction ID: 6ccb687d8d0d0b8a2cabcf28f6f8d61df93168a31e314847b746196ad4101b16
Opcode Fuzzy Hash: 1f1d1683aba39347225f811f49c435f081f87a9575292f0b49147f003d2a556f
Instruction Fuzzy Hash: 4A31D1B69043119FD700CF58DC80A5B7BA5FF84361F158668FC458B384EB75E845CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 03251290 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 34COMMON

Download Yara Rule

APIs

PyErr_SetFromWindowsErr.PYTHON27(00000000), ref: 032512AF
PyErr_SetString.PYTHON27(?,GetSystemInfo() failed to retrieve CPU count), ref: 032512E7

Strings

GetSystemInfo() failed to retrieve CPU count, xrefs: 032512E1
GetActiveProcessorCount() not available; using GetSystemInfo(), xrefs: 032512BC

Memory Dump Source

Source File: 0000000F.00000002.1423676562.0000000003251000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03250000, based on PE: true

Associated: 0000000F.00000002.1423656216.0000000003250000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423775563.0000000003263000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3250000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Err_$FromStringWindows
String ID: GetActiveProcessorCount() not available; using GetSystemInfo()$GetSystemInfo() failed to retrieve CPU count
API String ID: 3288110570-607474584
Opcode ID: 2937ad16cf89f22381d4fa44e81ef63450db672fcacc01fb72c99706b9c0ad82
Instruction ID: 41afc626fcba0da5da258da21eaf9e92fbba7e48623729a23013cbe18a291536
Opcode Fuzzy Hash: 2937ad16cf89f22381d4fa44e81ef63450db672fcacc01fb72c99706b9c0ad82
Instruction Fuzzy Hash: E2F08231A10332ABCE60E768BC0965A77559F41B91F088164FC04D7249C731EBE4CBD7

Uniqueness

Uniqueness Score: -1.00%

Function 1E8CC380 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 32COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON27(?,PyDISPLAY_DEVICE cannot be None in this context), ref: 1E8CC3B1
PyErr_SetString.PYTHON27(?,Object must be a PyDISPLAY_DEVICE), ref: 1E8CC3D3

Strings

PyDISPLAY_DEVICE cannot be None in this context, xrefs: 1E8CC3AB
Object must be a PyDISPLAY_DEVICE, xrefs: 1E8CC3CD

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Err_String
String ID: Object must be a PyDISPLAY_DEVICE$PyDISPLAY_DEVICE cannot be None in this context
API String ID: 1450464846-405748036
Opcode ID: e89c9a85334526bac0ab53cbacb74359faf66aabb9cd7e1899d6c125f13a21a2
Instruction ID: 501ab3cfbfd86b682cb8db7a33c957312986ce6e56eb62dc9eb2bad537a3eaad
Opcode Fuzzy Hash: e89c9a85334526bac0ab53cbacb74359faf66aabb9cd7e1899d6c125f13a21a2
Instruction Fuzzy Hash: B1F01774220311AFD300DB34C8A8B8A77E1BBC6746F8085A8E849C7364C775D886CB01

Uniqueness

Uniqueness Score: -1.00%

Function 1E7D2F90 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 31COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,1E7D4410), ref: 1E7D2FA8
PythonService_PrepareToHostSingle.SERVICEMANAGER(00000000), ref: 1E7D2FB9
PyErr_SetString.PYTHON27(03AC6208,PrepareToHostSingle failed!), ref: 1E7D2FD1

Strings

PrepareToHostSingle failed!, xrefs: 1E7D2FCB

Memory Dump Source

Source File: 0000000F.00000002.1434219289.000000001E7D1000.00000040.00000001.01000000.00000015.sdmp, Offset: 1E7D0000, based on PE: true

Associated: 0000000F.00000002.1434197225.000000001E7D0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000F.00000002.1434219289.000000001E7DA000.00000040.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000F.00000002.1434284534.000000001E7DB000.00000080.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000F.00000002.1434310614.000000001E7DD000.00000004.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e7d0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Err_HostParsePreparePythonService_SingleStringTuple
String ID: PrepareToHostSingle failed!
API String ID: 1333664782-85598821
Opcode ID: 2b54bca35b5b5e7c0b373872ff5cce923c46f9b2fc6b6240102f271ba5feeb4a
Instruction ID: 4c8ea9770406a559d2d4e590d98cad70f2ac53d139ea68866d7fdc81ca0c64c4
Opcode Fuzzy Hash: 2b54bca35b5b5e7c0b373872ff5cce923c46f9b2fc6b6240102f271ba5feeb4a
Instruction Fuzzy Hash: 67F082B05042519FF304CB68EC88A9633F8FB58315B144918FC56D3311F735E41ACB22

Uniqueness

Uniqueness Score: -1.00%

Function 1E8CAFA0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 26keyboardCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27 ref: 1E8CAFC1
MapVirtualKeyW.USER32(?,00000000), ref: 1E8CAFDB
PyInt_FromLong.PYTHON27(00000000,?,?,?,00000000,00000000), ref: 1E8CAFE2

Strings

ii|O, xrefs: 1E8CAFB3

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_FromInt_LongParseTupleVirtual
String ID: ii|O
API String ID: 3814047383-1166409153
Opcode ID: 468e61a3283d20fc7856ac0f7213df9d7d9799319ff80cf4ee50a1def5b6e197
Instruction ID: 2c8c4a43155c7093a4e1ee9f5dccd1540b76565a26c040d942b97ad9a4becf87
Opcode Fuzzy Hash: 468e61a3283d20fc7856ac0f7213df9d7d9799319ff80cf4ee50a1def5b6e197
Instruction Fuzzy Hash: 1EE0E5F55142007BE304DF64DD49B5B77E8BB94A04F444518FA4D83250E635DA5DCBA3

Uniqueness

Uniqueness Score: -1.00%

Function 03255940 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 24COMMON

Download Yara Rule

APIs

GetSystemPowerStatus.KERNEL32 ref: 03255947
PyErr_SetFromWindowsErr.PYTHON27(00000000), ref: 03255952
Py_BuildValue.PYTHON27(iiiI,?,?,?,?), ref: 0325597B

Strings

iiiI, xrefs: 03255976

Memory Dump Source

Source File: 0000000F.00000002.1423676562.0000000003251000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03250000, based on PE: true

Associated: 0000000F.00000002.1423656216.0000000003250000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423775563.0000000003263000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3250000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: BuildErr_FromPowerStatusSystemValueWindows
String ID: iiiI
API String ID: 2045901803-2605956832
Opcode ID: cb4edac158855c6f5f7c27660edfaec6384e41229d25c4b3685870c8209973db
Instruction ID: 41a6ddcff3b8c6b433b8be49d66bc472ea1098e705f70fbbdd2a4f0118d1fbe3
Opcode Fuzzy Hash: cb4edac158855c6f5f7c27660edfaec6384e41229d25c4b3685870c8209973db
Instruction Fuzzy Hash: 25E092E08082406BD240A7747819A3F3BE86980501F888458FD8AC1105E3398764DAA3

Uniqueness

Uniqueness Score: -1.00%

Function 1E8CACB0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,|i:GetKeyboardLayout), ref: 1E8CACC7
GetKeyboardLayout.USER32 ref: 1E8CACDA
?PyWinLong_FromVoidPtr@@YAPAU_object@@PBX@Z.PYWINTYPES27(00000000), ref: 1E8CACE1

Strings

|i:GetKeyboardLayout, xrefs: 1E8CACB9

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_FromKeyboardLayoutLong_ParsePtr@@TupleU_object@@Void
String ID: |i:GetKeyboardLayout
API String ID: 1317064056-2940790594
Opcode ID: 09a060fcc3da761e7cbb32738a244b1ad15c8de339e3ed68de2e14662a5b57ac
Instruction ID: 40816fbaaf80538c511bb5444039194ada2f8adf6546f3ab00c00861a388c44b
Opcode Fuzzy Hash: 09a060fcc3da761e7cbb32738a244b1ad15c8de339e3ed68de2e14662a5b57ac
Instruction Fuzzy Hash: C4E08CB0008200ABE2149B60D88CA8A77E8AF84219F10851DF84EC3240D730C094DA22

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C4A40 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,i:GetSystemMetrics), ref: 1E8C4A4F
GetSystemMetrics.USER32 ref: 1E8C4A62
Py_BuildValue.PYTHON27(1E8D04E8,00000000), ref: 1E8C4A6E

Strings

i:GetSystemMetrics, xrefs: 1E8C4A49

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_BuildMetricsParseSystemTupleValue
String ID: i:GetSystemMetrics
API String ID: 725957282-2591059673
Opcode ID: a9957b2b90f2ad978d2ac9babdf989c3353ca72dfba8476ca51d01fe12711ec1
Instruction ID: 88ea78358364e9ab9d1c7e8d3968945b61ac0cb936ccb9f30ec9b3a05d7cd284
Opcode Fuzzy Hash: a9957b2b90f2ad978d2ac9babdf989c3353ca72dfba8476ca51d01fe12711ec1
Instruction Fuzzy Hash: 13E0C2B00042106FE2049724DD88C9A33EEEB80209F10460CF85EC3200D63085958621

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C5590 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,i:GetSysColor), ref: 1E8C559F
GetSysColor.USER32 ref: 1E8C55B2
Py_BuildValue.PYTHON27(1E8D0804,00000000), ref: 1E8C55BE

Strings

i:GetSysColor, xrefs: 1E8C5599

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_BuildColorParseTupleValue
String ID: i:GetSysColor
API String ID: 1738626209-1403295634
Opcode ID: 108ab7d7826d3ed239f6191a1bb14ec065e925f9cf5907a10b33d928752393cc
Instruction ID: 778f50fab512a9596d65492bbe2488b29ee31a1f5aa1ae9a33c245e2ac923d88
Opcode Fuzzy Hash: 108ab7d7826d3ed239f6191a1bb14ec065e925f9cf5907a10b33d928752393cc
Instruction Fuzzy Hash: F2E012B4114206AFE6049B60DD88CAA37EDAB85219F10451CF85EC3340DA3195659A61

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C11E0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 20COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,i:GetStdHandle), ref: 1E8C11EF
GetStdHandle.KERNEL32 ref: 1E8C1202
?PyWinLong_FromHANDLE@@YAPAU_object@@PAX@Z.PYWINTYPES27(00000000), ref: 1E8C1209

Strings

i:GetStdHandle, xrefs: 1E8C11E9

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_FromHandleLong_ParseTupleU_object@@
String ID: i:GetStdHandle
API String ID: 7986732-1864289571
Opcode ID: 347bf9416aa9b191e35074066cb0bfe1607b4b420d5499735df63cd8aa09006e
Instruction ID: b5601b76630eeca97fae304e71a85a7ba58aa028ad9f505f5826c9aa5ef7c253
Opcode Fuzzy Hash: 347bf9416aa9b191e35074066cb0bfe1607b4b420d5499735df63cd8aa09006e
Instruction Fuzzy Hash: 58D017B1114201ABE6149B649C8C99A37ECAB85219F144A19F95EC3640EA34D5A8DA16

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C3380 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 14COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,:GetCommandLine), ref: 1E8C338A
GetCommandLineA.KERNEL32(000000FF), ref: 1E8C339A
?PyWinObject_FromTCHAR@@YAPAU_object@@PBDH@Z.PYWINTYPES27(00000000), ref: 1E8C33A1

Strings

:GetCommandLine, xrefs: 1E8C3384

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_CommandFromLineObject_ParseTupleU_object@@
String ID: :GetCommandLine
API String ID: 3930691415-3337920127
Opcode ID: f086f842816503a80e4bd5ce0dd256e48ade3070e726a9b91cd2329492f671d5
Instruction ID: 056f59a69b5d007fa26453af01ac2a7a9241068f1e6511ae4629bde16c0a4d12
Opcode Fuzzy Hash: f086f842816503a80e4bd5ce0dd256e48ade3070e726a9b91cd2329492f671d5
Instruction Fuzzy Hash: 66D01275400351BBEE0027B89D4C9CA37D87E86A27FD44754F92DC72A1D734C2D5C626

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C30A0 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 13COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,:GetCurrentProcessId), ref: 1E8C30AA
GetCurrentProcessId.KERNEL32 ref: 1E8C30B8
PyLong_FromUnsignedLong.PYTHON27(00000000), ref: 1E8C30BF

Strings

:GetCurrentProcessId, xrefs: 1E8C30A4

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_CurrentFromLongLong_ParseProcessTupleUnsigned
String ID: :GetCurrentProcessId
API String ID: 3032462896-1699093009
Opcode ID: 276130d3cc22fd1f690ad07a273cb2c9a31b4f1e937937a629cc27b0bbfffb98
Instruction ID: 146dd15b365ed1b2c2524c27bbe08420038e32910f31412ed5b7add437767a46
Opcode Fuzzy Hash: 276130d3cc22fd1f690ad07a273cb2c9a31b4f1e937937a629cc27b0bbfffb98
Instruction Fuzzy Hash: 49C01275400211BFFA002BB49C4C5CA36D87E4650EFC04450FE0EC3120E639D1D98A1A

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C3010 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 13threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,:GetCurrentThread), ref: 1E8C301A
GetCurrentThread.KERNEL32 ref: 1E8C3028
?PyWinLong_FromHANDLE@@YAPAU_object@@PAX@Z.PYWINTYPES27(00000000), ref: 1E8C302F

Strings

:GetCurrentThread, xrefs: 1E8C3014

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_CurrentFromLong_ParseThreadTupleU_object@@
String ID: :GetCurrentThread
API String ID: 1734122981-929862528
Opcode ID: f337bdd109942e0fbd099691ee016e5bd255c2ab4fcb3d3bda4e6050ba18ee0e
Instruction ID: 9d4cc8aaff61248f68d869493510890a09bdf3815a55dff329fc891614ab01a7
Opcode Fuzzy Hash: f337bdd109942e0fbd099691ee016e5bd255c2ab4fcb3d3bda4e6050ba18ee0e
Instruction Fuzzy Hash: 18C01279400211FBEA001774DC4C4C636D87E4650AFC08550FA0DC3110E639D198C715

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C3040 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 13threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,:GetCurrentThreadId), ref: 1E8C304A
GetCurrentThreadId.KERNEL32 ref: 1E8C3058
PyLong_FromUnsignedLong.PYTHON27(00000000), ref: 1E8C305F

Strings

:GetCurrentThreadId, xrefs: 1E8C3044

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_CurrentFromLongLong_ParseThreadTupleUnsigned
String ID: :GetCurrentThreadId
API String ID: 3722607512-2016947755
Opcode ID: cc9f207cb2e8bf795010baa77be821d31f5fe7f31a83cf47fd0a41b38b8fd842
Instruction ID: b1885eb8c927712484ea09ebfce43f0256fdf333ef7feda9b9d3e1b943472bc0
Opcode Fuzzy Hash: cc9f207cb2e8bf795010baa77be821d31f5fe7f31a83cf47fd0a41b38b8fd842
Instruction Fuzzy Hash: 7AC012755002517FEA0027B49C4C5C636D87E4650AFC40554FE0EC3110E639D2E5C655

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C3070 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 13COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,:GetCurrentProcess), ref: 1E8C307A
GetCurrentProcess.KERNEL32 ref: 1E8C3088
?PyWinLong_FromHANDLE@@YAPAU_object@@PAX@Z.PYWINTYPES27(00000000), ref: 1E8C308F

Strings

:GetCurrentProcess, xrefs: 1E8C3074

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_CurrentFromLong_ParseProcessTupleU_object@@
String ID: :GetCurrentProcess
API String ID: 2431447350-521274867
Opcode ID: 0a23308958b15157f8934ef0dad7bc25c038c69d307098069107125a8d38c2a4
Instruction ID: 5222b167127caf7ffd612000e6c389607dfd310af6d469462c9ef39a22521fb2
Opcode Fuzzy Hash: 0a23308958b15157f8934ef0dad7bc25c038c69d307098069107125a8d38c2a4
Instruction Fuzzy Hash: 85C012794003127BEA0027B49C4C5C73AE87E4654AFC40454FA0DC3111E738D298CA16

Uniqueness

Uniqueness Score: -1.00%

Function 6CBDA400 Relevance: 6.3, APIs: 1, Strings: 3, Instructions: 300COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(C:\build27\cpython\externals\openssl-1.0.2j\crypto\bio\bss_file.c,00000192), ref: 6CBDA612

Strings

fopen(', xrefs: 6CBDA633
C:\build27\cpython\externals\openssl-1.0.2j\crypto\bio\bss_file.c, xrefs: 6CBDA60D, 6CBDA649, 6CBDA68A
',', xrefs: 6CBDA62D

Memory Dump Source

Source File: 0000000F.00000002.1435325332.000000006CBC1000.00000040.00000001.01000000.0000000E.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 0000000F.00000002.1435141262.000000006CBC0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCAB000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCBE000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436271764.000000006CCC4000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436295892.000000006CCC6000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6cbc0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: ErrorLast
String ID: ','$C:\build27\cpython\externals\openssl-1.0.2j\crypto\bio\bss_file.c$fopen('
API String ID: 1452528299-2143245757
Opcode ID: 92b7757f6480c67049ea64f71fa6ca613132d2ec2bcc47a180665ee7f5657906
Instruction ID: 83fc0d7d61382a66d2f14a2d3f8fe3c1e1e6fc6f1ba28f22b7d3a0ca5f98bb14
Opcode Fuzzy Hash: 92b7757f6480c67049ea64f71fa6ca613132d2ec2bcc47a180665ee7f5657906
Instruction Fuzzy Hash: B99149757112849BCB00CF6CE8447E9B7B4EB85369F1541AAED48CBA40E732EE15CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 6CBDA1C0 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 66COMMON

Download Yara Rule

APIs

Part of subcall function 6CBDA040: MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,00000000,00000000), ref: 6CBDA080
Part of subcall function 6CBDA040: GetLastError.KERNEL32(?,?,00000000,00000000), ref: 6CBDA08C
Part of subcall function 6CBDA040: MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000,?,?,00000000,00000000), ref: 6CBDA0AD
Part of subcall function 6CBDA040: GetLastError.KERNEL32(?,?,00000000,00000000), ref: 6CBDA0B9

GetLastError.KERNEL32(C:\build27\cpython\externals\openssl-1.0.2j\crypto\bio\bss_file.c,000000AF), ref: 6CBDA1DF

Strings

fopen(', xrefs: 6CBDA1FB
C:\build27\cpython\externals\openssl-1.0.2j\crypto\bio\bss_file.c, xrefs: 6CBDA1DA, 6CBDA232
',', xrefs: 6CBDA1F5

Memory Dump Source

Source File: 0000000F.00000002.1435325332.000000006CBC1000.00000040.00000001.01000000.0000000E.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 0000000F.00000002.1435141262.000000006CBC0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCAB000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCBE000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436271764.000000006CCC4000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436295892.000000006CCC6000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6cbc0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: ErrorLast$ByteCharMultiWide
String ID: ','$C:\build27\cpython\externals\openssl-1.0.2j\crypto\bio\bss_file.c$fopen('
API String ID: 3361762293-2143245757
Opcode ID: ad05d8ad3f71138b94aabb16686f72b79c88fe223e8a6389977c0867cf6fa87c
Instruction ID: d818b582a9936f2f4339b84cd39b09645478e88d2c9c02216d9a18c88b173fc0
Opcode Fuzzy Hash: ad05d8ad3f71138b94aabb16686f72b79c88fe223e8a6389977c0867cf6fa87c
Instruction Fuzzy Hash: 20112B71B4026167D70117E56C46FDB3265DB0132AF060431F606AEA81E783A955CBF3

Uniqueness

Uniqueness Score: -1.00%

Function 03252720 Relevance: 6.0, APIs: 4, Instructions: 50COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,0325B49C), ref: 0325272F

Memory Dump Source

Source File: 0000000F.00000002.1423676562.0000000003251000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03250000, based on PE: true

Associated: 0000000F.00000002.1423656216.0000000003250000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423775563.0000000003263000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3250000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_ParseTuple
String ID:
API String ID: 3371842430-0
Opcode ID: e3545b204ee5936324cf690fe8140bf9c955c8179bd5fbefb98e7eed88f9c44a
Instruction ID: e1855eb293e17d75657dccaef7e94c52adf0007dad2049c0c5d84111bed28d0e
Opcode Fuzzy Hash: e3545b204ee5936324cf690fe8140bf9c955c8179bd5fbefb98e7eed88f9c44a
Instruction Fuzzy Hash: F6F02272611310ABCA20E764BC0CE8B77ACDFC0177F148829FD0AC2240EB34CA9586E1

Uniqueness

Uniqueness Score: -1.00%

Function 1ECB3350 Relevance: 6.0, APIs: 4, Instructions: 35COMMON

Download Yara Rule

APIs

PyErr_SetString.PYTHON27(?,1ECB6E98), ref: 1ECB3370
PyArg_ParseTuple.PYTHON27(?,1ECB6ECC,?,?), ref: 1ECB338B
PyErr_Clear.PYTHON27 ref: 1ECB3398
PyErr_SetString.PYTHON27(?,1ECB6E98), ref: 1ECB33AD

Memory Dump Source

Source File: 0000000F.00000002.1435001879.000000001ECB1000.00000040.00000001.01000000.00000011.sdmp, Offset: 1ECB0000, based on PE: true

Associated: 0000000F.00000002.1434980425.000000001ECB0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBA000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBD000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435097428.000000001ECBF000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435120797.000000001ECC0000.00000004.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ecb0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Err_$String$Arg_ClearParseTuple
String ID:
API String ID: 1897559954-0
Opcode ID: 36af11bca4cc8e96ab04d13fa2917b32dd3358b753541bbfea9f5b2992f99f08
Instruction ID: 8c4955afebbb535ad8a0f3425e377589588c17bbe7ea6e8fff0d351cfd6a2680
Opcode Fuzzy Hash: 36af11bca4cc8e96ab04d13fa2917b32dd3358b753541bbfea9f5b2992f99f08
Instruction Fuzzy Hash: A6F04974210111AFE700DB28CEC8D27B7A9EF89A8AF04C598FC09C7316E632E8489A10

Uniqueness

Uniqueness Score: -1.00%

Function 6CC4E7F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 69libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,?), ref: 6CC4E854

Strings

C:\build27\cpython\externals\openssl-1.0.2j\crypto\dso\dso_win32.c, xrefs: 6CC4E868, 6CC4E89B
symname(, xrefs: 6CC4E87D

Memory Dump Source

Source File: 0000000F.00000002.1435325332.000000006CBC1000.00000040.00000001.01000000.0000000E.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 0000000F.00000002.1435141262.000000006CBC0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCAB000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCBE000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436271764.000000006CCC4000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436295892.000000006CCC6000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6cbc0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: AddressProc
String ID: C:\build27\cpython\externals\openssl-1.0.2j\crypto\dso\dso_win32.c$symname(
API String ID: 190572456-2646578252
Opcode ID: 0351821add42859a4b357541c536f147a0ccb8df6542ce395685c3b410c233fb
Instruction ID: 9ca3ba5c7f572dbdae8f0450a8db1b703c1cdd175a0b030018d035f4d5b8d9e5
Opcode Fuzzy Hash: 0351821add42859a4b357541c536f147a0ccb8df6542ce395685c3b410c233fb
Instruction Fuzzy Hash: 87112730B442029BEF14DA5D9C05F91B769EB01768F06C62CBA08DFAC1F610E800C7D2

Uniqueness

Uniqueness Score: -1.00%

Function 6CC4E720 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 69libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,?), ref: 6CC4E784

Strings

C:\build27\cpython\externals\openssl-1.0.2j\crypto\dso\dso_win32.c, xrefs: 6CC4E798, 6CC4E7CB
symname(, xrefs: 6CC4E7AD

Memory Dump Source

Source File: 0000000F.00000002.1435325332.000000006CBC1000.00000040.00000001.01000000.0000000E.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 0000000F.00000002.1435141262.000000006CBC0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCAB000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCBE000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436271764.000000006CCC4000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436295892.000000006CCC6000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6cbc0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: AddressProc
String ID: C:\build27\cpython\externals\openssl-1.0.2j\crypto\dso\dso_win32.c$symname(
API String ID: 190572456-2646578252
Opcode ID: 4e99fcbf8d369dae3dec65d125a48aad74251cb3fb9527a14f6dfe2a3c587e2f
Instruction ID: e706280ae9deaf7fec334db75505eaeedb60c8917e9db9dfdbf73a5b4089313a
Opcode Fuzzy Hash: 4e99fcbf8d369dae3dec65d125a48aad74251cb3fb9527a14f6dfe2a3c587e2f
Instruction Fuzzy Hash: 9F11C4307842429BE710DA699C45F55B369EB01775F06C66DFA18DFEC1F621E900C7D1

Uniqueness

Uniqueness Score: -1.00%

Function 03251A90 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 53COMMON

Download Yara Rule

APIs

PyArg_ParseTupleAndKeywords.PYTHON27(?,?,i|O,0325B2C4,?), ref: 03251AB9

Strings

i|O, xrefs: 03251AB2

Memory Dump Source

Source File: 0000000F.00000002.1423676562.0000000003251000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03250000, based on PE: true

Associated: 0000000F.00000002.1423656216.0000000003250000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423775563.0000000003263000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3250000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_KeywordsParseTuple
String ID: i|O
API String ID: 3508857537-3719185222
Opcode ID: 46044967d4f2181f73b05b51099a6e3ec2e1513559241688c3d6a970d7db2ee6
Instruction ID: 6341d5c604b4b6daee5ed52d75400ac0195372db907d09c627b04e0986f2fbed
Opcode Fuzzy Hash: 46044967d4f2181f73b05b51099a6e3ec2e1513559241688c3d6a970d7db2ee6
Instruction Fuzzy Hash: 5D0184B5A203026FDF00F668BC45A1F73D86A84605F884924FC5DC2105F235E3A8C6A3

Uniqueness

Uniqueness Score: -1.00%

Function 1E8CC8F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

Py_BuildValue.PYTHON27(O&O&O&,1E7A4700,?,1E7A4700,?,1E7AA620,?), ref: 1E8CC913
PyList_Append.PYTHON27(?,00000000), ref: 1E8CC928

Strings

O&O&O&, xrefs: 1E8CC90E

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: AppendBuildList_Value
String ID: O&O&O&
API String ID: 2697182481-1528194992
Opcode ID: eb1c4cfc7d12b7c32becc9904c3ea688ddd20078ee265e0048b073791030e8fc
Instruction ID: ba703cbcddef479ea44520c9ac7f819abd94486d464151d09c21986fb55ead4b
Opcode Fuzzy Hash: eb1c4cfc7d12b7c32becc9904c3ea688ddd20078ee265e0048b073791030e8fc
Instruction Fuzzy Hash: 59014FB2510612AFD214CB68DD84DD773E9EB86330F004B18F9A983385D334ED86C7A2

Uniqueness

Uniqueness Score: -1.00%

Function 03251020 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

PyObject_CallFunction.PYTHON27(?,(is),00000003,00000000,0325D7E1), ref: 0325105A
PyErr_SetObject.PYTHON27(00000000,00000000,?,(is),00000003,00000000,0325D7E1), ref: 0325106C

Strings

(is), xrefs: 03251054

Memory Dump Source

Source File: 0000000F.00000002.1423676562.0000000003251000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03250000, based on PE: true

Associated: 0000000F.00000002.1423656216.0000000003250000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423775563.0000000003263000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3250000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: CallErr_FunctionObjectObject_
String ID: (is)
API String ID: 915594520-1164188219
Opcode ID: bfeb5e43d425473fe5c277c8f743446d34f01ce78f6cd81a48cfa5e4dc8416ad
Instruction ID: d87504a957971140431db05814d7a83e468e73c308c04c95058eaafba29c36fd
Opcode Fuzzy Hash: bfeb5e43d425473fe5c277c8f743446d34f01ce78f6cd81a48cfa5e4dc8416ad
Instruction Fuzzy Hash: 6E01D172624321DFCA24EB28EC18B9773A9AB45360F188255FC46C7284D771FB92CBD1

Uniqueness

Uniqueness Score: -1.00%

Function 032510D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

PyObject_CallFunction.PYTHON27(?,(is),0000000D,00000000,0325D7E0), ref: 0325110A
PyErr_SetObject.PYTHON27(00000000,00000000,?,(is),0000000D,00000000,0325D7E0), ref: 0325111C

Strings

(is), xrefs: 03251104

Memory Dump Source

Source File: 0000000F.00000002.1423676562.0000000003251000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03250000, based on PE: true

Associated: 0000000F.00000002.1423656216.0000000003250000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423775563.0000000003263000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3250000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: CallErr_FunctionObjectObject_
String ID: (is)
API String ID: 915594520-1164188219
Opcode ID: 25ca941cf9c13bd63bd89643f4faf6aa96ff7f7ef14c47b2669ba78676966a69
Instruction ID: 80a75aafcf0f39ed359ac2be45815ceda10e58bdb390eb487981119dbbd3fd88
Opcode Fuzzy Hash: 25ca941cf9c13bd63bd89643f4faf6aa96ff7f7ef14c47b2669ba78676966a69
Instruction Fuzzy Hash: 7701AD726203119BCA24EB68FC08B5773A9AB45620F18C295FC06C7288D771FA92C791

Uniqueness

Uniqueness Score: -1.00%

Function 6CBC2180 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON27(?,|s*:md5,00000000,?,00000000,00000030), ref: 6CBC21A7
PyBuffer_Release.PYTHON27(?,00000000,?,?), ref: 6CBC21D9

Strings

|s*:md5, xrefs: 6CBC21A1

Memory Dump Source

Source File: 0000000F.00000002.1435325332.000000006CBC1000.00000040.00000001.01000000.0000000E.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 0000000F.00000002.1435141262.000000006CBC0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCAB000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCBE000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436271764.000000006CCC4000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436295892.000000006CCC6000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6cbc0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Buffer_ParseReleaseSizeTuple_
String ID: |s*:md5
API String ID: 1377858087-953681885
Opcode ID: 2f6df88ceca2bc1780ab7736e00ca83782f4036ad7b84387c756f9ce56224bee
Instruction ID: 9f5dea1cb2a5fdee93a61677c6d759e0ac307c186eec2cad2da8a4fb9d3c755b
Opcode Fuzzy Hash: 2f6df88ceca2bc1780ab7736e00ca83782f4036ad7b84387c756f9ce56224bee
Instruction Fuzzy Hash: F2F06271B011087BCB04FBD8DC49F9E73BDDB49619F044648FA08E7240E670AA1487E6

Uniqueness

Uniqueness Score: -1.00%

Function 6CBC21F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON27(?,|s*:sha1,00000000,?,00000000,00000030), ref: 6CBC2217
PyBuffer_Release.PYTHON27(?,00000000,?,?), ref: 6CBC2249

Strings

|s*:sha1, xrefs: 6CBC2211

Memory Dump Source

Source File: 0000000F.00000002.1435325332.000000006CBC1000.00000040.00000001.01000000.0000000E.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 0000000F.00000002.1435141262.000000006CBC0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCAB000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCBE000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436271764.000000006CCC4000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436295892.000000006CCC6000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6cbc0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Buffer_ParseReleaseSizeTuple_
String ID: |s*:sha1
API String ID: 1377858087-479057985
Opcode ID: f2292d11f8ea6259a9154eb4c42152674f0e4efd044dbd523d55f4e7c9d296af
Instruction ID: 6e752ae9eaf80d7a7f10a399ee29ac741fe87432311e1bf75cf17cc24336b913
Opcode Fuzzy Hash: f2292d11f8ea6259a9154eb4c42152674f0e4efd044dbd523d55f4e7c9d296af
Instruction Fuzzy Hash: C0F06271B011087BCB14EBD8ED49F9E73BDEB49619F044658FA18E7280E670E91487A6

Uniqueness

Uniqueness Score: -1.00%

Function 6CBC22D0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON27(?,|s*:sha256,00000000,?,00000000,00000030), ref: 6CBC22F7
PyBuffer_Release.PYTHON27(?,00000000,?,?), ref: 6CBC2329

Strings

|s*:sha256, xrefs: 6CBC22F1

Memory Dump Source

Source File: 0000000F.00000002.1435325332.000000006CBC1000.00000040.00000001.01000000.0000000E.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 0000000F.00000002.1435141262.000000006CBC0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCAB000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCBE000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436271764.000000006CCC4000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436295892.000000006CCC6000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6cbc0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Buffer_ParseReleaseSizeTuple_
String ID: |s*:sha256
API String ID: 1377858087-1333707686
Opcode ID: 06493c993800589d48f0a6aa9491fc8cbabc6fcbb85899bedb5bd87cea14cbbc
Instruction ID: 488c32c5fe837d4ea0704a89c57d31ce75b6e808d1d29d3d04b5aabea7d96b92
Opcode Fuzzy Hash: 06493c993800589d48f0a6aa9491fc8cbabc6fcbb85899bedb5bd87cea14cbbc
Instruction Fuzzy Hash: 05F06271B151087BCB04EFD8DD49FAE73BDEB49219F044648FA0CE7240E670A91487A6

Uniqueness

Uniqueness Score: -1.00%

Function 6CBC2260 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON27(?,|s*:sha224,00000000,?,00000000,00000030), ref: 6CBC2287
PyBuffer_Release.PYTHON27(?,00000000,?,?), ref: 6CBC22B9

Strings

|s*:sha224, xrefs: 6CBC2281

Memory Dump Source

Source File: 0000000F.00000002.1435325332.000000006CBC1000.00000040.00000001.01000000.0000000E.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 0000000F.00000002.1435141262.000000006CBC0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCAB000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCBE000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436271764.000000006CCC4000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436295892.000000006CCC6000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6cbc0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Buffer_ParseReleaseSizeTuple_
String ID: |s*:sha224
API String ID: 1377858087-3996202061
Opcode ID: 51eaceaa7e8392e7b11d72e9ed47482ba44b9e5323f7f166037d9524e83da570
Instruction ID: ec8a2c7a1044abd48a32607d0458ffb761afc0cdfe397cce43928d85fef36ccb
Opcode Fuzzy Hash: 51eaceaa7e8392e7b11d72e9ed47482ba44b9e5323f7f166037d9524e83da570
Instruction Fuzzy Hash: 38F06271B011087BDB04EBD8DC4AF9E73BDDF49619F044648FA18E7680E670A91487A6

Uniqueness

Uniqueness Score: -1.00%

Function 6CBC23B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON27(?,|s*:sha512,00000000,?,00000000,00000030), ref: 6CBC23D7
PyBuffer_Release.PYTHON27(?,00000000,?,?), ref: 6CBC2409

Strings

|s*:sha512, xrefs: 6CBC23D1

Memory Dump Source

Source File: 0000000F.00000002.1435325332.000000006CBC1000.00000040.00000001.01000000.0000000E.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 0000000F.00000002.1435141262.000000006CBC0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCAB000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCBE000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436271764.000000006CCC4000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436295892.000000006CCC6000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6cbc0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Buffer_ParseReleaseSizeTuple_
String ID: |s*:sha512
API String ID: 1377858087-691065918
Opcode ID: 81f096414a1c8b6f9aa50d2c822f4cc1643c554b5a9a8453647aded4451a9cc9
Instruction ID: 079393620cc5f8015bd0a6030a24128e5d31d9a453275014b3f8e357c3644fb3
Opcode Fuzzy Hash: 81f096414a1c8b6f9aa50d2c822f4cc1643c554b5a9a8453647aded4451a9cc9
Instruction Fuzzy Hash: 1FF0C231B051087BCB04EBD8DC89F9E73BDEB49219F044248FA19E3240E670A91487A2

Uniqueness

Uniqueness Score: -1.00%

Function 6CBC2340 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 40COMMON

Download Yara Rule

APIs

_PyArg_ParseTuple_SizeT.PYTHON27(?,|s*:sha384,00000000,?,00000000,00000030), ref: 6CBC2367
PyBuffer_Release.PYTHON27(?,00000000,?,?), ref: 6CBC2399

Strings

|s*:sha384, xrefs: 6CBC2361

Memory Dump Source

Source File: 0000000F.00000002.1435325332.000000006CBC1000.00000040.00000001.01000000.0000000E.sdmp, Offset: 6CBC0000, based on PE: true

Associated: 0000000F.00000002.1435141262.000000006CBC0000.00000002.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCAB000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1435325332.000000006CCBE000.00000040.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436271764.000000006CCC4000.00000080.00000001.01000000.0000000E.sdmpDownload File
Associated: 0000000F.00000002.1436295892.000000006CCC6000.00000004.00000001.01000000.0000000E.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_6cbc0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Buffer_ParseReleaseSizeTuple_
String ID: |s*:sha384
API String ID: 1377858087-354203376
Opcode ID: bd69aa485942d329563d02aae61e161023365398f8159bbd1d41dfec6f7b20ff
Instruction ID: b5e50ca5cc9083c9c9bd84851976d4630ac057785a5cf9562d7a4d3303b22964
Opcode Fuzzy Hash: bd69aa485942d329563d02aae61e161023365398f8159bbd1d41dfec6f7b20ff
Instruction Fuzzy Hash: 85F06271B011087BCB04EBD8DD49FAE73BDEB49719F044648FA0CE7240E670A91487A6

Uniqueness

Uniqueness Score: -1.00%

Function 03256060 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37COMMON

Download Yara Rule

Strings

OpenProcess, xrefs: 032560AC

Memory Dump Source

Source File: 0000000F.00000002.1423676562.0000000003251000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03250000, based on PE: true

Associated: 0000000F.00000002.1423656216.0000000003250000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423775563.0000000003263000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3250000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Err_ErrorLastString
String ID: OpenProcess
API String ID: 2598814712-3743895883
Opcode ID: 05a1a1ab86cb7d1b9ec24b31e0f34f261284b8ebca52b1c2518d7ee285150e6a
Instruction ID: 6487674ca7619eee8cfb5cb89c64a6e0a26fa75e9980415c7a0215c450f357e4
Opcode Fuzzy Hash: 05a1a1ab86cb7d1b9ec24b31e0f34f261284b8ebca52b1c2518d7ee285150e6a
Instruction Fuzzy Hash: 93F0A0779242226ADC50B278BC056DF32585B41174F4945A1FD15C9159E771EBD042D3

Uniqueness

Uniqueness Score: -1.00%

Function 1ECB3BB0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 34COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,OO:StartService,?,?), ref: 1ECB3BD0
?PyWinObject_AsHANDLE@@YAHPAU_object@@PAPAX@Z.PYWINTYPES27(?,?), ref: 1ECB3BEC

Strings

OO:StartService, xrefs: 1ECB3BCA

Memory Dump Source

Source File: 0000000F.00000002.1435001879.000000001ECB1000.00000040.00000001.01000000.00000011.sdmp, Offset: 1ECB0000, based on PE: true

Associated: 0000000F.00000002.1434980425.000000001ECB0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBA000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBD000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435097428.000000001ECBF000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435120797.000000001ECC0000.00000004.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ecb0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_Object_ParseTupleU_object@@
String ID: OO:StartService
API String ID: 71531768-496221635
Opcode ID: 54a061feafcf693d674f2141152632d043cf77507ae688d7b837e96d7918bbca
Instruction ID: 42e9a98287f5bb2ace130cc18084b29dda22b07ba98e6fe46d9174852b98cb46
Opcode Fuzzy Hash: 54a061feafcf693d674f2141152632d043cf77507ae688d7b837e96d7918bbca
Instruction Fuzzy Hash: 94F0F4B6504201AFD704DB64DE45A6B77EDAF84A40F448E6CFC89C2205F635E918DB63

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C98A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,iii:RGB,?,?), ref: 1E8C98BB
Py_BuildValue.PYTHON27(1E8D1898), ref: 1E8C98EA

Strings

iii:RGB, xrefs: 1E8C98B5

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_BuildParseTupleValue
String ID: iii:RGB
API String ID: 155762061-4024403587
Opcode ID: 6a107d205be4ae74f5a8f5a88b9cb3bc012bf4ed536f3e3fe7d54220c3333bcd
Instruction ID: e55180f7454dc98bbebbff8a9c721b95a64144eb62a42f8ca264fddfe3379853
Opcode Fuzzy Hash: 6a107d205be4ae74f5a8f5a88b9cb3bc012bf4ed536f3e3fe7d54220c3333bcd
Instruction Fuzzy Hash: 8FF0ECB48082522BD708D728DC5997A7FE4ADC1141F48495DF9DEC1151F224832CC763

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C1080 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

Py_BuildValue.PYTHON27((izs),00000000,?,?), ref: 1E8C1092
PyErr_SetObject.PYTHON27(00000000,00000000), ref: 1E8C10AB

Strings

(izs), xrefs: 1E8C108D

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: BuildErr_ObjectValue
String ID: (izs)
API String ID: 893777110-1853584526
Opcode ID: 444c8dcf400e9214967bb6f3f9d38ff8b45b5fd5fca8b50161822f51621304f4
Instruction ID: 3b10a9d8e536fb499eb69ce40538f5937920e9c40a288ae469dde84ca554babb
Opcode Fuzzy Hash: 444c8dcf400e9214967bb6f3f9d38ff8b45b5fd5fca8b50161822f51621304f4
Instruction Fuzzy Hash: B7F065B5600121ABE3109F64DD88DD77BE5EF46320F114718F95D87380E635ED82CE92

Uniqueness

Uniqueness Score: -1.00%

Function 03257C40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMON

Download Yara Rule

APIs

RtlNtStatusToDosErrorNoTeb.NTDLL(00000000), ref: 03257C61
PyErr_SetFromWindowsErrWithFilename.PYTHON27(00000000,?), ref: 03257C87

Strings

(originated from %s), xrefs: 03257C75

Memory Dump Source

Source File: 0000000F.00000002.1423676562.0000000003251000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03250000, based on PE: true

Associated: 0000000F.00000002.1423656216.0000000003250000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423775563.0000000003263000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3250000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Err_ErrorFilenameFromStatusWindowsWith
String ID: (originated from %s)
API String ID: 3439497670-1804376747
Opcode ID: e1a32b7838bc79346f692be37f8a2ca9349564cca5128b768682f70efd76d3ae
Instruction ID: a56726667b326c111564fa5e0181201ebdd7d9a2e68ed744de06973dd52148a3
Opcode Fuzzy Hash: e1a32b7838bc79346f692be37f8a2ca9349564cca5128b768682f70efd76d3ae
Instruction Fuzzy Hash: 37E09BB5810211EFC710F72CDC8CABF73D8EF44615F048918FA4693245D6349A89C7E6

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C9800 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,ii:MAKEWORD,?), ref: 1E8C9816
Py_BuildValue.PYTHON27(1E8D187C), ref: 1E8C9840

Strings

ii:MAKEWORD, xrefs: 1E8C9810

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_BuildParseTupleValue
String ID: ii:MAKEWORD
API String ID: 155762061-2814099321
Opcode ID: 1b7844d0a77b860d0295d6ae167181b1b76d517bed9f05300de3b6520f25117d
Instruction ID: 9fcedd9464ae863094b8dd6a7851cbd9b0cd01cbf5704c5921abd2f656e5a61c
Opcode Fuzzy Hash: 1b7844d0a77b860d0295d6ae167181b1b76d517bed9f05300de3b6520f25117d
Instruction Fuzzy Hash: F9E0D8B84041513BD704B734DC498FA3AE4EEC1542F88866DF4DD92340F635926DDAB3

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C12A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,O:CloseHandle), ref: 1E8C12AF
?PyWinObject_CloseHANDLE@@YAHPAU_object@@@Z.PYWINTYPES27 ref: 1E8C12C4

Strings

O:CloseHandle, xrefs: 1E8C12A9

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_CloseObject_ParseTupleU_object@@@
String ID: O:CloseHandle
API String ID: 3472323294-2961406049
Opcode ID: aa87869055a5b7ad71a42f5129ea2f7053d92170931817aa4536b8c7839d83cd
Instruction ID: 750c3133fc38a4e7ef9b938bbd1db128e09c6b2f89a4e8d3fa2e66dff809a3b4
Opcode Fuzzy Hash: aa87869055a5b7ad71a42f5129ea2f7053d92170931817aa4536b8c7839d83cd
Instruction Fuzzy Hash: 8CE04F78214101AFF304CB74DDC999673F8EB86245F104519F84EC3651E730D651DA55

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C96B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,ii:MAKELANGID,?), ref: 1E8C96C6
Py_BuildValue.PYTHON27(1E8D182C,00000000), ref: 1E8C96EB

Strings

ii:MAKELANGID, xrefs: 1E8C96C0

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_BuildParseTupleValue
String ID: ii:MAKELANGID
API String ID: 155762061-2052633188
Opcode ID: b37c3daec02fb16663ddcfa9e6f0e6a0bf8abc1c0670acc461f90505a65b8f28
Instruction ID: abcc1383068a00334d1f70dce470c76f102b1bb2d8044fbf65a8e81acde3c889
Opcode Fuzzy Hash: b37c3daec02fb16663ddcfa9e6f0e6a0bf8abc1c0670acc461f90505a65b8f28
Instruction Fuzzy Hash: 8EE0D8B58041006BE700AB24EC498BA76E8FE80A02F844A6CF88CC1200F235C66CC6A3

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C9850 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,ii:MAKELONG,?), ref: 1E8C9866
Py_BuildValue.PYTHON27(1E8D188C,00000000), ref: 1E8C988B

Strings

ii:MAKELONG, xrefs: 1E8C9860

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_BuildParseTupleValue
String ID: ii:MAKELONG
API String ID: 155762061-1608344320
Opcode ID: 558280e68739c48e7747efd07e2e46400d5f3417e36ae772c5adb74d41dd9e55
Instruction ID: 159faa3b8526e6f8920408efd6bcdad28fadb247ad09b9984508cf7fb2744657
Opcode Fuzzy Hash: 558280e68739c48e7747efd07e2e46400d5f3417e36ae772c5adb74d41dd9e55
Instruction Fuzzy Hash: 6CE048754041107BE704AB68EC498BA76E4FE80641F844A6DF88DD2210F635D66DD6B3

Uniqueness

Uniqueness Score: -1.00%

Function 1ECB10B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21serviceCOMMON

Download Yara Rule

APIs

CloseServiceHandle.ADVAPI32(?), ref: 1ECB10C1
?PyWin_SetAPIError@@YAPAU_object@@PADJ@Z.PYWINTYPES27(CloseServiceHandle,00000000), ref: 1ECB10DA

Strings

CloseServiceHandle, xrefs: 1ECB10D5

Memory Dump Source

Source File: 0000000F.00000002.1435001879.000000001ECB1000.00000040.00000001.01000000.00000011.sdmp, Offset: 1ECB0000, based on PE: true

Associated: 0000000F.00000002.1434980425.000000001ECB0000.00000002.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBA000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435001879.000000001ECBD000.00000040.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435097428.000000001ECBF000.00000080.00000001.01000000.00000011.sdmpDownload File
Associated: 0000000F.00000002.1435120797.000000001ECC0000.00000004.00000001.01000000.00000011.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1ecb0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: CloseError@@HandleServiceU_object@@Win_
String ID: CloseServiceHandle
API String ID: 604189671-1886769119
Opcode ID: 38b0db4ba69cd33aa8518fe63bf98f09ade465dd182a1edf99161b4ca315b95c
Instruction ID: 38635ae24cbdac29adc0152123198b6fc50e13d988b0bbdd09f8663944faa5a9
Opcode Fuzzy Hash: 38b0db4ba69cd33aa8518fe63bf98f09ade465dd182a1edf99161b4ca315b95c
Instruction Fuzzy Hash: 50E0C23BA002104BE3244A0AFC18B577A99DFC43A1F01816DFC26C3304D63088008B20

Uniqueness

Uniqueness Score: -1.00%

Function 1E7D1070 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,l:CoInitializeEx), ref: 1E7D107F
PyInt_FromLong.PYTHON27(00000000), ref: 1E7D109B

Strings

l:CoInitializeEx, xrefs: 1E7D1079

Memory Dump Source

Source File: 0000000F.00000002.1434219289.000000001E7D1000.00000040.00000001.01000000.00000015.sdmp, Offset: 1E7D0000, based on PE: true

Associated: 0000000F.00000002.1434197225.000000001E7D0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000F.00000002.1434219289.000000001E7DA000.00000040.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000F.00000002.1434284534.000000001E7DB000.00000080.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000F.00000002.1434310614.000000001E7DD000.00000004.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e7d0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_FromInt_LongParseTuple
String ID: l:CoInitializeEx
API String ID: 1558196150-1925297153
Opcode ID: ec0509fd26b9ef2bfcaef7020cfca185c8b10c1574a64fbc4144a89fc15cc55e
Instruction ID: 1c623fa8a659761ff80ced244e31f837b15c6b8dd6e3d274f15f084048ef0bc9
Opcode Fuzzy Hash: ec0509fd26b9ef2bfcaef7020cfca185c8b10c1574a64fbc4144a89fc15cc55e
Instruction Fuzzy Hash: 5BE012B11442016FF618A7A4EC49E9A37ACFF98316F144518F85AC2644F631D4189A12

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C9780 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,i:HIBYTE), ref: 1E8C978F
Py_BuildValue.PYTHON27(1E8D185C,00000000), ref: 1E8C97AD

Strings

i:HIBYTE, xrefs: 1E8C9789

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_BuildParseTupleValue
String ID: i:HIBYTE
API String ID: 155762061-2590802970
Opcode ID: 2763f62d721677e1ddee347e83a8c2e0d122fddc804a74874ccfc112410a4364
Instruction ID: e0ca8e0a3e9938b6be76d93a916b2d4b8581d3f35dcb0a9d6a34d2a3275d378d
Opcode Fuzzy Hash: 2763f62d721677e1ddee347e83a8c2e0d122fddc804a74874ccfc112410a4364
Instruction Fuzzy Hash: 49D05EB40152116FE604DB24EC88DAA33EDEEC120AF14465DFC8ED3744D730D6B99A36

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C9B00 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20threadCOMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,i:SetThreadLocale), ref: 1E8C9B0F
SetThreadLocale.KERNEL32 ref: 1E8C9B22

Strings

i:SetThreadLocale, xrefs: 1E8C9B09

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_LocaleParseThreadTuple
String ID: i:SetThreadLocale
API String ID: 3627380632-2528413986
Opcode ID: 4605e3fbc77f5d247fe53b10f0b917bdda5aace6c163460a40e77f5878a2d6cc
Instruction ID: 0f93813525b90b7dd1cb7a0c5c9b5b0d5047b91816859b9a6fb141cb92d0ad6a
Opcode Fuzzy Hash: 4605e3fbc77f5d247fe53b10f0b917bdda5aace6c163460a40e77f5878a2d6cc
Instruction Fuzzy Hash: 12E0E2B4214212BFE208DB24D8C8D9A73E8EB8A255F148549F84EC3251DB30E5969A11

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C9700 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 20COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,i:HIWORD), ref: 1E8C970F
Py_BuildValue.PYTHON27(1E8D183C), ref: 1E8C972A

Strings

i:HIWORD, xrefs: 1E8C9709

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_BuildParseTupleValue
String ID: i:HIWORD
API String ID: 155762061-3294456677
Opcode ID: 0587242bbf81e3b2fedcd4c551293293c14e0984e8d6955ff7ec16c5d62a11b7
Instruction ID: 4fe24b56a5788844fc2585f6d25360349978921a56916d58b2b37c34e04f02d5
Opcode Fuzzy Hash: 0587242bbf81e3b2fedcd4c551293293c14e0984e8d6955ff7ec16c5d62a11b7
Instruction Fuzzy Hash: 31D05EB00152016BE204DB64EC88D9E33EDEEC4209F18865DF88ED3345E731A5B9C626

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C97C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,i:LOBYTE), ref: 1E8C97CF
Py_BuildValue.PYTHON27(1E8D186C), ref: 1E8C97E8

Strings

i:LOBYTE, xrefs: 1E8C97C9

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_BuildParseTupleValue
String ID: i:LOBYTE
API String ID: 155762061-2394764204
Opcode ID: 03021429ab00f9785643580e42af78515a56a524a7d0f8f3051649016d9b5837
Instruction ID: ee4a016c18ff6d9a85c38ede41c8c53bd6041a30090cb73956fca556d2b1dc8d
Opcode Fuzzy Hash: 03021429ab00f9785643580e42af78515a56a524a7d0f8f3051649016d9b5837
Instruction Fuzzy Hash: 1DD0A5740181557BD30497719C44D5537DC5EC1209F14455DFC9EC2741D73091759526

Uniqueness

Uniqueness Score: -1.00%

Function 03251090 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 032510B2
PyErr_SetFromWindowsErrWithFilename.PYTHON27(00000000), ref: 032510B9

Strings

(originated from %s), xrefs: 0325109F

Memory Dump Source

Source File: 0000000F.00000002.1423676562.0000000003251000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03250000, based on PE: true

Associated: 0000000F.00000002.1423656216.0000000003250000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423775563.0000000003263000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3250000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Err_ErrorFilenameFromLastWindowsWith
String ID: (originated from %s)
API String ID: 3182726521-1804376747
Opcode ID: 2845c0d7c09928f542328104710493e5730d1c9dcad151aa2a13d2cf328622d4
Instruction ID: 79d1dbb3629a6b0272ac1940a3a1bb0ba2c1314f35fdf5acd7fc31893299aa07
Opcode Fuzzy Hash: 2845c0d7c09928f542328104710493e5730d1c9dcad151aa2a13d2cf328622d4
Instruction Fuzzy Hash: 1FD017B1404300ABC710FBB4FD4D9AA77A8AB44A01F80C918B656D1044EB79A698CAA6

Uniqueness

Uniqueness Score: -1.00%

Function 03257090 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(0325712E,032559F6), ref: 0325709D
PyErr_WarnEx.PYTHON27(?,psutil module couldn't set SE DEBUG mode for this process; please file an issue against psutil bug tracker,00000001), ref: 032570B7

Strings

psutil module couldn't set SE DEBUG mode for this process; please file an issue against psutil bug tracker, xrefs: 03257090, 032570B1

Memory Dump Source

Source File: 0000000F.00000002.1423676562.0000000003251000.00000040.00000001.01000000.0000000F.sdmp, Offset: 03250000, based on PE: true

Associated: 0000000F.00000002.1423656216.0000000003250000.00000002.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325B000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423676562.000000000325F000.00000040.00000001.01000000.0000000F.sdmpDownload File
Associated: 0000000F.00000002.1423775563.0000000003263000.00000004.00000001.01000000.0000000F.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_3250000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Err_ErrorLastWarn
String ID: psutil module couldn't set SE DEBUG mode for this process; please file an issue against psutil bug tracker
API String ID: 2910580754-1400796036
Opcode ID: c42c01ce1c2e003e7f7757a4ebec12e7c08de5e00113a32217121b14f7cd3916
Instruction ID: 5e38c5ec89360dab7e3faab3dd39bcf6050abadf09be67ff5f5e44db642578eb
Opcode Fuzzy Hash: c42c01ce1c2e003e7f7757a4ebec12e7c08de5e00113a32217121b14f7cd3916
Instruction Fuzzy Hash: 27D05E30960300DFD201A724B84DA1A3220A702700B048050FC02C6946D7B293D0CA02

Uniqueness

Uniqueness Score: -1.00%

Function 1E7D10B0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 13COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,:CoUninitialize), ref: 1E7D10BA
773FD120.OLE32 ref: 1E7D10C8

Strings

:CoUninitialize, xrefs: 1E7D10B4

Memory Dump Source

Source File: 0000000F.00000002.1434219289.000000001E7D1000.00000040.00000001.01000000.00000015.sdmp, Offset: 1E7D0000, based on PE: true

Associated: 0000000F.00000002.1434197225.000000001E7D0000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000F.00000002.1434219289.000000001E7DA000.00000040.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000F.00000002.1434284534.000000001E7DB000.00000080.00000001.01000000.00000015.sdmpDownload File
Associated: 0000000F.00000002.1434310614.000000001E7DD000.00000004.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e7d0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_D120ParseTuple
String ID: :CoUninitialize
API String ID: 1723112310-4124906679
Opcode ID: 33aa3bc3a4d1318914e480ad88524f8f589a94fa845ea05bd4fcaccd5dda84c5
Instruction ID: 6b3fcdcd7bde38cb48e555476325dc9214291706c06f053cb35c5b445605e222
Opcode Fuzzy Hash: 33aa3bc3a4d1318914e480ad88524f8f589a94fa845ea05bd4fcaccd5dda84c5
Instruction Fuzzy Hash: F8D092746002229FEA00AB9CD98CAC63BF8BB58302B400444EC15A2321F63AA408CE00

Uniqueness

Uniqueness Score: -1.00%

Function 1E8C5990 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 12COMMON

Download Yara Rule

APIs

PyArg_ParseTuple.PYTHON27(?,:GetVersion), ref: 1E8C599A
GetVersion.KERNEL32 ref: 1E8C59A8

Strings

:GetVersion, xrefs: 1E8C5994

Memory Dump Source

Source File: 0000000F.00000002.1434362557.000000001E8C1000.00000040.00000001.01000000.00000013.sdmp, Offset: 1E8C0000, based on PE: true

Associated: 0000000F.00000002.1434338544.000000001E8C0000.00000002.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8D7000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434362557.000000001E8DC000.00000040.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434606816.000000001E8DF000.00000080.00000001.01000000.00000013.sdmpDownload File
Associated: 0000000F.00000002.1434629552.000000001E8E0000.00000004.00000001.01000000.00000013.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_1e8c0000_5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.jbxd

Similarity

API ID: Arg_ParseTupleVersion
String ID: :GetVersion
API String ID: 322320466-235393037
Opcode ID: f8ca0e449184e12c242462229bf1263d67a67a025446e0bfa2461b1cc2d42e74
Instruction ID: edf8c9fea9b39d5e35d73d5f35fdeaf1007e9c7ca045f0ed5592c07d7c58a692
Opcode Fuzzy Hash: f8ca0e449184e12c242462229bf1263d67a67a025446e0bfa2461b1cc2d42e74
Instruction Fuzzy Hash: 98D0C974845312FFE7009F75CA8C5CA7BE5FA85386F808969F94DC3250E235D18ACB12

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse the Windows service control manager to execute malicious commands or payloads. The Windows service control manager ( `services.exe` ) is an interface to manage and manipulate services.The service control manager is accessible to users via GUI components as well as system utilities such as `sc.exe` and Net .
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: Process Creation, Service: Service Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create an account to maintain access to victim systems. With a sufficient level of access, creating such accounts may be used to establish secondary credentialed access that do not require persistent remote access tools to be deployed on the system.
Tactics:	Persistence
Data Sources:	Command: Command Execution, Process: Process Creation, User Account: User Account Creation
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify Windows services to repeatedly execute malicious payloads as part of persistence. When Windows boots up, it starts programs or applications called services that perform background system functions.Windows service configuration information, including the file path to the service's executable or recovery programs/commands, is stored in the Windows Registry.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Driver: Driver Load, File: File Metadata, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Service: Service Creation, Service: Service Modification, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use bootkits to persist on systems. Bootkits reside at a layer below the operating system and may make it difficult to perform full remediation unless an organization suspects one was used and can act accordingly.
Tactics:	Defense Evasion, Persistence
Data Sources:	Drive: Drive Modification
Platforms:	Linux, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report 5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.zip

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Bitcoin Miner

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

Protection of GUI

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\Microsoft\Network\Downloader\edb.log

C:\ProgramData\Microsoft\Network\Downloader\qmgr.db

C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm

C:\ProgramData\USOShared\Logs\System\UpdateSessionOrchestration.7ae3c485-636a-4b66-a35a-b2059d1e6bb9.1.etl

C:\Users\user\AppData\Local\Temp\_MEI14482\Crypto.Cipher._AES.pyd

C:\Users\user\AppData\Local\Temp\_MEI14482\Include\pyconfig.h

C:\Users\user\AppData\Local\Temp\_MEI14482\Microsoft.VC90.CRT.manifest

C:\Users\user\AppData\Local\Temp\_MEI14482\_ctypes.pyd

C:\Users\user\AppData\Local\Temp\_MEI14482\_hashlib.pyd

C:\Users\user\AppData\Local\Temp\_MEI14482\_socket.pyd

Windows Analysis Report
5d9fe2735d4399d98e6e6a792b1feb26d6f2d9a5d77944ecacb4b4837e5e5fca.zip

Description:	Adversaries may try to gather information about registered local system services. Adversaries may obtain information about services using tools as well as OS utility commands such as `sc query` , `tasklist /svc` , `systemctl --type=service` , and `net start` .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre